@hasna/todos 0.15.46 → 0.15.49

package/dist/server/index.js

@@ -70,7 +70,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/todos",
-    version: "0.15.46",
+    version: "0.15.49",
     description: "Universal task management for AI coding agents - CLI + MCP server + interactive TUI",
     type: "module",
     main: "dist/index.js",
@@ -134,6 +134,7 @@ var init_package = __esm(() => {
     ],
     scripts: {
       build: "rm -rf dist dashboard/dist && cd dashboard && bun install --frozen-lockfile && bun run build && cd .. && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
+      "build:js": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --root src --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && tsc --emitDeclarationOnly --outDir dist",
       "build:server": "rm -rf dist && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external @modelcontextprotocol/sdk --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/server/index.ts --outdir dist/server --target bun && bun build src/sdk/index.ts --outdir dist/sdk --target bun --external '@hasna/contracts' --external '@hasna/contracts/*' && bun build src/index.ts src/mcp.ts src/registry.ts src/contracts.ts src/storage.ts src/testing.ts src/project-registration.ts src/task-manifest.ts src/task-subtree-transfer.ts --outdir dist --target bun --external '@hasna/contracts' --external '@hasna/contracts/*'",
       migrate: "bun run src/server/index.ts migrate",
       "backfill:comment-redaction": "bun run src/server/index.ts redact-comments",
@@ -188,18 +189,19 @@ var init_package = __esm(() => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.13.4",
+      "@hasna/contracts": "0.14.0",
       "@hasna/events": "^0.1.11",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
       commander: "^13.1.0",
       ink: "^5.2.0",
       react: "^18.3.1",
-      zod: "^3.24.2"
+      zod: "3.25.76"
     },
     overrides: {
       ajv: "8.20.0",
-      "fast-uri": "3.1.2"
+      "fast-uri": "3.1.2",
+      zod: "3.25.76"
     },
     devDependencies: {
       "@types/bun": "^1.2.4",
@@ -223,7 +225,7 @@ var init_package_version = __esm(() => {
   init_package();
 });
 
-// node_modules/.bun/@hasna+contracts@0.13.4+ad7b1171e6eea7eb/node_modules/@hasna/contracts/dist/auth/index.js
+// node_modules/.bun/@hasna+contracts@0.14.0+619f74e7b30eeaf4/node_modules/@hasna/contracts/dist/auth/index.js
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "crypto";
 function isValidTenantId(value) {
   return typeof value === "string" && TENANT_ID_PATTERN.test(value);
@@ -1646,13 +1648,15 @@ function upsertSecretSafetyConfig(input) {
   saveConfig({ ...config, secret_safety: next });
   return next;
 }
-var DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS, REDACTION_PLACEHOLDER;
+var XAI_PREFIX, DEFAULT_SECRET_PATTERNS, DEFAULT_SECRET_KEY_PATTERN, NON_SECRET_USAGE_KEYS, REDACTION_PLACEHOLDER;
 var init_redaction = __esm(() => {
   init_config2();
+  XAI_PREFIX = ["x", "ai", "-"].join("");
   DEFAULT_SECRET_PATTERNS = [
     { name: "aws-access-key", regex: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/g, replacement: "[REDACTED_AWS_KEY]" },
     { name: "private-key", regex: /-----BEGIN (?:RSA |EC |OPENSSH |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH |)PRIVATE KEY-----/g, replacement: "[REDACTED_PRIVATE_KEY]" },
     { name: "openai-token", regex: /\bsk-[A-Za-z0-9_-]{12,}\b/g, replacement: "[REDACTED_TOKEN]" },
+    { name: `${XAI_PREFIX}token`, regex: /\bxai[-][A-Za-z0-9]{20,80}\b/g, replacement: "[REDACTED_TOKEN]" },
     { name: "npm-token", regex: /\bnpm_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_NPM_TOKEN]" },
     { name: "github-fine-grained-token", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
     { name: "github-token", regex: /\bgh[opsu]_[A-Za-z0-9]{20,}\b/g, replacement: "[REDACTED_GITHUB_TOKEN]" },
@@ -2059,6 +2063,27 @@ function validateSnapshotRoutingDestinationConflicts(projects, taskLists, existi
   return errors;
 }
 
+// src/storage/postgres-errors.ts
+function isPostgresUniqueViolation(error) {
+  if (typeof error !== "object" || error === null)
+    return false;
+  const candidate = error;
+  const states = [candidate.code, candidate.errno, candidate.sqlState, candidate.sqlstate];
+  if (typeof candidate.cause === "object" && candidate.cause !== null) {
+    const cause = candidate.cause;
+    states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
+  }
+  return states.some((state) => String(state) === "23505");
+}
+function postgresConstraintName(error) {
+  if (typeof error !== "object" || error === null)
+    return "";
+  const candidate = error;
+  const cause = typeof candidate.cause === "object" && candidate.cause !== null ? candidate.cause : undefined;
+  const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
+  return typeof constraint === "string" ? constraint : "";
+}
+
 // src/storage/postgres-sync.ts
 function postgresTodosSyncSchemaSql(tableName = DEFAULT_TODOS_POSTGRES_SYNC_TABLE, cursorTableName = DEFAULT_TODOS_POSTGRES_CURSOR_TABLE) {
   assertSafeIdentifier(tableName);
@@ -2253,53 +2278,98 @@ class PostgresTodosSyncStore {
     if (routingErrors.length > 0) {
       throw new Error(`Invalid snapshot routing metadata: ${routingErrors.join("; ")}`);
     }
-    const existing = await this.client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
-       FROM ${this.tableName}
-       WHERE service = $1 AND object_type IN ($2, $3) AND deleted_at IS NULL`, [this.service, "projects", "task_lists"]);
-    const existingProjects = [];
-    const existingTaskLists = [];
-    for (const row of existing.rows) {
-      const payload = payloadRecord(row.payload);
-      if (row.object_type === "projects")
-        existingProjects.push(payload);
-      if (row.object_type === "task_lists")
-        existingTaskLists.push(payload);
-    }
-    const destinationErrors = validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists);
-    if (destinationErrors.length > 0) {
-      throw new Error(`Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
-    }
-    const result = { records: 0, objectTypes: {} };
-    const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
-    for (const entry of snapshotEntries(snapshot)) {
-      if (entry.deletedAt === null)
-        assertCanonicalScopedSlugEntry(entry);
-      await this.client.query(`INSERT INTO ${this.tableName} (
-          service, object_type, object_id, payload, updated_at,
-          deleted_at, source_machine_id, version
-        ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
-        ON CONFLICT (service, object_type, object_id) DO UPDATE SET
-          payload = EXCLUDED.payload,
-          updated_at = EXCLUDED.updated_at,
-          deleted_at = EXCLUDED.deleted_at,
-          source_machine_id = EXCLUDED.source_machine_id,
-          version = EXCLUDED.version
-        WHERE ${this.tableName}.updated_at < EXCLUDED.updated_at
-           OR (${this.tableName}.updated_at = EXCLUDED.updated_at
-               AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))`, [
-        this.service,
-        entry.type,
-        entry.id,
-        entry.payload,
-        entry.updatedAt,
-        entry.deletedAt,
-        sourceMachineId,
-        entry.version
-      ]);
-      result.records += 1;
-      result.objectTypes[entry.type] = (result.objectTypes[entry.type] ?? 0) + 1;
+    const push = async (client) => {
+      const existing = await client.query(`SELECT object_type, object_id, payload, updated_at, deleted_at, source_machine_id, version
+         FROM ${this.tableName}
+         WHERE service = $1 AND object_type IN ($2, $3) AND deleted_at IS NULL`, [this.service, "projects", "task_lists"]);
+      const existingProjects = [];
+      const existingTaskLists = [];
+      for (const row of existing.rows) {
+        const payload = payloadRecord(row.payload);
+        if (row.object_type === "projects")
+          existingProjects.push(payload);
+        if (row.object_type === "task_lists")
+          existingTaskLists.push(payload);
+      }
+      const destinationErrors = validateSnapshotRoutingDestinationConflicts(snapshot.projects, snapshot.taskLists, existingProjects, existingTaskLists);
+      if (destinationErrors.length > 0) {
+        throw new ResourceConflictError("SNAPSHOT_DESTINATION_CONFLICT", `Snapshot routing conflicts with destination: ${destinationErrors.join("; ")}`);
+      }
+      const result = { records: 0, objectTypes: {} };
+      const sourceMachineId = context.requestId ?? this.sourceMachineId ?? null;
+      for (const entry of snapshotEntries(snapshot)) {
+        if (entry.deletedAt === null)
+          assertCanonicalScopedSlugEntry(entry);
+        try {
+          await client.query(`INSERT INTO ${this.tableName} (
+              service, object_type, object_id, payload, updated_at,
+              deleted_at, source_machine_id, version
+            ) VALUES ($1, $2, $3, $4::jsonb, $5::timestamptz, $6::timestamptz, $7, $8)
+            ON CONFLICT (service, object_type, object_id) DO UPDATE SET
+              payload = EXCLUDED.payload,
+              updated_at = EXCLUDED.updated_at,
+              deleted_at = EXCLUDED.deleted_at,
+              source_machine_id = EXCLUDED.source_machine_id,
+              version = EXCLUDED.version
+            WHERE ${this.tableName}.updated_at < EXCLUDED.updated_at
+               OR (${this.tableName}.updated_at = EXCLUDED.updated_at
+                   AND COALESCE(${this.tableName}.version, 0) <= COALESCE(EXCLUDED.version, 0))`, [
+            this.service,
+            entry.type,
+            entry.id,
+            entry.payload,
+            entry.updatedAt,
+            entry.deletedAt,
+            sourceMachineId,
+            entry.version
+          ]);
+        } catch (error) {
+          await this.classifySyncInsertConflict(error, entry);
+        }
+        result.records += 1;
+        result.objectTypes[entry.type] = (result.objectTypes[entry.type] ?? 0) + 1;
+      }
+      return result;
+    };
+    if (typeof this.client.transaction === "function") {
+      return this.client.transaction((client) => push(client));
     }
-    return result;
+    return push(this.client);
+  }
+  async classifySyncInsertConflict(error, entry) {
+    if (!isPostgresUniqueViolation(error))
+      throw error;
+    const payload = entry.payload;
+    const taskListSlug = String(payload["slug"] ?? "");
+    const projectSlug = String(payload["task_list_id"] ?? "");
+    const constraintName = postgresConstraintName(error);
+    if (entry.type === "projects" && constraintName.includes("project_task_list_slug_uidx")) {
+      throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${projectSlug}" already exists`);
+    }
+    if (entry.type === "task_lists" && constraintName.includes("task_list_scope_slug_uidx")) {
+      throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${taskListSlug}" already exists in this scope`);
+    }
+    if (entry.type === "task_lists") {
+      const scope = typeof payload["project_id"] === "string" ? payload["project_id"] : "";
+      const conflict = await this.client.query(`/* todos:classify-sync-task-list-conflict */ SELECT EXISTS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'task_lists' AND object_id <> $2
+            AND deleted_at IS NULL AND COALESCE(payload->>'project_id','') = $3 AND payload->>'slug' = $4
+        ) AS conflict`, [this.service, entry.id, scope, taskListSlug]);
+      if (conflict.rows[0]?.conflict) {
+        throw new ResourceConflictError("TASK_LIST_SLUG_CONFLICT", `Task list with slug "${taskListSlug}" already exists in this scope`);
+      }
+    } else if (entry.type === "projects") {
+      const conflict = await this.client.query(`/* todos:classify-sync-project-conflict */ SELECT EXISTS (
+          SELECT 1 FROM ${this.tableName}
+          WHERE service = $1 AND object_type = 'projects' AND object_id <> $2
+            AND deleted_at IS NULL AND payload->>'task_list_id' = $3
+        ) AS conflict`, [this.service, entry.id, projectSlug]);
+      if (conflict.rows[0]?.conflict) {
+        throw new ResourceConflictError("PROJECT_SLUG_CONFLICT", `Project slug "${projectSlug}" already exists`);
+      }
+    }
+    throw error;
   }
   async pullSnapshot(options = {}) {
     const params = [this.service];
@@ -2456,6 +2526,7 @@ function assertSafeIdentifier(value) {
 }
 var DEFAULT_TODOS_POSTGRES_SYNC_TABLE = "todos_sync_records", DEFAULT_TODOS_POSTGRES_CURSOR_TABLE = "todos_sync_cursors", PostgresScopedSlugMigrationConflictError, PostgresScopedSlugIndexBuildError;
 var init_postgres_sync = __esm(() => {
+  init_types();
   PostgresScopedSlugMigrationConflictError = class PostgresScopedSlugMigrationConflictError extends Error {
     conflicts;
     constructor(conflicts) {
@@ -2954,9 +3025,11 @@ class PostgresJsonRecordStore {
   async ensureSchema() {
     if (!this.schemaReady) {
       this.schemaReady = (async () => {
-        for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
-          await this.options.client.query(sql);
-        }
+        await retryOnTransientPostgresError(async () => {
+          for (const sql of postgresTodosSyncSchemaSql(this.tableName, this.cursorTableName)) {
+            await this.options.client.query(sql);
+          }
+        });
       })().catch((error) => {
         this.schemaReady = null;
         throw error;
@@ -3370,13 +3443,14 @@ class PostgresJsonRecordStore {
     throw new Error(divergentAuditHistoryReplayError(value.id));
   }
   async withTaskParentIntegrityTransaction(fn) {
-    if (typeof this.options.client.transaction !== "function") {
+    const transaction = this.options.client.transaction;
+    if (typeof transaction !== "function") {
       throw new Error("TASK_PARENT_ATOMICITY_UNAVAILABLE: PostgreSQL parent writes and task deletion require transaction(callback)");
     }
-    return this.options.client.transaction(async (client) => {
+    return retryOnTransientPostgresError(() => transaction(async (client) => {
       await client.query("/* todos:task-parent-integrity-lock */ SELECT pg_advisory_xact_lock(hashtextextended($1 || ':task-parent-integrity', 0))", [this.service]);
       return fn(client);
-    });
+    }));
   }
   async upsertTaskWithPlanMembershipGuard(value, guardedPlanIds, explicitProject, context = {}, parentGuard, queryClient) {
     const planIds = [...new Set(guardedPlanIds.filter(Boolean))].sort();
@@ -5259,7 +5333,7 @@ function compareClock(left, right) {
 function numberValue2(value) {
   return typeof value === "number" && Number.isSafeInteger(value) ? value : null;
 }
-function isPostgresUniqueViolation(error) {
+function isTransientPostgresError(error) {
   if (typeof error !== "object" || error === null)
     return false;
   const candidate = error;
@@ -5268,17 +5342,27 @@ function isPostgresUniqueViolation(error) {
     const cause = candidate.cause;
     states.push(cause.code, cause.errno, cause.sqlState, cause.sqlstate);
   }
-  return states.some((state) => String(state) === "23505");
+  if (states.some((state) => typeof state === "string" && TRANSIENT_POSTGRES_SQLSTATES.has(state))) {
+    return true;
+  }
+  const message = typeof candidate.message === "string" ? candidate.message : candidate.cause?.message;
+  return typeof message === "string" && TRANSIENT_POSTGRES_MESSAGE_MARKERS.some((marker) => message.includes(marker));
 }
-function postgresConstraintName(error) {
-  if (typeof error !== "object" || error === null)
-    return "";
-  const candidate = error;
-  const cause = typeof candidate.cause === "object" && candidate.cause !== null ? candidate.cause : undefined;
-  const constraint = candidate.constraint ?? candidate.constraint_name ?? cause?.constraint ?? cause?.constraint_name;
-  return typeof constraint === "string" ? constraint : "";
+async function retryOnTransientPostgresError(fn, attempts = 2, delayMs = 150) {
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt += 1) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+      if (!isTransientPostgresError(error) || attempt === attempts)
+        throw error;
+      await new Promise((resolve) => setTimeout(resolve, delayMs * attempt));
+    }
+  }
+  throw lastError;
 }
-var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY;
+var CLOUD_LOCK_EXPIRY_MINUTES = 30, TASK_ORDER_TIEBREAK = "CASE payload->>'priority' WHEN 'critical' THEN 0 WHEN 'high' THEN 1 WHEN 'medium' THEN 2 WHEN 'low' THEN 3 ELSE 4 END ASC, payload->>'created_at' ASC, payload->>'id' ASC", TASK_ORDER_BY, TRANSIENT_POSTGRES_SQLSTATES, TRANSIENT_POSTGRES_MESSAGE_MARKERS;
 var init_postgres_adapter = __esm(() => {
   init_types();
   init_creator_identity();
@@ -5292,6 +5376,12 @@ var init_postgres_adapter = __esm(() => {
   init_audit_history_import();
   init_canonical();
   TASK_ORDER_BY = `ORDER BY ${TASK_ORDER_TIEBREAK}`;
+  TRANSIENT_POSTGRES_SQLSTATES = new Set(["55P03", "40P01", "40001"]);
+  TRANSIENT_POSTGRES_MESSAGE_MARKERS = [
+    "canceling statement due to lock timeout",
+    "deadlock detected",
+    "could not serialize access"
+  ];
 });
 
 // src/pr-groups/types.ts
@@ -13245,8 +13335,9 @@ var init_event_hooks = __esm(() => {
   VALID_TARGETS = new Set(["stdout", "file", "socket", "script"]);
 });
 
-// node_modules/.bun/@hasna+events@0.1.11/node_modules/@hasna/events/dist/index.js
+// node_modules/.bun/@hasna+events@0.1.16/node_modules/@hasna/events/dist/index.js
 import { chmod, mkdir, readFile, rename, writeFile } from "fs/promises";
+import { Buffer as Buffer2 } from "buffer";
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join5 } from "path";
@@ -13355,11 +13446,13 @@ function getEventsDataDir(override) {
 
 class JsonEventsStore {
   dataDir;
+  runtime;
   channelsPath;
   eventsPath;
   deliveriesPath;
   constructor(dataDir = getEventsDataDir()) {
     this.dataDir = dataDir;
+    this.runtime = localJsonRuntime(dataDir);
     this.channelsPath = join5(dataDir, "channels.json");
     this.eventsPath = join5(dataDir, "events.json");
     this.deliveriesPath = join5(dataDir, "deliveries.json");
@@ -13407,13 +13500,58 @@ class JsonEventsStore {
     await this.writeJson(this.eventsPath, events);
     return event;
   }
-  async listEvents() {
+  async appendEventOnce(event, options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    const dedupe = options.dedupe !== false;
+    if (dedupe) {
+      const existing = findEventByIdentity(events, { id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    events.push(event);
+    await this.writeJson(this.eventsPath, events);
+    return {
+      event,
+      stored: true,
+      deduped: false,
+      identity: { id: event.id, dedupeKey: event.dedupeKey }
+    };
+  }
+  async listEvents(options = {}) {
+    await this.init();
+    const events = await this.readJson(this.eventsPath, []);
+    return queryEvents(events, options);
+  }
+  async listEventsPage(options = {}) {
     await this.init();
-    return this.readJson(this.eventsPath, []);
+    const events = await this.readJson(this.eventsPath, []);
+    const queried = queryEvents(events, {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = queried.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < queried.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async findEventByIdentity(identity) {
     const events = await this.listEvents();
-    return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+    return findEventByIdentity(events, identity);
   }
   async appendDelivery(result) {
     await this.init();
@@ -13464,6 +13602,83 @@ class JsonEventsStore {
     });
   }
 }
+function localJsonRuntime(dataDir = getEventsDataDir()) {
+  return {
+    mode: "local-files",
+    name: "json-events-store",
+    remote: false,
+    localFiles: true,
+    localSqlite: false,
+    postgres: false,
+    s3: false,
+    aws: false,
+    durable: true,
+    idempotency: "best-effort-local",
+    replayCursors: true,
+    description: `Local JSON files in ${dataDir}; no SQLite, Postgres, S3, or AWS runtime is configured by this store.`
+  };
+}
+function encodeLocalJsonEventCursor(offset, options = {}) {
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid event cursor offset: ${offset}`);
+  const payload = {
+    offset,
+    eventId: options.eventId,
+    source: options.source,
+    type: options.type
+  };
+  return `${LOCAL_JSON_EVENT_CURSOR_PREFIX}${Buffer2.from(JSON.stringify(payload), "utf-8").toString("base64url")}`;
+}
+function decodeLocalJsonEventCursor(cursor, options = {}) {
+  if (!cursor)
+    return 0;
+  if (!cursor.startsWith(LOCAL_JSON_EVENT_CURSOR_PREFIX))
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  const rawPayload = cursor.slice(LOCAL_JSON_EVENT_CURSOR_PREFIX.length);
+  let payload;
+  try {
+    payload = JSON.parse(Buffer2.from(rawPayload, "base64url").toString("utf-8"));
+  } catch {
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  }
+  const offset = payload.offset;
+  if (!Number.isInteger(offset) || offset < 0)
+    throw new Error(`Invalid local JSON event cursor: ${cursor}`);
+  assertCursorFilter("eventId", payload.eventId, options.eventId);
+  assertCursorFilter("source", payload.source, options.source);
+  assertCursorFilter("type", payload.type, options.type);
+  return offset;
+}
+function normalizeEventPageLimit(limit) {
+  if (limit === undefined)
+    return DEFAULT_EVENT_PAGE_LIMIT;
+  if (!Number.isInteger(limit) || limit < 1)
+    throw new Error(`Event page limit must be a positive integer, got ${limit}`);
+  return Math.min(limit, MAX_EVENT_PAGE_LIMIT);
+}
+function queryEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor) {
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    rows = rows.slice(offset);
+  }
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
+}
+function assertCursorFilter(name, cursorValue, optionValue) {
+  if (cursorValue !== optionValue)
+    throw new Error(`Local JSON event cursor ${name} filter mismatch`);
+}
+function findEventByIdentity(events, identity) {
+  return events.find((event) => identity.id !== undefined && event.id === identity.id || identity.dedupeKey !== undefined && event.dedupeKey === identity.dedupeKey);
+}
 function buildSignatureBase(timestamp2, body) {
   return `${timestamp2}.${body}`;
 }
@@ -13477,21 +13692,27 @@ function now2() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp2 = event.time;
+  const timestamp2 = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp2,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp2
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp2, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp2, body);
   }
   return { body, headers };
 }
@@ -13499,7 +13720,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now2();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp2 = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp: timestamp2 });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -13531,6 +13766,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now2(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -13619,6 +13863,76 @@ function createDeliveryResult(event, channel, attempts) {
     completedAt: attempts.at(-1)?.completedAt ?? now2()
   };
 }
+
+class EventTypeCatalog {
+  definitions = new Map;
+  register(definition) {
+    this.definitions.set(definition.type, definition);
+    return this;
+  }
+  unregister(type) {
+    return this.definitions.delete(type);
+  }
+  has(type) {
+    return this.definitions.has(type);
+  }
+  get(type) {
+    return this.definitions.get(type);
+  }
+  list() {
+    return [...this.definitions.values()];
+  }
+  validateEvent(event) {
+    const definition = this.definitions.get(event.type);
+    if (!definition)
+      return { ok: true };
+    return definition.validate(event.data, event);
+  }
+  assertEventValid(event) {
+    const result = this.validateEvent(event);
+    if (!result.ok) {
+      throw new EventValidationError(event.type, result.issues);
+    }
+  }
+}
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue2(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue2(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue2(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
 function createEvent(input) {
   return {
     id: input.id ?? randomUUID22(),
@@ -13639,10 +13953,18 @@ class EventsClient {
   store;
   redactors;
   transportOptions;
+  catalog;
+  validateCatalogTypes;
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
+    this.catalog = options.catalog ?? defaultEventTypeCatalog;
+    this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
   async addChannel(input) {
     const timestamp2 = new Date().toISOString();
@@ -13660,18 +13982,40 @@ class EventsClient {
   }
   async emit(input, options = {}) {
     const event = options.redactSensitiveData === false ? createEvent(input) : redactSensitiveKeys(createEvent(input));
-    if (options.dedupe !== false) {
-      const existing = await this.store.findEventByIdentity({ id: input.id, dedupeKey: event.dedupeKey });
-      if (existing) {
-        return { event: existing, deliveries: [], deduped: true };
-      }
-    }
-    await this.store.appendEvent(event);
-    const deliveries = options.deliver === false ? [] : await this.deliver(event);
-    return { event, deliveries, deduped: false };
-  }
-  async listEvents() {
-    return this.store.listEvents();
+    if (options.validate ?? this.validateCatalogTypes) {
+      this.catalog.assertEventValid(event);
+    }
+    const append = await this.appendEvent(event, { dedupe: options.dedupe !== false });
+    if (append.deduped) {
+      return { event: append.event, deliveries: [], deduped: true };
+    }
+    const deliveries = options.deliver === false ? [] : await this.deliver(append.event);
+    return { event: append.event, deliveries, deduped: false };
+  }
+  async listEvents(options = {}) {
+    if (Object.keys(options).length === 0)
+      return this.store.listEvents();
+    return queryClientEvents(await this.store.listEvents(), options);
+  }
+  async listEventsPage(options = {}) {
+    if (this.store.listEventsPage)
+      return this.store.listEventsPage(options);
+    const events = queryClientEvents(await this.store.listEvents(), {
+      eventId: options.eventId,
+      source: options.source,
+      type: options.type
+    });
+    const offset = decodeLocalJsonEventCursor(options.cursor, options);
+    const limit = normalizeEventPageLimit(options.limit);
+    const pageEvents = events.slice(offset, offset + limit);
+    const nextOffset = offset + pageEvents.length;
+    const hasMore = nextOffset < events.length;
+    return {
+      events: pageEvents,
+      cursor: options.cursor,
+      nextCursor: hasMore ? encodeLocalJsonEventCursor(nextOffset, options) : undefined,
+      hasMore
+    };
   }
   async listDeliveries() {
     return this.store.listDeliveries();
@@ -13739,22 +14083,37 @@ class EventsClient {
     return result;
   }
   async replay(options = {}) {
-    const events = (await this.store.listEvents()).filter((event) => {
-      if (options.eventId && event.id !== options.eventId)
-        return false;
-      if (options.source && event.source !== options.source)
-        return false;
-      if (options.type && event.type !== options.type)
-        return false;
-      return true;
-    });
+    const page = options.cursor || options.limit !== undefined ? await this.listEventsPage(options) : { events: await this.listEvents(options), hasMore: false };
     if (options.dryRun)
-      return { events, deliveries: [] };
+      return { events: page.events, deliveries: [], cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
     const deliveries = [];
-    for (const event of events) {
+    for (const event of page.events) {
       deliveries.push(...await this.deliver(event));
     }
-    return { events, deliveries };
+    return { events: page.events, deliveries, cursor: page.cursor, nextCursor: page.nextCursor, hasMore: page.hasMore };
+  }
+  async appendEvent(event, options) {
+    if (this.store.appendEventOnce) {
+      return this.store.appendEventOnce(event, { dedupe: options.dedupe });
+    }
+    if (options.dedupe) {
+      const existing = await this.store.findEventByIdentity({ id: event.id, dedupeKey: event.dedupeKey });
+      if (existing) {
+        return {
+          event: existing,
+          stored: false,
+          deduped: true,
+          identity: { id: existing.id, dedupeKey: existing.dedupeKey }
+        };
+      }
+    }
+    const stored = await this.store.appendEvent(event);
+    return {
+      event: stored,
+      stored: true,
+      deduped: false,
+      identity: { id: stored.id, dedupeKey: stored.dedupeKey }
+    };
   }
   async applyRedaction(event, channel) {
     let next = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
@@ -13781,43 +14140,19 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue2(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue2(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue2(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue2(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
+function queryClientEvents(events, options) {
+  let rows = events;
+  if (options.eventId)
+    rows = rows.filter((event) => event.id === options.eventId);
+  if (options.source)
+    rows = rows.filter((event) => event.source === options.source);
+  if (options.type)
+    rows = rows.filter((event) => event.type === options.type);
+  if (options.cursor)
+    rows = rows.slice(decodeLocalJsonEventCursor(options.cursor, options));
+  if (options.limit !== undefined)
+    rows = rows.slice(0, normalizeEventPageLimit(options.limit));
+  return rows;
 }
 function normalizeTime(value) {
   if (!value)
@@ -13831,9 +14166,22 @@ function normalizeRetryPolicy(policy) {
     multiplier: Math.max(1, policy?.multiplier ?? 2)
   };
 }
-var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", DEFAULT_SIGNATURE_TOLERANCE_MS;
+var HASNA_EVENTS_DIR_ENV = "HASNA_EVENTS_DIR", HASNA_EVENTS_HOME_ENV = "HASNA_EVENTS_HOME", LOCAL_JSON_EVENT_CURSOR_PREFIX = "local-json-v1:", DEFAULT_EVENT_PAGE_LIMIT = 100, MAX_EVENT_PAGE_LIMIT = 1000, DEFAULT_SIGNATURE_TOLERANCE_MS, EventValidationError, defaultEventTypeCatalog, APP_EVENT_V1_MAX_DATA_BYTES;
 var init_dist = __esm(() => {
   DEFAULT_SIGNATURE_TOLERANCE_MS = 5 * 60 * 1000;
+  EventValidationError = class EventValidationError extends Error {
+    eventType;
+    issues;
+    constructor(eventType, issues) {
+      const detail = issues.map((issue) => `${issue.path || "<root>"}: ${issue.message}`).join("; ");
+      super(`Event validation failed for type "${eventType}": ${detail}`);
+      this.name = "EventValidationError";
+      this.eventType = eventType;
+      this.issues = issues;
+    }
+  };
+  defaultEventTypeCatalog = new EventTypeCatalog;
+  APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
 });
 
 // src/db/task-lists.ts
@@ -14672,8 +15020,12 @@ async function deliverWebhook(wh, event, body, attempt, db) {
       const sig = await crypto.subtle.sign("HMAC", key, encoder.encode(body));
       headers["X-Webhook-Signature"] = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
     }
-    const resp = await fetch(wh.url, { method: "POST", headers, body });
+    const resp = await fetch(wh.url, { method: "POST", headers, body, redirect: "manual" });
     const respText = await resp.text().catch(() => "");
+    if (resp.status >= 300 && resp.status < 400) {
+      logDelivery(db, wh.id, event, body, resp.status, "Blocked: webhook URL returned a 3xx redirect; redirects are never followed (SSRF prevention)", attempt);
+      return;
+    }
     logDelivery(db, wh.id, event, body, resp.status, respText.slice(0, 1000), attempt);
     if (resp.status >= 400 && attempt < MAX_RETRY_ATTEMPTS) {
       const delay = RETRY_BASE_DELAY_MS * Math.pow(2, attempt - 1);
@@ -16250,6 +16602,12 @@ function listTasks2(filter = {}, db) {
   const d = db || getDatabase();
   const { clearExpiredLocks: clearExpiredLocks2 } = (init_database(), __toCommonJS(exports_database));
   clearExpiredLocks2(d);
+  if (filter.limit !== undefined) {
+    const limit = filter.limit;
+    if (!Number.isSafeInteger(limit) || limit <= 0 || limit > MAX_TASK_LIST_LIMIT) {
+      throw new TypeError(`listTasks limit must be a positive integer between 1 and ${MAX_TASK_LIST_LIMIT}; got ${String(limit)}`);
+    }
+  }
   const conditions = [];
   const params = [];
   if (filter.project_id) {
@@ -16783,6 +17141,7 @@ function deleteTask(id, db) {
   }
   return result.changes > 0;
 }
+var MAX_TASK_LIST_LIMIT = 1e5;
 var init_task_crud = __esm(() => {
   init_types();
   init_database();
@@ -19697,7 +20056,8 @@ __export(exports_tasks, {
   buildTaskBoardSnapshot: () => buildTaskBoardSnapshot,
   archiveTasks: () => archiveTasks,
   archiveCompletedTasks: () => archiveCompletedTasks,
-  addDependency: () => addDependency2
+  addDependency: () => addDependency2,
+  MAX_TASK_LIST_LIMIT: () => MAX_TASK_LIST_LIMIT
 });
 var init_tasks = __esm(() => {
   init_task_crud();
@@ -30204,6 +30564,13 @@ function resolveSigningSecret(env = process.env) {
 function isPostgresBackendConfigured(env = process.env) {
   return Boolean(resolveCloudDatabaseUrl(env));
 }
+function schemaRetryMinIntervalMs(env = process.env) {
+  const raw = env.HASNA_TODOS_SCHEMA_RETRY_MIN_MS;
+  if (!raw)
+    return DEFAULT_SCHEMA_RETRY_MIN_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_SCHEMA_RETRY_MIN_MS;
+}
 function getCloudTenantId() {
   return process.env.HASNA_TODOS_TENANT_ID ?? "default";
 }
@@ -30299,6 +30666,10 @@ function getCloudVerifier() {
 async function ensureCloudSchema() {
   if (schemaEnsured)
     return schemaEnsured;
+  if (lastSchemaFailure !== null && Date.now() - lastSchemaAttemptAtMs < schemaRetryMinIntervalMs()) {
+    throw lastSchemaFailure;
+  }
+  lastSchemaAttemptAtMs = Date.now();
   schemaEnsured = (async () => {
     const client = getClient();
     for (const sql of postgresTodosSyncSchemaSql()) {
@@ -30319,6 +30690,7 @@ async function ensureCloudSchema() {
     await getApiKeyStore().ensureSchema();
   })().catch((error) => {
     schemaEnsured = null;
+    lastSchemaFailure = error;
     throw error;
   });
   return schemaEnsured;
@@ -30366,8 +30738,10 @@ async function closeCloud() {
   cachedTaskManifestAuthority = null;
   cachedTaskSubtreeTransferAuthority = null;
   schemaEnsured = null;
+  lastSchemaAttemptAtMs = 0;
+  lastSchemaFailure = null;
 }
-var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, cachedTaskManifestAuthority = null, cachedTaskSubtreeTransferAuthority = null, schemaEnsured = null;
+var TODOS_APP_SLUG = "todos", cachedClient = null, cachedAdapter = null, cachedStore = null, cachedVerifier = null, cachedPrGroupLedger = null, cachedProjectRegistrationAuthority = null, cachedTaskManifestAuthority = null, cachedTaskSubtreeTransferAuthority = null, schemaEnsured = null, lastSchemaAttemptAtMs = 0, lastSchemaFailure = null, DEFAULT_SCHEMA_RETRY_MIN_MS = 1e4;
 var init_cloud = __esm(() => {
   init_auth();
   init_auth();
@@ -31380,6 +31754,19 @@ function taskStatusQueryParam(url) {
     return { ok: false, message: result.message };
   return { ok: true, value: collapseEnumValues(result.values) };
 }
+function parsePaginationQueryParam(url, name) {
+  const raw = url.searchParams.get(name);
+  if (raw === null)
+    return { ok: true, value: undefined };
+  const min = name === "limit" ? 1 : 0;
+  const message = name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer";
+  if (!/^\d+$/.test(raw))
+    return { ok: false, message };
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min)
+    return { ok: false, message };
+  return { ok: true, value };
+}
 async function handleListTasks(_req, url, _ctx, json5, taskToSummary2) {
   const statusParam = taskStatusQueryParam(url);
   if (!statusParam.ok)
@@ -31387,16 +31774,20 @@ async function handleListTasks(_req, url, _ctx, json5, taskToSummary2) {
   const projectId = url.searchParams.get("project_id") || undefined;
   const sessionId = url.searchParams.get("session_id") || undefined;
   const agentId = url.searchParams.get("agent_id") || undefined;
-  const limitParam = url.searchParams.get("limit");
-  const offsetParam = url.searchParams.get("offset");
+  const limitParam = parsePaginationQueryParam(url, "limit");
+  if (!limitParam.ok)
+    return json5({ error: limitParam.message }, 400);
+  const offsetParam = parsePaginationQueryParam(url, "offset");
+  if (!offsetParam.ok)
+    return json5({ error: offsetParam.message }, 400);
   const fields = parseFieldsParam(url);
   const tasks = listTasks2({
     status: statusParam.value,
     project_id: projectId,
     session_id: sessionId,
     agent_id: agentId,
-    limit: limitParam ? parseInt(limitParam, 10) : undefined,
-    offset: offsetParam ? parseInt(offsetParam, 10) : undefined
+    limit: limitParam.value,
+    offset: offsetParam.value
   });
   return json5(tasks.map((t) => taskToSummary2(t, fields)));
 }
@@ -32188,6 +32579,12 @@ class TodosShadowOutbox {
       this.onEvent?.({ type: "mirrored", objectType: row.object_type, id: row.object_id, lagMs });
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
+      if (error instanceof ResourceConflictError) {
+        this.metrics.lastError = message;
+        this.db.run(`UPDATE shadow_outbox SET attempts=?, last_error=?, status='failed' WHERE seq=? AND revision=?`, [row.attempts + 1, message, row.seq, row.revision]);
+        this.onEvent?.({ type: "parked", objectType: row.object_type, id: row.object_id, error: message });
+        return;
+      }
       this.metrics.retries += 1;
       this.metrics.lastError = message;
       const attempts = row.attempts + 1;
@@ -32310,6 +32707,7 @@ function emptySnapshot() {
 }
 var MAX_BACKOFF_MS;
 var init_shadow_outbox = __esm(() => {
+  init_types();
   init_local_sqlite();
   init_postgres_sync();
   init_shadow_outbox_schema();
@@ -36608,6 +37006,26 @@ function parseSinceCursor(raw) {
   }
   return { ok: true, value: new Date(parsed).toISOString() };
 }
+function paginationQueryParam(url, name) {
+  const raw = url.searchParams.get(name);
+  if (raw === null)
+    return { ok: true, value: undefined };
+  const min = name === "limit" ? 1 : 0;
+  if (!/^\d+$/.test(raw)) {
+    return {
+      ok: false,
+      response: error(400, name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer")
+    };
+  }
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < min) {
+    return {
+      ok: false,
+      response: error(400, name === "limit" ? "limit must be a positive integer" : "offset must be a non-negative integer")
+    };
+  }
+  return { ok: true, value };
+}
 function validateTaskCompletion(value) {
   if (!value || typeof value !== "object" || Array.isArray(value))
     return { ok: false, message: "completion body must be an object" };
@@ -37136,6 +37554,12 @@ async function handleV1Request(req, url, dependencies = {}) {
           if (updatedAfter !== null && !updatedAfter.ok) {
             return error(400, updatedAfter.message);
           }
+          const limitParam = paginationQueryParam(url, "limit");
+          if (!limitParam.ok)
+            return limitParam.response;
+          const offsetParam = paginationQueryParam(url, "offset");
+          if (!offsetParam.ok)
+            return offsetParam.response;
           const filter = {
             ...updatedAfter !== null && updatedAfter.ok ? { updated_after: updatedAfter.value } : {},
             ...url.searchParams.get("q") ? { query: url.searchParams.get("q") } : {},
@@ -37152,8 +37576,8 @@ async function handleV1Request(req, url, dependencies = {}) {
             ...url.searchParams.get("tags") ? {
               tags: url.searchParams.get("tags").split(",").map((tag) => tag.trim()).filter(Boolean)
             } : {},
-            ...url.searchParams.get("limit") ? { limit: Number(url.searchParams.get("limit")) } : {},
-            ...url.searchParams.get("offset") ? { offset: Number(url.searchParams.get("offset")) } : {}
+            ...limitParam.value !== undefined ? { limit: limitParam.value } : {},
+            ...offsetParam.value !== undefined ? { offset: offsetParam.value } : {}
           };
           const tasks = await store.tasks.list(filter);
           const { limit: _l, offset: _o, ...countFilter } = filter;
@@ -38180,6 +38604,152 @@ var init_v1 = __esm(() => {
   RFC3339_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[Tt]\d{2}:\d{2}:\d{2}(\.\d+)?([Zz]|[+-]\d{2}:\d{2})$/;
 });
 
+// node_modules/.bun/content-type@1.0.5/node_modules/content-type/index.js
+var require_content_type = __commonJS((exports) => {
+  /*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
+  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+  var QUOTE_REGEXP = /([\\"])/g;
+  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  exports.format = format;
+  exports.parse = parse;
+  function format(obj) {
+    if (!obj || typeof obj !== "object") {
+      throw new TypeError("argument obj is required");
+    }
+    var parameters = obj.parameters;
+    var type = obj.type;
+    if (!type || !TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid type");
+    }
+    var string = type;
+    if (parameters && typeof parameters === "object") {
+      var param;
+      var params = Object.keys(parameters).sort();
+      for (var i = 0;i < params.length; i++) {
+        param = params[i];
+        if (!TOKEN_REGEXP.test(param)) {
+          throw new TypeError("invalid parameter name");
+        }
+        string += "; " + param + "=" + qstring(parameters[param]);
+      }
+    }
+    return string;
+  }
+  function parse(string) {
+    if (!string) {
+      throw new TypeError("argument string is required");
+    }
+    var header = typeof string === "object" ? getcontenttype(string) : string;
+    if (typeof header !== "string") {
+      throw new TypeError("argument string is required to be a string");
+    }
+    var index = header.indexOf(";");
+    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+    if (!TYPE_REGEXP.test(type)) {
+      throw new TypeError("invalid media type");
+    }
+    var obj = new ContentType(type.toLowerCase());
+    if (index !== -1) {
+      var key2;
+      var match;
+      var value;
+      PARAM_REGEXP.lastIndex = index;
+      while (match = PARAM_REGEXP.exec(header)) {
+        if (match.index !== index) {
+          throw new TypeError("invalid parameter format");
+        }
+        index += match[0].length;
+        key2 = match[1].toLowerCase();
+        value = match[2];
+        if (value.charCodeAt(0) === 34) {
+          value = value.slice(1, -1);
+          if (value.indexOf("\\") !== -1) {
+            value = value.replace(QESC_REGEXP, "$1");
+          }
+        }
+        obj.parameters[key2] = value;
+      }
+      if (index !== header.length) {
+        throw new TypeError("invalid parameter format");
+      }
+    }
+    return obj;
+  }
+  function getcontenttype(obj) {
+    var header;
+    if (typeof obj.getHeader === "function") {
+      header = obj.getHeader("content-type");
+    } else if (typeof obj.headers === "object") {
+      header = obj.headers && obj.headers["content-type"];
+    }
+    if (typeof header !== "string") {
+      throw new TypeError("content-type header is missing from object");
+    }
+    return header;
+  }
+  function qstring(val) {
+    var str = String(val);
+    if (TOKEN_REGEXP.test(str)) {
+      return str;
+    }
+    if (str.length > 0 && !TEXT_REGEXP.test(str)) {
+      throw new TypeError("invalid parameter value");
+    }
+    return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+  }
+  function ContentType(type) {
+    this.parameters = Object.create(null);
+    this.type = type;
+  }
+});
+
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+function mediaTypeEssence(header) {
+  if (!header) {
+    return;
+  }
+  try {
+    return import_content_type.default.parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header) {
+  if (header === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header) === "application/json";
+}
+var import_content_type;
+var init_mediaType = __esm(() => {
+  import_content_type = __toESM(require_content_type(), 1);
+});
+
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000, MAX_TIMER_DELAY_MS;
+var init_sseKeepAlive = __esm(() => {
+  MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+});
+
 // node_modules/.bun/zod@3.25.76/node_modules/zod/v4/core/core.js
 function $constructor(name, initializer, params) {
   function init(inst, def) {
@@ -42766,7 +43336,7 @@ var init_v4 = __esm(() => {
   init_classic();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/types.js
 function assertCompleteRequestPrompt(request) {
   if (request.params.ref.type !== "ref/prompt") {
     throw new TypeError(`Expected CompleteRequestPrompt, but got ${request.params.ref.type}`);
@@ -42785,7 +43355,7 @@ var init_types7 = __esm(() => {
   ProgressTokenSchema = union([string2(), number2().int()]);
   CursorSchema = string2();
   TaskCreationParamsSchema = looseObject({
-    ttl: union([number2(), _null3()]).optional(),
+    ttl: number2().optional(),
     pollInterval: number2().optional()
   });
   TaskMetadataSchema = object({
@@ -42933,7 +43503,8 @@ var init_types7 = __esm(() => {
     roots: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ClientTasksCapabilitySchema.optional()
+    tasks: ClientTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string2(),
@@ -42958,7 +43529,8 @@ var init_types7 = __esm(() => {
     tools: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ServerTasksCapabilitySchema.optional()
+    tasks: ServerTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string2(),
@@ -43073,6 +43645,7 @@ var init_types7 = __esm(() => {
     uri: string2(),
     description: optional(string2()),
     mimeType: optional(string2()),
+    size: optional(number2()),
     annotations: AnnotationsSchema.optional(),
     _meta: optional(looseObject({}))
   });
@@ -43601,17 +44174,19 @@ var init_types7 = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/webStandardStreamableHttp.js
 class WebStandardStreamableHTTPServerTransport {
   constructor(options = {}) {
     this._started = false;
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -43621,6 +44196,22 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -43668,6 +44259,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -43707,10 +44301,12 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
     if (!acceptHeader?.includes("text/event-stream")) {
+      this.onerror?.(new Error("Not Acceptable: Client must accept text/event-stream"));
       return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept text/event-stream");
     }
     const sessionError = this.validateSession(req);
@@ -43728,22 +44324,30 @@ data:
       }
     }
     if (this._streamMapping.get(this._standaloneSseStreamId) !== undefined) {
+      this.onerror?.(new Error("Conflict: Only one SSE stream is allowed per session"));
       return this.createJsonErrorResponse(409, -32000, "Conflict: Only one SSE stream is allowed per session");
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers["mcp-session-id"] = this.sessionId;
@@ -43752,16 +44356,21 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers });
   }
   async replayEvents(lastEventId) {
     if (!this._eventStore) {
+      this.onerror?.(new Error("Event store not configured"));
       return this.createJsonErrorResponse(400, -32000, "Event store not configured");
     }
     try {
@@ -43769,29 +44378,44 @@ data:
       if (this._eventStore.getStreamIdForEventId) {
         streamId = await this._eventStore.getStreamIdForEventId(lastEventId);
         if (!streamId) {
+          this.onerror?.(new Error("Invalid event ID format"));
           return this.createJsonErrorResponse(400, -32000, "Invalid event ID format");
         }
         if (this._streamMapping.get(streamId) !== undefined) {
+          this.onerror?.(new Error("Conflict: Stream already has an active connection"));
           return this.createJsonErrorResponse(409, -32000, "Conflict: Stream already has an active connection");
         }
       }
       const headers = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -43799,19 +44423,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers });
     } catch (error3) {
       this.onerror?.(error3);
@@ -43831,11 +44470,13 @@ data:
 `;
       controller.enqueue(encoder.encode(eventData));
       return true;
-    } catch {
+    } catch (error3) {
+      this.onerror?.(error3);
       return false;
     }
   }
   handleUnsupportedRequest() {
+    this.onerror?.(new Error("Method not allowed."));
     return new Response(JSON.stringify({
       jsonrpc: "2.0",
       error: {
@@ -43855,14 +44496,17 @@ data:
     try {
       const acceptHeader = req.headers.get("accept");
       if (!acceptHeader?.includes("application/json") || !acceptHeader.includes("text/event-stream")) {
+        this.onerror?.(new Error("Not Acceptable: Client must accept both application/json and text/event-stream"));
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
+        this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
       const requestInfo = {
-        headers: Object.fromEntries(req.headers.entries())
+        headers: Object.fromEntries(req.headers.entries()),
+        url: new URL(req.url)
       };
       let rawMessage;
       if (options?.parsedBody !== undefined) {
@@ -43871,6 +44515,7 @@ data:
         try {
           rawMessage = await req.json();
         } catch {
+          this.onerror?.(new Error("Parse error: Invalid JSON"));
           return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
         }
       }
@@ -43882,14 +44527,20 @@ data:
           messages = [JSONRPCMessageSchema.parse(rawMessage)];
         }
       } catch {
+        this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
+          this.onerror?.(new Error("Invalid Request: Server already initialized"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Server already initialized");
         }
         if (messages.length > 1) {
+          this.onerror?.(new Error("Invalid Request: Only one initialization request is allowed"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Only one initialization request is allowed");
         }
         this.sessionId = this.sessionIdGenerator?.();
@@ -43908,6 +44559,9 @@ data:
           return protocolError;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -43938,18 +44592,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
@@ -43960,6 +44621,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -43969,19 +44633,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+        }
+      } catch (error3) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+        throw error3;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers });
     } catch (error3) {
@@ -43998,22 +44676,28 @@ data:
     if (protocolError) {
       return protocolError;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
       return;
     }
     if (!this._initialized) {
+      this.onerror?.(new Error("Bad Request: Server not initialized"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Server not initialized");
     }
     const sessionId = req.headers.get("mcp-session-id");
     if (!sessionId) {
+      this.onerror?.(new Error("Bad Request: Mcp-Session-Id header is required"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Mcp-Session-Id header is required");
     }
     if (sessionId !== this.sessionId) {
+      this.onerror?.(new Error("Session not found"));
       return this.createJsonErrorResponse(404, -32001, "Session not found");
     }
     return;
@@ -44021,16 +44705,22 @@ data:
   validateProtocolVersion(req) {
     const protocolVersion = req.headers.get("mcp-protocol-version");
     if (protocolVersion !== null && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+      this.onerror?.(new Error(`Bad Request: Unsupported protocol version: ${protocolVersion}` + ` (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`));
       return this.createJsonErrorResponse(400, -32000, `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`);
     }
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -44065,7 +44755,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -44074,13 +44764,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -44088,6 +44784,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -44110,11 +44825,14 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
 }
 var init_webStandardStreamableHttp = __esm(() => {
+  init_mediaType();
+  init_sseKeepAlive();
   init_types7();
 });
 
@@ -44208,7 +44926,7 @@ var init_v4_mini = __esm(() => {
   init_mini();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js
 function isZ4Schema(s) {
   const schema2 = s;
   return !!schema2._zod;
@@ -44292,17 +45010,34 @@ function normalizeObjectSchema(schema2) {
   }
   return;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error3) {
   if (error3 && typeof error3 === "object") {
+    if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
+      return error3.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join(`
+`);
+    }
     if ("message" in error3 && typeof error3.message === "string") {
       return error3.message;
     }
-    if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
-      const firstIssue = error3.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error3);
     } catch {
@@ -44356,12 +45091,12 @@ var init_zod_compat = __esm(() => {
   init_v4_mini();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/interfaces.js
 function isTerminal(status3) {
   return status3 === "completed" || status3 === "failed" || status3 === "cancelled";
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Options.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Options.js
 var ignoreOverride, defaultOptions, getDefaultOptions = (options) => typeof options === "string" ? {
   ...defaultOptions,
   name: options
@@ -44397,7 +45132,7 @@ var init_Options = __esm(() => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Refs.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/Refs.js
 var getRefs = (options) => {
   const _options = getDefaultOptions(options);
   const currentPath = _options.name !== undefined ? [..._options.basePath, _options.definitionPath, _options.name] : _options.basePath;
@@ -44420,7 +45155,7 @@ var init_Refs = __esm(() => {
   init_Options();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/errorMessages.js
 function addErrorMessage(res, key2, errorMessage, refs) {
   if (!refs?.errorMessages)
     return;
@@ -44436,7 +45171,7 @@ function setResponseValueAndErrors(res, key2, value, errorMessage, refs) {
   addErrorMessage(res, key2, errorMessage, refs);
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/getRelativePath.js
 var getRelativePath = (pathA, pathB) => {
   let i = 0;
   for (;i < pathA.length && i < pathB.length; i++) {
@@ -44446,7 +45181,7 @@ var getRelativePath = (pathA, pathB) => {
   return [(pathA.length - i).toString(), ...pathB.slice(i)].join("/");
 };
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/any.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/any.js
 function parseAnyDef(refs) {
   if (refs.target !== "openAi") {
     return {};
@@ -44463,7 +45198,7 @@ function parseAnyDef(refs) {
 }
 var init_any = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/array.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/array.js
 function parseArrayDef(def, refs) {
   const res = {
     type: "array"
@@ -44491,7 +45226,7 @@ var init_array = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/bigint.js
 function parseBigintDef(def, refs) {
   const res = {
     type: "integer",
@@ -44538,14 +45273,14 @@ function parseBigintDef(def, refs) {
 }
 var init_bigint = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/boolean.js
 function parseBooleanDef() {
   return {
     type: "boolean"
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/branded.js
 function parseBrandedDef(_def, refs) {
   return parseDef(_def.type._def, refs);
 }
@@ -44553,7 +45288,7 @@ var init_branded = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/catch.js
 var parseCatchDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
@@ -44561,7 +45296,7 @@ var init_catch = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/date.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/date.js
 function parseDateDef(def, refs, overrideDateStrategy) {
   const strategy = overrideDateStrategy ?? refs.dateStrategy;
   if (Array.isArray(strategy)) {
@@ -44607,7 +45342,7 @@ var integerDateParser = (def, refs) => {
 };
 var init_date = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/default.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/default.js
 function parseDefaultDef(_def, refs) {
   return {
     ...parseDef(_def.innerType._def, refs),
@@ -44618,7 +45353,7 @@ var init_default = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/effects.js
 function parseEffectsDef(_def, refs) {
   return refs.effectStrategy === "input" ? parseDef(_def.schema._def, refs) : parseAnyDef(refs);
 }
@@ -44627,7 +45362,7 @@ var init_effects = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/enum.js
 function parseEnumDef(def) {
   return {
     type: "string",
@@ -44635,7 +45370,7 @@ function parseEnumDef(def) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/intersection.js
 function parseIntersectionDef(def, refs) {
   const allOf = [
     parseDef(def.left._def, {
@@ -44680,7 +45415,7 @@ var init_intersection = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/literal.js
 function parseLiteralDef(def, refs) {
   const parsedType2 = typeof def.value;
   if (parsedType2 !== "bigint" && parsedType2 !== "number" && parsedType2 !== "boolean" && parsedType2 !== "string") {
@@ -44700,7 +45435,7 @@ function parseLiteralDef(def, refs) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/string.js
 function parseStringDef(def, refs) {
   const res = {
     type: "string"
@@ -44999,7 +45734,7 @@ var init_string = __esm(() => {
   ALPHA_NUMERIC = new Set("ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvxyz0123456789");
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/record.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/record.js
 function parseRecordDef(def, refs) {
   if (refs.target === "openAi") {
     console.warn("Warning: OpenAI may not support records in schemas! Try an array of key-value pairs instead.");
@@ -45058,7 +45793,7 @@ var init_record = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/map.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/map.js
 function parseMapDef(def, refs) {
   if (refs.mapStrategy === "record") {
     return parseRecordDef(def, refs);
@@ -45088,7 +45823,7 @@ var init_map = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nativeEnum.js
 function parseNativeEnumDef(def) {
   const object3 = def.values;
   const actualKeys = Object.keys(def.values).filter((key2) => {
@@ -45102,7 +45837,7 @@ function parseNativeEnumDef(def) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/never.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/never.js
 function parseNeverDef(refs) {
   return refs.target === "openAi" ? undefined : {
     not: parseAnyDef({
@@ -45115,7 +45850,7 @@ var init_never = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/null.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/null.js
 function parseNullDef(refs) {
   return refs.target === "openApi3" ? {
     enum: ["null"],
@@ -45125,7 +45860,7 @@ function parseNullDef(refs) {
   };
 }
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/union.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/union.js
 function parseUnionDef(def, refs) {
   if (refs.target === "openApi3")
     return asAnyOf(def, refs);
@@ -45196,7 +45931,7 @@ var init_union = __esm(() => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/nullable.js
 function parseNullableDef(def, refs) {
   if (["ZodString", "ZodNumber", "ZodBigInt", "ZodBoolean", "ZodNull"].includes(def.innerType._def.typeName) && (!def.innerType._def.checks || !def.innerType._def.checks.length)) {
     if (refs.target === "openApi3") {
@@ -45232,7 +45967,7 @@ var init_nullable = __esm(() => {
   init_union();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/number.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/number.js
 function parseNumberDef(def, refs) {
   const res = {
     type: "number"
@@ -45282,7 +46017,7 @@ function parseNumberDef(def, refs) {
 }
 var init_number = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/object.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/object.js
 function parseObjectDef(def, refs) {
   const forceOptionalIntoNullable = refs.target === "openAi";
   const result = {
@@ -45355,7 +46090,7 @@ var init_object = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/optional.js
 var parseOptionalDef = (def, refs) => {
   if (refs.currentPath.toString() === refs.propertyPath?.toString()) {
     return parseDef(def.innerType._def, refs);
@@ -45378,7 +46113,7 @@ var init_optional = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/pipeline.js
 var parsePipelineDef = (def, refs) => {
   if (refs.pipeStrategy === "input") {
     return parseDef(def.in._def, refs);
@@ -45401,7 +46136,7 @@ var init_pipeline = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/promise.js
 function parsePromiseDef(def, refs) {
   return parseDef(def.type._def, refs);
 }
@@ -45409,7 +46144,7 @@ var init_promise = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/set.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/set.js
 function parseSetDef(def, refs) {
   const items = parseDef(def.valueType._def, {
     ...refs,
@@ -45432,7 +46167,7 @@ var init_set = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/tuple.js
 function parseTupleDef(def, refs) {
   if (def.rest) {
     return {
@@ -45463,7 +46198,7 @@ var init_tuple = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/undefined.js
 function parseUndefinedDef(refs) {
   return {
     not: parseAnyDef(refs)
@@ -45473,7 +46208,7 @@ var init_undefined = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/unknown.js
 function parseUnknownDef(refs) {
   return parseAnyDef(refs);
 }
@@ -45481,7 +46216,7 @@ var init_unknown = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parsers/readonly.js
 var parseReadonlyDef = (def, refs) => {
   return parseDef(def.innerType._def, refs);
 };
@@ -45489,7 +46224,7 @@ var init_readonly = __esm(() => {
   init_parseDef();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/selectParser.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/selectParser.js
 var selectParser = (def, typeName, refs) => {
   switch (typeName) {
     case ZodFirstPartyTypeKind.ZodString:
@@ -45595,7 +46330,7 @@ var init_selectParser = __esm(() => {
   init_readonly();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseDef.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseDef.js
 function parseDef(def, refs, forceResolution = false) {
   const seenItem = refs.seen.get(def);
   if (refs.override) {
@@ -45655,10 +46390,10 @@ var init_parseDef = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseTypes.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/parseTypes.js
 var init_parseTypes = () => {};
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/zodToJsonSchema.js
 var zodToJsonSchema = (schema2, options) => {
   const refs = getRefs(options);
   let definitions = typeof options === "object" && options.definitions ? Object.entries(options.definitions).reduce((acc, [name2, schema3]) => ({
@@ -45724,7 +46459,7 @@ var init_zodToJsonSchema = __esm(() => {
   init_any();
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/index.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/esm/index.js
 var init_esm = __esm(() => {
   init_zodToJsonSchema();
   init_Options();
@@ -45760,7 +46495,7 @@ var init_esm = __esm(() => {
   init_zodToJsonSchema();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-json-schema-compat.js
 function mapMiniTarget(t) {
   if (!t)
     return "draft-7";
@@ -45807,7 +46542,7 @@ var init_zod_json_schema_compat = __esm(() => {
   init_esm();
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/protocol.js
 class Protocol {
   constructor(_options) {
     this._options = _options;
@@ -46009,6 +46744,10 @@ class Protocol {
     this._progressHandlers.clear();
     this._taskProgressTokens.clear();
     this._pendingDebouncedNotifications.clear();
+    for (const info of this._timeoutInfo.values()) {
+      clearTimeout(info.timeoutId);
+    }
+    this._timeoutInfo.clear();
     for (const controller of this._requestHandlerAbortControllers.values()) {
       controller.abort();
     }
@@ -46139,7 +46878,9 @@ class Protocol {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error3) => this._onerror(new Error(`Failed to send response: ${error3}`))).finally(() => {
-      this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request.id);
+      }
     });
   }
   _onprogress(notification) {
@@ -53205,7 +53946,7 @@ var require_dist = __commonJS((exports, module) => {
   exports.default = formatsPlugin;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/validation/ajv-provider.js
 function createDefaultAjvInstance() {
   const ajv = new import_ajv.default({
     strict: false,
@@ -53248,7 +53989,7 @@ var init_ajv_provider = __esm(() => {
   import_ajv_formats = __toESM(require_dist(), 1);
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
 class ExperimentalServerTasks {
   constructor(_server) {
     this._server = _server;
@@ -53256,6 +53997,62 @@ class ExperimentalServerTasks {
   requestStream(request, resultSchema, options) {
     return this._server.requestStream(request, resultSchema, options);
   }
+  createMessageStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    if ((params.tools || params.toolChoice) && !clientCapabilities?.sampling?.tools) {
+      throw new Error("Client does not support sampling tools capability.");
+    }
+    if (params.messages.length > 0) {
+      const lastMessage = params.messages[params.messages.length - 1];
+      const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+      const hasToolResults = lastContent.some((c) => c.type === "tool_result");
+      const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+      const previousContent = previousMessage ? Array.isArray(previousMessage.content) ? previousMessage.content : [previousMessage.content] : [];
+      const hasPreviousToolUse = previousContent.some((c) => c.type === "tool_use");
+      if (hasToolResults) {
+        if (lastContent.some((c) => c.type !== "tool_result")) {
+          throw new Error("The last message must contain only tool_result content if any is present");
+        }
+        if (!hasPreviousToolUse) {
+          throw new Error("tool_result blocks are not matching any tool_use from the previous message");
+        }
+      }
+      if (hasPreviousToolUse) {
+        const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
+        const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+          throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
+        }
+      }
+    }
+    return this.requestStream({
+      method: "sampling/createMessage",
+      params
+    }, CreateMessageResultSchema, options);
+  }
+  elicitInputStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    const mode = params.mode ?? "form";
+    switch (mode) {
+      case "url": {
+        if (!clientCapabilities?.elicitation?.url) {
+          throw new Error("Client does not support url elicitation.");
+        }
+        break;
+      }
+      case "form": {
+        if (!clientCapabilities?.elicitation?.form) {
+          throw new Error("Client does not support form elicitation.");
+        }
+        break;
+      }
+    }
+    const normalizedParams = mode === "form" && params.mode === undefined ? { ...params, mode: "form" } : params;
+    return this.requestStream({
+      method: "elicitation/create",
+      params: normalizedParams
+    }, ElicitResultSchema, options);
+  }
   async getTask(taskId, options) {
     return this._server.getTask({ taskId }, options);
   }
@@ -53269,8 +54066,11 @@ class ExperimentalServerTasks {
     return this._server.cancelTask({ taskId }, options);
   }
 }
+var init_server = __esm(() => {
+  init_types7();
+});
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
   if (!requests) {
     throw new Error(`${entityName} does not support task creation (required for ${method})`);
@@ -53305,13 +54105,14 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
   }
 }
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server;
-var init_server = __esm(() => {
+var init_server2 = __esm(() => {
   init_protocol();
   init_types7();
   init_ajv_provider();
   init_zod_compat();
+  init_server();
   Server = class Server extends Protocol {
     constructor(_serverInfo, options) {
       super(options);
@@ -53359,16 +54160,7 @@ var init_server = __esm(() => {
       if (!methodSchema) {
         throw new Error("Schema is missing a method literal");
       }
-      let methodValue;
-      if (isZ4Schema(methodSchema)) {
-        const v4Schema = methodSchema;
-        const v4Def = v4Schema._zod?.def;
-        methodValue = v4Def?.value ?? v4Schema.value;
-      } else {
-        const v3Schema = methodSchema;
-        const legacyDef = v3Schema._def;
-        methodValue = legacyDef?.value ?? v3Schema.value;
-      }
+      const methodValue = getLiteralValue(methodSchema);
       if (typeof methodValue !== "string") {
         throw new Error("Schema method literal must be a string");
       }
@@ -53645,7 +54437,7 @@ var init_server = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/completable.js
 function isCompletable(schema2) {
   return !!schema2 && typeof schema2 === "object" && COMPLETABLE_SYMBOL in schema2;
 }
@@ -53660,7 +54452,7 @@ var init_completable = __esm(() => {
     McpZodTypeKind2["Completable"] = "McpCompletable";
   })(McpZodTypeKind || (McpZodTypeKind = {}));
 });
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/toolNameValidation.js
 function validateToolName(name) {
   const warnings = [];
   if (name.length === 0) {
@@ -53721,7 +54513,7 @@ var init_toolNameValidation = __esm(() => {
   TOOL_NAME_REGEX = /^[A-Za-z0-9._-]{1,128}$/;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/mcp-server.js
 class ExperimentalMcpServerTasks {
   constructor(_mcpServer) {
     this._mcpServer = _mcpServer;
@@ -53736,7 +54528,7 @@ class ExperimentalMcpServerTasks {
   }
 }
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -54320,6 +55112,9 @@ class McpServer {
           annotations = rest.shift();
         }
       } else if (typeof firstArg === "object" && firstArg !== null) {
+        if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+          throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+        }
         annotations = rest.shift();
       }
     }
@@ -54408,6 +55203,9 @@ function getZodSchemaObject(schema2) {
   if (isZodRawShapeCompat(schema2)) {
     return objectFromShape(schema2);
   }
+  if (!isZodSchemaInstance(schema2)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+  }
   return schema2;
 }
 function promptArgumentsFromSchema(schema2) {
@@ -54447,7 +55245,7 @@ function createCompletionResult(suggestions) {
 }
 var EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
 var init_mcp = __esm(() => {
-  init_server();
+  init_server2();
   init_zod_compat();
   init_zod_json_schema_compat();
   init_types7();
@@ -54466,9 +55264,17 @@ var init_mcp = __esm(() => {
   };
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 class ReadBuffer {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -54495,26 +55301,33 @@ function serializeMessage(message) {
   return JSON.stringify(message) + `
 `;
 }
+var STDIO_DEFAULT_MAX_BUFFER_SIZE;
 var init_stdio = __esm(() => {
   init_types7();
+  STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "process";
 
 class StdioServerTransport {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout) {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer;
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error3) {
+        this.onerror?.(error3);
+        this.close().catch(() => {});
+      }
     };
     this._onerror = (error3) => {
       this.onerror?.(error3);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   async start() {
     if (this._started) {
@@ -55795,7 +56608,7 @@ var init_assignee_context = __esm(() => {
   init_assignee_validation();
 });
 
-// node_modules/.bun/@hasna+contracts@0.13.4+ad7b1171e6eea7eb/node_modules/@hasna/contracts/dist/client/storage.js
+// node_modules/.bun/@hasna+contracts@0.14.0+619f74e7b30eeaf4/node_modules/@hasna/contracts/dist/client/storage.js
 import { isIP } from "net";
 import { readFileSync as readFileSync5, statSync as statSync4 } from "fs";
 import { join as join10 } from "path";
@@ -58460,8 +59273,8 @@ function registerTaskCrudTools(server, ctx) {
       tags: exports_external.array(exports_external.string()).optional().describe("Filter by tags (AND logic)"),
       created_after: exports_external.string().optional().describe("ISO date \u2014 tasks created after this date"),
       created_before: exports_external.string().optional().describe("ISO date \u2014 tasks created before this date"),
-      limit: exports_external.number().optional().describe("Max results (default: 50, max 500)"),
-      offset: exports_external.number().optional().describe("Pagination offset"),
+      limit: exports_external.number().int().min(1).optional().describe("Max results (default: 50, max 500)"),
+      offset: exports_external.number().int().min(0).optional().describe("Pagination offset"),
       metadata: exports_external.record(exports_external.unknown()).optional().describe("Exact top-level metadata filters")
     }, async (params) => {
       try {
@@ -61811,6 +62624,48 @@ var init_task_relationships = __esm(() => {
   ];
 });
 
+// src/lib/dedupe-projection.ts
+function projectTasksForDedupe(tasks) {
+  return tasks.map((task2) => {
+    const metadata = {};
+    for (const key2 of DEDUPE_SOURCE_KEY_ALLOWLIST) {
+      if (key2 in task2.metadata) {
+        metadata[key2] = redactValue(task2.metadata[key2]);
+      }
+    }
+    return {
+      id: task2.id,
+      short_id: task2.short_id,
+      title: redactEvidenceText(task2.title),
+      description: task2.description === null || task2.description === undefined ? null : redactEvidenceText(task2.description),
+      status: task2.status,
+      created_at: task2.created_at,
+      updated_at: task2.updated_at,
+      project_id: task2.project_id,
+      task_list_id: task2.task_list_id,
+      assigned_to: task2.assigned_to,
+      priority: task2.priority,
+      metadata
+    };
+  });
+}
+var DEDUPE_SOURCE_KEY_ALLOWLIST;
+var init_dedupe_projection = __esm(() => {
+  init_redaction();
+  DEDUPE_SOURCE_KEY_ALLOWLIST = [
+    "github_url",
+    "github_issue_url",
+    "github_pr_url",
+    "source_url",
+    "url",
+    "external_url",
+    "issue_url",
+    "github_owner",
+    "github_repo",
+    "github_number"
+  ];
+});
+
 // src/lib/task-dedupe.ts
 function asObject(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
@@ -61975,10 +62830,10 @@ function olderFirst(left, right) {
 function findDuplicateTasks(options = {}, db) {
   const d = db || getDatabase();
   const threshold = options.threshold ?? DEFAULT_THRESHOLD;
-  const fingerprints = listTasks2({
+  const fingerprints = projectTasksForDedupe(listTasks2({
     include_archived: Boolean(options.include_archived),
     limit: options.limit ?? 1000
-  }, d).map(fingerprint);
+  }, d)).map(fingerprint);
   const candidates = [];
   for (let i = 0;i < fingerprints.length; i++) {
     for (let j = i + 1;j < fingerprints.length; j++) {
@@ -62213,6 +63068,7 @@ var init_task_dedupe = __esm(() => {
   init_database();
   init_task_relationships();
   init_tasks();
+  init_dedupe_projection();
   STOP_WORDS = new Set([
     "a",
     "an",
@@ -85410,7 +86266,7 @@ var require_v4_mini = __commonJS((exports) => {
   __exportStar(require_mini(), exports);
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
 var require_zod_compat = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -85540,17 +86396,34 @@ var require_zod_compat = __commonJS((exports) => {
     }
     return;
   }
+  function getDotPath2(path) {
+    if (path.length === 0) {
+      return "object root";
+    }
+    return path.reduce((acc, seg, index) => {
+      if (index === 0) {
+        return String(seg);
+      }
+      if (typeof seg === "number") {
+        return `${acc}[${seg}]`;
+      }
+      return `${acc}.${seg}`;
+    }, "");
+  }
   function getParseErrorMessage2(error3) {
     if (error3 && typeof error3 === "object") {
+      if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
+        return error3.issues.map((i) => {
+          if (!i.path?.length) {
+            return i.message;
+          }
+          return `${i.message} at ${getDotPath2(i.path)}`;
+        }).join(`
+`);
+      }
       if ("message" in error3 && typeof error3.message === "string") {
         return error3.message;
       }
-      if ("issues" in error3 && Array.isArray(error3.issues) && error3.issues.length > 0) {
-        const firstIssue = error3.issues[0];
-        if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-          return String(firstIssue.message);
-        }
-      }
       try {
         return JSON.stringify(error3);
       } catch {
@@ -87257,7 +88130,7 @@ var require_v4 = __commonJS((exports) => {
   exports.default = index_js_1.default;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/types.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/types.js
 var require_types3 = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -87308,7 +88181,7 @@ var require_types3 = __commonJS((exports) => {
   exports.ProgressTokenSchema = z.union([z.string(), z.number().int()]);
   exports.CursorSchema = z.string();
   exports.TaskCreationParamsSchema = z.looseObject({
-    ttl: z.union([z.number(), z.null()]).optional(),
+    ttl: z.number().optional(),
     pollInterval: z.number().optional()
   });
   exports.TaskMetadataSchema = z.object({
@@ -87470,7 +88343,8 @@ var require_types3 = __commonJS((exports) => {
     roots: z.object({
       listChanged: z.boolean().optional()
     }).optional(),
-    tasks: exports.ClientTasksCapabilitySchema.optional()
+    tasks: exports.ClientTasksCapabilitySchema.optional(),
+    extensions: z.record(z.string(), AssertObjectSchema2).optional()
   });
   exports.InitializeRequestParamsSchema = BaseRequestParamsSchema2.extend({
     protocolVersion: z.string(),
@@ -87497,7 +88371,8 @@ var require_types3 = __commonJS((exports) => {
     tools: z.object({
       listChanged: z.boolean().optional()
     }).optional(),
-    tasks: exports.ServerTasksCapabilitySchema.optional()
+    tasks: exports.ServerTasksCapabilitySchema.optional(),
+    extensions: z.record(z.string(), AssertObjectSchema2).optional()
   });
   exports.InitializeResultSchema = exports.ResultSchema.extend({
     protocolVersion: z.string(),
@@ -87614,6 +88489,7 @@ var require_types3 = __commonJS((exports) => {
     uri: z.string(),
     description: z.optional(z.string()),
     mimeType: z.optional(z.string()),
+    size: z.optional(z.number()),
     annotations: exports.AnnotationsSchema.optional(),
     _meta: z.optional(z.looseObject({}))
   });
@@ -88157,7 +89033,7 @@ var require_types3 = __commonJS((exports) => {
   exports.UrlElicitationRequiredError = UrlElicitationRequiredError2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/interfaces.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/interfaces.js
 var require_interfaces = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.isTerminal = isTerminal2;
@@ -88166,7 +89042,7 @@ var require_interfaces = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Options.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Options.js
 var require_Options = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getDefaultOptions = exports.defaultOptions = exports.jsonDescription = exports.ignoreOverride = undefined;
@@ -88217,7 +89093,7 @@ var require_Options = __commonJS((exports) => {
   exports.getDefaultOptions = getDefaultOptions2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Refs.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/Refs.js
 var require_Refs = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRefs = undefined;
@@ -88243,7 +89119,7 @@ var require_Refs = __commonJS((exports) => {
   exports.getRefs = getRefs2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/errorMessages.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/errorMessages.js
 var require_errorMessages = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.setResponseValueAndErrors = exports.addErrorMessage = undefined;
@@ -88265,7 +89141,7 @@ var require_errorMessages = __commonJS((exports) => {
   exports.setResponseValueAndErrors = setResponseValueAndErrors2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/getRelativePath.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/getRelativePath.js
 var require_getRelativePath = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.getRelativePath = undefined;
@@ -88280,7 +89156,7 @@ var require_getRelativePath = __commonJS((exports) => {
   exports.getRelativePath = getRelativePath3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/any.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/any.js
 var require_any = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseAnyDef = undefined;
@@ -88302,7 +89178,7 @@ var require_any = __commonJS((exports) => {
   exports.parseAnyDef = parseAnyDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/array.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/array.js
 var require_array = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseArrayDef = undefined;
@@ -88334,7 +89210,7 @@ var require_array = __commonJS((exports) => {
   exports.parseArrayDef = parseArrayDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/bigint.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/bigint.js
 var require_bigint = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBigintDef = undefined;
@@ -88386,7 +89262,7 @@ var require_bigint = __commonJS((exports) => {
   exports.parseBigintDef = parseBigintDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/boolean.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/boolean.js
 var require_boolean = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBooleanDef = undefined;
@@ -88398,7 +89274,7 @@ var require_boolean = __commonJS((exports) => {
   exports.parseBooleanDef = parseBooleanDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/branded.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/branded.js
 var require_branded = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseBrandedDef = undefined;
@@ -88409,7 +89285,7 @@ var require_branded = __commonJS((exports) => {
   exports.parseBrandedDef = parseBrandedDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/catch.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/catch.js
 var require_catch = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseCatchDef = undefined;
@@ -88420,7 +89296,7 @@ var require_catch = __commonJS((exports) => {
   exports.parseCatchDef = parseCatchDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/date.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/date.js
 var require_date = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDateDef = undefined;
@@ -88471,7 +89347,7 @@ var require_date = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/default.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/default.js
 var require_default = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDefaultDef = undefined;
@@ -88485,7 +89361,7 @@ var require_default = __commonJS((exports) => {
   exports.parseDefaultDef = parseDefaultDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/effects.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/effects.js
 var require_effects = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseEffectsDef = undefined;
@@ -88497,7 +89373,7 @@ var require_effects = __commonJS((exports) => {
   exports.parseEffectsDef = parseEffectsDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/enum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/enum.js
 var require_enum2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseEnumDef = undefined;
@@ -88510,7 +89386,7 @@ var require_enum2 = __commonJS((exports) => {
   exports.parseEnumDef = parseEnumDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/intersection.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/intersection.js
 var require_intersection = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseIntersectionDef = undefined;
@@ -88558,7 +89434,7 @@ var require_intersection = __commonJS((exports) => {
   exports.parseIntersectionDef = parseIntersectionDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/literal.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/literal.js
 var require_literal = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseLiteralDef = undefined;
@@ -88583,7 +89459,7 @@ var require_literal = __commonJS((exports) => {
   exports.parseLiteralDef = parseLiteralDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/string.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/string.js
 var require_string = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseStringDef = exports.zodPatterns = undefined;
@@ -88886,7 +89762,7 @@ var require_string = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/record.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/record.js
 var require_record = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseRecordDef = undefined;
@@ -88948,7 +89824,7 @@ var require_record = __commonJS((exports) => {
   exports.parseRecordDef = parseRecordDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/map.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/map.js
 var require_map = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseMapDef = undefined;
@@ -88981,7 +89857,7 @@ var require_map = __commonJS((exports) => {
   exports.parseMapDef = parseMapDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nativeEnum.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nativeEnum.js
 var require_nativeEnum = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNativeEnumDef = undefined;
@@ -89000,7 +89876,7 @@ var require_nativeEnum = __commonJS((exports) => {
   exports.parseNativeEnumDef = parseNativeEnumDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/never.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/never.js
 var require_never = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNeverDef = undefined;
@@ -89016,7 +89892,7 @@ var require_never = __commonJS((exports) => {
   exports.parseNeverDef = parseNeverDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/null.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/null.js
 var require_null = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNullDef = undefined;
@@ -89031,7 +89907,7 @@ var require_null = __commonJS((exports) => {
   exports.parseNullDef = parseNullDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/union.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/union.js
 var require_union = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUnionDef = exports.primitiveMappings = undefined;
@@ -89105,7 +89981,7 @@ var require_union = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nullable.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/nullable.js
 var require_nullable = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNullableDef = undefined;
@@ -89144,7 +90020,7 @@ var require_nullable = __commonJS((exports) => {
   exports.parseNullableDef = parseNullableDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/number.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/number.js
 var require_number = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseNumberDef = undefined;
@@ -89199,7 +90075,7 @@ var require_number = __commonJS((exports) => {
   exports.parseNumberDef = parseNumberDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/object.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/object.js
 var require_object = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseObjectDef = undefined;
@@ -89275,7 +90151,7 @@ var require_object = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/optional.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/optional.js
 var require_optional = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseOptionalDef = undefined;
@@ -89301,7 +90177,7 @@ var require_optional = __commonJS((exports) => {
   exports.parseOptionalDef = parseOptionalDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/pipeline.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/pipeline.js
 var require_pipeline = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parsePipelineDef = undefined;
@@ -89327,7 +90203,7 @@ var require_pipeline = __commonJS((exports) => {
   exports.parsePipelineDef = parsePipelineDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/promise.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/promise.js
 var require_promise = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parsePromiseDef = undefined;
@@ -89338,7 +90214,7 @@ var require_promise = __commonJS((exports) => {
   exports.parsePromiseDef = parsePromiseDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/set.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/set.js
 var require_set = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseSetDef = undefined;
@@ -89365,7 +90241,7 @@ var require_set = __commonJS((exports) => {
   exports.parseSetDef = parseSetDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/tuple.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/tuple.js
 var require_tuple = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseTupleDef = undefined;
@@ -89399,7 +90275,7 @@ var require_tuple = __commonJS((exports) => {
   exports.parseTupleDef = parseTupleDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/undefined.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/undefined.js
 var require_undefined = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUndefinedDef = undefined;
@@ -89412,7 +90288,7 @@ var require_undefined = __commonJS((exports) => {
   exports.parseUndefinedDef = parseUndefinedDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/unknown.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/unknown.js
 var require_unknown = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseUnknownDef = undefined;
@@ -89423,7 +90299,7 @@ var require_unknown = __commonJS((exports) => {
   exports.parseUnknownDef = parseUnknownDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/readonly.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parsers/readonly.js
 var require_readonly = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseReadonlyDef = undefined;
@@ -89434,7 +90310,7 @@ var require_readonly = __commonJS((exports) => {
   exports.parseReadonlyDef = parseReadonlyDef2;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/selectParser.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/selectParser.js
 var require_selectParser = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.selectParser = undefined;
@@ -89548,7 +90424,7 @@ var require_selectParser = __commonJS((exports) => {
   exports.selectParser = selectParser3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseDef.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseDef.js
 var require_parseDef = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.parseDef = undefined;
@@ -89613,12 +90489,12 @@ var require_parseDef = __commonJS((exports) => {
   };
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseTypes.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/parseTypes.js
 var require_parseTypes = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/zodToJsonSchema.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/zodToJsonSchema.js
 var require_zodToJsonSchema = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.zodToJsonSchema = undefined;
@@ -89687,7 +90563,7 @@ var require_zodToJsonSchema = __commonJS((exports) => {
   exports.zodToJsonSchema = zodToJsonSchema3;
 });
 
-// node_modules/.bun/zod-to-json-schema@3.25.1+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/index.js
+// node_modules/.bun/zod-to-json-schema@3.25.2+27912429049419a2/node_modules/zod-to-json-schema/dist/cjs/index.js
 var require_cjs = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -89752,7 +90628,7 @@ var require_cjs = __commonJS((exports) => {
   exports.default = zodToJsonSchema_js_1.zodToJsonSchema;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js
 var require_zod_json_schema_compat = __commonJS((exports) => {
   var __createBinding = exports && exports.__createBinding || (Object.create ? function(o, m, k, k2) {
     if (k2 === undefined)
@@ -89835,7 +90711,7 @@ var require_zod_json_schema_compat = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/protocol.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/protocol.js
 var require_protocol = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Protocol = exports.DEFAULT_REQUEST_TIMEOUT_MSEC = undefined;
@@ -90047,6 +90923,10 @@ var require_protocol = __commonJS((exports) => {
       this._progressHandlers.clear();
       this._taskProgressTokens.clear();
       this._pendingDebouncedNotifications.clear();
+      for (const info of this._timeoutInfo.values()) {
+        clearTimeout(info.timeoutId);
+      }
+      this._timeoutInfo.clear();
       for (const controller of this._requestHandlerAbortControllers.values()) {
         controller.abort();
       }
@@ -90177,7 +91057,9 @@ var require_protocol = __commonJS((exports) => {
           await capturedTransport?.send(errorResponse);
         }
       }).catch((error3) => this._onerror(new Error(`Failed to send response: ${error3}`))).finally(() => {
-        this._requestHandlerAbortControllers.delete(request.id);
+        if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+          this._requestHandlerAbortControllers.delete(request.id);
+        }
       });
     }
     _onprogress(notification) {
@@ -90680,7 +91562,7 @@ var require_protocol = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/validation/ajv-provider.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/validation/ajv-provider.js
 var require_ajv_provider = __commonJS((exports) => {
   var __importDefault = exports && exports.__importDefault || function(mod) {
     return mod && mod.__esModule ? mod : { default: mod };
@@ -90728,10 +91610,11 @@ var require_ajv_provider = __commonJS((exports) => {
   exports.AjvJsonSchemaValidator = AjvJsonSchemaValidator2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/server.js
 var require_server = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ExperimentalServerTasks = undefined;
+  var types_js_1 = require_types3();
 
   class ExperimentalServerTasks2 {
     constructor(_server) {
@@ -90740,6 +91623,62 @@ var require_server = __commonJS((exports) => {
     requestStream(request, resultSchema, options) {
       return this._server.requestStream(request, resultSchema, options);
     }
+    createMessageStream(params, options) {
+      const clientCapabilities = this._server.getClientCapabilities();
+      if ((params.tools || params.toolChoice) && !clientCapabilities?.sampling?.tools) {
+        throw new Error("Client does not support sampling tools capability.");
+      }
+      if (params.messages.length > 0) {
+        const lastMessage = params.messages[params.messages.length - 1];
+        const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+        const hasToolResults = lastContent.some((c) => c.type === "tool_result");
+        const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+        const previousContent = previousMessage ? Array.isArray(previousMessage.content) ? previousMessage.content : [previousMessage.content] : [];
+        const hasPreviousToolUse = previousContent.some((c) => c.type === "tool_use");
+        if (hasToolResults) {
+          if (lastContent.some((c) => c.type !== "tool_result")) {
+            throw new Error("The last message must contain only tool_result content if any is present");
+          }
+          if (!hasPreviousToolUse) {
+            throw new Error("tool_result blocks are not matching any tool_use from the previous message");
+          }
+        }
+        if (hasPreviousToolUse) {
+          const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
+          const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
+          if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+            throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
+          }
+        }
+      }
+      return this.requestStream({
+        method: "sampling/createMessage",
+        params
+      }, types_js_1.CreateMessageResultSchema, options);
+    }
+    elicitInputStream(params, options) {
+      const clientCapabilities = this._server.getClientCapabilities();
+      const mode = params.mode ?? "form";
+      switch (mode) {
+        case "url": {
+          if (!clientCapabilities?.elicitation?.url) {
+            throw new Error("Client does not support url elicitation.");
+          }
+          break;
+        }
+        case "form": {
+          if (!clientCapabilities?.elicitation?.form) {
+            throw new Error("Client does not support form elicitation.");
+          }
+          break;
+        }
+      }
+      const normalizedParams = mode === "form" && params.mode === undefined ? { ...params, mode: "form" } : params;
+      return this.requestStream({
+        method: "elicitation/create",
+        params: normalizedParams
+      }, types_js_1.ElicitResultSchema, options);
+    }
     async getTask(taskId, options) {
       return this._server.getTask({ taskId }, options);
     }
@@ -90756,7 +91695,7 @@ var require_server = __commonJS((exports) => {
   exports.ExperimentalServerTasks = ExperimentalServerTasks2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/helpers.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/helpers.js
 var require_helpers = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.assertToolsCallTaskCapability = assertToolsCallTaskCapability2;
@@ -90796,7 +91735,7 @@ var require_helpers = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.js
 var require_server2 = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.Server = undefined;
@@ -90854,16 +91793,7 @@ var require_server2 = __commonJS((exports) => {
       if (!methodSchema) {
         throw new Error("Schema is missing a method literal");
       }
-      let methodValue;
-      if ((0, zod_compat_js_1.isZ4Schema)(methodSchema)) {
-        const v4Schema = methodSchema;
-        const v4Def = v4Schema._zod?.def;
-        methodValue = v4Def?.value ?? v4Schema.value;
-      } else {
-        const v3Schema = methodSchema;
-        const legacyDef = v3Schema._def;
-        methodValue = legacyDef?.value ?? v3Schema.value;
-      }
+      const methodValue = (0, zod_compat_js_1.getLiteralValue)(methodSchema);
       if (typeof methodValue !== "string") {
         throw new Error("Schema method literal must be a string");
       }
@@ -91141,7 +92071,7 @@ var require_server2 = __commonJS((exports) => {
   exports.Server = Server2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js
 var require_completable = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.McpZodTypeKind = exports.COMPLETABLE_SYMBOL = undefined;
@@ -91175,7 +92105,7 @@ var require_completable = __commonJS((exports) => {
   })(McpZodTypeKind2 || (exports.McpZodTypeKind = McpZodTypeKind2 = {}));
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/uriTemplate.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/uriTemplate.js
 var require_uriTemplate = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.UriTemplate = undefined;
@@ -91398,7 +92328,7 @@ var require_uriTemplate = __commonJS((exports) => {
   exports.UriTemplate = UriTemplate2;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/toolNameValidation.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/shared/toolNameValidation.js
 var require_toolNameValidation = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.validateToolName = validateToolName2;
@@ -91462,7 +92392,7 @@ var require_toolNameValidation = __commonJS((exports) => {
   }
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/mcp-server.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/experimental/tasks/mcp-server.js
 var require_mcp_server = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ExperimentalMcpServerTasks = undefined;
@@ -91530,7 +92460,7 @@ var require_zod = __commonJS((exports) => {
   exports.default = z;
 });
 
-// node_modules/.bun/@modelcontextprotocol+sdk@1.26.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
+// node_modules/.bun/@modelcontextprotocol+sdk@1.30.0/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js
 var require_mcp = __commonJS((exports) => {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.ResourceTemplate = exports.McpServer = undefined;
@@ -92127,6 +93057,9 @@ var require_mcp = __commonJS((exports) => {
             annotations = rest.shift();
           }
         } else if (typeof firstArg === "object" && firstArg !== null) {
+          if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+            throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+          }
           annotations = rest.shift();
         }
       }
@@ -92237,6 +93170,9 @@ var require_mcp = __commonJS((exports) => {
     if (isZodRawShapeCompat2(schema2)) {
       return (0, zod_compat_js_1.objectFromShape)(schema2);
     }
+    if (!isZodSchemaInstance2(schema2)) {
+      throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+    }
     return schema2;
   }
   function promptArgumentsFromSchema2(schema2) {
@@ -105197,10 +106133,10 @@ function serveStaticFile(filePath) {
   if (!existsSync16(filePath))
     return null;
   const ext = extname(filePath);
-  const contentType = MIME_TYPES[ext] || "application/octet-stream";
+  const contentType2 = MIME_TYPES[ext] || "application/octet-stream";
   return new Response(Bun.file(filePath), {
     headers: {
-      "Content-Type": contentType,
+      "Content-Type": contentType2,
       ...SECURITY_HEADERS
     }
   });