@introspection-ai/recipes 0.18.0 → 0.19.0

package/dist/mcp-chunks/chunk-P3PSC54P.js

@@ -1,869 +0,0 @@
-import { createRequire as __createRequire } from "node:module"; const require = __createRequire(import.meta.url);
-import {
-  LATEST_PROTOCOL_VERSION,
-  NEVER,
-  ZodIssueCode,
-  any,
-  array,
-  boolean,
-  coerce_exports,
-  literal,
-  looseObject,
-  number,
-  object,
-  string,
-  url
-} from "./chunk-D3MRAZ6H.js";
-
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth-utils.js
-function resourceUrlFromServerUrl(url2) {
-  const resourceURL = typeof url2 === "string" ? new URL(url2) : new URL(url2.href);
-  resourceURL.hash = "";
-  return resourceURL;
-}
-function checkResourceAllowed({ requestedResource, configuredResource }) {
-  const requested = typeof requestedResource === "string" ? new URL(requestedResource) : new URL(requestedResource.href);
-  const configured = typeof configuredResource === "string" ? new URL(configuredResource) : new URL(configuredResource.href);
-  if (requested.origin !== configured.origin) {
-    return false;
-  }
-  if (requested.pathname.length < configured.pathname.length) {
-    return false;
-  }
-  const requestedPath = requested.pathname.endsWith("/") ? requested.pathname : requested.pathname + "/";
-  const configuredPath = configured.pathname.endsWith("/") ? configured.pathname : configured.pathname + "/";
-  return requestedPath.startsWith(configuredPath);
-}
-
-// node_modules/.pnpm/pkce-challenge@5.0.1/node_modules/pkce-challenge/dist/index.node.js
-var crypto;
-crypto = globalThis.crypto?.webcrypto ?? // Node.js [18-16] REPL
-globalThis.crypto ?? // Node.js >18
-import("node:crypto").then((m) => m.webcrypto);
-async function getRandomValues(size) {
-  return (await crypto).getRandomValues(new Uint8Array(size));
-}
-async function random(size) {
-  const mask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~";
-  const evenDistCutoff = Math.pow(2, 8) - Math.pow(2, 8) % mask.length;
-  let result = "";
-  while (result.length < size) {
-    const randomBytes = await getRandomValues(size - result.length);
-    for (const randomByte of randomBytes) {
-      if (randomByte < evenDistCutoff) {
-        result += mask[randomByte % mask.length];
-      }
-    }
-  }
-  return result;
-}
-async function generateVerifier(length) {
-  return await random(length);
-}
-async function generateChallenge(code_verifier) {
-  const buffer = await (await crypto).subtle.digest("SHA-256", new TextEncoder().encode(code_verifier));
-  return btoa(String.fromCharCode(...new Uint8Array(buffer))).replace(/\//g, "_").replace(/\+/g, "-").replace(/=/g, "");
-}
-async function pkceChallenge(length) {
-  if (!length)
-    length = 43;
-  if (length < 43 || length > 128) {
-    throw `Expected a length between 43 and 128. Received ${length}.`;
-  }
-  const verifier = await generateVerifier(length);
-  const challenge = await generateChallenge(verifier);
-  return {
-    code_verifier: verifier,
-    code_challenge: challenge
-  };
-}
-
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/auth.js
-var SafeUrlSchema = url().superRefine((val, ctx) => {
-  if (!URL.canParse(val)) {
-    ctx.addIssue({
-      code: ZodIssueCode.custom,
-      message: "URL must be parseable",
-      fatal: true
-    });
-    return NEVER;
-  }
-}).refine((url2) => {
-  const u = new URL(url2);
-  return u.protocol !== "javascript:" && u.protocol !== "data:" && u.protocol !== "vbscript:";
-}, { message: "URL cannot use javascript:, data:, or vbscript: scheme" });
-var OAuthProtectedResourceMetadataSchema = looseObject({
-  resource: string().url(),
-  authorization_servers: array(SafeUrlSchema).optional(),
-  jwks_uri: string().url().optional(),
-  scopes_supported: array(string()).optional(),
-  bearer_methods_supported: array(string()).optional(),
-  resource_signing_alg_values_supported: array(string()).optional(),
-  resource_name: string().optional(),
-  resource_documentation: string().optional(),
-  resource_policy_uri: string().url().optional(),
-  resource_tos_uri: string().url().optional(),
-  tls_client_certificate_bound_access_tokens: boolean().optional(),
-  authorization_details_types_supported: array(string()).optional(),
-  dpop_signing_alg_values_supported: array(string()).optional(),
-  dpop_bound_access_tokens_required: boolean().optional()
-});
-var OAuthMetadataSchema = looseObject({
-  issuer: string(),
-  authorization_endpoint: SafeUrlSchema,
-  token_endpoint: SafeUrlSchema,
-  registration_endpoint: SafeUrlSchema.optional(),
-  scopes_supported: array(string()).optional(),
-  response_types_supported: array(string()),
-  response_modes_supported: array(string()).optional(),
-  grant_types_supported: array(string()).optional(),
-  token_endpoint_auth_methods_supported: array(string()).optional(),
-  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
-  service_documentation: SafeUrlSchema.optional(),
-  revocation_endpoint: SafeUrlSchema.optional(),
-  revocation_endpoint_auth_methods_supported: array(string()).optional(),
-  revocation_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
-  introspection_endpoint: string().optional(),
-  introspection_endpoint_auth_methods_supported: array(string()).optional(),
-  introspection_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
-  code_challenge_methods_supported: array(string()).optional(),
-  client_id_metadata_document_supported: boolean().optional()
-});
-var OpenIdProviderMetadataSchema = looseObject({
-  issuer: string(),
-  authorization_endpoint: SafeUrlSchema,
-  token_endpoint: SafeUrlSchema,
-  userinfo_endpoint: SafeUrlSchema.optional(),
-  jwks_uri: SafeUrlSchema,
-  registration_endpoint: SafeUrlSchema.optional(),
-  scopes_supported: array(string()).optional(),
-  response_types_supported: array(string()),
-  response_modes_supported: array(string()).optional(),
-  grant_types_supported: array(string()).optional(),
-  acr_values_supported: array(string()).optional(),
-  subject_types_supported: array(string()),
-  id_token_signing_alg_values_supported: array(string()),
-  id_token_encryption_alg_values_supported: array(string()).optional(),
-  id_token_encryption_enc_values_supported: array(string()).optional(),
-  userinfo_signing_alg_values_supported: array(string()).optional(),
-  userinfo_encryption_alg_values_supported: array(string()).optional(),
-  userinfo_encryption_enc_values_supported: array(string()).optional(),
-  request_object_signing_alg_values_supported: array(string()).optional(),
-  request_object_encryption_alg_values_supported: array(string()).optional(),
-  request_object_encryption_enc_values_supported: array(string()).optional(),
-  token_endpoint_auth_methods_supported: array(string()).optional(),
-  token_endpoint_auth_signing_alg_values_supported: array(string()).optional(),
-  display_values_supported: array(string()).optional(),
-  claim_types_supported: array(string()).optional(),
-  claims_supported: array(string()).optional(),
-  service_documentation: string().optional(),
-  claims_locales_supported: array(string()).optional(),
-  ui_locales_supported: array(string()).optional(),
-  claims_parameter_supported: boolean().optional(),
-  request_parameter_supported: boolean().optional(),
-  request_uri_parameter_supported: boolean().optional(),
-  require_request_uri_registration: boolean().optional(),
-  op_policy_uri: SafeUrlSchema.optional(),
-  op_tos_uri: SafeUrlSchema.optional(),
-  client_id_metadata_document_supported: boolean().optional()
-});
-var OpenIdProviderDiscoveryMetadataSchema = object({
-  ...OpenIdProviderMetadataSchema.shape,
-  ...OAuthMetadataSchema.pick({
-    code_challenge_methods_supported: true
-  }).shape
-});
-var OAuthTokensSchema = object({
-  access_token: string(),
-  id_token: string().optional(),
-  // Optional for OAuth 2.1, but necessary in OpenID Connect
-  token_type: string(),
-  expires_in: coerce_exports.number().optional(),
-  scope: string().optional(),
-  refresh_token: string().optional()
-}).strip();
-var OAuthErrorResponseSchema = object({
-  error: string(),
-  error_description: string().optional(),
-  error_uri: string().optional()
-});
-var OptionalSafeUrlSchema = SafeUrlSchema.optional().or(literal("").transform(() => void 0));
-var OAuthClientMetadataSchema = object({
-  redirect_uris: array(SafeUrlSchema),
-  token_endpoint_auth_method: string().optional(),
-  grant_types: array(string()).optional(),
-  response_types: array(string()).optional(),
-  client_name: string().optional(),
-  client_uri: SafeUrlSchema.optional(),
-  logo_uri: OptionalSafeUrlSchema,
-  scope: string().optional(),
-  contacts: array(string()).optional(),
-  tos_uri: OptionalSafeUrlSchema,
-  policy_uri: string().optional(),
-  jwks_uri: SafeUrlSchema.optional(),
-  jwks: any().optional(),
-  software_id: string().optional(),
-  software_version: string().optional(),
-  software_statement: string().optional()
-}).strip();
-var OAuthClientInformationSchema = object({
-  client_id: string(),
-  client_secret: string().optional(),
-  client_id_issued_at: number().optional(),
-  client_secret_expires_at: number().optional()
-}).strip();
-var OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
-var OAuthClientRegistrationErrorSchema = object({
-  error: string(),
-  error_description: string().optional()
-}).strip();
-var OAuthTokenRevocationRequestSchema = object({
-  token: string(),
-  token_type_hint: string().optional()
-}).strip();
-
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/server/auth/errors.js
-var OAuthError = class extends Error {
-  constructor(message, errorUri) {
-    super(message);
-    this.errorUri = errorUri;
-    this.name = this.constructor.name;
-  }
-  /**
-   * Converts the error to a standard OAuth error response object
-   */
-  toResponseObject() {
-    const response = {
-      error: this.errorCode,
-      error_description: this.message
-    };
-    if (this.errorUri) {
-      response.error_uri = this.errorUri;
-    }
-    return response;
-  }
-  get errorCode() {
-    return this.constructor.errorCode;
-  }
-};
-var InvalidRequestError = class extends OAuthError {
-};
-InvalidRequestError.errorCode = "invalid_request";
-var InvalidClientError = class extends OAuthError {
-};
-InvalidClientError.errorCode = "invalid_client";
-var InvalidGrantError = class extends OAuthError {
-};
-InvalidGrantError.errorCode = "invalid_grant";
-var UnauthorizedClientError = class extends OAuthError {
-};
-UnauthorizedClientError.errorCode = "unauthorized_client";
-var UnsupportedGrantTypeError = class extends OAuthError {
-};
-UnsupportedGrantTypeError.errorCode = "unsupported_grant_type";
-var InvalidScopeError = class extends OAuthError {
-};
-InvalidScopeError.errorCode = "invalid_scope";
-var AccessDeniedError = class extends OAuthError {
-};
-AccessDeniedError.errorCode = "access_denied";
-var ServerError = class extends OAuthError {
-};
-ServerError.errorCode = "server_error";
-var TemporarilyUnavailableError = class extends OAuthError {
-};
-TemporarilyUnavailableError.errorCode = "temporarily_unavailable";
-var UnsupportedResponseTypeError = class extends OAuthError {
-};
-UnsupportedResponseTypeError.errorCode = "unsupported_response_type";
-var UnsupportedTokenTypeError = class extends OAuthError {
-};
-UnsupportedTokenTypeError.errorCode = "unsupported_token_type";
-var InvalidTokenError = class extends OAuthError {
-};
-InvalidTokenError.errorCode = "invalid_token";
-var MethodNotAllowedError = class extends OAuthError {
-};
-MethodNotAllowedError.errorCode = "method_not_allowed";
-var TooManyRequestsError = class extends OAuthError {
-};
-TooManyRequestsError.errorCode = "too_many_requests";
-var InvalidClientMetadataError = class extends OAuthError {
-};
-InvalidClientMetadataError.errorCode = "invalid_client_metadata";
-var InsufficientScopeError = class extends OAuthError {
-};
-InsufficientScopeError.errorCode = "insufficient_scope";
-var InvalidTargetError = class extends OAuthError {
-};
-InvalidTargetError.errorCode = "invalid_target";
-var OAUTH_ERRORS = {
-  [InvalidRequestError.errorCode]: InvalidRequestError,
-  [InvalidClientError.errorCode]: InvalidClientError,
-  [InvalidGrantError.errorCode]: InvalidGrantError,
-  [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
-  [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
-  [InvalidScopeError.errorCode]: InvalidScopeError,
-  [AccessDeniedError.errorCode]: AccessDeniedError,
-  [ServerError.errorCode]: ServerError,
-  [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
-  [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
-  [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
-  [InvalidTokenError.errorCode]: InvalidTokenError,
-  [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
-  [TooManyRequestsError.errorCode]: TooManyRequestsError,
-  [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
-  [InsufficientScopeError.errorCode]: InsufficientScopeError,
-  [InvalidTargetError.errorCode]: InvalidTargetError
-};
-
-// node_modules/.pnpm/@modelcontextprotocol+sdk@1.29.0_zod@4.4.3/node_modules/@modelcontextprotocol/sdk/dist/esm/client/auth.js
-var UnauthorizedError = class extends Error {
-  constructor(message) {
-    super(message ?? "Unauthorized");
-  }
-};
-function isClientAuthMethod(method) {
-  return ["client_secret_basic", "client_secret_post", "none"].includes(method);
-}
-var AUTHORIZATION_CODE_RESPONSE_TYPE = "code";
-var AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
-function selectClientAuthMethod(clientInformation, supportedMethods) {
-  const hasClientSecret = clientInformation.client_secret !== void 0;
-  if ("token_endpoint_auth_method" in clientInformation && clientInformation.token_endpoint_auth_method && isClientAuthMethod(clientInformation.token_endpoint_auth_method) && (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
-    return clientInformation.token_endpoint_auth_method;
-  }
-  if (supportedMethods.length === 0) {
-    return hasClientSecret ? "client_secret_basic" : "none";
-  }
-  if (hasClientSecret && supportedMethods.includes("client_secret_basic")) {
-    return "client_secret_basic";
-  }
-  if (hasClientSecret && supportedMethods.includes("client_secret_post")) {
-    return "client_secret_post";
-  }
-  if (supportedMethods.includes("none")) {
-    return "none";
-  }
-  return hasClientSecret ? "client_secret_post" : "none";
-}
-function applyClientAuthentication(method, clientInformation, headers, params) {
-  const { client_id, client_secret } = clientInformation;
-  switch (method) {
-    case "client_secret_basic":
-      applyBasicAuth(client_id, client_secret, headers);
-      return;
-    case "client_secret_post":
-      applyPostAuth(client_id, client_secret, params);
-      return;
-    case "none":
-      applyPublicAuth(client_id, params);
-      return;
-    default:
-      throw new Error(`Unsupported client authentication method: ${method}`);
-  }
-}
-function applyBasicAuth(clientId, clientSecret, headers) {
-  if (!clientSecret) {
-    throw new Error("client_secret_basic authentication requires a client_secret");
-  }
-  const credentials = btoa(`${clientId}:${clientSecret}`);
-  headers.set("Authorization", `Basic ${credentials}`);
-}
-function applyPostAuth(clientId, clientSecret, params) {
-  params.set("client_id", clientId);
-  if (clientSecret) {
-    params.set("client_secret", clientSecret);
-  }
-}
-function applyPublicAuth(clientId, params) {
-  params.set("client_id", clientId);
-}
-async function parseErrorResponse(input) {
-  const statusCode = input instanceof Response ? input.status : void 0;
-  const body = input instanceof Response ? await input.text() : input;
-  try {
-    const result = OAuthErrorResponseSchema.parse(JSON.parse(body));
-    const { error, error_description, error_uri } = result;
-    const errorClass = OAUTH_ERRORS[error] || ServerError;
-    return new errorClass(error_description || "", error_uri);
-  } catch (error) {
-    const errorMessage = `${statusCode ? `HTTP ${statusCode}: ` : ""}Invalid OAuth error response: ${error}. Raw body: ${body}`;
-    return new ServerError(errorMessage);
-  }
-}
-async function auth(provider, options) {
-  try {
-    return await authInternal(provider, options);
-  } catch (error) {
-    if (error instanceof InvalidClientError || error instanceof UnauthorizedClientError) {
-      await provider.invalidateCredentials?.("all");
-      return await authInternal(provider, options);
-    } else if (error instanceof InvalidGrantError) {
-      await provider.invalidateCredentials?.("tokens");
-      return await authInternal(provider, options);
-    }
-    throw error;
-  }
-}
-async function authInternal(provider, { serverUrl, authorizationCode, scope, resourceMetadataUrl, fetchFn }) {
-  const cachedState = await provider.discoveryState?.();
-  let resourceMetadata;
-  let authorizationServerUrl;
-  let metadata;
-  let effectiveResourceMetadataUrl = resourceMetadataUrl;
-  if (!effectiveResourceMetadataUrl && cachedState?.resourceMetadataUrl) {
-    effectiveResourceMetadataUrl = new URL(cachedState.resourceMetadataUrl);
-  }
-  if (cachedState?.authorizationServerUrl) {
-    authorizationServerUrl = cachedState.authorizationServerUrl;
-    resourceMetadata = cachedState.resourceMetadata;
-    metadata = cachedState.authorizationServerMetadata ?? await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn });
-    if (!resourceMetadata) {
-      try {
-        resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl }, fetchFn);
-      } catch {
-      }
-    }
-    if (metadata !== cachedState.authorizationServerMetadata || resourceMetadata !== cachedState.resourceMetadata) {
-      await provider.saveDiscoveryState?.({
-        authorizationServerUrl: String(authorizationServerUrl),
-        resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-        resourceMetadata,
-        authorizationServerMetadata: metadata
-      });
-    }
-  } else {
-    const serverInfo = await discoverOAuthServerInfo(serverUrl, { resourceMetadataUrl: effectiveResourceMetadataUrl, fetchFn });
-    authorizationServerUrl = serverInfo.authorizationServerUrl;
-    metadata = serverInfo.authorizationServerMetadata;
-    resourceMetadata = serverInfo.resourceMetadata;
-    await provider.saveDiscoveryState?.({
-      authorizationServerUrl: String(authorizationServerUrl),
-      resourceMetadataUrl: effectiveResourceMetadataUrl?.toString(),
-      resourceMetadata,
-      authorizationServerMetadata: metadata
-    });
-  }
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(" ") || provider.clientMetadata.scope;
-  let clientInformation = await Promise.resolve(provider.clientInformation());
-  if (!clientInformation) {
-    if (authorizationCode !== void 0) {
-      throw new Error("Existing OAuth client information is required when exchanging an authorization code");
-    }
-    const supportsUrlBasedClientId = metadata?.client_id_metadata_document_supported === true;
-    const clientMetadataUrl = provider.clientMetadataUrl;
-    if (clientMetadataUrl && !isHttpsUrl(clientMetadataUrl)) {
-      throw new InvalidClientMetadataError(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${clientMetadataUrl}`);
-    }
-    const shouldUseUrlBasedClientId = supportsUrlBasedClientId && clientMetadataUrl;
-    if (shouldUseUrlBasedClientId) {
-      clientInformation = {
-        client_id: clientMetadataUrl
-      };
-      await provider.saveClientInformation?.(clientInformation);
-    } else {
-      if (!provider.saveClientInformation) {
-        throw new Error("OAuth client information must be saveable for dynamic registration");
-      }
-      const fullInformation = await registerClient(authorizationServerUrl, {
-        metadata,
-        clientMetadata: provider.clientMetadata,
-        scope: resolvedScope,
-        fetchFn
-      });
-      await provider.saveClientInformation(fullInformation);
-      clientInformation = fullInformation;
-    }
-  }
-  const nonInteractiveFlow = !provider.redirectUrl;
-  if (authorizationCode !== void 0 || nonInteractiveFlow) {
-    const tokens2 = await fetchToken(provider, authorizationServerUrl, {
-      metadata,
-      resource,
-      authorizationCode,
-      fetchFn
-    });
-    await provider.saveTokens(tokens2);
-    return "AUTHORIZED";
-  }
-  const tokens = await provider.tokens();
-  if (tokens?.refresh_token) {
-    try {
-      const newTokens = await refreshAuthorization(authorizationServerUrl, {
-        metadata,
-        clientInformation,
-        refreshToken: tokens.refresh_token,
-        resource,
-        addClientAuthentication: provider.addClientAuthentication,
-        fetchFn
-      });
-      await provider.saveTokens(newTokens);
-      return "AUTHORIZED";
-    } catch (error) {
-      if (!(error instanceof OAuthError) || error instanceof ServerError) {
-      } else {
-        throw error;
-      }
-    }
-  }
-  const state = provider.state ? await provider.state() : void 0;
-  const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
-    metadata,
-    clientInformation,
-    state,
-    redirectUrl: provider.redirectUrl,
-    scope: resolvedScope,
-    resource
-  });
-  await provider.saveCodeVerifier(codeVerifier);
-  await provider.redirectToAuthorization(authorizationUrl);
-  return "REDIRECT";
-}
-function isHttpsUrl(value) {
-  if (!value)
-    return false;
-  try {
-    const url2 = new URL(value);
-    return url2.protocol === "https:" && url2.pathname !== "/";
-  } catch {
-    return false;
-  }
-}
-async function selectResourceURL(serverUrl, provider, resourceMetadata) {
-  const defaultResource = resourceUrlFromServerUrl(serverUrl);
-  if (provider.validateResourceURL) {
-    return await provider.validateResourceURL(defaultResource, resourceMetadata?.resource);
-  }
-  if (!resourceMetadata) {
-    return void 0;
-  }
-  if (!checkResourceAllowed({ requestedResource: defaultResource, configuredResource: resourceMetadata.resource })) {
-    throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${defaultResource} (or origin)`);
-  }
-  return new URL(resourceMetadata.resource);
-}
-function extractWWWAuthenticateParams(res) {
-  const authenticateHeader = res.headers.get("WWW-Authenticate");
-  if (!authenticateHeader) {
-    return {};
-  }
-  const [type, scheme] = authenticateHeader.split(" ");
-  if (type.toLowerCase() !== "bearer" || !scheme) {
-    return {};
-  }
-  const resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0;
-  let resourceMetadataUrl;
-  if (resourceMetadataMatch) {
-    try {
-      resourceMetadataUrl = new URL(resourceMetadataMatch);
-    } catch {
-    }
-  }
-  const scope = extractFieldFromWwwAuth(res, "scope") || void 0;
-  const error = extractFieldFromWwwAuth(res, "error") || void 0;
-  return {
-    resourceMetadataUrl,
-    scope,
-    error
-  };
-}
-function extractFieldFromWwwAuth(response, fieldName) {
-  const wwwAuthHeader = response.headers.get("WWW-Authenticate");
-  if (!wwwAuthHeader) {
-    return null;
-  }
-  const pattern = new RegExp(`${fieldName}=(?:"([^"]+)"|([^\\s,]+))`);
-  const match = wwwAuthHeader.match(pattern);
-  if (match) {
-    return match[1] || match[2];
-  }
-  return null;
-}
-async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn = fetch) {
-  const response = await discoverMetadataWithFallback(serverUrl, "oauth-protected-resource", fetchFn, {
-    protocolVersion: opts?.protocolVersion,
-    metadataUrl: opts?.resourceMetadataUrl
-  });
-  if (!response || response.status === 404) {
-    await response?.body?.cancel();
-    throw new Error(`Resource server does not implement OAuth 2.0 Protected Resource Metadata.`);
-  }
-  if (!response.ok) {
-    await response.body?.cancel();
-    throw new Error(`HTTP ${response.status} trying to load well-known OAuth protected resource metadata.`);
-  }
-  return OAuthProtectedResourceMetadataSchema.parse(await response.json());
-}
-async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
-  try {
-    return await fetchFn(url2, { headers });
-  } catch (error) {
-    if (error instanceof TypeError) {
-      if (headers) {
-        return fetchWithCorsRetry(url2, void 0, fetchFn);
-      } else {
-        return void 0;
-      }
-    }
-    throw error;
-  }
-}
-function buildWellKnownPath(wellKnownPrefix, pathname = "", options = {}) {
-  if (pathname.endsWith("/")) {
-    pathname = pathname.slice(0, -1);
-  }
-  return options.prependPathname ? `${pathname}/.well-known/${wellKnownPrefix}` : `/.well-known/${wellKnownPrefix}${pathname}`;
-}
-async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
-  const headers = {
-    "MCP-Protocol-Version": protocolVersion
-  };
-  return await fetchWithCorsRetry(url2, headers, fetchFn);
-}
-function shouldAttemptFallback(response, pathname) {
-  return !response || response.status >= 400 && response.status < 500 && pathname !== "/";
-}
-async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
-  const issuer = new URL(serverUrl);
-  const protocolVersion = opts?.protocolVersion ?? LATEST_PROTOCOL_VERSION;
-  let url2;
-  if (opts?.metadataUrl) {
-    url2 = new URL(opts.metadataUrl);
-  } else {
-    const wellKnownPath = buildWellKnownPath(wellKnownType, issuer.pathname);
-    url2 = new URL(wellKnownPath, opts?.metadataServerUrl ?? issuer);
-    url2.search = issuer.search;
-  }
-  let response = await tryMetadataDiscovery(url2, protocolVersion, fetchFn);
-  if (!opts?.metadataUrl && shouldAttemptFallback(response, issuer.pathname)) {
-    const rootUrl = new URL(`/.well-known/${wellKnownType}`, issuer);
-    response = await tryMetadataDiscovery(rootUrl, protocolVersion, fetchFn);
-  }
-  return response;
-}
-function buildDiscoveryUrls(authorizationServerUrl) {
-  const url2 = typeof authorizationServerUrl === "string" ? new URL(authorizationServerUrl) : authorizationServerUrl;
-  const hasPath = url2.pathname !== "/";
-  const urlsToTry = [];
-  if (!hasPath) {
-    urlsToTry.push({
-      url: new URL("/.well-known/oauth-authorization-server", url2.origin),
-      type: "oauth"
-    });
-    urlsToTry.push({
-      url: new URL(`/.well-known/openid-configuration`, url2.origin),
-      type: "oidc"
-    });
-    return urlsToTry;
-  }
-  let pathname = url2.pathname;
-  if (pathname.endsWith("/")) {
-    pathname = pathname.slice(0, -1);
-  }
-  urlsToTry.push({
-    url: new URL(`/.well-known/oauth-authorization-server${pathname}`, url2.origin),
-    type: "oauth"
-  });
-  urlsToTry.push({
-    url: new URL(`/.well-known/openid-configuration${pathname}`, url2.origin),
-    type: "oidc"
-  });
-  urlsToTry.push({
-    url: new URL(`${pathname}/.well-known/openid-configuration`, url2.origin),
-    type: "oidc"
-  });
-  return urlsToTry;
-}
-async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn = fetch, protocolVersion = LATEST_PROTOCOL_VERSION } = {}) {
-  const headers = {
-    "MCP-Protocol-Version": protocolVersion,
-    Accept: "application/json"
-  };
-  const urlsToTry = buildDiscoveryUrls(authorizationServerUrl);
-  for (const { url: endpointUrl, type } of urlsToTry) {
-    const response = await fetchWithCorsRetry(endpointUrl, headers, fetchFn);
-    if (!response) {
-      continue;
-    }
-    if (!response.ok) {
-      await response.body?.cancel();
-      if (response.status >= 400 && response.status < 500) {
-        continue;
-      }
-      throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
-    }
-    if (type === "oauth") {
-      return OAuthMetadataSchema.parse(await response.json());
-    } else {
-      return OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
-    }
-  }
-  return void 0;
-}
-async function discoverOAuthServerInfo(serverUrl, opts) {
-  let resourceMetadata;
-  let authorizationServerUrl;
-  try {
-    resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, { resourceMetadataUrl: opts?.resourceMetadataUrl }, opts?.fetchFn);
-    if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
-      authorizationServerUrl = resourceMetadata.authorization_servers[0];
-    }
-  } catch {
-  }
-  if (!authorizationServerUrl) {
-    authorizationServerUrl = String(new URL("/", serverUrl));
-  }
-  const authorizationServerMetadata = await discoverAuthorizationServerMetadata(authorizationServerUrl, { fetchFn: opts?.fetchFn });
-  return {
-    authorizationServerUrl,
-    authorizationServerMetadata,
-    resourceMetadata
-  };
-}
-async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
-  let authorizationUrl;
-  if (metadata) {
-    authorizationUrl = new URL(metadata.authorization_endpoint);
-    if (!metadata.response_types_supported.includes(AUTHORIZATION_CODE_RESPONSE_TYPE)) {
-      throw new Error(`Incompatible auth server: does not support response type ${AUTHORIZATION_CODE_RESPONSE_TYPE}`);
-    }
-    if (metadata.code_challenge_methods_supported && !metadata.code_challenge_methods_supported.includes(AUTHORIZATION_CODE_CHALLENGE_METHOD)) {
-      throw new Error(`Incompatible auth server: does not support code challenge method ${AUTHORIZATION_CODE_CHALLENGE_METHOD}`);
-    }
-  } else {
-    authorizationUrl = new URL("/authorize", authorizationServerUrl);
-  }
-  const challenge = await pkceChallenge();
-  const codeVerifier = challenge.code_verifier;
-  const codeChallenge = challenge.code_challenge;
-  authorizationUrl.searchParams.set("response_type", AUTHORIZATION_CODE_RESPONSE_TYPE);
-  authorizationUrl.searchParams.set("client_id", clientInformation.client_id);
-  authorizationUrl.searchParams.set("code_challenge", codeChallenge);
-  authorizationUrl.searchParams.set("code_challenge_method", AUTHORIZATION_CODE_CHALLENGE_METHOD);
-  authorizationUrl.searchParams.set("redirect_uri", String(redirectUrl));
-  if (state) {
-    authorizationUrl.searchParams.set("state", state);
-  }
-  if (scope) {
-    authorizationUrl.searchParams.set("scope", scope);
-  }
-  if (scope?.includes("offline_access")) {
-    authorizationUrl.searchParams.append("prompt", "consent");
-  }
-  if (resource) {
-    authorizationUrl.searchParams.set("resource", resource.href);
-  }
-  return { authorizationUrl, codeVerifier };
-}
-function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redirectUri) {
-  return new URLSearchParams({
-    grant_type: "authorization_code",
-    code: authorizationCode,
-    code_verifier: codeVerifier,
-    redirect_uri: String(redirectUri)
-  });
-}
-async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
-  const tokenUrl = metadata?.token_endpoint ? new URL(metadata.token_endpoint) : new URL("/token", authorizationServerUrl);
-  const headers = new Headers({
-    "Content-Type": "application/x-www-form-urlencoded",
-    Accept: "application/json"
-  });
-  if (resource) {
-    tokenRequestParams.set("resource", resource.href);
-  }
-  if (addClientAuthentication) {
-    await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
-  } else if (clientInformation) {
-    const supportedMethods = metadata?.token_endpoint_auth_methods_supported ?? [];
-    const authMethod = selectClientAuthMethod(clientInformation, supportedMethods);
-    applyClientAuthentication(authMethod, clientInformation, headers, tokenRequestParams);
-  }
-  const response = await (fetchFn ?? fetch)(tokenUrl, {
-    method: "POST",
-    headers,
-    body: tokenRequestParams
-  });
-  if (!response.ok) {
-    throw await parseErrorResponse(response);
-  }
-  return OAuthTokensSchema.parse(await response.json());
-}
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
-  const tokenRequestParams = new URLSearchParams({
-    grant_type: "refresh_token",
-    refresh_token: refreshToken
-  });
-  const tokens = await executeTokenRequest(authorizationServerUrl, {
-    metadata,
-    tokenRequestParams,
-    clientInformation,
-    addClientAuthentication,
-    resource,
-    fetchFn
-  });
-  return { refresh_token: refreshToken, ...tokens };
-}
-async function fetchToken(provider, authorizationServerUrl, { metadata, resource, authorizationCode, fetchFn } = {}) {
-  const scope = provider.clientMetadata.scope;
-  let tokenRequestParams;
-  if (provider.prepareTokenRequest) {
-    tokenRequestParams = await provider.prepareTokenRequest(scope);
-  }
-  if (!tokenRequestParams) {
-    if (!authorizationCode) {
-      throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");
-    }
-    if (!provider.redirectUrl) {
-      throw new Error("redirectUrl is required for authorization_code flow");
-    }
-    const codeVerifier = await provider.codeVerifier();
-    tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, provider.redirectUrl);
-  }
-  const clientInformation = await provider.clientInformation();
-  return executeTokenRequest(authorizationServerUrl, {
-    metadata,
-    tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
-    addClientAuthentication: provider.addClientAuthentication,
-    resource,
-    fetchFn
-  });
-}
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
-  let registrationUrl;
-  if (metadata) {
-    if (!metadata.registration_endpoint) {
-      throw new Error("Incompatible auth server: does not support dynamic client registration");
-    }
-    registrationUrl = new URL(metadata.registration_endpoint);
-  } else {
-    registrationUrl = new URL("/register", authorizationServerUrl);
-  }
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify({
-      ...clientMetadata,
-      ...scope !== void 0 ? { scope } : {}
-    })
-  });
-  if (!response.ok) {
-    throw await parseErrorResponse(response);
-  }
-  return OAuthClientInformationFullSchema.parse(await response.json());
-}
-
-export {
-  resourceUrlFromServerUrl,
-  checkResourceAllowed,
-  UnauthorizedError,
-  auth,
-  extractWWWAuthenticateParams,
-  discoverOAuthServerInfo,
-  refreshAuthorization
-};