@lightsage/mcp 0.4.13 → 0.4.15

package/bin/mcp-server.js

@@ -385,6 +385,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a;
   for (let i = start;i < issues.length; i++) {
@@ -1453,7 +1465,7 @@ var init_versions = __esm(() => {
   version2 = {
     major: 4,
     minor: 6,
-    patch: 5
+    patch: 7
   };
 });
 
@@ -1579,6 +1591,28 @@ function isValidJWT(token, algorithm = null) {
     return false;
   }
 }
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse(payload, ctx);
+  };
+}
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -1884,7 +1918,7 @@ function handleRefineResult(result, payload, input, inst) {
     payload.issues.push(issue(_iss));
   }
 }
-var $ZodType, toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value }, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT = 1, URL_UNPARSEABLE = 2, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodDiscriminatedUnion, $ZodIntersection, $ZodRecord, $ZodEnum, $ZodLiteral, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodCatch, $ZodPipe, $ZodPreprocess, $ZodReadonly, $ZodLazy, $ZodCustom;
+var $ZodType, toStandardResult = (r, ctx) => r.issues.length ? { issues: r.issues.map((iss) => finalizeIssue(iss, ctx, config())) } : { value: r.value }, $ZodString, $ZodStringFormat, $ZodGUID, $ZodUUID, $ZodEmail, URL_BAD_FORMAT = 1, URL_UNPARSEABLE = 2, asciiTabOrNewline, $ZodURL, $ZodEmoji, $ZodNanoID, $ZodCUID, $ZodCUID2, $ZodULID, $ZodXID, $ZodKSUID, $ZodISODateTime, $ZodISODate, $ZodISOTime, $ZodISODuration, $ZodIPv4, ipv6Alphabet, $ZodIPv6, $ZodCIDRv4, $ZodCIDRv6, base64Charset, $ZodBase64, base64urlCharset, $ZodBase64URL, $ZodE164, $ZodJWT, $ZodNumber, $ZodNumberFormat, $ZodBoolean, $ZodNull, $ZodAny, $ZodUnknown, $ZodNever, arraySize = (input) => Array.isArray(input) ? input.length : -1, $ZodArray, NO_SYMBOL_KEYS, $ZodObject, $ZodObjectJIT, $ZodUnion, $ZodDiscriminatedUnion, $ZodIntersection, $ZodRecord, $ZodEnum, $ZodLiteral, $ZodTransform, $ZodOptional, $ZodExactOptional, $ZodNullable, $ZodDefault, $ZodPrefault, $ZodNonOptional, $ZodCatch, $ZodPipe, $ZodPreprocess, $ZodReadonly, $ZodLazy, $ZodCustom;
 var init_schemas = __esm(() => {
   init_checks();
   init_core();
@@ -2374,6 +2408,7 @@ var init_schemas = __esm(() => {
       }
       return payload;
     };
+    capSize(inst, arraySize);
   });
   NO_SYMBOL_KEYS = [];
   $ZodObject = /* @__PURE__ */ $constructor("$ZodObject", (inst, def) => {
@@ -7062,6 +7097,161 @@ var init_dist = __esm(() => {
   MAX_DRAIN_BYTES = 64 * 1024 * 1024;
 });
 
+// node_modules/content-type/index.js
+function parse5(string) {
+  if (!string) {
+    throw new TypeError("argument string is required");
+  }
+  var header = typeof string === "object" ? getcontenttype(string) : string;
+  if (typeof header !== "string") {
+    throw new TypeError("argument string is required to be a string");
+  }
+  var index = header.indexOf(";");
+  var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
+  if (!TYPE_REGEXP.test(type)) {
+    throw new TypeError("invalid media type");
+  }
+  var obj = new ContentType(type.toLowerCase());
+  if (index !== -1) {
+    var key;
+    var match;
+    var value;
+    PARAM_REGEXP.lastIndex = index;
+    while (match = PARAM_REGEXP.exec(header)) {
+      if (match.index !== index) {
+        throw new TypeError("invalid parameter format");
+      }
+      index += match[0].length;
+      key = match[1].toLowerCase();
+      value = match[2];
+      if (value.charCodeAt(0) === 34) {
+        value = value.slice(1, -1);
+        if (value.indexOf("\\") !== -1) {
+          value = value.replace(QESC_REGEXP, "$1");
+        }
+      }
+      obj.parameters[key] = value;
+    }
+    if (index !== header.length) {
+      throw new TypeError("invalid parameter format");
+    }
+  }
+  return obj;
+}
+function getcontenttype(obj) {
+  var header;
+  if (typeof obj.getHeader === "function") {
+    header = obj.getHeader("content-type");
+  } else if (typeof obj.headers === "object") {
+    header = obj.headers && obj.headers["content-type"];
+  }
+  if (typeof header !== "string") {
+    throw new TypeError("content-type header is missing from object");
+  }
+  return header;
+}
+function ContentType(type) {
+  this.parameters = Object.create(null);
+  this.type = type;
+}
+var PARAM_REGEXP, QESC_REGEXP, TYPE_REGEXP, $parse;
+var init_content_type = __esm(() => {
+  /*!
+   * content-type
+   * Copyright(c) 2015 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
+  QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
+  TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  $parse = parse5;
+});
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js
+function mediaTypeEssence(header) {
+  if (!header) {
+    return;
+  }
+  try {
+    return $parse(header).type;
+  } catch {
+    const essence = (header.split(";", 1)[0] ?? "").trim().toLowerCase();
+    if (essence === "" || header.slice(essence.length).includes(",")) {
+      return;
+    }
+    return essence;
+  }
+}
+function isJsonContentType(header) {
+  if (header === "application/json") {
+    return true;
+  }
+  return mediaTypeEssence(header) === "application/json";
+}
+var init_mediaType = __esm(() => {
+  init_content_type();
+});
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/requestBody.js
+function requestBodyTooLargeMessage(maxBytes) {
+  return `Payload Too Large: Request body must not exceed ${maxBytes} bytes`;
+}
+function resolveMaxRequestBodySize(value) {
+  if (value === undefined) {
+    return DEFAULT_MAX_REQUEST_BODY_SIZE;
+  }
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
+    throw new RangeError(`maxRequestBodySize must be a positive number of bytes, got ${String(value)}`);
+  }
+  return value;
+}
+async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE) {
+  if (Number(request.headers.get("content-length")) > maxBytes) {
+    return { tooLarge: true };
+  }
+  if (request.body === null) {
+    return { tooLarge: false, text: "" };
+  }
+  const reader = request.body.getReader();
+  const decoder = new TextDecoder;
+  let received = 0;
+  let text = "";
+  try {
+    for (;; ) {
+      const { done, value } = await reader.read();
+      if (done) {
+        break;
+      }
+      received += value.byteLength;
+      if (received > maxBytes) {
+        return { tooLarge: true };
+      }
+      text += decoder.decode(value, { stream: true });
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  return { tooLarge: false, text: text + decoder.decode() };
+}
+var DEFAULT_MAX_REQUEST_BODY_SIZE, MAX_BATCH_SIZE = 100;
+var init_requestBody = __esm(() => {
+  DEFAULT_MAX_REQUEST_BODY_SIZE = 4 * 1024 * 1024;
+});
+
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/sseKeepAlive.js
+function armSseKeepAlive(intervalMs, onTick) {
+  if (!Number.isFinite(intervalMs) || intervalMs < 1) {
+    return;
+  }
+  const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+  timer.unref?.();
+  return timer;
+}
+var DEFAULT_SSE_KEEP_ALIVE_MS = 15000, MAX_TIMER_DELAY_MS;
+var init_sseKeepAlive = __esm(() => {
+  MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+});
+
 // node_modules/zod/v4/classic/index.js
 var init_classic = __esm(() => {
   init_external();
@@ -7091,7 +7281,7 @@ var init_types = __esm(() => {
   ProgressTokenSchema = union([string2(), number2().int()]);
   CursorSchema = string2();
   TaskCreationParamsSchema = looseObject({
-    ttl: union([number2(), _null3()]).optional(),
+    ttl: number2().optional(),
     pollInterval: number2().optional()
   });
   TaskMetadataSchema = object({
@@ -7239,7 +7429,8 @@ var init_types = __esm(() => {
     roots: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ClientTasksCapabilitySchema.optional()
+    tasks: ClientTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
     protocolVersion: string2(),
@@ -7264,7 +7455,8 @@ var init_types = __esm(() => {
     tools: object({
       listChanged: boolean2().optional()
     }).optional(),
-    tasks: ServerTasksCapabilitySchema.optional()
+    tasks: ServerTasksCapabilitySchema.optional(),
+    extensions: record(string2(), AssertObjectSchema).optional()
   });
   InitializeResultSchema = ResultSchema.extend({
     protocolVersion: string2(),
@@ -7379,6 +7571,7 @@ var init_types = __esm(() => {
     uri: string2(),
     description: optional(string2()),
     mimeType: optional(string2()),
+    size: optional(number2()),
     annotations: AnnotationsSchema.optional(),
     _meta: optional(looseObject({}))
   });
@@ -7914,10 +8107,12 @@ class WebStandardStreamableHTTPServerTransport {
     this._hasHandledRequest = false;
     this._streamMapping = new Map;
     this._requestToStreamMapping = new Map;
+    this._resumableStreams = new Set;
     this._requestResponseMap = new Map;
     this._initialized = false;
     this._enableJsonResponse = false;
     this._standaloneSseStreamId = "_GET_stream";
+    this._closed = false;
     this.sessionIdGenerator = options.sessionIdGenerator;
     this._enableJsonResponse = options.enableJsonResponse ?? false;
     this._eventStore = options.eventStore;
@@ -7927,6 +8122,23 @@ class WebStandardStreamableHTTPServerTransport {
     this._allowedOrigins = options.allowedOrigins;
     this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
     this._retryInterval = options.retryInterval;
+    this._keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
+    this._maxRequestBodySize = resolveMaxRequestBodySize(options.maxRequestBodySize);
+  }
+  startKeepAlive(controller, encoder) {
+    if (this._closed)
+      return;
+    const timer = armSseKeepAlive(this._keepAliveMs, () => {
+      try {
+        controller.enqueue(encoder.encode(`: keepalive
+
+`));
+      } catch {
+        if (timer !== undefined)
+          clearInterval(timer);
+      }
+    });
+    return timer;
   }
   async start() {
     if (this._started) {
@@ -7974,6 +8186,9 @@ class WebStandardStreamableHTTPServerTransport {
     return;
   }
   async handleRequest(req, options) {
+    if (this._closed) {
+      return this.createJsonErrorResponse(404, -32001, "Session not found");
+    }
     if (!this.sessionIdGenerator && this._hasHandledRequest) {
       throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
     }
@@ -8013,10 +8228,12 @@ data:
 `;
     }
     controller.enqueue(encoder.encode(primingEvent));
+    this._resumableStreams.add(streamId);
   }
   async handleGetRequest(req) {
     const acceptHeader = req.headers.get("accept");
     if (!acceptHeader?.includes("text/event-stream")) {
+      this.onerror?.(new Error("Not Acceptable: Client must accept text/event-stream"));
       return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept text/event-stream");
     }
     const sessionError = this.validateSession(req);
@@ -8034,22 +8251,30 @@ data:
       }
     }
     if (this._streamMapping.get(this._standaloneSseStreamId) !== undefined) {
+      this.onerror?.(new Error("Conflict: Only one SSE stream is allowed per session"));
       return this.createJsonErrorResponse(409, -32000, "Conflict: Only one SSE stream is allowed per session");
     }
     const encoder = new TextEncoder;
     let streamController;
+    let keepAliveTimer = undefined;
     const readable = new ReadableStream({
       start: (controller) => {
         streamController = controller;
       },
       cancel: () => {
-        this._streamMapping.delete(this._standaloneSseStreamId);
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
+        if (this._streamMapping.get(this._standaloneSseStreamId)?.controller === streamController) {
+          this._streamMapping.delete(this._standaloneSseStreamId);
+        }
       }
     });
     const headers = {
       "Content-Type": "text/event-stream",
       "Cache-Control": "no-cache, no-transform",
-      Connection: "keep-alive"
+      Connection: "keep-alive",
+      "X-Accel-Buffering": "no"
     };
     if (this.sessionId !== undefined) {
       headers["mcp-session-id"] = this.sessionId;
@@ -8058,16 +8283,21 @@ data:
       controller: streamController,
       encoder,
       cleanup: () => {
+        if (keepAliveTimer !== undefined) {
+          clearInterval(keepAliveTimer);
+        }
         this._streamMapping.delete(this._standaloneSseStreamId);
         try {
           streamController.close();
         } catch {}
       }
     });
+    keepAliveTimer = this.startKeepAlive(streamController, encoder);
     return new Response(readable, { headers });
   }
   async replayEvents(lastEventId) {
     if (!this._eventStore) {
+      this.onerror?.(new Error("Event store not configured"));
       return this.createJsonErrorResponse(400, -32000, "Event store not configured");
     }
     try {
@@ -8075,29 +8305,44 @@ data:
       if (this._eventStore.getStreamIdForEventId) {
         streamId = await this._eventStore.getStreamIdForEventId(lastEventId);
         if (!streamId) {
+          this.onerror?.(new Error("Invalid event ID format"));
           return this.createJsonErrorResponse(400, -32000, "Invalid event ID format");
         }
         if (this._streamMapping.get(streamId) !== undefined) {
+          this.onerror?.(new Error("Conflict: Stream already has an active connection"));
           return this.createJsonErrorResponse(409, -32000, "Conflict: Stream already has an active connection");
         }
       }
       const headers = {
         "Content-Type": "text/event-stream",
         "Cache-Control": "no-cache, no-transform",
-        Connection: "keep-alive"
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
+      let replayedStreamId = undefined;
+      let cancelled = false;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
-        cancel: () => {}
+        cancel: () => {
+          cancelled = true;
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (replayedStreamId !== undefined && this._streamMapping.get(replayedStreamId)?.controller === streamController) {
+            this._streamMapping.delete(replayedStreamId);
+          }
+        }
       });
-      const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+      const replayedEventIds = new Set;
+      replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
         send: async (eventId, message) => {
           const success = this.writeSSEEvent(streamController, encoder, message, eventId);
           if (!success) {
@@ -8105,19 +8350,34 @@ data:
             try {
               streamController.close();
             } catch {}
+          } else {
+            replayedEventIds.add(eventId);
           }
         }
       });
+      if (this._closed || cancelled) {
+        try {
+          streamController.close();
+        } catch {}
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
+      this._streamMapping.get(replayedStreamId)?.cleanup();
       this._streamMapping.set(replayedStreamId, {
         controller: streamController,
         encoder,
+        replayedEventIds,
         cleanup: () => {
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
           this._streamMapping.delete(replayedStreamId);
           try {
             streamController.close();
           } catch {}
         }
       });
+      this._resumableStreams.add(replayedStreamId);
+      keepAliveTimer = this.startKeepAlive(streamController, encoder);
       return new Response(readable, { headers });
     } catch (error) {
       this.onerror?.(error);
@@ -8137,11 +8397,13 @@ data:
 `;
       controller.enqueue(encoder.encode(eventData));
       return true;
-    } catch {
+    } catch (error) {
+      this.onerror?.(error);
       return false;
     }
   }
   handleUnsupportedRequest() {
+    this.onerror?.(new Error("Method not allowed."));
     return new Response(JSON.stringify({
       jsonrpc: "2.0",
       error: {
@@ -8161,25 +8423,39 @@ data:
     try {
       const acceptHeader = req.headers.get("accept");
       if (!acceptHeader?.includes("application/json") || !acceptHeader.includes("text/event-stream")) {
+        this.onerror?.(new Error("Not Acceptable: Client must accept both application/json and text/event-stream"));
         return this.createJsonErrorResponse(406, -32000, "Not Acceptable: Client must accept both application/json and text/event-stream");
       }
       const ct = req.headers.get("content-type");
-      if (!ct || !ct.includes("application/json")) {
+      if (!isJsonContentType(ct)) {
+        this.onerror?.(new Error("Unsupported Media Type: Content-Type must be application/json"));
         return this.createJsonErrorResponse(415, -32000, "Unsupported Media Type: Content-Type must be application/json");
       }
       const requestInfo = {
-        headers: Object.fromEntries(req.headers.entries())
+        headers: Object.fromEntries(req.headers.entries()),
+        url: new URL(req.url)
       };
       let rawMessage;
       if (options?.parsedBody !== undefined) {
         rawMessage = options.parsedBody;
       } else {
         try {
-          rawMessage = await req.json();
+          const body = await readRequestBody(req, this._maxRequestBodySize);
+          if (body.tooLarge) {
+            const message = requestBodyTooLargeMessage(this._maxRequestBodySize);
+            this.onerror?.(new Error(message));
+            return this.createJsonErrorResponse(413, -32000, message);
+          }
+          rawMessage = JSON.parse(body.text);
         } catch {
+          this.onerror?.(new Error("Parse error: Invalid JSON"));
           return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON");
         }
       }
+      if (Array.isArray(rawMessage) && rawMessage.length > MAX_BATCH_SIZE) {
+        this.onerror?.(new Error(`Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE} messages`));
+        return this.createJsonErrorResponse(400, -32600, `Invalid Request: Batch must not exceed ${MAX_BATCH_SIZE} messages`);
+      }
       let messages;
       try {
         if (Array.isArray(rawMessage)) {
@@ -8188,14 +8464,20 @@ data:
           messages = [JSONRPCMessageSchema.parse(rawMessage)];
         }
       } catch {
+        this.onerror?.(new Error("Parse error: Invalid JSON-RPC message"));
         return this.createJsonErrorResponse(400, -32700, "Parse error: Invalid JSON-RPC message");
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const isInitializationRequest = messages.some(isInitializeRequest);
       if (isInitializationRequest) {
         if (this._initialized && this.sessionId !== undefined) {
+          this.onerror?.(new Error("Invalid Request: Server already initialized"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Server already initialized");
         }
         if (messages.length > 1) {
+          this.onerror?.(new Error("Invalid Request: Only one initialization request is allowed"));
           return this.createJsonErrorResponse(400, -32600, "Invalid Request: Only one initialization request is allowed");
         }
         this.sessionId = this.sessionIdGenerator?.();
@@ -8214,6 +8496,9 @@ data:
           return protocolError;
         }
       }
+      if (this._closed) {
+        return this.createJsonErrorResponse(404, -32001, "Session not found");
+      }
       const hasRequests = messages.some(isJSONRPCRequest);
       if (!hasRequests) {
         for (const message of messages) {
@@ -8244,18 +8529,25 @@ data:
       }
       const encoder = new TextEncoder;
       let streamController;
+      let keepAliveTimer = undefined;
       const readable = new ReadableStream({
         start: (controller) => {
           streamController = controller;
         },
         cancel: () => {
-          this._streamMapping.delete(streamId);
+          if (keepAliveTimer !== undefined) {
+            clearInterval(keepAliveTimer);
+          }
+          if (this._streamMapping.get(streamId)?.controller === streamController) {
+            this._streamMapping.delete(streamId);
+          }
         }
       });
       const headers = {
         "Content-Type": "text/event-stream",
-        "Cache-Control": "no-cache",
-        Connection: "keep-alive"
+        "Cache-Control": "no-cache, no-transform",
+        Connection: "keep-alive",
+        "X-Accel-Buffering": "no"
       };
       if (this.sessionId !== undefined) {
         headers["mcp-session-id"] = this.sessionId;
@@ -8266,6 +8558,9 @@ data:
             controller: streamController,
             encoder,
             cleanup: () => {
+              if (keepAliveTimer !== undefined) {
+                clearInterval(keepAliveTimer);
+              }
               this._streamMapping.delete(streamId);
               try {
                 streamController.close();
@@ -8275,19 +8570,33 @@ data:
           this._requestToStreamMapping.set(message.id, streamId);
         }
       }
-      await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
-      for (const message of messages) {
-        let closeSSEStream;
-        let closeStandaloneSSEStream;
-        if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
-          closeSSEStream = () => {
-            this.closeSSEStream(message.id);
-          };
-          closeStandaloneSSEStream = () => {
-            this.closeStandaloneSSEStream();
-          };
+      try {
+        await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+        for (const message of messages) {
+          let closeSSEStream;
+          let closeStandaloneSSEStream;
+          if (isJSONRPCRequest(message) && this._eventStore && clientProtocolVersion >= "2025-11-25") {
+            closeSSEStream = () => {
+              this.closeSSEStream(message.id);
+            };
+            closeStandaloneSSEStream = () => {
+              this.closeStandaloneSSEStream();
+            };
+          }
+          this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
         }
-        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+      } catch (error) {
+        this._streamMapping.get(streamId)?.cleanup();
+        this._resumableStreams.delete(streamId);
+        for (const message of messages) {
+          if (isJSONRPCRequest(message)) {
+            this._requestToStreamMapping.delete(message.id);
+          }
+        }
+        throw error;
+      }
+      if (this._streamMapping.get(streamId)?.controller === streamController) {
+        keepAliveTimer = this.startKeepAlive(streamController, encoder);
       }
       return new Response(readable, { status: 200, headers });
     } catch (error) {
@@ -8304,22 +8613,28 @@ data:
     if (protocolError) {
       return protocolError;
     }
-    await Promise.resolve(this._onsessionclosed?.(this.sessionId));
-    await this.close();
-    return new Response(null, { status: 200 });
+    try {
+      await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+      return new Response(null, { status: 200 });
+    } finally {
+      await this.close();
+    }
   }
   validateSession(req) {
     if (this.sessionIdGenerator === undefined) {
       return;
     }
     if (!this._initialized) {
+      this.onerror?.(new Error("Bad Request: Server not initialized"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Server not initialized");
     }
     const sessionId = req.headers.get("mcp-session-id");
     if (!sessionId) {
+      this.onerror?.(new Error("Bad Request: Mcp-Session-Id header is required"));
       return this.createJsonErrorResponse(400, -32000, "Bad Request: Mcp-Session-Id header is required");
     }
     if (sessionId !== this.sessionId) {
+      this.onerror?.(new Error("Session not found"));
       return this.createJsonErrorResponse(404, -32001, "Session not found");
     }
     return;
@@ -8327,16 +8642,22 @@ data:
   validateProtocolVersion(req) {
     const protocolVersion = req.headers.get("mcp-protocol-version");
     if (protocolVersion !== null && !SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+      this.onerror?.(new Error(`Bad Request: Unsupported protocol version: ${protocolVersion}` + ` (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`));
       return this.createJsonErrorResponse(400, -32000, `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")})`);
     }
     return;
   }
   async close() {
+    if (this._closed) {
+      return;
+    }
+    this._closed = true;
     this._streamMapping.forEach(({ cleanup }) => {
       cleanup();
     });
     this._streamMapping.clear();
     this._requestResponseMap.clear();
+    this._resumableStreams.clear();
     this.onclose?.();
   }
   closeSSEStream(requestId) {
@@ -8371,7 +8692,7 @@ data:
       if (standaloneSse === undefined) {
         return;
       }
-      if (standaloneSse.controller && standaloneSse.encoder) {
+      if (standaloneSse.controller && standaloneSse.encoder && (eventId === undefined || !standaloneSse.replayedEventIds?.has(eventId))) {
         this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
       }
       return;
@@ -8380,13 +8701,19 @@ data:
     if (!streamId) {
       throw new Error(`No connection established for request ID: ${String(requestId)}`);
     }
-    const stream = this._streamMapping.get(streamId);
-    if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+    let stream = this._streamMapping.get(streamId);
+    if (!this._enableJsonResponse) {
       let eventId;
       if (this._eventStore) {
         eventId = await this._eventStore.storeEvent(streamId, message);
+        stream = this._streamMapping.get(streamId);
+      }
+      if (stream?.controller && stream?.encoder && (eventId === undefined || !stream.replayedEventIds?.has(eventId))) {
+        const written = this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        if (written && eventId !== undefined) {
+          this._resumableStreams.add(streamId);
+        }
       }
-      this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
@@ -8394,6 +8721,25 @@ data:
       const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
       if (allResponsesReady) {
         if (!stream) {
+          if (this._closed) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            return;
+          }
+          if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
+            for (const id of relatedIds) {
+              this._requestResponseMap.delete(id);
+              this._requestToStreamMapping.delete(id);
+            }
+            this._resumableStreams.delete(streamId);
+            return;
+          }
+          for (const id of relatedIds) {
+            this._requestResponseMap.delete(id);
+            this._requestToStreamMapping.delete(id);
+          }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
         if (this._enableJsonResponse && stream.resolveJson) {
@@ -8416,11 +8762,15 @@ data:
           this._requestResponseMap.delete(id);
           this._requestToStreamMapping.delete(id);
         }
+        this._resumableStreams.delete(streamId);
       }
     }
   }
 }
 var init_webStandardStreamableHttp = __esm(() => {
+  init_mediaType();
+  init_requestBody();
+  init_sseKeepAlive();
   init_types();
 });
 
@@ -25872,6 +26222,17 @@ var require_utils2 = __commonJS(function(exports, module) {
   var setMaxIndex = function setMaxIndex(obj, maxIndex) {
     overflowChannel.set(obj, maxIndex);
   };
+  var conflictChannel = getSideChannel();
+  var markConflict = function markConflict(obj, maxIndex) {
+    conflictChannel.set(obj, maxIndex);
+    return obj;
+  };
+  var isConflict = function isConflict(obj) {
+    return conflictChannel.has(obj);
+  };
+  var getConflictIndex = function getConflictIndex(obj) {
+    return conflictChannel.get(obj);
+  };
   var hexTable = function() {
     var array = [];
     for (var i = 0;i < 256; ++i) {
@@ -25915,6 +26276,27 @@ var require_utils2 = __commonJS(function(exports, module) {
       obj[key] = value;
     }
   };
+  var maxNumericIndex = function maxNumericIndex(obj, min) {
+    var max = min;
+    var keys = Object.keys(obj);
+    for (var i = 0;i < keys.length; ++i) {
+      var num = parseInt(keys[i], 10);
+      if (String(num) === keys[i] && num > max) {
+        max = num;
+      }
+    }
+    return max;
+  };
+  var limitedPair = function limitedPair(first, second, options) {
+    var pair = [first, second];
+    if (options && typeof options.arrayLimit === "number" && pair.length > options.arrayLimit) {
+      if (options.throwOnLimitExceeded) {
+        throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+      }
+      return markOverflow(arrayToObject(pair, options), 1);
+    }
+    return pair;
+  };
   var merge = function merge(target, source, options) {
     if (!source) {
       return target;
@@ -25934,13 +26316,21 @@ var require_utils2 = __commonJS(function(exports, module) {
           var newIndex = getMaxIndex(target) + 1;
           target[newIndex] = source;
           setMaxIndex(target, newIndex);
+        } else if (options && options.strictMerge && isConflict(target)) {
+          var nextConflict = getConflictIndex(target) + 1;
+          if (options.throwOnLimitExceeded && typeof options.arrayLimit === "number" && nextConflict >= options.arrayLimit) {
+            throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+          }
+          target[nextConflict] = source;
+          markConflict(target, nextConflict);
         } else if (options && options.strictMerge) {
-          return [target, source];
+          var conflict = limitedPair(target, source, options);
+          return isArray(conflict) ? markConflict(conflict, 1) : conflict;
         } else if (options && (options.plainObjects || options.allowPrototypes) || !has.call(Object.prototype, source)) {
           target[source] = true;
         }
       } else {
-        return [target, source];
+        return limitedPair(target, source, options);
       }
       return target;
     }
@@ -25966,6 +26356,9 @@ var require_utils2 = __commonJS(function(exports, module) {
     var mergeTarget = target;
     if (isArray(target) && !isArray(source)) {
       mergeTarget = arrayToObject(target, options);
+      if (isConflict(target)) {
+        markConflict(mergeTarget, target.length - 1);
+      }
     }
     if (isArray(target) && isArray(source)) {
       source.forEach(function(item, i) {
@@ -25996,7 +26389,7 @@ var require_utils2 = __commonJS(function(exports, module) {
         setProperty(acc, key, value);
       }
       if (isOverflow(source) && !isOverflow(acc)) {
-        markOverflow(acc, getMaxIndex(source));
+        markOverflow(acc, maxNumericIndex(acc, getMaxIndex(source)));
       }
       if (isOverflow(acc)) {
         var keyNum = parseInt(key, 10);
@@ -26004,6 +26397,12 @@ var require_utils2 = __commonJS(function(exports, module) {
           setMaxIndex(acc, keyNum);
         }
       }
+      if (isConflict(acc)) {
+        var conflictKey = parseInt(key, 10);
+        if (String(conflictKey) === key && conflictKey > getConflictIndex(acc)) {
+          markConflict(acc, conflictKey);
+        }
+      }
       return acc;
     }, mergeTarget);
   };
@@ -26014,6 +26413,9 @@ var require_utils2 = __commonJS(function(exports, module) {
     }, target);
   };
   var decode = function(str, defaultDecoder, charset) {
+    if (typeof str === "string" && str.indexOf("%") === -1) {
+      return str.indexOf("+") === -1 ? str : str.replace(/\+/g, " ");
+    }
     var strWithoutPlus = str.replace(/\+/g, " ");
     if (charset === "iso-8859-1") {
       return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
@@ -26024,6 +26426,52 @@ var require_utils2 = __commonJS(function(exports, module) {
       return strWithoutPlus;
     }
   };
+  var hasToPrimitive = typeof Symbol === "function" && typeof Symbol.toPrimitive === "symbol";
+  var arrayJoin = Array.prototype.join;
+  var arrayToString = Array.prototype.toString;
+  var objectToString = Object.prototype.toString;
+  var toCoercible = function toCoercible(value, joining) {
+    if (!value || typeof value !== "object" && typeof value !== "function") {
+      return value;
+    }
+    if (hasToPrimitive && value[Symbol.toPrimitive] != null) {
+      return value;
+    }
+    if (isArray(value) && value.toString === arrayToString && value.join === arrayJoin) {
+      var ancestors = joining || getSideChannel();
+      if (ancestors.has(value)) {
+        return "";
+      }
+      ancestors.set(value, true);
+      var copy;
+      for (var i = 0;i < value.length; i += 1) {
+        var item = value[i];
+        var coerced = toCoercible(item, ancestors);
+        if (!copy && coerced !== item) {
+          copy = [];
+          for (var j = 0;j < i; j += 1) {
+            copy[j] = value[j];
+          }
+        }
+        if (copy) {
+          copy[i] = coerced;
+        }
+      }
+      ancestors["delete"](value);
+      return copy || value;
+    }
+    if (typeof value.toString === "function") {
+      return value;
+    }
+    var valueOf = value.valueOf;
+    if (typeof valueOf === "function") {
+      var primitive = valueOf.call(value);
+      if (!primitive || typeof primitive !== "object" && typeof primitive !== "function") {
+        return String(primitive);
+      }
+    }
+    return objectToString.call(value);
+  };
   var limit = 1024;
   var encode = function encode(str, defaultEncoder, charset, kind, format) {
     if (str.length === 0) {
@@ -26033,12 +26481,12 @@ var require_utils2 = __commonJS(function(exports, module) {
     if (typeof str === "symbol") {
       string = Symbol.prototype.toString.call(str);
     } else if (typeof str !== "string") {
-      string = String(str);
+      string = String(toCoercible(str));
     }
     if (charset === "iso-8859-1") {
       return escape(string).replace(/%u[0-9a-f]{4}/gi, function($0) {
         return "%26%23" + parseInt($0.slice(2), 16) + "%3B";
-      });
+      }).replace(/\+/g, "%2B");
     }
     var out = "";
     for (var j = 0;j < string.length; j += limit) {
@@ -26150,7 +26598,8 @@ var require_utils2 = __commonJS(function(exports, module) {
     isRegExp,
     markOverflow,
     maybeMap,
-    merge
+    merge,
+    toCoercible
   };
 });
 
@@ -26261,17 +26710,17 @@ var require_stringify = __commonJS(function(exports, module) {
     if (generateArrayPrefix === "comma" && isArray(obj)) {
       if (encodeValuesOnly && encoder) {
         obj = utils.maybeMap(obj, function(v) {
-          return v == null ? v : encoder(v);
+          return v == null ? v : encoder(v, defaults.encoder, charset, "value", format);
         });
       }
-      objKeys = [{ value: obj.length > 0 ? obj.join(",") || null : undefined }];
+      objKeys = [{ value: obj.length > 0 ? utils.toCoercible(obj).join(",") || null : undefined }];
     } else if (isArray(filter)) {
       objKeys = filter;
     } else {
       var keys = Object.keys(obj);
       objKeys = sort ? keys.sort(sort) : keys;
     }
-    var encodedPrefix = encodeDotInKeys ? String(prefix).replace(/\./g, "%2E") : String(prefix);
+    var encodedPrefix = String(prefix);
     var adjustedPrefix = commaRoundTrip && isArray(obj) && obj.length === 1 ? encodedPrefix + "[]" : encodedPrefix;
     if (allowEmptyArrays && isArray(obj) && obj.length === 0 && Object.keys(obj).length === 0) {
       return adjustedPrefix + "[]";
@@ -26321,7 +26770,7 @@ var require_stringify = __commonJS(function(exports, module) {
       filter = opts.filter;
     }
     var arrayFormat;
-    if (opts.arrayFormat in arrayPrefixGenerators) {
+    if (has.call(arrayPrefixGenerators, opts.arrayFormat)) {
       arrayFormat = opts.arrayFormat;
     } else if ("indices" in opts) {
       arrayFormat = opts.indices ? "indices" : "repeat";
@@ -26407,9 +26856,53 @@ var require_stringify = __commonJS(function(exports, module) {
 
 // node_modules/qs/lib/parse.js
 var require_parse = __commonJS(function(exports, module) {
+  var getSideChannel = require_side_channel();
   var utils = require_utils2();
   var has = Object.prototype.hasOwnProperty;
   var isArray = Array.isArray;
+  var getPrototypeOf = Object.getPrototypeOf;
+  var isPlainContainer = function isPlainContainer(value) {
+    if (!value || typeof value !== "object") {
+      return false;
+    }
+    if (isArray(value)) {
+      return true;
+    }
+    var proto = getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+  };
+  var emptyCopyOf = function emptyCopyOf(value) {
+    if (isArray(value)) {
+      var arr = [];
+      arr.length = value.length;
+      return arr;
+    }
+    return getPrototypeOf(value) === null ? { __proto__: null } : {};
+  };
+  var copyInput = function copyInput(input) {
+    var copies = getSideChannel();
+    var result = {};
+    var queue = [{ source: input, target: result }];
+    for (var i = 0;i < queue.length; ++i) {
+      var source = queue[i].source;
+      var target = queue[i].target;
+      var keys = Object.keys(source);
+      for (var j = 0;j < keys.length; ++j) {
+        var value = source[keys[j]];
+        if (isPlainContainer(value)) {
+          if (!copies.has(value)) {
+            var copy = emptyCopyOf(value);
+            copies.set(value, copy);
+            queue[queue.length] = { source: value, target: copy };
+          }
+          target[keys[j]] = copies.get(value);
+        } else {
+          target[keys[j]] = value;
+        }
+      }
+    }
+    return result;
+  };
   var defaults = {
     allowDots: false,
     allowEmptyArrays: false,
@@ -26493,6 +26986,7 @@ var require_parse = __commonJS(function(exports, module) {
       var part = parts[i];
       var bracketEqualsPos = part.indexOf("]=");
       var pos = bracketEqualsPos === -1 ? part.indexOf("=") : bracketEqualsPos + 1;
+      var isEmptyBracketKey = pos > 1 && part.slice(pos - 2, pos) === "[]";
       var key;
       var val;
       if (pos === -1) {
@@ -26509,7 +27003,7 @@ var require_parse = __commonJS(function(exports, module) {
       if (val && options.interpretNumericEntities && charset === "iso-8859-1") {
         val = interpretNumericEntities(String(val));
       }
-      if (part.indexOf("[]=") > -1) {
+      if (isEmptyBracketKey) {
         val = isArray(val) ? [val] : val;
       }
       if (options.comma && isArray(val) && val.length > options.arrayLimit) {
@@ -26517,7 +27011,7 @@ var require_parse = __commonJS(function(exports, module) {
       }
       if (key !== null) {
         var existing = has.call(obj, key);
-        if (existing && (options.duplicates === "combine" || part.indexOf("[]=") > -1)) {
+        if (existing && (options.duplicates === "combine" || isEmptyBracketKey)) {
           obj[key] = utils.combine(obj[key], val, options.arrayLimit, options.plainObjects, options.throwOnLimitExceeded);
         } else if (!existing || options.duplicates === "last") {
           obj[key] = val;
@@ -26566,8 +27060,35 @@ var require_parse = __commonJS(function(exports, module) {
     }
     return leaf;
   };
+  var topLevelDotsToBrackets = function topLevelDotsToBrackets(key) {
+    var result = "";
+    var depth = 0;
+    for (var i = 0;i < key.length; i += 1) {
+      var cu = key.charCodeAt(i);
+      if (cu === 91) {
+        depth += 1;
+        result += "[";
+      } else if (cu === 93) {
+        if (depth > 0) {
+          depth -= 1;
+        }
+        result += "]";
+      } else if (cu === 46 && depth === 0 && i + 1 < key.length && key.charCodeAt(i + 1) !== 46 && key.charCodeAt(i + 1) !== 91) {
+        var start = i + 1;
+        var j = start;
+        while (j < key.length && key.charCodeAt(j) !== 46 && key.charCodeAt(j) !== 91) {
+          j += 1;
+        }
+        result += "[" + key.slice(start, j) + "]";
+        i = j - 1;
+      } else {
+        result += key.charAt(i);
+      }
+    }
+    return result;
+  };
   var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
-    var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, "[$1]") : originalKey;
+    var key = options.allowDots ? topLevelDotsToBrackets(originalKey) : originalKey;
     if (options.depth <= 0) {
       if (!options.plainObjects && has.call(Object.prototype, key)) {
         if (!options.allowPrototypes) {
@@ -26692,7 +27213,7 @@ var require_parse = __commonJS(function(exports, module) {
     if (str === "" || str === null || typeof str === "undefined") {
       return options.plainObjects ? { __proto__: null } : {};
     }
-    var tempObj = typeof str === "string" ? parseValues(str, options) : str;
+    var tempObj = typeof str === "string" ? parseValues(str, options) : copyInput(str);
     var obj = options.plainObjects ? { __proto__: null } : {};
     var keys = Object.keys(tempObj);
     for (var i = 0;i < keys.length; ++i) {
@@ -27233,109 +27754,144 @@ var require_view = __commonJS(function(exports, module) {
   }
 });
 
-// node_modules/content-type/index.js
-var require_content_type = __commonJS(function(exports) {
+// node_modules/express/node_modules/content-type/dist/index.js
+var require_dist3 = __commonJS(function(exports) {
   /*!
    * content-type
    * Copyright(c) 2015 Douglas Christopher Wilson
    * MIT Licensed
    */
-  var PARAM_REGEXP = /; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g;
-  var TEXT_REGEXP = /^[\u000b\u0020-\u007e\u0080-\u00ff]+$/;
-  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-  var QESC_REGEXP = /\\([\u000b\u0020-\u00ff])/g;
-  var QUOTE_REGEXP = /([\\"])/g;
-  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  Object.defineProperty(exports, "__esModule", { value: true });
   exports.format = format;
   exports.parse = parse;
+  var TEXT_REGEXP = /^[\u0009\u0020-\u007e\u0080-\u00ff]*$/;
+  var TOKEN_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  var QUOTE_REGEXP = /[\\"]/g;
+  var TYPE_REGEXP = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+  var NullObject = /* @__PURE__ */ (() => {
+    const C = function() {};
+    C.prototype = Object.create(null);
+    return C;
+  })();
   function format(obj) {
-    if (!obj || typeof obj !== "object") {
-      throw new TypeError("argument obj is required");
-    }
-    var parameters = obj.parameters;
-    var type = obj.type;
+    const { type, parameters } = obj;
     if (!type || !TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid type");
+      throw new TypeError(`Invalid type: ${type}`);
     }
-    var string = type;
-    if (parameters && typeof parameters === "object") {
-      var param;
-      var params = Object.keys(parameters).sort();
-      for (var i = 0;i < params.length; i++) {
-        param = params[i];
+    let result = type;
+    if (parameters) {
+      for (const param of Object.keys(parameters)) {
         if (!TOKEN_REGEXP.test(param)) {
-          throw new TypeError("invalid parameter name");
+          throw new TypeError(`Invalid parameter name: ${param}`);
         }
-        string += "; " + param + "=" + qstring(parameters[param]);
+        result += `; ${param}=${qstring(parameters[param])}`;
       }
     }
-    return string;
+    return result;
   }
-  function parse(string) {
-    if (!string) {
-      throw new TypeError("argument string is required");
-    }
-    var header = typeof string === "object" ? getcontenttype(string) : string;
-    if (typeof header !== "string") {
-      throw new TypeError("argument string is required to be a string");
-    }
-    var index = header.indexOf(";");
-    var type = index !== -1 ? header.slice(0, index).trim() : header.trim();
-    if (!TYPE_REGEXP.test(type)) {
-      throw new TypeError("invalid media type");
+  function parse(header, options) {
+    const stopChar = options?.comma === true ? COMMA : 65536;
+    const len = header.length;
+    let index = skipOWS(header, options?.start ?? 0, len);
+    const valueStart = index;
+    index = skipValue(header, index, len, stopChar);
+    const valueEnd = trailingOWS(header, valueStart, index);
+    const type = header.slice(valueStart, valueEnd).toLowerCase();
+    if (options?.parameters === false) {
+      return { type, index, parameters: new NullObject };
     }
-    var obj = new ContentType(type.toLowerCase());
-    if (index !== -1) {
-      var key;
-      var match;
-      var value;
-      PARAM_REGEXP.lastIndex = index;
-      while (match = PARAM_REGEXP.exec(header)) {
-        if (match.index !== index) {
-          throw new TypeError("invalid parameter format");
-        }
-        index += match[0].length;
-        key = match[1].toLowerCase();
-        value = match[2];
-        if (value.charCodeAt(0) === 34) {
-          value = value.slice(1, -1);
-          if (value.indexOf("\\") !== -1) {
-            value = value.replace(QESC_REGEXP, "$1");
+    return parseParameters(header, type, index, len, stopChar);
+  }
+  var SP = 32;
+  var HTAB = 9;
+  var SEMI = 59;
+  var EQ = 61;
+  var DQUOTE = 34;
+  var BSLASH = 92;
+  var COMMA = 44;
+  function parseParameters(header, type, index, len, stopChar) {
+    const parameters = new NullObject;
+    parameter:
+      while (index < len) {
+        if (header.charCodeAt(index) === stopChar)
+          break;
+        index = skipOWS(header, index + 1, len);
+        const keyStart = index;
+        while (index < len) {
+          const code = header.charCodeAt(index);
+          if (code === stopChar)
+            break parameter;
+          if (code === SEMI)
+            continue parameter;
+          if (code === EQ) {
+            const keyEnd = trailingOWS(header, keyStart, index);
+            const key = header.slice(keyStart, keyEnd).toLowerCase();
+            index = skipOWS(header, index + 1, len);
+            if (index < len && header.charCodeAt(index) === DQUOTE) {
+              index++;
+              let value = "";
+              while (index < len) {
+                const code = header.charCodeAt(index++);
+                if (code === DQUOTE) {
+                  index = skipValue(header, index, len, stopChar);
+                  if (parameters[key] === undefined)
+                    parameters[key] = value;
+                  break;
+                }
+                if (code === BSLASH && index < len) {
+                  value += header[index++];
+                  continue;
+                }
+                value += String.fromCharCode(code);
+              }
+              continue parameter;
+            }
+            const valueStart = index;
+            index = skipValue(header, index, len, stopChar);
+            if (parameters[key] === undefined) {
+              const valueEnd = trailingOWS(header, valueStart, index);
+              parameters[key] = header.slice(valueStart, valueEnd);
+            }
+            continue parameter;
           }
+          index++;
         }
-        obj.parameters[key] = value;
-      }
-      if (index !== header.length) {
-        throw new TypeError("invalid parameter format");
       }
-    }
-    return obj;
+    return { type, index, parameters };
   }
-  function getcontenttype(obj) {
-    var header;
-    if (typeof obj.getHeader === "function") {
-      header = obj.getHeader("content-type");
-    } else if (typeof obj.headers === "object") {
-      header = obj.headers && obj.headers["content-type"];
-    }
-    if (typeof header !== "string") {
-      throw new TypeError("content-type header is missing from object");
+  function skipValue(str, index, len, stopChar) {
+    while (index < len) {
+      const code = str.charCodeAt(index);
+      if (code === SEMI || code === stopChar)
+        break;
+      index++;
     }
-    return header;
+    return index;
   }
-  function qstring(val) {
-    var str = String(val);
-    if (TOKEN_REGEXP.test(str)) {
-      return str;
+  function skipOWS(header, index, len) {
+    while (index < len) {
+      const char = header.charCodeAt(index);
+      if (char !== SP && char !== HTAB)
+        break;
+      index++;
     }
-    if (str.length > 0 && !TEXT_REGEXP.test(str)) {
-      throw new TypeError("invalid parameter value");
+    return index;
+  }
+  function trailingOWS(header, start, end) {
+    while (end > start) {
+      const char = header.charCodeAt(end - 1);
+      if (char !== SP && char !== HTAB)
+        break;
+      end--;
     }
-    return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+    return end;
   }
-  function ContentType(type) {
-    this.parameters = Object.create(null);
-    this.type = type;
+  function qstring(str) {
+    if (TOKEN_REGEXP.test(str))
+      return str;
+    if (TEXT_REGEXP.test(str))
+      return `"${str.replace(QUOTE_REGEXP, "\\$&")}"`;
+    throw new TypeError(`Invalid parameter value: ${str}`);
   }
 });
 
@@ -28241,7 +28797,7 @@ var require_utils3 = __commonJS(function(exports) {
    * MIT Licensed
    */
   var { METHODS } = __require("node:http");
-  var contentType = require_content_type();
+  var contentType = require_dist3();
   var etag = require_etag();
   var mime = require_mime_types();
   var proxyaddr = require_proxy_addr();
@@ -28446,7 +29002,7 @@ var require_is_promise = __commonJS(function(exports, module) {
 });
 
 // node_modules/path-to-regexp/dist/index.js
-var require_dist3 = __commonJS(function(exports) {
+var require_dist4 = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
   exports.PathError = exports.TokenData = undefined;
   exports.parse = parse;
@@ -28822,7 +29378,7 @@ var require_layer = __commonJS(function(exports, module) {
    * MIT Licensed
    */
   var isPromise = require_is_promise();
-  var pathRegexp = require_dist3();
+  var pathRegexp = require_dist4();
   var debug = require_src()("router:layer");
   var deprecate = require_depd()("router");
   var TRAILING_SLASH_REGEXP = /\/+$/;
@@ -29702,7 +30258,7 @@ var require_application = __commonJS(function(exports, module) {
     var cache = this.cache;
     var done = callback;
     var engines = this.engines;
-    var opts = options;
+    var opts = options || {};
     var view;
     if (typeof options === "function") {
       done = options;
@@ -29745,7 +30301,7 @@ var require_application = __commonJS(function(exports, module) {
   };
   function logerror(err) {
     if (this.get("env") !== "test")
-      console.error(err.stack || err.toString());
+      console.error(err);
   }
   function tryRender(view, options, callback) {
     try {
@@ -29757,7 +30313,7 @@ var require_application = __commonJS(function(exports, module) {
 });
 
 // node_modules/negotiator/node_modules/content-type/dist/index.js
-var require_dist4 = __commonJS(function(exports) {
+var require_dist5 = __commonJS(function(exports) {
   /*!
    * content-type
    * Copyright(c) 2015 Douglas Christopher Wilson
@@ -29904,7 +30460,7 @@ var require_accept = __commonJS(function(exports, module) {
    * Copyright(c) 2026 Blake Embrey
    * MIT Licensed
    */
-  var contentType = require_dist4();
+  var contentType = require_dist5();
   module.exports = parseAccept;
   function parseAccept(header) {
     var values = [];
@@ -30098,7 +30654,7 @@ var require_encoding = __commonJS(function(exports, module) {
 
 // node_modules/negotiator/lib/language.js
 var require_language = __commonJS(function(exports, module) {
-  var contentType = require_dist4();
+  var contentType = require_dist5();
   var parseAccept = require_accept();
   module.exports = preferredLanguages;
   module.exports.preferredLanguages = preferredLanguages;
@@ -30182,7 +30738,7 @@ var require_language = __commonJS(function(exports, module) {
 
 // node_modules/negotiator/lib/mediaType.js
 var require_mediaType = __commonJS(function(exports, module) {
-  var contentType = require_dist4();
+  var contentType = require_dist5();
   var parseAcceptHeader = require_accept();
   module.exports = preferredMediaTypes;
   module.exports.preferredMediaTypes = preferredMediaTypes;
@@ -30635,9 +31191,9 @@ var require_request = __commonJS(function(exports, module) {
     var accept = accepts(this);
     return accept.encodings.apply(accept, arguments);
   };
-  req.acceptsCharsets = function() {
-    var accept = accepts(this);
-    return accept.charsets.apply(accept, arguments);
+  req.acceptsCharsets = function(...charsets) {
+    const accept = accepts(this);
+    return accept.charsets(...charsets);
   };
   req.acceptsLanguages = function(...languages) {
     return accepts(this).languages(...languages);
@@ -30706,7 +31262,7 @@ var require_request = __commonJS(function(exports, module) {
     if (!val || !trust(this.socket.remoteAddress, 0)) {
       val = this.get("Host");
     } else if (val.indexOf(",") !== -1) {
-      val = val.substring(0, val.indexOf(",")).trimRight();
+      val = val.substring(0, val.indexOf(",")).trimEnd();
     }
     return val || undefined;
   });
@@ -30722,7 +31278,7 @@ var require_request = __commonJS(function(exports, module) {
     var method = this.method;
     var res = this.res;
     var status = res.statusCode;
-    if (method !== "GET" && method !== "HEAD")
+    if (method !== "GET" && method !== "HEAD" && method !== "QUERY")
       return false;
     if (status >= 200 && status < 300 || status === 304) {
       return fresh(this.headers, {
@@ -30748,199 +31304,279 @@ var require_request = __commonJS(function(exports, module) {
   }
 });
 
-// node_modules/content-disposition/index.js
-var require_content_disposition = __commonJS(function(exports, module) {
+// node_modules/content-disposition/dist/index.js
+var require_dist6 = __commonJS(function(exports) {
   /*!
    * content-disposition
    * Copyright(c) 2014-2017 Douglas Christopher Wilson
    * MIT Licensed
    */
-  module.exports = contentDisposition;
-  module.exports.parse = parse;
-  var utf8Decoder = new TextDecoder("utf-8");
+  Object.defineProperty(exports, "__esModule", { value: true });
+  exports.create = create;
+  exports.parse = parse;
+  exports.decodeExtended = decodeExtended;
+  exports.format = format;
+  exports.encodeExtended = encodeExtended;
+  var NullObject = /* @__PURE__ */ (() => {
+    const C = function() {};
+    C.prototype = Object.create(null);
+    return C;
+  })();
+  function create(filename, options) {
+    const type = options?.type || "attachment";
+    const parameters = createParameters(filename, options?.fallback);
+    return format({ type, parameters }, { extended: false });
+  }
+  var SP = 32;
+  var HTAB = 9;
+  var SEMI = 59;
+  var EQ = 61;
+  var DQUOTE = 34;
+  var BSLASH = 92;
+  var ASTERISK = 42;
+  function parse(header, options) {
+    const len = header.length;
+    const multipart = options?.multipart === true;
+    const extended = options?.extended !== false;
+    let index = skipOWS(header, 0, header.length);
+    const typeStart = index;
+    index = parseToken(header, index, len);
+    const typeEnd = trailingOWS(header, typeStart, index);
+    const type = header.slice(typeStart, typeEnd).toLowerCase();
+    const parameters = new NullObject;
+    parameter:
+      while (index < len) {
+        index = skipOWS(header, index + 1, len);
+        const keyStart = index;
+        while (index < len) {
+          const char = header.charCodeAt(index);
+          if (char === SEMI)
+            continue parameter;
+          if (char === EQ) {
+            const keyEnd = trailingOWS(header, keyStart, index);
+            const key = header.slice(keyStart, keyEnd).toLowerCase();
+            index = skipOWS(header, index + 1, len);
+            if (index < len && header.charCodeAt(index) === DQUOTE) {
+              index++;
+              let value = "";
+              if (multipart) {
+                while (index < len) {
+                  const code = header.charCodeAt(index++);
+                  if (code === DQUOTE) {
+                    index = parseToken(header, index, len);
+                    if (parameters[key] === undefined)
+                      parameters[key] = value;
+                    break;
+                  }
+                  if (code === 37 && index + 1 < len) {
+                    const code2 = header.charCodeAt(index);
+                    const code3 = header.charCodeAt(index + 1);
+                    if (code2 === 50 && code3 === 50) {
+                      value += '"';
+                      index += 2;
+                      continue;
+                    }
+                    if (code2 === 48) {
+                      if (code3 === 100 || code3 === 68) {
+                        value += "\r";
+                        index += 2;
+                        continue;
+                      }
+                      if (code3 === 97 || code3 === 65) {
+                        value += `
+`;
+                        index += 2;
+                        continue;
+                      }
+                    }
+                  }
+                  value += String.fromCharCode(code);
+                }
+              } else {
+                while (index < len) {
+                  const code = header.charCodeAt(index++);
+                  if (code === DQUOTE) {
+                    index = parseToken(header, index, len);
+                    if (parameters[key] === undefined)
+                      parameters[key] = value;
+                    break;
+                  }
+                  if (code === BSLASH && index < len) {
+                    value += header[index++];
+                    continue;
+                  }
+                  value += String.fromCharCode(code);
+                }
+              }
+              continue parameter;
+            }
+            const valueStart = index;
+            index = parseToken(header, index, len);
+            const valueEnd = trailingOWS(header, valueStart, index);
+            const value = header.slice(valueStart, valueEnd);
+            if (parameters[key] === undefined) {
+              parameters[key] = value;
+              if (extended && key.charCodeAt(key.length - 1) === ASTERISK) {
+                const normalizedKey = key.slice(0, -1);
+                const decoded = decodeExtended(value);
+                if (decoded !== undefined)
+                  parameters[normalizedKey] = decoded;
+              }
+            }
+            continue parameter;
+          }
+          index++;
+        }
+      }
+    return { type, parameters };
+  }
   var ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
-  var NON_LATIN1_REGEXP = /[^\x20-\x7e\xa0-\xff]/g;
-  var QESC_REGEXP = /\\([\u0000-\u007f])/g;
-  var QUOTE_REGEXP = /([\\"])/g;
-  var PARAM_REGEXP = /;[\x09\x20]*([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*=[\x09\x20]*("(?:[\x20!\x23-\x5b\x5d-\x7e\x80-\xff]|\\[\x20-\x7e])*"|[!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*/g;
-  var TEXT_REGEXP = /^[\x20-\x7e\x80-\xff]+$/;
+  var NON_ASCII_REGEXP = /[^\x20-\x7e]/g;
+  var QUOTE_REGEXP = /[\\"]/g;
+  var INVALID_FILENAME_REGEXP = /%[0-9A-Fa-f]{2}/;
+  var TEXT_REGEXP = /^[\x20-\x7e\x80-\xff]*$/;
+  var ASCII_TEXT_REGEXP = /^[\x20-\x7e]*$/;
   var TOKEN_REGEXP = /^[!#$%&'*+.0-9A-Z^_`a-z|~-]+$/;
-  var EXT_VALUE_REGEXP = /^([A-Za-z0-9!#$%&+\-^_`{}~]+)'(?:[A-Za-z]{2,3}(?:-[A-Za-z]{3}){0,3}|[A-Za-z]{4,8}|)'((?:%[0-9A-Fa-f]{2}|[A-Za-z0-9!#$&+.^_`|~-])+)$/;
-  var DISPOSITION_TYPE_REGEXP = /^([!#$%&'*+.0-9A-Z^_`a-z|~-]+)[\x09\x20]*(?:$|;)/;
-  function contentDisposition(filename, options) {
-    var opts = options || {};
-    var type = opts.type || "attachment";
-    var params = createparams(filename, opts.fallback);
-    return format(new ContentDisposition(type, params));
-  }
-  function createparams(filename, fallback) {
-    if (filename === undefined) {
+  function createParameters(filename, fallback = true) {
+    if (filename === undefined)
       return;
+    if (typeof fallback === "string") {
+      if (!ASCII_TEXT_REGEXP.test(fallback)) {
+        throw new TypeError("Fallback must be valid US-ASCII: " + fallback);
+      }
+      if (fallback === filename)
+        return { filename };
+      return { filename: fallback, "filename*": encodeExtended(filename) };
     }
-    var params = {};
-    if (typeof filename !== "string") {
-      throw new TypeError("filename must be a string");
-    }
-    if (fallback === undefined) {
-      fallback = true;
-    }
-    if (typeof fallback !== "string" && typeof fallback !== "boolean") {
-      throw new TypeError("fallback must be a string or boolean");
-    }
-    if (typeof fallback === "string" && NON_LATIN1_REGEXP.test(fallback)) {
-      throw new TypeError("fallback must be ISO-8859-1 string");
-    }
-    var name = basename(filename);
-    var isQuotedString = TEXT_REGEXP.test(name);
-    var fallbackName = typeof fallback !== "string" ? fallback && getlatin1(name) : basename(fallback);
-    var hasFallback = typeof fallbackName === "string" && fallbackName !== name;
-    if (hasFallback || !isQuotedString || hasHexEscape(name)) {
-      params["filename*"] = name;
+    if (ASCII_TEXT_REGEXP.test(filename) && !INVALID_FILENAME_REGEXP.test(filename)) {
+      return { filename };
     }
-    if (isQuotedString || hasFallback) {
-      params.filename = hasFallback ? fallbackName : name;
+    if (fallback === false) {
+      return { "filename*": encodeExtended(filename) };
     }
-    return params;
+    return {
+      filename: getAscii(filename),
+      "filename*": encodeExtended(filename)
+    };
   }
-  function format(obj) {
-    var parameters = obj.parameters;
-    var type = obj.type;
-    if (!type || typeof type !== "string" || !TOKEN_REGEXP.test(type)) {
-      throw new TypeError("invalid type");
-    }
-    var string = String(type).toLowerCase();
-    if (parameters && typeof parameters === "object") {
-      var param;
-      var params = Object.keys(parameters).sort();
-      for (var i = 0;i < params.length; i++) {
-        param = params[i];
-        var val = param.slice(-1) === "*" ? ustring(parameters[param]) : qstring(parameters[param]);
-        string += "; " + param + "=" + val;
-      }
+  function decodeExtended(str) {
+    const charsetEnd = str.indexOf("'");
+    if (charsetEnd <= 0) {
+      return;
     }
-    return string;
-  }
-  function decodefield(str) {
-    const match = EXT_VALUE_REGEXP.exec(str);
-    if (!match) {
-      throw new TypeError("invalid extended field value");
+    const languageEnd = str.indexOf("'", charsetEnd + 1);
+    if (languageEnd === -1) {
+      return;
     }
-    const charset = match[1].toLowerCase();
-    const encoded = match[2];
+    const charset = str.slice(0, charsetEnd).toLowerCase();
+    const encoded = str.slice(languageEnd + 1);
     switch (charset) {
       case "iso-8859-1": {
-        const binary = decodeHexEscapes(encoded);
-        return getlatin1(binary);
+        return decodeHexEscapes(encoded);
       }
       case "utf-8":
       case "utf8": {
-        try {
-          return decodeURIComponent(encoded);
-        } catch {
-          const binary = decodeHexEscapes(encoded);
-          const bytes = new Uint8Array(binary.length);
-          for (let idx = 0;idx < binary.length; idx++) {
-            bytes[idx] = binary.charCodeAt(idx);
-          }
-          return utf8Decoder.decode(bytes);
-        }
+        return tryDecodeURIComponent(encoded);
       }
     }
-    throw new TypeError("unsupported charset in extended field");
+    return;
   }
-  function getlatin1(val) {
-    return String(val).replace(NON_LATIN1_REGEXP, "?");
+  function tryDecodeURIComponent(str) {
+    try {
+      return decodeURIComponent(str);
+    } catch {
+      return;
+    }
   }
-  function parse(string) {
-    if (!string || typeof string !== "string") {
-      throw new TypeError("argument string is required");
+  function parseToken(str, index, len) {
+    while (index < len) {
+      const char = str.charCodeAt(index);
+      if (char === SEMI)
+        break;
+      index++;
     }
-    var match = DISPOSITION_TYPE_REGEXP.exec(string);
-    if (!match) {
-      throw new TypeError("invalid type format");
+    return index;
+  }
+  function skipOWS(str, index, len) {
+    while (index < len) {
+      const char = str.charCodeAt(index);
+      if (char !== SP && char !== HTAB)
+        break;
+      index++;
     }
-    var index = match[0].length;
-    var type = match[1].toLowerCase();
-    var key;
-    var names = [];
-    var params = {};
-    var value;
-    index = PARAM_REGEXP.lastIndex = match[0].slice(-1) === ";" ? index - 1 : index;
-    while (match = PARAM_REGEXP.exec(string)) {
-      if (match.index !== index) {
-        throw new TypeError("invalid parameter format");
-      }
-      index += match[0].length;
-      key = match[1].toLowerCase();
-      value = match[2];
-      if (names.indexOf(key) !== -1) {
-        throw new TypeError("invalid duplicate parameter");
-      }
-      names.push(key);
-      if (key.indexOf("*") + 1 === key.length) {
-        key = key.slice(0, -1);
-        value = decodefield(value);
-        params[key] = value;
-        continue;
-      }
-      if (typeof params[key] === "string") {
-        continue;
-      }
-      if (value[0] === '"') {
-        value = value.slice(1, -1).replace(QESC_REGEXP, "$1");
-      }
-      params[key] = value;
+    return index;
+  }
+  function trailingOWS(str, start, end) {
+    while (end > start) {
+      const char = str.charCodeAt(end - 1);
+      if (char !== SP && char !== HTAB)
+        break;
+      end--;
     }
-    if (index !== -1 && index !== string.length) {
-      throw new TypeError("invalid parameter format");
+    return end;
+  }
+  function format(obj, options) {
+    const { type, parameters } = obj;
+    const multipart = options?.multipart === true;
+    const extended = options?.extended !== false;
+    if (!type || !TOKEN_REGEXP.test(type)) {
+      throw new TypeError("Invalid type: " + type);
+    }
+    let result = type;
+    if (parameters) {
+      for (const param of Object.keys(parameters)) {
+        const value = parameters[param];
+        if (!TOKEN_REGEXP.test(param)) {
+          throw new TypeError("Invalid parameter name: " + param);
+        }
+        if (multipart) {
+          result += "; " + param + "=" + qmultipart(value);
+          continue;
+        }
+        if (TOKEN_REGEXP.test(value)) {
+          result += "; " + param + "=" + value;
+          continue;
+        }
+        if (TEXT_REGEXP.test(value)) {
+          result += "; " + param + "=" + qstring(value);
+          continue;
+        }
+        if (!extended) {
+          throw new TypeError("Invalid parameter value: " + value);
+        }
+        result += "; " + param + "*=" + encodeExtended(value);
+      }
     }
-    return new ContentDisposition(type, params);
+    return result;
+  }
+  function getAscii(val) {
+    return val.replace(NON_ASCII_REGEXP, "?");
   }
   function pencode(char) {
-    return "%" + String(char).charCodeAt(0).toString(16).toUpperCase();
+    return "%" + char.charCodeAt(0).toString(16).toUpperCase();
   }
-  function qstring(val) {
-    var str = String(val);
-    return '"' + str.replace(QUOTE_REGEXP, "\\$1") + '"';
+  function qstring(str) {
+    return '"' + str.replace(QUOTE_REGEXP, "\\$&") + '"';
   }
-  function ustring(val) {
-    var str = String(val);
-    var encoded = encodeURIComponent(str).replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode);
-    return "UTF-8''" + encoded;
+  function qmultipart(str) {
+    return '"' + str.replace(/[\n\r"]/g, multipartEscape) + '"';
   }
-  function ContentDisposition(type, parameters) {
-    this.type = type;
-    this.parameters = parameters;
+  function multipartEscape(char) {
+    if (char === `
+`)
+      return "%0A";
+    if (char === "\r")
+      return "%0D";
+    return "%22";
   }
-  function basename(path) {
-    const normalized = path.replaceAll("\\", "/");
-    let end = normalized.length;
-    while (end > 0 && normalized[end - 1] === "/") {
-      end--;
-    }
-    if (end === 0) {
-      return "";
-    }
-    let start = end - 1;
-    while (start >= 0 && normalized[start] !== "/") {
-      start--;
-    }
-    return normalized.slice(start + 1, end);
+  function encodeExtended(str) {
+    const encoded = encodeURIComponent(str).replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode);
+    return "UTF-8''" + encoded;
   }
   function isHexDigit(char) {
     const code = char.charCodeAt(0);
     return code >= 48 && code <= 57 || code >= 65 && code <= 70 || code >= 97 && code <= 102;
   }
-  function hasHexEscape(str) {
-    const maxIndex = str.length - 3;
-    let lastIndex = -1;
-    while ((lastIndex = str.indexOf("%", lastIndex + 1)) !== -1 && lastIndex <= maxIndex) {
-      if (isHexDigit(str[lastIndex + 1]) && isHexDigit(str[lastIndex + 2])) {
-        return true;
-      }
-    }
-    return false;
-  }
   function decodeHexEscapes(str) {
     const firstEscape = str.indexOf("%");
     if (firstEscape === -1)
@@ -31741,7 +32377,7 @@ var require_response = __commonJS(function(exports, module) {
    * Copyright(c) 2014-2015 Douglas Christopher Wilson
    * MIT Licensed
    */
-  var contentDisposition = require_content_disposition();
+  var contentDisposition = require_dist6();
   var createError = require_http_errors();
   var deprecate = require_depd()("express");
   var encodeUrl = require_encodeurl();
@@ -31760,6 +32396,7 @@ var require_response = __commonJS(function(exports, module) {
   var send = require_send();
   var extname = path.extname;
   var resolve = path.resolve;
+  var basename = path.basename;
   var vary = require_vary();
   var { Buffer: Buffer2 } = __require("node:buffer");
   var res = Object.create(http.ServerResponse.prototype);
@@ -31792,11 +32429,14 @@ var require_response = __commonJS(function(exports, module) {
     var chunk = body;
     var encoding;
     var req = this.req;
-    var type;
     var app = this.app;
     switch (typeof chunk) {
       case "string":
-        if (!this.get("Content-Type")) {
+        encoding = "utf8";
+        const type = this.get("Content-Type");
+        if (typeof type === "string") {
+          this.set("Content-Type", setCharset(type, "utf-8"));
+        } else {
           this.type("html");
         }
         break;
@@ -31814,13 +32454,6 @@ var require_response = __commonJS(function(exports, module) {
         }
         break;
     }
-    if (typeof chunk === "string") {
-      encoding = "utf8";
-      type = this.get("Content-Type");
-      if (typeof type === "string") {
-        this.set("Content-Type", setCharset(type, "utf-8"));
-      }
-    }
     var etagFn = app.get("etag fn");
     var generateETag = !this.get("ETag") && typeof etagFn === "function";
     var len;
@@ -31834,7 +32467,9 @@ var require_response = __commonJS(function(exports, module) {
         encoding = undefined;
         len = chunk.length;
       }
-      this.set("Content-Length", len);
+      if (!this.get("Transfer-Encoding")) {
+        this.set("Content-Length", len);
+      }
     }
     var etag;
     if (generateETag && len !== undefined) {
@@ -31955,7 +32590,7 @@ var require_response = __commonJS(function(exports, module) {
       opts = filename;
     }
     var headers = {
-      "Content-Disposition": contentDisposition(name || path)
+      "Content-Disposition": contentDisposition.create(basename(name || path))
     };
     if (opts && opts.headers) {
       var keys = Object.keys(opts.headers);
@@ -31998,10 +32633,11 @@ var require_response = __commonJS(function(exports, module) {
     return this;
   };
   res.attachment = function attachment(filename) {
-    if (filename) {
-      this.type(extname(filename));
+    const name = filename !== undefined ? basename(filename) : undefined;
+    if (name) {
+      this.type(extname(name));
     }
-    this.set("Content-Disposition", contentDisposition(filename));
+    this.set("Content-Disposition", contentDisposition.create(name));
     return this;
   };
   res.append = function append(field, val) {
@@ -32088,7 +32724,7 @@ var require_response = __commonJS(function(exports, module) {
       },
       html: function() {
         var u = escapeHtml(address);
-        body = "<p>" + statuses.message[status] + ". Redirecting to " + u + "</p>";
+        body = "<!DOCTYPE html><head><title>" + statuses.message[status] + "</title></head>" + "<body><p>" + statuses.message[status] + ". Redirecting to " + u + "</p></body>";
       },
       default: function() {
         body = "";
@@ -36391,17 +37027,34 @@ function normalizeObjectSchema(schema) {
   }
   return;
 }
+function getDotPath(path) {
+  if (path.length === 0) {
+    return "object root";
+  }
+  return path.reduce((acc, seg, index) => {
+    if (index === 0) {
+      return String(seg);
+    }
+    if (typeof seg === "number") {
+      return `${acc}[${seg}]`;
+    }
+    return `${acc}.${seg}`;
+  }, "");
+}
 function getParseErrorMessage(error) {
   if (error && typeof error === "object") {
+    if ("issues" in error && Array.isArray(error.issues) && error.issues.length > 0) {
+      return error.issues.map((i) => {
+        if (!i.path?.length) {
+          return i.message;
+        }
+        return `${i.message} at ${getDotPath(i.path)}`;
+      }).join(`
+`);
+    }
     if ("message" in error && typeof error.message === "string") {
       return error.message;
     }
-    if ("issues" in error && Array.isArray(error.issues) && error.issues.length > 0) {
-      const firstIssue = error.issues[0];
-      if (firstIssue && typeof firstIssue === "object" && "message" in firstIssue) {
-        return String(firstIssue.message);
-      }
-    }
     try {
       return JSON.stringify(error);
     } catch {
@@ -37942,6 +38595,9 @@ class Protocol {
       this.setRequestHandler(GetTaskPayloadRequestSchema, async (request, extra) => {
         const handleTaskResult = async () => {
           const taskId = request.params.taskId;
+          if (!await this._taskStore.getTask(taskId, extra.sessionId)) {
+            throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
+          }
           if (this._taskMessageQueue) {
             let queuedMessage;
             while (queuedMessage = await this._taskMessageQueue.dequeue(taskId, extra.sessionId)) {
@@ -37972,12 +38628,12 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Task not found: ${taskId}`);
           }
           if (!isTerminal(task.status)) {
-            await this._waitForTaskUpdate(taskId, extra.signal);
+            await this._waitForTaskUpdate(taskId, extra.signal, extra.sessionId);
             return await handleTaskResult();
           }
           if (isTerminal(task.status)) {
             const result = await this._taskStore.getTaskResult(taskId, extra.sessionId);
-            this._clearTaskQueue(taskId);
+            this._clearTaskQueue(taskId, extra.sessionId);
             return {
               ...result,
               _meta: {
@@ -38014,7 +38670,7 @@ class Protocol {
             throw new McpError(ErrorCode.InvalidParams, `Cannot cancel task in terminal status: ${task.status}`);
           }
           await this._taskStore.updateTaskStatus(request.params.taskId, "cancelled", "Client cancelled task execution.", extra.sessionId);
-          this._clearTaskQueue(request.params.taskId);
+          this._clearTaskQueue(request.params.taskId, extra.sessionId);
           const cancelledTask = await this._taskStore.getTask(request.params.taskId, extra.sessionId);
           if (!cancelledTask) {
             throw new McpError(ErrorCode.InvalidParams, `Task not found after cancellation: ${request.params.taskId}`);
@@ -38108,6 +38764,10 @@ class Protocol {
     this._progressHandlers.clear();
     this._taskProgressTokens.clear();
     this._pendingDebouncedNotifications.clear();
+    for (const info of this._timeoutInfo.values()) {
+      clearTimeout(info.timeoutId);
+    }
+    this._timeoutInfo.clear();
     for (const controller of this._requestHandlerAbortControllers.values()) {
       controller.abort();
     }
@@ -38133,6 +38793,19 @@ class Protocol {
     const handler = this._requestHandlers.get(request.method) ?? this.fallbackRequestHandler;
     const capturedTransport = this._transport;
     const relatedTaskId = request.params?._meta?.[RELATED_TASK_META_KEY]?.taskId;
+    const sessionId = capturedTransport?.sessionId;
+    const store = this._taskStore;
+    let relatedTaskFound = true;
+    let relatedTaskLookup;
+    if (relatedTaskId && store && this._taskMessageQueue && sessionId !== undefined) {
+      relatedTaskFound = false;
+      relatedTaskLookup = (async () => {
+        if (!await store.getTask(relatedTaskId, sessionId)) {
+          throw new McpError(ErrorCode.InvalidParams, `Task not found: ${relatedTaskId}`);
+        }
+        relatedTaskFound = true;
+      })();
+    }
     if (handler === undefined) {
       const errorResponse = {
         jsonrpc: "2.0",
@@ -38142,7 +38815,10 @@ class Protocol {
           message: "Method not found"
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && relatedTaskLookup) {
+        const queuedError = { type: "error", message: errorResponse, timestamp: Date.now() };
+        relatedTaskLookup.then(() => this._enqueueTaskMessage(relatedTaskId, queuedError, sessionId), () => capturedTransport?.send(errorResponse)).catch((error) => this._onerror(new Error(`Failed to send an error response: ${error}`)));
+      } else if (relatedTaskId && this._taskMessageQueue) {
         this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -38193,7 +38869,10 @@ class Protocol {
       closeSSEStream: extra?.closeSSEStream,
       closeStandaloneSSEStream: extra?.closeStandaloneSSEStream
     };
-    Promise.resolve().then(() => {
+    (relatedTaskLookup ?? Promise.resolve()).then(() => {
+      if (relatedTaskLookup && abortController.signal.aborted) {
+        throw new McpError(ErrorCode.ConnectionClosed, "Request was cancelled");
+      }
       if (taskCreationParams) {
         this.assertTaskHandlerCapability(request.method);
       }
@@ -38228,7 +38907,7 @@ class Protocol {
           ...error["data"] !== undefined && { data: error["data"] }
         }
       };
-      if (relatedTaskId && this._taskMessageQueue) {
+      if (relatedTaskId && this._taskMessageQueue && relatedTaskFound) {
         await this._enqueueTaskMessage(relatedTaskId, {
           type: "error",
           message: errorResponse,
@@ -38238,7 +38917,9 @@ class Protocol {
         await capturedTransport?.send(errorResponse);
       }
     }).catch((error) => this._onerror(new Error(`Failed to send response: ${error}`))).finally(() => {
-      this._requestHandlerAbortControllers.delete(request.id);
+      if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+        this._requestHandlerAbortControllers.delete(request.id);
+      }
     });
   }
   _onprogress(notification) {
@@ -38614,7 +39295,7 @@ class Protocol {
       throw new Error("Cannot enqueue task message: taskStore and taskMessageQueue are not configured");
     }
     const maxQueueSize = this._options?.maxTaskQueueSize;
-    await this._taskMessageQueue.enqueue(taskId, message, sessionId, maxQueueSize);
+    await this._taskMessageQueue.enqueue(taskId, message, sessionId ?? this._transport?.sessionId, maxQueueSize);
   }
   async _clearTaskQueue(taskId, sessionId) {
     if (this._taskMessageQueue) {
@@ -38633,10 +39314,10 @@ class Protocol {
       }
     }
   }
-  async _waitForTaskUpdate(taskId, signal) {
+  async _waitForTaskUpdate(taskId, signal, sessionId) {
     let interval = this._options?.defaultTaskPollInterval ?? 1000;
     try {
-      const task = await this._taskStore?.getTask(taskId);
+      const task = await this._taskStore?.getTask(taskId, sessionId);
       if (task?.pollInterval) {
         interval = task.pollInterval;
       }
@@ -41757,6 +42438,8 @@ var require_utils4 = __commonJS(function(exports, module) {
   var isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
   var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
   var isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  var isRegNameCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]$/u);
+  var isLiteralRegName = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=]*$/u);
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -41986,13 +42669,16 @@ var require_utils4 = __commonJS(function(exports, module) {
     }
     return output.join("");
   }
-  var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
-  var HOST_DELIM_RE = /[@/?#:]/g;
-  var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
-  function reescapeHostDelimiters(host, isIP) {
-    const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
-    re.lastIndex = 0;
-    return host.replace(re, (ch) => HOST_DELIMS[ch]);
+  var IP_HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23" };
+  var IP_HOST_DELIM_RE = /[@/?#]/g;
+  function encodeHost(host, isIP, allowNonAscii = false) {
+    if (!isIP) {
+      if (isLiteralRegName(host))
+        return host;
+      return encodeComponent(host, isRegNameCharacter, allowNonAscii);
+    }
+    IP_HOST_DELIM_RE.lastIndex = 0;
+    return host.replace(IP_HOST_DELIM_RE, (ch) => IP_HOST_DELIMS[ch]);
   }
   function normalizePercentEncoding(input, decodeUnreserved = false) {
     if (input.indexOf("%") === -1) {
@@ -42158,7 +42844,7 @@ var require_utils4 = __commonJS(function(exports, module) {
     }
     return output;
   }
-  function encodeComponent(input, isAllowed) {
+  function encodeComponent(input, isAllowed, allowNonAscii = false) {
     let output = "";
     for (let i = 0;i < input.length; i++) {
       const ch = input[i];
@@ -42177,17 +42863,17 @@ var require_utils4 = __commonJS(function(exports, module) {
         if (code < 128) {
           output += BYTE_HEX[code];
         } else if (code < 55296 || code > 57343) {
-          output += percentEncodeNonAscii(code);
+          output += allowNonAscii ? ch : percentEncodeNonAscii(code);
         } else if (code <= 56319 && i + 1 < input.length) {
           const low = input.charCodeAt(i + 1);
           if (low >= 56320 && low <= 57343) {
-            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            output += allowNonAscii ? ch + input[i + 1] : percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
             i++;
           } else {
-            output += percentEncodeNonAscii(65533);
+            output += allowNonAscii ? "�" : percentEncodeNonAscii(65533);
           }
         } else {
-          output += percentEncodeNonAscii(65533);
+          output += allowNonAscii ? "�" : percentEncodeNonAscii(65533);
         }
       }
     }
@@ -42249,7 +42935,7 @@ var require_utils4 = __commonJS(function(exports, module) {
     }
     return;
   }
-  function recomposeAuthority(component) {
+  function recomposeAuthority(component, allowNonAscii = false) {
     const uriTokens = [];
     if (component.userinfo !== undefined) {
       uriTokens.push(encodeUserinfo(component.userinfo));
@@ -42270,7 +42956,7 @@ var require_utils4 = __commonJS(function(exports, module) {
           if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
             host = `[${ipV6res.escapedHost}]`;
           } else {
-            host = reescapeHostDelimiters(host, false);
+            host = encodeHost(host, false, allowNonAscii);
           }
         }
       }
@@ -42292,7 +42978,7 @@ var require_utils4 = __commonJS(function(exports, module) {
     nonSimpleDomain,
     nonSimpleMailtoDomain,
     recomposeAuthority,
-    reescapeHostDelimiters,
+    encodeHost,
     normalizePercentEncoding,
     normalizePathEncoding,
     serializePathEncoding,
@@ -42457,7 +43143,8 @@ var require_schemes = __commonJS(function(exports, module) {
     scheme: "urn",
     parse: urnParse,
     serialize: urnSerialize,
-    skipNormalize: true
+    skipNormalize: true,
+    absolutePath: true
   };
   var urnuuid = {
     scheme: "urn:uuid",
@@ -42736,7 +43423,7 @@ var require_schemes = __commonJS(function(exports, module) {
 
 // node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS(function(exports, module) {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils4();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, encodeHost, isIPv4, nonSimpleDomain } = require_utils4();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   var VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
   var MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
@@ -42760,6 +43447,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
     const {
       parsed: baseParsed,
       malformedAuthorityOrPort: baseMalformed,
+      malformedReferenceEdge: baseMalformedReferenceEdge,
       malformedPercentEncoding: baseMalformedPercentEncoding,
       malformedSchemeSpecific: baseMalformedSchemeSpecific,
       malformedHost: baseMalformedHost,
@@ -42768,17 +43456,21 @@ var require_fast_uri = __commonJS(function(exports, module) {
     const {
       parsed: relativeParsed,
       malformedAuthorityOrPort: relativeMalformed,
+      malformedReferenceEdge: relativeMalformedReferenceEdge,
       malformedPercentEncoding: relativeMalformedPercentEncoding,
       malformedSchemeSpecific: relativeMalformedSchemeSpecific,
       malformedHost: relativeMalformedHost,
       malformedScheme: relativeMalformedScheme
     } = parseWithStatus(relativeURI, schemelessOptions);
-    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
+    if (baseMalformed || relativeMalformed || baseMalformedReferenceEdge || relativeMalformedReferenceEdge || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
       throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
     }
     const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
     const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
     const resolvedHost = resolved.host;
+    if ((resolved.scheme === "http" || resolved.scheme === "https") && !resolvedHost) {
+      throw new Error("HTTP URIs must have a host.");
+    }
     const resolvedHostIsIP = resolvedHost !== undefined && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
     canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
     const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
@@ -42786,6 +43478,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
       throw new Error(resolved.error);
     }
     schemelessOptions.skipEscape = true;
+    if (resolvedSchemeHandler && resolvedSchemeHandler.absolutePath) {
+      schemelessOptions.absolutePath = true;
+    }
     return serialize(resolved, schemelessOptions);
   }
   function copyHost(target, source) {
@@ -42806,7 +43501,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
       target.userinfo = relative.userinfo;
       copyHost(target, relative);
       target.port = relative.port;
-      target.path = removeDotSegments(relative.path || "");
+      const relativeSchemeHandler = getSchemeHandler(relative.scheme);
+      target.path = relativeSchemeHandler && relativeSchemeHandler.absolutePath ? relative.path || "" : removeDotSegments(relative.path || "");
       target.query = relative.query;
     } else {
       if (relative.userinfo !== undefined || relative.host !== undefined || relative.port !== undefined) {
@@ -42895,7 +43591,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
       component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
-    const authority = recomposeAuthority(component);
+    const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+    const authority = recomposeAuthority(component, allowNonAsciiHost);
     if (authority !== undefined) {
       if (options.reference !== "suffix") {
         uriTokens.push("//");
@@ -42981,6 +43678,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
       fragment: undefined
     };
     let malformedAuthorityOrPort = false;
+    const malformedReferenceEdge = uri.length !== 0 && (uri.charCodeAt(0) <= 32 || uri.charCodeAt(uri.length - 1) <= 32);
     let malformedPercentEncoding = false;
     let malformedSchemeSpecific = false;
     let malformedHost = false;
@@ -43013,6 +43711,9 @@ var require_fast_uri = __commonJS(function(exports, module) {
         }
       }
     }
+    if (malformedReferenceEdge) {
+      parsed.error = parsed.error || "URI must not contain leading or trailing C0 controls or spaces.";
+    }
     const matches = uri.match(URI_PARSE);
     if (matches) {
       parsed.scheme = matches[1];
@@ -43079,12 +43780,18 @@ var require_fast_uri = __commonJS(function(exports, module) {
       if (!malformedIPLiteral) {
         malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
       }
-      if (uri.indexOf("%") !== -1 && parsed.host !== undefined && !malformedIPLiteral) {
-        let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
-        if (!isIP) {
+      if (parsed.host !== undefined && !malformedIPLiteral) {
+        let host = parsed.host;
+        if (uri.indexOf("%") !== -1 && !isIP) {
+          host = normalizePercentEncoding(host, true);
           host = normalizePercentEncoding(host.toLowerCase());
         }
-        parsed.host = reescapeHostDelimiters(host, isIP);
+        if (options.scheme !== "null") {
+          const allowNonAsciiHost = options.unicodeSupport === true || Boolean(schemeHandler && schemeHandler.unicodeSupport);
+          parsed.host = encodeHost(host, isIP, allowNonAsciiHost);
+        } else {
+          parsed.host = host;
+        }
       }
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (parsed.path) {
@@ -43106,7 +43813,7 @@ var require_fast_uri = __commonJS(function(exports, module) {
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
+    return { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse(uri, opts) {
     return parseWithStatus(uri, opts).parsed;
@@ -43115,10 +43822,11 @@ var require_fast_uri = __commonJS(function(exports, module) {
     return normalizeStringWithStatus(uri, opts).normalized;
   }
   function normalizeStringWithStatus(uri, opts) {
-    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
+    const { parsed, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
     return {
-      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+      normalized: malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
       malformedAuthorityOrPort,
+      malformedReferenceEdge,
       malformedPercentEncoding,
       malformedSchemeSpecific,
       malformedHost,
@@ -43135,8 +43843,8 @@ var require_fast_uri = __commonJS(function(exports, module) {
     } catch {
       return;
     }
-    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
-    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
+    const { normalized, malformedAuthorityOrPort, malformedReferenceEdge, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedReferenceEdge || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? undefined : normalized;
   }
   var fastUri = {
     SCHEMES,
@@ -51369,7 +52077,7 @@ var require_limit = __commonJS(function(exports) {
 });
 
 // node_modules/ajv-formats/dist/index.js
-var require_dist5 = __commonJS(function(exports, module) {
+var require_dist7 = __commonJS(function(exports, module) {
   Object.defineProperty(exports, "__esModule", { value: true });
   var formats_1 = require_formats2();
   var limit_1 = require_limit();
@@ -51447,7 +52155,7 @@ class AjvJsonSchemaValidator {
 var import_ajv, import_ajv_formats;
 var init_ajv_provider = __esm(() => {
   import_ajv = __toESM(require_ajv(), 1);
-  import_ajv_formats = __toESM(require_dist5(), 1);
+  import_ajv_formats = __toESM(require_dist7(), 1);
 });
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/server.js
@@ -51458,6 +52166,62 @@ class ExperimentalServerTasks {
   requestStream(request, resultSchema, options) {
     return this._server.requestStream(request, resultSchema, options);
   }
+  createMessageStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    if ((params.tools || params.toolChoice) && !clientCapabilities?.sampling?.tools) {
+      throw new Error("Client does not support sampling tools capability.");
+    }
+    if (params.messages.length > 0) {
+      const lastMessage = params.messages[params.messages.length - 1];
+      const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+      const hasToolResults = lastContent.some((c) => c.type === "tool_result");
+      const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+      const previousContent = previousMessage ? Array.isArray(previousMessage.content) ? previousMessage.content : [previousMessage.content] : [];
+      const hasPreviousToolUse = previousContent.some((c) => c.type === "tool_use");
+      if (hasToolResults) {
+        if (lastContent.some((c) => c.type !== "tool_result")) {
+          throw new Error("The last message must contain only tool_result content if any is present");
+        }
+        if (!hasPreviousToolUse) {
+          throw new Error("tool_result blocks are not matching any tool_use from the previous message");
+        }
+      }
+      if (hasPreviousToolUse) {
+        const toolUseIds = new Set(previousContent.filter((c) => c.type === "tool_use").map((c) => c.id));
+        const toolResultIds = new Set(lastContent.filter((c) => c.type === "tool_result").map((c) => c.toolUseId));
+        if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every((id) => toolResultIds.has(id))) {
+          throw new Error("ids of tool_result blocks and tool_use blocks from previous message do not match");
+        }
+      }
+    }
+    return this.requestStream({
+      method: "sampling/createMessage",
+      params
+    }, CreateMessageResultSchema, options);
+  }
+  elicitInputStream(params, options) {
+    const clientCapabilities = this._server.getClientCapabilities();
+    const mode = params.mode ?? "form";
+    switch (mode) {
+      case "url": {
+        if (!clientCapabilities?.elicitation?.url) {
+          throw new Error("Client does not support url elicitation.");
+        }
+        break;
+      }
+      case "form": {
+        if (!clientCapabilities?.elicitation?.form) {
+          throw new Error("Client does not support form elicitation.");
+        }
+        break;
+      }
+    }
+    const normalizedParams = mode === "form" && params.mode === undefined ? { ...params, mode: "form" } : params;
+    return this.requestStream({
+      method: "elicitation/create",
+      params: normalizedParams
+    }, ElicitResultSchema, options);
+  }
   async getTask(taskId, options) {
     return this._server.getTask({ taskId }, options);
   }
@@ -51471,6 +52235,9 @@ class ExperimentalServerTasks {
     return this._server.cancelTask({ taskId }, options);
   }
 }
+var init_server = __esm(() => {
+  init_types();
+});
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/experimental/tasks/helpers.js
 function assertToolsCallTaskCapability(requests, method, entityName) {
@@ -51509,11 +52276,12 @@ function assertClientRequestTaskCapability(requests, method, entityName) {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/index.js
 var Server;
-var init_server = __esm(() => {
+var init_server2 = __esm(() => {
   init_protocol();
   init_types();
   init_ajv_provider();
   init_zod_compat();
+  init_server();
   Server = class Server extends Protocol {
     constructor(_serverInfo, options) {
       super(options);
@@ -51561,16 +52329,7 @@ var init_server = __esm(() => {
       if (!methodSchema) {
         throw new Error("Schema is missing a method literal");
       }
-      let methodValue;
-      if (isZ4Schema(methodSchema)) {
-        const v4Schema = methodSchema;
-        const v4Def = v4Schema._zod?.def;
-        methodValue = v4Def?.value ?? v4Schema.value;
-      } else {
-        const v3Schema = methodSchema;
-        const legacyDef = v3Schema._def;
-        methodValue = legacyDef?.value ?? v3Schema.value;
-      }
+      const methodValue = getLiteralValue(methodSchema);
       if (typeof methodValue !== "string") {
         throw new Error("Schema method literal must be a string");
       }
@@ -51939,6 +52698,43 @@ class ExperimentalMcpServerTasks {
 }
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/mcp.js
+function toolInputElementCount(value, max) {
+  let count = 0;
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (node === null || typeof node !== "object")
+      continue;
+    if (Array.isArray(node)) {
+      for (const child of node) {
+        if (++count > max)
+          return count;
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    } else {
+      for (const key in node) {
+        if (!Object.prototype.hasOwnProperty.call(node, key))
+          continue;
+        if (++count > max)
+          return count;
+        const child = node[key];
+        if (child !== null && typeof child === "object")
+          stack.push(child);
+      }
+    }
+  }
+  return count;
+}
+function resolveMaxToolInputElements(value) {
+  if (value === undefined || value === Infinity)
+    return;
+  if (typeof value !== "number" || Number.isNaN(value) || value < 1) {
+    throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+  }
+  return value;
+}
+
 class McpServer {
   constructor(serverInfo, options) {
     this._registeredResources = {};
@@ -51950,6 +52746,7 @@ class McpServer {
     this._resourceHandlersInitialized = false;
     this._promptHandlersInitialized = false;
     this.server = new Server(serverInfo, options);
+    this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
   }
   get experimental() {
     if (!this._experimental) {
@@ -52056,12 +52853,15 @@ class McpServer {
     };
   }
   async validateToolInput(tool, args, toolName) {
+    if (this._maxToolInputElements !== undefined && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) {
+      throw new McpError(ErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
+    }
     if (!tool.inputSchema) {
       return;
     }
     const inputObj = normalizeObjectSchema(tool.inputSchema);
     const schemaToParse = inputObj ?? tool.inputSchema;
-    const parseResult = await safeParseAsync3(schemaToParse, args);
+    const parseResult = await safeParseAsync3(schemaToParse, args ?? {});
     if (!parseResult.success) {
       const error = "error" in parseResult ? parseResult.error : "Unknown error";
       const errorMessage = getParseErrorMessage(error);
@@ -52286,7 +53086,7 @@ class McpServer {
       }
       if (prompt.argsSchema) {
         const argsObj = normalizeObjectSchema(prompt.argsSchema);
-        const parseResult = await safeParseAsync3(argsObj, request.params.arguments);
+        const parseResult = await safeParseAsync3(argsObj, request.params.arguments ?? {});
         if (!parseResult.success) {
           const error = "error" in parseResult ? parseResult.error : "Unknown error";
           const errorMessage = getParseErrorMessage(error);
@@ -52522,6 +53322,9 @@ class McpServer {
           annotations = rest.shift();
         }
       } else if (typeof firstArg === "object" && firstArg !== null) {
+        if (Object.values(firstArg).some((v) => typeof v === "object" && v !== null)) {
+          throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+        }
         annotations = rest.shift();
       }
     }
@@ -52610,6 +53413,9 @@ function getZodSchemaObject(schema) {
   if (isZodRawShapeCompat(schema)) {
     return objectFromShape(schema);
   }
+  if (!isZodSchemaInstance(schema)) {
+    throw new Error("inputSchema must be a Zod schema or raw shape, received an unrecognized object");
+  }
   return schema;
 }
 function promptArgumentsFromSchema(schema) {
@@ -52649,7 +53455,7 @@ function createCompletionResult(suggestions) {
 }
 var EMPTY_OBJECT_JSON_SCHEMA, EMPTY_COMPLETION_RESULT;
 var init_mcp = __esm(() => {
-  init_server();
+  init_server2();
   init_zod_compat();
   init_zod_json_schema_compat();
   init_types();
@@ -52844,9 +53650,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1.0.0",
-    sdkVersion: "0.4.13",
-    genVersion: "2.943.0",
-    userAgent: "speakeasy-sdk/mcp-typescript 0.4.13 2.943.0 1.0.0 @lightsage/mcp"
+    sdkVersion: "0.4.15",
+    genVersion: "2.948.4",
+    userAgent: "speakeasy-sdk/mcp-typescript 0.4.15 2.948.4 1.0.0 @lightsage/mcp"
   };
 });
 
@@ -55927,7 +56733,7 @@ var init_evalRunsList2 = __esm(() => {
     name: "eval-runs-list",
     description: `List Runs
 
-Returns jobs created through \`POST /v2/eval-runs\`, ordered newest first, with lifecycle state and progress.`,
+Returns custom eval runs, ordered newest first, with lifecycle state and progress. Includes scheduled, onboarding, and pull request runs and runs started in the Lightsage app, as well as runs started through \`POST /v2/eval-runs\`.`,
     annotations: {
       title: "",
       destructiveHint: false,
@@ -58370,12 +59176,13 @@ var init_createevaltemplaterequest = __esm(() => {
     judges: array(GraderDefinition$zodSchema).optional().describe("Judge definitions copied when `judges` is included. May be empty to explicitly create the eval without template judges."),
     name: string2().describe("Organization-visible name for this reusable template."),
     persona: string2().optional().describe("Optional persona copied when `persona` is included."),
+    prompt: string2().optional().describe('Prompt filled into the new eval form when the template is applied, or the scenario for Agent Preference, where `{{"{{"}}competitor_name}}` names the brand each comparison is against. Requests that create evals from a template still supply their own prompts.'),
     runs_per_execution: int().default(1).describe("Attempt count copied when `runs` is included."),
     runtime: EvalTemplateRuntime$zodSchema.optional().describe("Reusable runtime resources copied into each created eval."),
     schedule: EvalTemplateSchedule$zodSchema.optional().describe("Schedule copied into every eval created from the template."),
     tag: string2().optional().describe("Optional tag copied when `tag` is included."),
     target_keys: array(string2()).optional().describe("Runnable target keys copied when `targets` is included, such as `agent:codex:gpt-5.6-terra`.")
-  }).describe("Create reusable configuration before supplying prompt-specific evals.");
+  }).describe("Create a reusable eval that can be applied to many brands or prompts.");
 });
 
 // src/funcs/evalTemplatesCreate.ts
@@ -58530,6 +59337,7 @@ var init_evaltemplate = __esm(() => {
     name: string2().describe("Organization-visible name for this reusable template."),
     org_id: string2(),
     persona: string2().nullable().optional().describe("Optional persona copied when `persona` is included."),
+    prompt: string2().nullable().optional().describe('Prompt filled into the new eval form when the template is applied, or the scenario for Agent Preference, where `{{"{{"}}competitor_name}}` names the brand each comparison is against. Requests that create evals from a template still supply their own prompts.'),
     runs_per_execution: int().default(1).describe("Attempt count copied when `runs` is included."),
     runtime: EvalTemplateRuntime$zodSchema.optional().describe("Reusable runtime resources copied into each created eval."),
     schedule: EvalTemplateSchedule$zodSchema.optional().describe("Schedule copied into every eval created from the template."),
@@ -58940,6 +59748,7 @@ var init_updateevaltemplaterequest = __esm(() => {
     judges: array(GraderDefinition$zodSchema).nullable().optional(),
     name: string2().optional(),
     persona: string2().optional(),
+    prompt: string2().optional(),
     runs_per_execution: int().optional(),
     runtime: EvalTemplateRuntime$zodSchema.nullable().optional(),
     schedule: EvalTemplateSchedule$zodSchema.nullable().optional(),
@@ -62771,15 +63580,24 @@ Checks API liveness without authentication. Use \`GET /v2/auth/status\` to valid
 });
 
 // src/models/v2publictask.ts
-var V2PublicTask$zodSchema, V2PublicTask$zodSchemaOutbound;
+var ContentStatus$zodSchema, V2PublicTask$zodSchema, V2PublicTask$zodSchemaOutbound;
 var init_v2publictask = __esm(() => {
   init_zod();
   init_schemas4();
+  ContentStatus$zodSchema = _enum([
+    "none",
+    "writing",
+    "ready",
+    "failed"
+  ]).describe("Progress of the Markdown write-up in `content`.");
   V2PublicTask$zodSchema = collectExtraKeys(object({
     action_date: string2(),
     action_type: string2().nullable().optional(),
     assignee_user_id: string2().nullable().optional(),
     batch_number: int(),
+    content: string2().nullable().optional().describe("The task's Markdown write-up covering what went wrong, how to fix it, the impact, and the evidence. Null until the write-up is generated; see `content_status`."),
+    content_status: ContentStatus$zodSchema.default("none").describe("Progress of the Markdown write-up in `content`."),
+    content_written_at: string2().nullable().optional().describe("When the write-up in `content` was last generated."),
     created_at: string2().nullable().optional(),
     description: string2().nullable().optional(),
     effort: string2().describe("A free-form effort estimate such as `Low` or `Medium`; this field is not an enum."),
@@ -62797,7 +63615,8 @@ var init_v2publictask = __esm(() => {
     source_key: string2().describe("A finding key namespaced by source, such as `api_perf:https://example.com/docs/cli`."),
     source_refs: record(string2(), any()).optional().describe("Source references needed to understand or execute the task."),
     source_type: string2().nullable().optional().describe("A free-form source type such as `api_performance`; manually created tasks may not have a source."),
-    status: string2().describe("The workflow status. New tasks start as `new`; `added_to_sheet` and `snoozed` tasks are listed only when `status=all`."),
+    status: string2().describe("The workflow status. New tasks start as `new`. A task is `in_review` while its content waits to go live, as an open pull request or a CMS draft; it is listed with `in_progress` tasks. `added_to_sheet` and `snoozed` tasks are listed only when `status=all`."),
+    target_url: string2().nullable().optional().describe("The page the fix should be made on, when the task targets one."),
     task_type: string2().describe("A free-form label such as `Redirect` or `Docs`; this field is not an enum."),
     title: string2(),
     updated_at: string2().nullable().optional(),
@@ -62809,6 +63628,9 @@ var init_v2publictask = __esm(() => {
     action_type: nullable(string2()).optional(),
     assignee_user_id: nullable(string2()).optional(),
     batch_number: int(),
+    content: nullable(string2()).optional(),
+    content_status: ContentStatus$zodSchema.default("none"),
+    content_written_at: nullable(string2()).optional(),
     created_at: nullable(string2()).optional(),
     description: nullable(string2()).optional(),
     effort: string2(),
@@ -62827,6 +63649,7 @@ var init_v2publictask = __esm(() => {
     source_refs: record(string2(), any()).optional(),
     source_type: nullable(string2()).optional(),
     status: string2(),
+    target_url: nullable(string2()).optional(),
     task_type: string2(),
     title: string2(),
     updated_at: nullable(string2()).optional(),
@@ -64117,7 +64940,7 @@ function createMCPServer(deps) {
       sizes: ["any"]
     }],
     name: "LightsageMcp",
-    version: "0.4.13"
+    version: "0.4.15"
   });
   const getClient = deps.getSDK || (() => new LightsageMcpCore({
     security: deps.security,
@@ -64206,7 +65029,7 @@ function createMCPServer(deps) {
   }
   return { server, tools };
 }
-var init_server2 = __esm(() => {
+var init_server3 = __esm(() => {
   init_mcp();
   init_core3();
   init_resources();
@@ -64535,7 +65358,7 @@ Soft-deletes an Eval template. Evals previously created from it remain independe
     },
     {
       name: "eval-runs-list",
-      description: "List Runs\n\nReturns jobs created through `POST /v2/eval-runs`, ordered newest first, with lifecycle state and progress."
+      description: "List Runs\n\nReturns custom eval runs, ordered newest first, with lifecycle state and progress. Includes scheduled, onboarding, and pull request runs and runs started in the Lightsage app, as well as runs started through `POST /v2/eval-runs`."
     },
     {
       name: "agent-preference-competitors-list",
@@ -65541,7 +66364,7 @@ http_headers = { "lightsage-api-key-auth" = "YOUR_LIGHTSAGE_API_KEY_AUTH" }`;
         <h1>Instructions</h1>
         <p>One-click installation for Claude Desktop users</p>
         <div class="instruction-item">
-          <a href="https://github.com/lightsagehq/mcp/releases/download/v0.4.13/mcp-server.mcpb" download="mcp-server.mcpb" class="action-button header-action" style="display: inline-flex; margin-bottom: 16px;">
+          <a href="https://github.com/lightsagehq/mcp/releases/download/v0.4.15/mcp-server.mcpb" download="mcp-server.mcpb" class="action-button header-action" style="display: inline-flex; margin-bottom: 16px;">
             \uD83D\uDCE5 Download MCP Bundle
           </a>
         </div>
@@ -65761,7 +66584,7 @@ var import_express;
 var init_impl = __esm(() => {
   init_streamableHttp();
   init_console_logger();
-  init_server2();
+  init_server3();
   init_tools();
   init_tools();
   init_landing_page();
@@ -65770,6 +66593,7 @@ var init_impl = __esm(() => {
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/sse.js
 import { randomUUID } from "node:crypto";
+import { TLSSocket } from "node:tls";
 import { URL as URL2 } from "node:url";
 
 class SSEServerTransport {
@@ -65833,10 +66657,16 @@ data: ${relativeUrlWithSession}
       return;
     }
     const authInfo = req.auth;
-    const requestInfo = { headers: req.headers };
+    const host = req.headers.host;
+    const protocol = req.socket instanceof TLSSocket ? "https" : "http";
+    const fullUrl = host && req.url ? new URL2(req.url, `${protocol}://${host}`) : undefined;
+    const requestInfo = {
+      headers: req.headers,
+      url: fullUrl
+    };
     let body;
     try {
-      const ct = import_content_type.default.parse(req.headers["content-type"] ?? "");
+      const ct = $parse(req.headers["content-type"] ?? "");
       if (ct.type !== "application/json") {
         throw new Error(`Unsupported content-type: ${ct.type}`);
       }
@@ -65885,16 +66715,24 @@ data: ${JSON.stringify(message)}
     return this._sessionId;
   }
 }
-var import_raw_body, import_content_type, MAXIMUM_MESSAGE_SIZE = "4mb";
+var import_raw_body, MAXIMUM_MESSAGE_SIZE = "4mb";
 var init_sse = __esm(() => {
   init_types();
+  init_content_type();
   import_raw_body = __toESM(require_raw_body(), 1);
-  import_content_type = __toESM(require_content_type(), 1);
 });
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js
 class ReadBuffer {
+  constructor(options) {
+    this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+  }
   append(chunk) {
+    const newSize = (this._buffer?.length ?? 0) + chunk.length;
+    if (newSize > this._maxBufferSize) {
+      this.clear();
+      throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+    }
     this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
   }
   readMessage() {
@@ -65921,26 +66759,33 @@ function serializeMessage(message) {
   return JSON.stringify(message) + `
 `;
 }
+var STDIO_DEFAULT_MAX_BUFFER_SIZE;
 var init_stdio = __esm(() => {
   init_types();
+  STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 });
 
 // node_modules/@modelcontextprotocol/sdk/dist/esm/server/stdio.js
 import process2 from "node:process";
 
 class StdioServerTransport {
-  constructor(_stdin = process2.stdin, _stdout = process2.stdout) {
+  constructor(_stdin = process2.stdin, _stdout = process2.stdout, options) {
     this._stdin = _stdin;
     this._stdout = _stdout;
-    this._readBuffer = new ReadBuffer;
     this._started = false;
     this._ondata = (chunk) => {
-      this._readBuffer.append(chunk);
-      this.processReadBuffer();
+      try {
+        this._readBuffer.append(chunk);
+        this.processReadBuffer();
+      } catch (error) {
+        this.onerror?.(error);
+        this.close().catch(() => {});
+      }
     };
     this._onerror = (error) => {
       this.onerror?.(error);
     };
+    this._readBuffer = new ReadBuffer({ maxBufferSize: options?.maxBufferSize });
   }
   async start() {
     if (this._started) {
@@ -66147,7 +66992,7 @@ var init_impl2 = __esm(() => {
   init_sse();
   init_stdio2();
   init_console_logger();
-  init_server2();
+  init_server3();
   init_tools();
   init_landing_page();
   import_express2 = __toESM(require_express(), 1);
@@ -68419,7 +69264,7 @@ var routes = buildRouteMap({
 var app = buildApplication(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.4.13"
+    currentVersion: "0.4.15"
   }
 });
 run(app, process3.argv.slice(2), buildContext(process3));
@@ -68427,5 +69272,5 @@ export {
   app
 };
 
-//# debugId=D0F84367AD5BED5264756E2164756E21
+//# debugId=E3C4ACAC8665A9C164756E2164756E21
 //# sourceMappingURL=mcp-server.js.map