@mcp-use/inspector 20.0.0-beta.17 → 20.0.0-beta.19

package/dist/cli.js

@@ -1,298 +1,21 @@
 #!/usr/bin/env node
-
-// src/server/cli.ts
-import { serve } from "@hono/node-server";
-import { Hono } from "hono";
-import { cors as cors2 } from "hono/cors";
-import open from "open";
-
-// src/server/favicon-links.ts
-var FAVICON_CACHE_VERSION = "4";
-function renderInspectorFaviconLinks(basePath = "") {
-  const prefix = basePath.replace(/\/$/, "");
-  const href = `${prefix}/favicon-black.svg?v=${FAVICON_CACHE_VERSION}`;
-  return `<link rel="icon" type="image/svg+xml" href="${href}" />`;
-}
-
-// src/server/static-assets.ts
-import { existsSync, readFileSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-var CONTENT_TYPES = {
-  ".js": "application/javascript",
-  ".css": "text/css",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".ico": "image/x-icon",
-  ".webmanifest": "application/manifest+json"
-};
-function resolveInspectorAppDir() {
-  const here = path.dirname(fileURLToPath(import.meta.url));
-  for (const dir of [
-    path.resolve(here, "app"),
-    // dist/cli.js (bundled)
-    path.resolve(here, "../app"),
-    // dist/server/*.js
-    path.resolve(here, "../../dist/app")
-    // src/server/*.ts (workspace dev)
-  ]) {
-    if (existsSync(path.join(dir, "inspector.js"))) {
-      return dir;
-    }
-  }
-  throw new Error(
-    "Inspector bundle not found (expected dist/app/inspector.js)"
-  );
-}
-function registerInspectorStaticAssets(app2, mountPath = "/inspector/assets") {
-  const appDir = resolveInspectorAppDir();
-  app2.get(`${mountPath}/*`, (c) => {
-    const subPath = c.req.path.slice(mountPath.length);
-    const relative = subPath.startsWith("/") ? subPath.slice(1) : subPath;
-    if (!relative || relative.includes("..")) {
-      return c.notFound();
-    }
-    const file = path.resolve(appDir, relative);
-    const root = appDir.endsWith(path.sep) ? appDir : `${appDir}${path.sep}`;
-    if (!file.startsWith(root) || !existsSync(file)) {
-      return c.notFound();
-    }
-    const ext = path.extname(file);
-    return c.body(readFileSync(file), 200, {
-      "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-      // Standalone assets use stable URLs across CLI restarts. Revalidate them
-      // so a rebuilt or upgraded Inspector cannot keep running an hour-old UI
-      // bundle that predates its storage migrations or proxy contract.
-      "Cache-Control": "no-cache"
-    });
-  });
-}
-
-// package.json
-var package_default = {
-  name: "@mcp-use/inspector",
-  type: "module",
-  version: "20.0.0-beta.16",
-  description: "MCP Inspector - A tool for inspecting and debugging MCP servers",
-  author: "",
-  license: "MIT",
-  homepage: "https://github.com/mcp-use/mcp-use#readme",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/mcp-use/mcp-use.git",
-    directory: "libraries/typescript/packages/inspector"
-  },
-  bugs: {
-    url: "https://github.com/mcp-use/mcp-use/issues"
-  },
-  keywords: [
-    "mcp",
-    "inspector",
-    "debug",
-    "tools"
-  ],
-  exports: {
-    ".": {
-      types: "./dist/server/index.d.ts",
-      import: "./dist/server/index.js",
-      default: "./dist/server/index.js"
-    },
-    "./dev": {
-      types: "./dist/server/index.d.ts",
-      import: "./dist/server/index.js",
-      default: "./dist/server/index.js"
-    },
-    "./proxy": {
-      types: "./dist/server/proxy-routes.d.ts",
-      import: "./dist/server/proxy-routes.js"
-    },
-    "./client": {
-      types: "./dist/client/index.d.ts",
-      import: "./dist/client/index.js"
-    }
-  },
-  main: "./dist/server/index.js",
-  types: "./dist/server/index.d.ts",
-  bin: {
-    "mcp-inspect": "./dist/cli.js"
-  },
-  files: [
-    "dist"
-  ],
-  scripts: {
-    dev: "rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort",
-    "dev:client": "pnpm run dev",
-    "dev:server": "VITE_DEV=true tsx watch src/server/server.ts",
-    "dev:standalone": "tsx watch src/server/server.ts",
-    clean: "rimraf dist",
-    build: "npm run clean && npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:app",
-    "build:app": "vite build --config vite.app.config.ts",
-    "watch:app": "vite build --watch --config vite.app.config.ts",
-    "preview:app": "vite preview --config vite.app.config.ts --host 127.0.0.1",
-    "serve:app": "pnpm build:app && pnpm preview:app",
-    "analyze:app": "ANALYZE=true vite build --config vite.app.config.ts",
-    "build:client": "vite build",
-    "build:client-exports": "tsup --config tsup.client.ts && tsc -p tsconfig.client.json --emitDeclarationOnly --declaration",
-    "build:server": "tsup 'src/server/**/*.ts' --format esm --out-dir dist/server && tsc -p tsconfig.server.json --emitDeclarationOnly --declaration",
-    "build:cli": "tsup src/server/cli.ts --format esm --out-dir dist/",
-    prepublishOnly: "pnpm --filter @mcp-use/client build && pnpm build",
-    start: "node dist/cli.js --port 3000",
-    preview: "vite preview",
-    "type-check": "tsc --noEmit",
-    lint: "eslint .",
-    "lint:fix": "eslint . --fix",
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui",
-    "test:e2e:debug": "playwright test --debug",
-    "test:e2e:builtin": "node tests/e2e/scripts/run-test-matrix.mjs builtin",
-    "test:e2e:prod": "node tests/e2e/scripts/run-test-matrix.mjs prod",
-    "test:e2e:mix": "node tests/e2e/scripts/run-test-matrix.mjs mix",
-    "test:e2e:prod:ui": "TEST_MODE=production playwright test --ui",
-    "test:e2e:codegen": "playwright codegen http://localhost:3000/inspector",
-    "test:e2e:report": "playwright show-report",
-    "test:e2e:python": "node tests/e2e/scripts/run-python-e2e.mjs",
-    "test:unit": "vitest run",
-    "test:unit:watch": "vitest",
-    "test:e2e:tunnel": "node tests/e2e/scripts/run-tunnel-test.mjs",
-    "install:pnpm": "pnpm install",
-    "install:npm": "npm install",
-    "lint:npm": "npm run lint:fix",
-    "lint:pnpm": "pnpm lint:fix"
-  },
-  engines: {
-    node: ">=22.22.2"
-  },
-  peerDependencies: {
-    "@mcp-use/client": "^2.0.0-alpha.0",
-    express: "^4.21.2 || ^5.0.0",
-    react: "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0",
-    "react-router": "^7.12.0"
-  },
-  peerDependenciesMeta: {
-    "@mcp-use/client": {
-      optional: true
-    },
-    express: {
-      optional: true
-    },
-    react: {
-      optional: true
-    },
-    "react-dom": {
-      optional: true
-    },
-    "react-router": {
-      optional: true
-    }
-  },
-  dependencies: {
-    "@base-ui/react": "^1.6.0",
-    "@hono/node-server": "^1.19.13",
-    "@mcp-use/agent": "workspace:*",
-    "@mcp-use/client": "workspace:*",
-    "class-variance-authority": "^0.7.1",
-    clsx: "^2.1.1",
-    hono: "^4.12.12",
-    "lucide-react": "^0.562.0",
-    "markdown-to-jsx": "^9.7.4",
-    motion: "^12.34.2",
-    open: "^11.0.0",
-    "react-resizable-panels": "^4.6.4",
-    sonner: "^2.0.7",
-    "tailwind-merge": "^3.5.0"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  devDependencies: {
-    "@playwright/test": "^1.58.2",
-    "@tailwindcss/vite": "^4.2.0",
-    "@types/express": "^5.0.6",
-    "mcp-use": "workspace:*",
-    "@vitejs/plugin-react": "^6.0.0",
-    emulate: "0.5.0",
-    eslint: "^9.39.2",
-    express: "^5.2.1",
-    "oauth2-mock-server": "^8.2.2",
-    react: "^19.2.3",
-    "react-dom": "^19.2.3",
-    "react-router": "^7.12.0",
-    "rollup-plugin-visualizer": "^6.0.3",
-    tailwindcss: "^4.2.0",
-    tsup: "^8.5.1",
-    tsx: "^4.21.0",
-    "tw-animate-css": "^1.4.0",
-    typescript: "^5.9.3",
-    vite: "^8.0.16",
-    vitest: "^4.1.0",
-    "wait-on": "^9.0.4",
-    zod: "^4.2.0"
-  }
-};
-
-// src/server/version.ts
-var VERSION = package_default.version;
-function getInspectorVersion() {
-  return VERSION;
-}
-
-// src/server/inspector-shell.ts
-var INSPECTOR_VERSION = getInspectorVersion();
-var OAUTH_POPUP_CLOSED_HTML = `<!doctype html>
+import{createServer as qr}from"http";import{Http2ServerRequest as yt,constants as zr}from"http2";import{Http2ServerRequest as _e}from"http2";import{Readable as mt}from"stream";import rn from"crypto";var N=class extends Error{constructor(e,t){super(e,t),this.name="RequestError"}},Wr=e=>e instanceof N?e:new N(e.message,{cause:e}),Vr=global.Request,Z=class extends Vr{constructor(e,t){typeof e=="object"&&V in e&&(e=e[V]()),typeof t?.body?.getReader<"u"&&(t.duplex??="half"),super(e,t)}},Gr=e=>{let t=[],r=e.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:o,[n+1]:s}=r;o.charCodeAt(0)!==58&&t.push([o,s])}return new Headers(t)},bt=Symbol("wrapBodyStream"),Kr=(e,t,r,n,o)=>{let s={method:e,headers:r,signal:o.signal};if(e==="TRACE"){s.method="GET";let i=new Z(t,s);return Object.defineProperty(i,"method",{get(){return"TRACE"}}),i}if(!(e==="GET"||e==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(i){i.enqueue(n.rawBody),i.close()}});else if(n[bt]){let i;s.body=new ReadableStream({async pull(a){try{i||=mt.toWeb(n).getReader();let{done:c,value:l}=await i.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=mt.toWeb(n);return new Z(t,s)},V=Symbol("getRequestCache"),Xr=Symbol("requestCache"),ae=Symbol("incomingKey"),ce=Symbol("urlKey"),Jr=Symbol("headersKey"),W=Symbol("abortControllerKey"),Yr=Symbol("getAbortController"),le={get method(){return this[ae].method||"GET"},get url(){return this[ce]},get headers(){return this[Jr]||=Gr(this[ae])},[Yr](){return this[V](),this[W]},[V](){return this[W]||=new AbortController,this[Xr]||=Kr(this.method,this[ce],this.headers,this[ae],this[W])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(e=>{Object.defineProperty(le,e,{get(){return this[V]()[e]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(e=>{Object.defineProperty(le,e,{value:function(){return this[V]()[e]()}})});Object.setPrototypeOf(le,Z.prototype);var Qr=(e,t)=>{let r=Object.create(le);r[ae]=e;let n=e.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(e instanceof _e)throw new N("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[ce]=a.href}catch(a){throw new N("Invalid absolute URL",{cause:a})}return r}let o=(e instanceof _e?e.authority:e.headers.host)||t;if(!o)throw new N("Missing host header");let s;if(e instanceof _e){if(s=e.scheme,!(s==="http"||s==="https"))throw new N("Unsupported scheme")}else s=e.socket&&e.socket.encrypted?"https":"http";let i=new URL(`${s}://${o}${n}`);if(i.hostname.length!==o.length&&i.hostname!==o.replace(/:\d+$/,""))throw new N("Invalid host header");return r[ce]=i.href,r},gt=Symbol("responseCache"),z=Symbol("getResponseCache"),$=Symbol("cache"),Ue=global.Response,ee=class vt{#t;#e;[z](){return delete this[$],this[gt]||=new Ue(this.#t,this.#e)}constructor(t,r){let n;if(this.#t=t,r instanceof vt){let o=r[gt];if(o){this.#e=o,this[z]();return}else this.#e=r.#e,n=new Headers(r.#e.headers)}else this.#e=r;(typeof t=="string"||typeof t?.getReader<"u"||t instanceof Blob||t instanceof Uint8Array)&&(this[$]=[r?.status||200,t,n||r?.headers])}get headers(){let t=this[$];return t?(t[2]instanceof Headers||(t[2]=new Headers(t[2]||{"content-type":"text/plain; charset=UTF-8"})),t[2]):this[z]().headers}get status(){return this[$]?.[0]??this[z]().status}get ok(){let t=this.status;return t>=200&&t<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(e=>{Object.defineProperty(ee.prototype,e,{get(){return this[z]()[e]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(e=>{Object.defineProperty(ee.prototype,e,{value:function(){return this[z]()[e]()}})});Object.setPrototypeOf(ee,Ue);Object.setPrototypeOf(ee.prototype,Ue.prototype);async function Zr(e){return Promise.race([e,Promise.resolve().then(()=>Promise.resolve(void 0))])}function xt(e,t,r){let n=a=>{e.cancel(a).catch(()=>{})};return t.on("close",n),t.on("error",n),(r??e.read()).then(i,o),e.closed.finally(()=>{t.off("close",n),t.off("error",n)});function o(a){a&&t.destroy(a)}function s(){e.read().then(i,o)}function i({done:a,value:c}){try{if(a)t.end();else if(!t.write(c))t.once("drain",s);else return e.read().then(i,o)}catch(l){o(l)}}}function en(e,t){if(e.locked)throw new TypeError("ReadableStream is locked.");return t.destroyed?void 0:xt(e.getReader(),t)}var Le=e=>{let t={};e instanceof Headers||(e=new Headers(e??void 0));let r=[];for(let[n,o]of e)n==="set-cookie"?r.push(o):t[n]=o;return r.length>0&&(t["set-cookie"]=r),t["content-type"]??="text/plain; charset=UTF-8",t},tn="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=rn);var Me=Symbol("outgoingEnded"),wt=Symbol("incomingDraining"),nn=500,on=64*1024*1024,Te=e=>{let t=e;if(e.destroyed||t[wt])return;if(t[wt]=!0,e instanceof yt){try{e.stream?.close?.(zr.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(s),e.off("data",i),e.off("end",n),e.off("error",n)},o=()=>{n();let a=e.socket;a&&!a.destroyed&&a.destroySoon()},s=setTimeout(o,nn);s.unref?.();let i=a=>{r+=a.length,r>on&&o()};e.on("data",i),e.on("end",n),e.on("error",n),e.resume()},sn=()=>new Response(null,{status:400}),Rt=e=>new Response(null,{status:e instanceof Error&&(e.name==="TimeoutError"||e.constructor.name==="TimeoutError")?504:500}),ke=(e,t)=>{let r=e instanceof Error?e:new Error("unknown error",{cause:e});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(e),t.headersSent||t.writeHead(500,{"Content-Type":"text/plain"}),t.end(`Error: ${r.message}`),t.destroy(r))},Et=e=>{"flushHeaders"in e&&e.writable&&e.flushHeaders()},St=async(e,t)=>{let[r,n,o]=e[$],s=!1;if(!o)o={"content-type":"text/plain; charset=UTF-8"};else if(o instanceof Headers)s=o.has("content-length"),o=Le(o);else if(Array.isArray(o)){let i=new Headers(o);s=i.has("content-length"),o=Le(i)}else for(let i in o)if(i.length===14&&i.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?o["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?o["Content-Length"]=n.byteLength:n instanceof Blob&&(o["Content-Length"]=n.size)),t.writeHead(r,o),typeof n=="string"||n instanceof Uint8Array?t.end(n):n instanceof Blob?t.end(new Uint8Array(await n.arrayBuffer())):(Et(t),await en(n,t)?.catch(i=>ke(i,t))),t[Me]?.()},an=e=>typeof e.then=="function",cn=async(e,t,r={})=>{if(an(e))if(r.errorHandler)try{e=await e}catch(o){let s=await r.errorHandler(o);if(!s)return;e=s}else e=await e.catch(Rt);if($ in e)return St(e,t);let n=Le(e.headers);if(e.body){let o=e.body.getReader(),s=[],i=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=o.read();let u=await Zr(a).catch(d=>{console.error(d),i=!0});if(!u){if(l===1){await new Promise(d=>setTimeout(d)),c=3;continue}break}if(a=void 0,u.value&&s.push(u.value),u.done){i=!0;break}}i&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,u)=>l+u.length,0))}t.writeHead(e.status,n),s.forEach(c=>{t.write(c)}),i?t.end():(s.length===0&&Et(t),await xt(o,t,a))}else n[tn]||(t.writeHead(e.status,n),t.end());t[Me]?.()},ln=(e,t={})=>{let r=t.autoCleanupIncoming??!0;return t.overrideGlobalObjects!==!1&&global.Request!==Z&&(Object.defineProperty(global,"Request",{value:Z}),Object.defineProperty(global,"Response",{value:ee})),async(n,o)=>{let s,i;try{i=Qr(n,t.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[bt]=!0,n.on("end",()=>{a=!0}),n instanceof yt&&(o[Me]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{Te(n)})})}),o.on("finish",()=>{a||Te(n)})),o.on("close",()=>{i[W]&&(n.errored?i[W].abort(n.errored.toString()):o.writableFinished||i[W].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{Te(n)})})}),s=e(i,{incoming:n,outgoing:o}),$ in s)return St(s,o)}catch(a){if(s)return ke(a,o);if(t.errorHandler){if(s=await t.errorHandler(i?a:Wr(a)),!s)return}else i?s=Rt(a):s=sn()}try{return await cn(s,o,t)}catch(a){return ke(a,o)}}},un=e=>{let t=e.fetch,r=ln(t,{hostname:e.hostname,overrideGlobalObjects:e.overrideGlobalObjects,autoCleanupIncoming:e.autoCleanupIncoming});return(e.createServer||qr)(e.serverOptions||{},r)},Pt=(e,t)=>{let r=un(e);return r.listen(e?.port??3e3,e.hostname,()=>{let n=r.address();t&&t(n)}),r};var Ie=(e,t,r)=>(n,o)=>{let s=-1;return i(0);async function i(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,u;if(e[a]?(u=e[a][0][0],n.req.routeIndex=a):u=a===e.length&&o||void 0,u)try{c=await u(n,()=>i(a+1))}catch(d){if(d instanceof Error&&t)n.error=d,c=await t(d,n),l=!0;else throw d}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var At=Symbol();var Ct=async(e,t=Object.create(null))=>{let{all:r=!1,dot:n=!1}=t,s=(e instanceof ue?e.raw.headers:e.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?dn(e,{all:r,dot:n}):{}};async function dn(e,t){let r=await e.formData();return r?pn(r,t):{}}function pn(e,t){let r=Object.create(null);return e.forEach((n,o)=>{t.all||o.endsWith("[]")?fn(r,o,n):r[o]=n}),t.dot&&Object.entries(r).forEach(([n,o])=>{n.includes(".")&&(hn(r,n,o),delete r[n])}),r}var fn=(e,t,r)=>{e[t]!==void 0?Array.isArray(e[t])?e[t].push(r):e[t]=[e[t],r]:t.endsWith("[]")?e[t]=[r]:e[t]=r},hn=(e,t,r)=>{if(/(?:^|\.)__proto__\./.test(t))return;let n=e,o=t.split(".");o.forEach((s,i)=>{i===o.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var je=e=>{let t=e.split("/");return t[0]===""&&t.shift(),t},Ot=e=>{let{groups:t,path:r}=mn(e),n=je(r);return gn(n,t)},mn=e=>{let t=[];return e=e.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return t.push([o,r]),o}),{groups:t,path:e}},gn=(e,t)=>{for(let r=t.length-1;r>=0;r--){let[n]=t[r];for(let o=e.length-1;o>=0;o--)if(e[o].includes(n)){e[o]=e[o].replace(n,t[r][1]);break}}return e},de={},_t=(e,t)=>{if(e==="*")return"*";let r=e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${e}#${t}`;return de[n]||(r[2]?de[n]=t&&t[0]!==":"&&t[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${t})`)]:[e,r[1],new RegExp(`^${r[2]}$`)]:de[n]=[e,r[1],!0]),de[n]}return null},pe=(e,t)=>{try{return t(e)}catch{return e.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return t(r)}catch{return r}})}},wn=e=>pe(e,decodeURI),Ne=e=>{let t=e.url,r=t.indexOf("/",t.indexOf(":")+4),n=r;for(;n<t.length;n++){let o=t.charCodeAt(n);if(o===37){let s=t.indexOf("?",n),i=t.indexOf("#",n),a=s===-1?i===-1?void 0:i:i===-1?s:Math.min(s,i),c=t.slice(r,a);return wn(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return t.slice(r,n)};var Tt=e=>{let t=Ne(e);return t.length>1&&t.at(-1)==="/"?t.slice(0,-1):t},H=(e,t,...r)=>(r.length&&(t=H(t,...r)),`${e?.[0]==="/"?"":"/"}${e}${t==="/"?"":`${e?.at(-1)==="/"?"":"/"}${t?.[0]==="/"?t.slice(1):t}`}`),fe=e=>{if(e.charCodeAt(e.length-1)!==63||!e.includes(":"))return null;let t=e.split("/"),r=[],n="";return t.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(/\?/.test(o)){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.replace("?","");n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,i)=>i.indexOf(o)===s)},He=e=>/[%+]/.test(e)?(e.indexOf("+")!==-1&&(e=e.replace(/\+/g," ")),e.indexOf("%")!==-1?pe(e,$e):e):e,Lt=(e,t,r)=>{let n;if(!r&&t&&!/[%+]/.test(t)){let i=e.indexOf("?",8);if(i===-1)return;for(e.startsWith(t,i+1)||(i=e.indexOf(`&${t}`,i+1));i!==-1;){let a=e.charCodeAt(i+t.length+1);if(a===61){let c=i+t.length+2,l=e.indexOf("&",c);return He(e.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";i=e.indexOf(`&${t}`,i+1)}if(n=/[%+]/.test(e),!n)return}let o={};n??=/[%+]/.test(e);let s=e.indexOf("?",8);for(;s!==-1;){let i=e.indexOf("&",s+1),a=e.indexOf("=",s);a>i&&i!==-1&&(a=-1);let c=e.slice(s+1,a===-1?i===-1?void 0:i:a);if(n&&(c=He(c)),s=i,c==="")continue;let l;a===-1?l="":(l=e.slice(a+1,i===-1?void 0:i),n&&(l=He(l))),r?(o[c]&&Array.isArray(o[c])||(o[c]=[]),o[c].push(l)):o[c]??=l}return t?o[t]:o},kt=Lt,Ut=(e,t)=>Lt(e,t,!0),$e=decodeURIComponent;var Mt=e=>pe(e,$e),ue=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(e,t="/",r=[[]]){this.raw=e,this.path=t,this.#e=r,this.#t={}}param(e){return e?this.#r(e):this.#s()}#r(e){let t=this.#e[0][this.routeIndex][1][e],r=this.#o(t);return r&&/\%/.test(r)?Mt(r):r}#s(){let e={},t=Object.keys(this.#e[0][this.routeIndex][1]);for(let r of t){let n=this.#o(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(e[r]=/\%/.test(n)?Mt(n):n)}return e}#o(e){return this.#e[1]?this.#e[1][e]:e}query(e){return kt(this.url,e)}queries(e){return Ut(this.url,e)}header(e){if(e)return this.raw.headers.get(e)??void 0;let t={};return this.raw.headers.forEach((r,n)=>{t[n]=r}),t}async parseBody(e){return Ct(this,e)}#n=e=>{let{bodyCache:t,raw:r}=this,n=t[e];if(n)return n;let o=Object.keys(t)[0];return o?t[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[e]())):t[e]=r[e]()};json(){return this.#n("text").then(e=>JSON.parse(e))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(e=>new Uint8Array(e))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(e,t){this.#t[e]=t}valid(e){return this.#t[e]}get url(){return this.raw.url}get method(){return this.raw.method}get[At](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,e]])=>e)}get routePath(){return this.#e[0].map(([[,e]])=>e)[this.routeIndex].path}};var It={Stringify:1,BeforeStream:2,Stream:3},yn=(e,t)=>{let r=new String(e);return r.isEscaped=!0,r.callbacks=t,r};var Be=async(e,t,r,n,o)=>{typeof e=="object"&&!(e instanceof String)&&(e instanceof Promise||(e=e.toString()),e instanceof Promise&&(e=await e));let s=e.callbacks;if(!s?.length)return Promise.resolve(e);o?o[0]+=e:o=[e];let i=Promise.all(s.map(a=>a({phase:t,buffer:o,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Be(c,t,!1,n,o))).then(()=>o[0]));return r?yn(await i,s):i};var bn="text/plain; charset=UTF-8",De=(e,t)=>({"Content-Type":e,...t}),te=(e,t)=>new Response(e,t),Fe=class{#t;#e;env={};#r;finalized=!1;error;#s;#o;#n;#u;#c;#l;#a;#d;#p;constructor(e,t){this.#t=e,t&&(this.#o=t.executionCtx,this.env=t.env,this.#l=t.notFoundHandler,this.#p=t.path,this.#d=t.matchResult)}get req(){return this.#e??=new ue(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#o&&"respondWith"in this.#o)return this.#o;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#o)return this.#o;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=te(null,{headers:this.#a??=new Headers})}set res(e){if(this.#n&&e){e=te(e.body,e);for(let[t,r]of this.#n.headers.entries())if(t!=="content-type")if(t==="set-cookie"){let n=this.#n.headers.getSetCookie();e.headers.delete("set-cookie");for(let o of n)e.headers.append("set-cookie",o)}else e.headers.set(t,r)}this.#n=e,this.finalized=!0}render=(...e)=>(this.#c??=t=>this.html(t),this.#c(...e));setLayout=e=>this.#u=e;getLayout=()=>this.#u;setRenderer=e=>{this.#c=e};header=(e,t,r)=>{this.finalized&&(this.#n=te(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#a??=new Headers;t===void 0?n.delete(e):r?.append?n.append(e,t):n.set(e,t)};status=e=>{this.#s=e};set=(e,t)=>{this.#r??=new Map,this.#r.set(e,t)};get=e=>this.#r?this.#r.get(e):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(e,t,r){let n=this.#n?new Headers(this.#n.headers):this.#a??new Headers;if(typeof t=="object"&&"headers"in t){let s=t.headers instanceof Headers?t.headers:new Headers(t.headers);for(let[i,a]of s)i.toLowerCase()==="set-cookie"?n.append(i,a):n.set(i,a)}if(r)for(let[s,i]of Object.entries(r))if(typeof i=="string")n.set(s,i);else{n.delete(s);for(let a of i)n.append(s,a)}let o=typeof t=="number"?t:t?.status??this.#s;return te(e,{status:o,headers:n})}newResponse=(...e)=>this.#i(...e);body=(e,t,r)=>this.#i(e,t,r);text=(e,t,r)=>!this.#a&&!this.#s&&!t&&!r&&!this.finalized?new Response(e):this.#i(e,t,De(bn,r));json=(e,t,r)=>this.#i(JSON.stringify(e),t,De("application/json",r));html=(e,t,r)=>{let n=o=>this.#i(o,t,De("text/html; charset=UTF-8",r));return typeof e=="object"?Be(e,It.Stringify,!1,{}).then(n):n(e)};redirect=(e,t)=>{let r=String(e);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,t??302)};notFound=()=>(this.#l??=()=>te(),this.#l(this))};var y="ALL",Ht="all",jt=["get","post","put","delete","options","patch"],he="Can not add a route since the matcher is already built.",me=class extends Error{};var Nt="__COMPOSED_HANDLER";var vn=e=>e.text("404 Not Found",404),$t=(e,t)=>{if("getResponse"in e){let r=e.getResponse();return t.newResponse(r.body,r)}return console.error(e),t.text("Internal Server Error",500)},Bt=class Dt{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(t={}){[...jt,Ht].forEach(s=>{this[s]=(i,...a)=>(typeof i=="string"?this.#t=i:this.#s(s,this.#t,i),a.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,i,...a)=>{for(let c of[i].flat()){this.#t=c;for(let l of[s].flat())a.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...i)=>(typeof s=="string"?this.#t=s:(this.#t="*",i.unshift(s)),i.forEach(a=>{this.#s(y,this.#t,a)}),this);let{strict:n,...o}=t;Object.assign(this,o),this.getPath=n??!0?t.getPath??Ne:Tt}#e(){let t=new Dt({router:this.router,getPath:this.getPath});return t.errorHandler=this.errorHandler,t.#r=this.#r,t.routes=this.routes,t}#r=vn;errorHandler=$t;route(t,r){let n=this.basePath(t);return r.routes.map(o=>{let s;r.errorHandler===$t?s=o.handler:(s=async(i,a)=>(await Ie([],r.errorHandler)(i,()=>o.handler(i,a))).res,s[Nt]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(t){let r=this.#e();return r._basePath=H(this._basePath,t),r}onError=t=>(this.errorHandler=t,this);notFound=t=>(this.#r=t,this);mount(t,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let i=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=H(this._basePath,t),l=c==="/"?0:c.length;return u=>{let d=new URL(u.url);return d.pathname=this.getPath(u).slice(l)||"/",new Request(d,u)}})();let a=async(c,l)=>{let u=await r(o(c.req.raw),...i(c));if(u)return u;await l()};return this.#s(y,H(t,"*"),a),this}#s(t,r,n,o){t=t.toUpperCase(),r=H(this._basePath,r);let s={basePath:o!==void 0?H(this._basePath,o):this._basePath,path:r,method:t,handler:n};this.router.add(t,r,[n,s]),this.routes.push(s)}#o(t,r){if(t instanceof Error)return this.errorHandler(t,r);throw t}#n(t,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#n(t,r,n,"GET")))();let s=this.getPath(t,{env:n}),i=this.router.match(o,s),a=new Fe(t,{path:s,matchResult:i,env:n,executionCtx:r,notFoundHandler:this.#r});if(i[0].length===1){let l;try{l=i[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#o(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#o(u,a)):l??this.#r(a)}let c=Ie(i[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#o(l,a)}})()}fetch=(t,...r)=>this.#n(t,r[1],r[0],t.method);request=(t,r,n,o)=>t instanceof Request?this.fetch(r?new Request(t,r):t,n,o):(t=t.toString(),this.fetch(new Request(/^https?:\/\//.test(t)?t:`http://localhost${H("/",t)}`,r),n,o));fire=()=>{addEventListener("fetch",t=>{t.respondWith(this.#n(t.request,t,void 0,t.request.method))})}};var ge=[];function qe(e,t){let r=this.buildAllMatchers(),n=((o,s)=>{let i=r[o]||r[y],a=i[2][s];if(a)return a;let c=s.match(i[0]);if(!c)return[[],ge];let l=c.indexOf("",1);return[i[1][l],c]});return this.match=n,n(e,t)}var we="[^/]+",re=".*",ne="(?:|/.*)",B=Symbol(),xn=new Set(".\\+*[^]$()");function Rn(e,t){return e.length===1?t.length===1?e<t?-1:1:-1:t.length===1||e===re||e===ne?1:t===re||t===ne?-1:e===we?1:t===we?-1:e.length===t.length?e<t?-1:1:t.length-e.length}var Ft=class ze{#t;#e;#r=Object.create(null);insert(t,r,n,o,s){if(t.length===0){if(this.#t!==void 0)throw B;if(s)return;this.#t=r;return}let[i,...a]=t,c=i==="*"?a.length===0?["","",re]:["","",we]:i==="/*"?["","",ne]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let u=c[1],d=c[2]||we;if(u&&c[2]&&(d===".*"||(d=d.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(d))))throw B;if(l=this.#r[d],!l){if(Object.keys(this.#r).some(h=>h!==re&&h!==ne))throw B;if(s)return;l=this.#r[d]=new ze,u!==""&&(l.#e=o.varIndex++)}!s&&u!==""&&n.push([u,l.#e])}else if(l=this.#r[i],!l){if(Object.keys(this.#r).some(u=>u.length>1&&u!==re&&u!==ne))throw B;if(s)return;l=this.#r[i]=new ze}l.insert(a,r,n,o,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(Rn).map(n=>{let o=this.#r[n];return(typeof o.#e=="number"?`(${n})@${o.#e}`:xn.has(n)?`\\${n}`:n)+o.buildRegExpStr()});return typeof this.#t=="number"&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var qt=class{#t={varIndex:0};#e=new Ft;insert(e,t,r){let n=[],o=[];for(let i=0;;){let a=!1;if(e=e.replace(/\{[^}]+\}/g,c=>{let l=`@\\${i}`;return o[i]=[l,c],i++,a=!0,l}),!a)break}let s=e.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=o.length-1;i>=0;i--){let[a]=o[i];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,o[i][1]);break}}return this.#e.insert(s,t,n,this.#t,r),n}buildRegExp(){let e=this.#e.buildRegExpStr();if(e==="")return[/^$/,[],[]];let t=0,r=[],n=[];return e=e.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,i)=>s!==void 0?(r[++t]=Number(s),"$()"):(i!==void 0&&(n[Number(i)]=++t),"")),[new RegExp(`^${e}`),r,n]}};var En=[/^$/,[],Object.create(null)],zt=Object.create(null);function Wt(e){return zt[e]??=new RegExp(e==="*"?"":`^${e.replace(/\/\*$|([.\\+*[^\]$()])/g,(t,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function Sn(){zt=Object.create(null)}function Pn(e){let t=new qt,r=[];if(e.length===0)return En;let n=e.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,u],[d,h])=>l?1:d?-1:u.length-h.length),o=Object.create(null);for(let l=0,u=-1,d=n.length;l<d;l++){let[h,f,g]=n[l];h?o[f]=[g.map(([w])=>[w,Object.create(null)]),ge]:u++;let p;try{p=t.insert(f,u,h)}catch(w){throw w===B?new me(f):w}h||(r[u]=g.map(([w,m])=>{let x=Object.create(null);for(m-=1;m>=0;m--){let[C,L]=p[m];x[C]=L}return[w,x]}))}let[s,i,a]=t.buildRegExp();for(let l=0,u=r.length;l<u;l++)for(let d=0,h=r[l].length;d<h;d++){let f=r[l][d]?.[1];if(!f)continue;let g=Object.keys(f);for(let p=0,w=g.length;p<w;p++)f[g[p]]=a[f[g[p]]]}let c=[];for(let l in i)c[l]=r[i[l]];return[s,c,o]}function G(e,t){if(e){for(let r of Object.keys(e).sort((n,o)=>o.length-n.length))if(Wt(r).test(t))return[...e[r]]}}var ye=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[y]:Object.create(null)},this.#e={[y]:Object.create(null)}}add(e,t,r){let n=this.#t,o=this.#e;if(!n||!o)throw new Error(he);n[e]||[n,o].forEach(a=>{a[e]=Object.create(null),Object.keys(a[y]).forEach(c=>{a[e][c]=[...a[y][c]]})}),t==="/*"&&(t="*");let s=(t.match(/\/:/g)||[]).length;if(/\*$/.test(t)){let a=Wt(t);e===y?Object.keys(n).forEach(c=>{n[c][t]||=G(n[c],t)||G(n[y],t)||[]}):n[e][t]||=G(n[e],t)||G(n[y],t)||[],Object.keys(n).forEach(c=>{(e===y||e===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(o).forEach(c=>{(e===y||e===c)&&Object.keys(o[c]).forEach(l=>a.test(l)&&o[c][l].push([r,s]))});return}let i=fe(t)||[t];for(let a=0,c=i.length;a<c;a++){let l=i[a];Object.keys(o).forEach(u=>{(e===y||e===u)&&(o[u][l]||=[...G(n[u],l)||G(n[y],l)||[]],o[u][l].push([r,s-c+a+1]))})}}match=qe;buildAllMatchers(){let e=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(t=>{e[t]||=this.#r(t)}),this.#t=this.#e=void 0,Sn(),e}#r(e){let t=[],r=e===y;return[this.#t,this.#e].forEach(n=>{let o=n[e]?Object.keys(n[e]).map(s=>[s,n[e][s]]):[];o.length!==0?(r||=!0,t.push(...o)):e!==y&&t.push(...Object.keys(n[y]).map(s=>[s,n[y][s]]))}),r?Pn(t):null}};var We=class{name="SmartRouter";#t=[];#e=[];constructor(e){this.#t=e.routers}add(e,t,r){if(!this.#e)throw new Error(he);this.#e.push([e,t,r])}match(e,t){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,i;for(;s<o;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);i=a.match(e,t)}catch(c){if(c instanceof me)continue;throw c}this.match=a.match.bind(a),this.#t=[a],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var oe=Object.create(null),An=e=>{for(let t in e)return!0;return!1},Vt=class Gt{#t;#e;#r;#s=0;#o=oe;constructor(t,r,n){if(this.#e=n||Object.create(null),this.#t=[],t&&r){let o=Object.create(null);o[t]={handler:r,possibleKeys:[],score:0},this.#t=[o]}this.#r=[]}insert(t,r,n){this.#s=++this.#s;let o=this,s=Ot(r),i=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],u=s[a+1],d=_t(l,u),h=Array.isArray(d)?d[0]:l;if(h in o.#e){o=o.#e[h],d&&i.push(d[1]);continue}o.#e[h]=new Gt,d&&(o.#r.push(d),i.push(d[1])),o=o.#e[h]}return o.#t.push({[t]:{handler:n,possibleKeys:i.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),o}#n(t,r,n,o,s){for(let i=0,a=r.#t.length;i<a;i++){let c=r.#t[i],l=c[n]||c[y],u={};if(l!==void 0&&(l.params=Object.create(null),t.push(l),o!==oe||s&&s!==oe))for(let d=0,h=l.possibleKeys.length;d<h;d++){let f=l.possibleKeys[d],g=u[l.score];l.params[f]=s?.[f]&&!g?s[f]:o[f]??s?.[f],u[l.score]=!0}}}search(t,r){let n=[];this.#o=oe;let s=[this],i=je(r),a=[],c=i.length,l=null;for(let u=0;u<c;u++){let d=i[u],h=u===c-1,f=[];for(let p=0,w=s.length;p<w;p++){let m=s[p],x=m.#e[d];x&&(x.#o=m.#o,h?(x.#e["*"]&&this.#n(n,x.#e["*"],t,m.#o),this.#n(n,x,t,m.#o)):f.push(x));for(let C=0,L=m.#r.length;C<L;C++){let R=m.#r[C],b=m.#o===oe?{}:{...m.#o};if(R==="*"){let U=m.#e["*"];U&&(this.#n(n,U,t,m.#o),U.#o=b,f.push(U));continue}let[P,v,A]=R;if(!d&&!(A instanceof RegExp))continue;let E=m.#e[P];if(A instanceof RegExp){if(l===null){l=new Array(c);let q=r[0]==="/"?1:0;for(let _=0;_<c;_++)l[_]=q,q+=i[_].length+1}let U=r.substring(l[u]),Q=A.exec(U);if(Q){if(b[v]=Q[0],this.#n(n,E,t,m.#o,b),An(E.#e)){E.#o=b;let q=Q[0].match(/\//)?.length??0;(a[q]||=[]).push(E)}continue}}(A===!0||A.test(d))&&(b[v]=d,h?(this.#n(n,E,t,b,m.#o),E.#e["*"]&&this.#n(n,E.#e["*"],t,b,m.#o)):(E.#o=b,f.push(E)))}}let g=a.shift();s=g?f.concat(g):f}return n.length>1&&n.sort((u,d)=>u.score-d.score),[n.map(({handler:u,params:d})=>[u,d])]}};var Ve=class{name="TrieRouter";#t;constructor(){this.#t=new Vt}add(e,t,r){let n=fe(t);if(n){for(let o=0,s=n.length;o<s;o++)this.#t.insert(e,n[o],r);return}this.#t.insert(e,t,r)}match(e,t){return this.#t.search(e,t)}};var Ge=class extends Bt{constructor(e={}){super(e),this.router=e.router??new We({routers:[new ye,new Ve]})}};var be=e=>{let t={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...e},r=(o=>typeof o=="string"?o==="*"?()=>o:s=>o===s?s:null:typeof o=="function"?o:s=>o.includes(s)?s:null)(t.origin),n=(o=>typeof o=="function"?o:Array.isArray(o)?()=>o:()=>[])(t.allowMethods);return async function(s,i){function a(l,u){s.res.headers.set(l,u)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),t.credentials&&a("Access-Control-Allow-Credentials","true"),t.exposeHeaders?.length&&a("Access-Control-Expose-Headers",t.exposeHeaders.join(",")),s.req.method==="OPTIONS"){t.origin!=="*"&&a("Vary","Origin"),t.maxAge!=null&&a("Access-Control-Max-Age",t.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let u=t.allowHeaders;if(!u?.length){let d=s.req.header("Access-Control-Request-Headers");d&&(u=d.split(/\s*,\s*/))}return u?.length&&(a("Access-Control-Allow-Headers",u.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await i(),t.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};import ur from"process";import dr from"path";import{fileURLToPath as oo}from"url";import so from"child_process";import io,{constants as ao}from"fs/promises";import{promisify as jn}from"util";import Nn from"child_process";import Qe,{constants as er}from"fs/promises";import Jt from"process";import Ln from"os";import kn from"fs";import _n from"fs";import Kt from"fs";var Ke;function Cn(){try{return Kt.statSync("/.dockerenv"),!0}catch{return!1}}function On(){try{return Kt.readFileSync("/proc/self/cgroup","utf8").includes("docker")}catch{return!1}}function Xe(){return Ke===void 0&&(Ke=Cn()||On()),Ke}var Je,Tn=()=>{try{return _n.statSync("/run/.containerenv"),!0}catch{return!1}};function K(){return Je===void 0&&(Je=Tn()||Xe()),Je}var Xt=()=>{if(Jt.platform!=="linux")return!1;if(Ln.release().toLowerCase().includes("microsoft"))return!K();try{return kn.readFileSync("/proc/version","utf8").toLowerCase().includes("microsoft")?!K():!1}catch{return!1}},M=Jt.env.__IS_WSL_TEST__?Xt:Xt();import Yt from"process";import{Buffer as Un}from"buffer";import{promisify as Mn}from"util";import In from"child_process";import Ni,{constants as $i}from"fs/promises";var Hn=Mn(In.execFile),Ye=()=>`${Yt.env.SYSTEMROOT||Yt.env.windir||String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;var T=async(e,t={})=>{let{powerShellPath:r,...n}=t,o=T.encodeCommand(e);return Hn(r??Ye(),[...T.argumentsPrefix,o],{encoding:"utf8",...n})};T.argumentsPrefix=["-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-EncodedCommand"];T.encodeCommand=e=>Un.from(e,"utf16le").toString("base64");T.escapeArgument=e=>`'${String(e).replaceAll("'","''")}'`;function Qt(e){for(let t of e.split(`
+`)){if(/^\s*#/.test(t))continue;let r=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(t);if(r)return r.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var $n=jn(Nn.execFile),Bn=(()=>{let e="/mnt/",t;return async function(){if(t)return t;let r="/etc/wsl.conf",n=!1;try{await Qe.access(r,er.F_OK),n=!0}catch{}if(!n)return e;let o=await Qe.readFile(r,{encoding:"utf8"}),s=Qt(o);return s===void 0?e:(t=s,t=t.endsWith("/")?t:`${t}/`,t)}})(),Dn=async()=>`${await Bn()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`,ve=M?Dn:Ye,Zt,tr=async()=>(Zt??=(async()=>{try{let e=await ve();return await Qe.access(e,er.X_OK),!0}catch{return!1}})(),Zt),rr=async()=>{let e=await ve(),t=String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`,{stdout:r}=await T(t,{powerShellPath:e});return r.trim()},nr=async e=>{if(/^[a-z]+:\/\//i.test(e))return e;try{let{stdout:t}=await $n("wslpath",["-aw",e],{encoding:"utf8"});return t.trim()}catch{return e}};function D(e,t,r){let n=o=>Object.defineProperty(e,t,{value:o,enumerable:!0,writable:!0});return Object.defineProperty(e,t,{configurable:!0,enumerable:!0,get(){let o=r();return n(o),o},set(o){n(o)}}),e}import{promisify as Zn}from"util";import ot from"process";import{execFile as eo}from"child_process";import{promisify as Fn}from"util";import qn from"process";import{execFile as zn}from"child_process";var Wn=Fn(zn);async function Ze(){if(qn.platform!=="darwin")throw new Error("macOS only");let{stdout:e}=await Wn("defaults",["read","com.apple.LaunchServices/com.apple.launchservices.secure","LSHandlers"]),r=/LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(e)?.groups.id??"com.apple.Safari";return r==="com.apple.safari"?"com.apple.Safari":r}import Vn from"process";import{promisify as Gn}from"util";import{execFile as Kn,execFileSync as oa}from"child_process";var Xn=Gn(Kn);async function or(e,{humanReadableOutput:t=!0,signal:r}={}){if(Vn.platform!=="darwin")throw new Error("macOS only");let n=t?[]:["-ss"],o={};r&&(o.signal=r);let{stdout:s}=await Xn("osascript",["-e",e,n],o);return s.trim()}async function et(e){return or(`tell application "Finder" to set app_path to application file id "${e}" as string
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`)}import{promisify as Jn}from"util";import{execFile as Yn}from"child_process";var Qn=Jn(Yn),xe={MSEdgeHTM:{name:"Edge",id:"com.microsoft.edge"},MSEdgeBHTML:{name:"Edge Beta",id:"com.microsoft.edge.beta"},MSEdgeDHTML:{name:"Edge Dev",id:"com.microsoft.edge.dev"},AppXq0fevzme2pys62n3e0fbqa7peapykr8v:{name:"Edge",id:"com.microsoft.edge.old"},ChromeHTML:{name:"Chrome",id:"com.google.chrome"},ChromeBHTML:{name:"Chrome Beta",id:"com.google.chrome.beta"},ChromeDHTML:{name:"Chrome Dev",id:"com.google.chrome.dev"},ChromiumHTM:{name:"Chromium",id:"org.chromium.Chromium"},BraveHTML:{name:"Brave",id:"com.brave.Browser"},BraveBHTML:{name:"Brave Beta",id:"com.brave.Browser.beta"},BraveDHTML:{name:"Brave Dev",id:"com.brave.Browser.dev"},BraveSSHTM:{name:"Brave Nightly",id:"com.brave.Browser.nightly"},FirefoxURL:{name:"Firefox",id:"org.mozilla.firefox"},OperaStable:{name:"Opera",id:"com.operasoftware.Opera"},VivaldiHTM:{name:"Vivaldi",id:"com.vivaldi.Vivaldi"},"IE.HTTP":{name:"Internet Explorer",id:"com.microsoft.ie"}},rt=new Map(Object.entries(xe)),tt=class extends Error{};async function nt(e=Qn){let{stdout:t}=await e("reg",["QUERY"," HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice","/v","ProgId"]),r=/ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(t);if(!r)throw new tt(`Cannot find Windows browser in stdout: ${JSON.stringify(t)}`);let{id:n}=r.groups,o=n.lastIndexOf("."),s=n.lastIndexOf("-"),i=o===-1?void 0:n.slice(0,o),a=s===-1?void 0:n.slice(0,s);return xe[n]??xe[i]??xe[a]??{name:n,id:n}}var to=Zn(eo),ro=e=>e.toLowerCase().replaceAll(/(?:^|\s|-)\S/g,t=>t.toUpperCase());async function st(){if(ot.platform==="darwin"){let e=await Ze();return{name:await et(e),id:e}}if(ot.platform==="linux"){let{stdout:e}=await to("xdg-mime",["query","default","x-scheme-handler/http"]),t=e.trim();return{name:ro(t.replace(/.desktop$/,"").replace("-"," ")),id:t}}if(ot.platform==="win32")return nt();throw new Error("Only macOS, Linux, and Windows are supported")}import it from"process";var no=!!(it.env.SSH_CONNECTION||it.env.SSH_CLIENT||it.env.SSH_TTY),sr=no;var Re=Symbol("fallbackAttempt"),at=import.meta.url?dr.dirname(oo(import.meta.url)):"",ir=dr.join(at,"xdg-open"),{platform:X,arch:ar}=ur,cr=async(e,t)=>{if(e.length===0)return;let r=[];for(let n of e)try{return await t(n)}catch(o){r.push(o)}throw new AggregateError(r,"Failed to open in all supported apps")},Ee=async e=>{e={wait:!1,background:!1,newInstance:!1,allowNonzeroExitCode:!1,...e};let t=e[Re]===!0;if(delete e[Re],Array.isArray(e.app))return cr(e.app,l=>Ee({...e,app:l,[Re]:!0}));let{name:r,arguments:n=[]}=e.app??{};if(n=[...n],Array.isArray(r))return cr(r,l=>Ee({...e,app:{name:l,arguments:n},[Re]:!0}));if(r==="browser"||r==="browserPrivate"){let l={"com.google.chrome":"chrome","google-chrome.desktop":"chrome","com.brave.browser":"brave","org.mozilla.firefox":"firefox","firefox.desktop":"firefox","com.microsoft.msedge":"edge","com.microsoft.edge":"edge","com.microsoft.edgemac":"edge","microsoft-edge.desktop":"edge","com.apple.safari":"safari"},u={chrome:"--incognito",brave:"--incognito",firefox:"--private-window",edge:"--inPrivate"},d;if(M){let h=await rr();d=rt.get(h)??{}}else d=await st();if(d.id in l){let h=l[d.id.toLowerCase()];if(r==="browserPrivate"){if(h==="safari")throw new Error("Safari doesn't support opening in private mode via command line");n.push(u[h])}return Ee({...e,app:{name:J[h],arguments:n}})}throw new Error(`${d.name} is not supported as a default browser`)}let o,s=[],i={},a=!1;if(M&&!K()&&!sr&&!r&&(a=await tr()),X==="darwin")o="open",e.wait&&s.push("--wait-apps"),e.background&&s.push("--background"),e.newInstance&&s.push("--new"),r&&s.push("-a",r);else if(X==="win32"||a){o=await ve(),s.push(...T.argumentsPrefix),M||(i.windowsVerbatimArguments=!0),M&&e.target&&(e.target=await nr(e.target));let l=["$ProgressPreference = 'SilentlyContinue';","Start"];e.wait&&l.push("-Wait"),r?(l.push(T.escapeArgument(r)),e.target&&n.push(e.target)):e.target&&l.push(T.escapeArgument(e.target)),n.length>0&&(n=n.map(u=>T.escapeArgument(u)),l.push("-ArgumentList",n.join(","))),e.target=T.encodeCommand(l.join(" ")),e.wait||(i.stdio="ignore")}else{if(r)o=r;else{let l=!at||at==="/",u=!1;try{await io.access(ir,ao.X_OK),u=!0}catch{}o=ur.versions.electron??(X==="android"||l||!u)?"xdg-open":ir}n.length>0&&s.push(...n),e.wait||(i.stdio="ignore",i.detached=!0)}X==="darwin"&&n.length>0&&s.push("--args",...n),e.target&&s.push(e.target);let c=so.spawn(o,s,i);return e.wait?new Promise((l,u)=>{c.once("error",u),c.once("close",d=>{if(!e.allowNonzeroExitCode&&d!==0){u(new Error(`Exited with code ${d}`));return}l(c)})}):t?new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.once("close",d=>{if(c.off("error",u),d!==0){u(new Error(`Exited with code ${d}`));return}c.unref(),l(c)})})}):(c.unref(),new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.off("error",u),l(c)})}))},co=(e,t)=>{if(typeof e!="string")throw new TypeError("Expected a `target`");return Ee({...t,target:e})};function lr(e){if(typeof e=="string"||Array.isArray(e))return e;let{[ar]:t}=e;if(!t)throw new Error(`${ar} is not supported`);return t}function se({[X]:e},{wsl:t}={}){if(t&&M)return lr(t);if(!e)throw new Error(`${X} is not supported`);return lr(e)}var J={browser:"browser",browserPrivate:"browserPrivate"};D(J,"chrome",()=>se({darwin:"google chrome",win32:"chrome",linux:["google-chrome","google-chrome-stable","chromium","chromium-browser"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",x64:["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe","/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]}}));D(J,"brave",()=>se({darwin:"brave browser",win32:"brave",linux:["brave-browser","brave"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",x64:["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe","/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]}}));D(J,"firefox",()=>se({darwin:"firefox",win32:String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,linux:"firefox"},{wsl:"/mnt/c/Program Files/Mozilla Firefox/firefox.exe"}));D(J,"edge",()=>se({darwin:"microsoft edge",win32:"msedge",linux:["microsoft-edge","microsoft-edge-dev"]},{wsl:"/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"}));D(J,"safari",()=>se({darwin:"Safari"}));var pr=co;function fr(e=""){return`<link rel="icon" type="image/svg+xml" href="${`${e.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as hr,readFileSync as lo}from"fs";import I from"path";import{fileURLToPath as uo}from"url";import{gunzipSync as po}from"zlib";var fo={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function ho(){let e=I.dirname(uo(import.meta.url));for(let t of[I.resolve(e,"app"),I.resolve(e,"../app"),I.resolve(e,"../../dist/app")])if(hr(I.join(t,"inspector.js.gz")))return t;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function mr(e,t="/inspector/assets"){let r=ho(),n=new Map;e.get(`${t}/*`,o=>{let s=o.req.path.slice(t.length),i=s.startsWith("/")?s.slice(1):s;if(!i||i.includes(".."))return o.notFound();let a=i==="inspector.js"||i==="inspector.css"?`${i}.gz`:i,c=I.resolve(r,a),l=r.endsWith(I.sep)?r:`${r}${I.sep}`;if(!c.startsWith(l)||!hr(c))return o.notFound();let u=I.extname(i),d=a.endsWith(".gz"),h=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(o.req.header("accept-encoding")??""),f=lo(c),g=d&&!h?n.get(c)??mo(n,c,f):f,p=g.buffer.slice(g.byteOffset,g.byteOffset+g.byteLength);return o.body(p,200,{"Content-Type":fo[u]??"application/octet-stream",...d&&h?{"Content-Encoding":"gzip"}:{},...d?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function mo(e,t,r){let n=po(r);return e.set(t,n),n}var gr={name:"@mcp-use/inspector",type:"module",version:"20.0.0-beta.19",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"npm run clean && npm run build:client-exports && npm run build:server && npm run build:app && npm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",prepublishOnly:"pnpm --filter @mcp-use/client build && pnpm build",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.0-alpha.0","@mcp-use/client":"^2.0.0-alpha.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"workspace:*",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^1.19.13","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.12.12","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^7.12.0","react-resizable-panels":"^4.6.4","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",zod:"^4.2.0"}};var wo=gr.version;function Se(){return wo}var wr=Se(),yo=`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
 <body><div>Signed in. You can close this window.</div>
 <script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
-</body></html>`;
-function generateInspectorShellHtml(config, basePath, assets) {
-  const scripts = [];
-  if (config?.basePath !== void 0) {
-    scripts.push(
-      `<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(config.basePath)};</script>`
-    );
-  }
-  if (config?.devMode) {
-    scripts.push(`<script>window.__MCP_DEV_MODE__ = true;</script>`);
-  }
-  if (config?.sandboxOrigin) {
-    scripts.push(
-      `<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(config.sandboxOrigin)};</script>`
-    );
-  }
-  if (config?.proxyUrl !== void 0) {
-    scripts.push(
-      `<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(config.proxyUrl)};</script>`
-    );
-  }
-  if (config?.inspectorMode) {
-    scripts.push(
-      `<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(config.inspectorMode)};</script>`
-    );
-  }
-  if (config?.manufactChatUrl) {
-    scripts.push(
-      `<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(config.manufactChatUrl)};</script>`
-    );
-  }
-  if (config?.disableTelemetry) {
-    scripts.push(
-      `<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>`
-    );
-  }
-  if (process.env.MCP_USE_DEV_CLI === "1") {
-    scripts.push(`<script>window.__MCP_DEV_CLI__ = true;</script>`);
-  }
-  const runtimeScripts = scripts.join("\n    ");
-  return `<!doctype html>
+</body></html>`;function bo(e,t,r){let n=[];e?.basePath!==void 0&&n.push(`<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(e.basePath)};</script>`),e?.devMode&&n.push("<script>window.__MCP_DEV_MODE__ = true;</script>"),e?.sandboxOrigin&&n.push(`<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(e.sandboxOrigin)};</script>`),e?.proxyUrl!==void 0&&n.push(`<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(e.proxyUrl)};</script>`),e?.inspectorMode&&n.push(`<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(e.inspectorMode)};</script>`),e?.manufactChatUrl&&n.push(`<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(e.manufactChatUrl)};</script>`),e?.disableTelemetry&&n.push('<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>'),process.env.MCP_USE_DEV_CLI==="1"&&n.push("<script>window.__MCP_DEV_CLI__ = true;</script>");let o=n.join(`
+    `);return`<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    ${renderInspectorFaviconLinks(`${basePath}/inspector/assets`)}
+    ${fr(`${t}/inspector/assets`)}
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
-    <link rel="stylesheet" href="${assets.cssUrl}" />
+    <link rel="stylesheet" href="${r.cssUrl}" />
     <title>Inspector | mcp-use</title>
     <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
     <style>
@@ -334,8 +57,8 @@ function generateInspectorShellHtml(config, basePath, assets) {
         .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
       }
     </style>
-    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(INSPECTOR_VERSION)};</script>
-    ${runtimeScripts}
+    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(wr)};</script>
+    ${o}
   </head>
   <body>
     <script>
@@ -372,1112 +95,11 @@ function generateInspectorShellHtml(config, basePath, assets) {
         </div>
       </div>
     </div>
-    <script type="module" src="${assets.jsUrl}"></script>
+    <script type="module" src="${r.jsUrl}"></script>
   </body>
-</html>`;
-}
-function registerInspectorShell(app2, config, basePath = "") {
-  const assetsPath = `${basePath}/inspector/assets`;
-  const version = encodeURIComponent(INSPECTOR_VERSION);
-  const assets = {
-    jsUrl: `${assetsPath}/inspector.js?v=${version}`,
-    cssUrl: `${assetsPath}/inspector.css?v=${version}`
-  };
-  const p = (suffix) => `${basePath}${suffix}`;
-  const effectiveConfig = {
-    ...config,
-    basePath: config?.basePath ?? basePath,
-    proxyUrl: config?.proxyUrl !== void 0 ? config.proxyUrl : p("/inspector/api/proxy"),
-    disableTelemetry: config?.disableTelemetry ?? process.env.MCP_USE_ANONYMIZED_TELEMETRY === "false"
-  };
-  const serveShell = (c) => {
-    return c.html(
-      generateInspectorShellHtml(effectiveConfig, basePath, assets)
-    );
-  };
-  registerInspectorStaticAssets(app2, assetsPath);
-  app2.get(
-    p("/inspector/oauth-popup-closed.html"),
-    (c) => c.html(OAUTH_POPUP_CLOSED_HTML)
-  );
-  app2.get(p("/inspector"), serveShell);
-  app2.get(`${p("/inspector")}/`, serveShell);
-  const apiPrefix = p("/inspector/api/");
-  app2.get(p("/inspector/*"), (c) => {
-    if (c.req.path.startsWith(apiPrefix)) {
-      return c.notFound();
-    }
-    return serveShell(c);
-  });
-  app2.post(p("/inspector/*"), (c) => {
-    if (c.req.path.startsWith(apiPrefix)) {
-      return c.notFound();
-    }
-    return serveShell(c);
-  });
-  if (basePath === "" && config?.rootRedirect !== false) {
-    app2.get("/", (c) => {
-      const url = new URL(c.req.url);
-      return c.redirect(`${p("/inspector")}${url.search}`);
-    });
-  }
-}
-
-// src/server/proxy/mcp-proxy.ts
-import { cors } from "hono/cors";
-import { logger } from "hono/logger";
-
-// src/server/proxy/oauth-proxy.ts
-import { lookup } from "dns/promises";
-import { Buffer } from "buffer";
-import { isIP } from "net";
-var SAFE_REQUEST_HEADERS = /* @__PURE__ */ new Set([
-  "accept",
-  "authorization",
-  "content-type",
-  "dpop"
-]);
-var SAFE_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
-  "cache-control",
-  "content-type",
-  "dpop-nonce",
-  "expires",
-  "pragma",
-  "retry-after",
-  "www-authenticate"
-]);
-var ENDPOINT_FIELDS = [
-  ["registration_endpoint", "registration"],
-  ["token_endpoint", "token"],
-  ["revocation_endpoint", "revocation"],
-  ["introspection_endpoint", "introspection"]
-];
-var BINDING_TTL_MS = 10 * 60 * 1e3;
-var MAX_BINDINGS = 100;
-var CONFIDENTIAL_CLIENT_TTL_MS = 24 * 60 * 60 * 1e3;
-var MAX_CONFIDENTIAL_CLIENTS = 500;
-function mountOAuthProxy(app2, options = {}) {
-  const {
-    basePath = "/oauth",
-    allowedOrigins = [],
-    allowLoopback = false,
-    timeoutMs = 1e4,
-    maxRequestBodyBytes = 64 * 1024,
-    maxResponseBodyBytes = 1024 * 1024,
-    callbackPath = "/oauth/callback",
-    enableLogging = true,
-    authenticate,
-    validateServerUrl
-  } = options;
-  const origins = new Set(allowedOrigins.map(normalizeOrigin));
-  const bindings = /* @__PURE__ */ new Map();
-  const confidentialClients = /* @__PURE__ */ new Map();
-  app2.use(`${basePath}/*`, async (c, next) => {
-    const origin = c.req.header("Origin");
-    if (origin && !isAllowedOrigin(origin, c, origins)) {
-      return c.json({ error: "Origin not allowed" }, 403);
-    }
-    if (c.req.method === "OPTIONS") {
-      return corsResponse(origin);
-    }
-    await next();
-    if (origin) setCorsHeaders(c.res.headers, origin);
-  });
-  app2.get(`${basePath}/metadata`, async (c) => {
-    if (!await isAuthenticated(c, authenticate)) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-    const serverUrlResult = await validateUrl(
-      c.req.query("serverUrl"),
-      allowLoopback
-    );
-    if ("error" in serverUrlResult) {
-      return c.json({ error: serverUrlResult.error }, 400);
-    }
-    const serverUrl = serverUrlResult.url;
-    if (validateServerUrl && !await validateServerUrl(serverUrl.toString(), c)) {
-      return c.json({ error: "MCP server URL not allowed" }, 403);
-    }
-    const targetResult = await validateUrl(c.req.query("url"), allowLoopback);
-    if ("error" in targetResult) {
-      return c.json({ error: targetResult.error }, 400);
-    }
-    const target = targetResult.url;
-    const key = canonicalUrl(serverUrl);
-    const binding = getBinding(bindings, key);
-    let metadataKind = classifyMetadataTarget(serverUrl, target, binding);
-    if (!metadataKind && binding.authorizationServers.size === 0) {
-      try {
-        await hydrateBinding(
-          serverUrl,
-          binding,
-          allowLoopback,
-          timeoutMs,
-          maxResponseBodyBytes
-        );
-        bindings.set(key, binding);
-        metadataKind = classifyMetadataTarget(serverUrl, target, binding);
-      } catch {
-      }
-    }
-    if (!metadataKind) {
-      return c.json(
-        { error: "Metadata target is not bound to this MCP server" },
-        403
-      );
-    }
-    try {
-      log(enableLogging, `GET ${target}`);
-      const upstream = await safeFetch(target, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(upstream.status)) {
-        return c.json(
-          { error: "OAuth metadata redirects are not allowed" },
-          502
-        );
-      }
-      const raw = await readCapped(upstream, maxResponseBodyBytes);
-      if (!upstream.ok) {
-        return c.body(raw, upstream.status, {
-          "Content-Type": upstream.headers.get("content-type") ?? "application/json"
-        });
-      }
-      const metadata = parseObject(raw);
-      if (metadataKind.type === "protected-resource") {
-        await bindProtectedResource(
-          metadata,
-          serverUrl,
-          binding,
-          allowLoopback
-        );
-      } else {
-        await bindAuthorizationServer(
-          metadata,
-          metadataKind.issuer,
-          binding,
-          allowLoopback
-        );
-      }
-      binding.updatedAt = Date.now();
-      bindings.set(key, binding);
-      pruneBindings(bindings);
-      return c.body(raw, 200, {
-        "Content-Type": upstream.headers.get("content-type") ?? "application/json"
-      });
-    } catch (error) {
-      return proxyError(c, error, enableLogging);
-    }
-  });
-  app2.post(`${basePath}/proxy`, async (c) => {
-    if (!await isAuthenticated(c, authenticate)) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-    let request;
-    try {
-      request = JSON.parse(
-        await readRequestCapped(c.req.raw, maxRequestBodyBytes)
-      );
-    } catch (error) {
-      return c.json(
-        {
-          error: error instanceof BodyTooLargeError ? "Request body too large" : "Invalid JSON request body"
-        },
-        error instanceof BodyTooLargeError ? 413 : 400
-      );
-    }
-    const serverUrlResult = await validateUrl(request.serverUrl, allowLoopback);
-    if ("error" in serverUrlResult) {
-      return c.json({ error: serverUrlResult.error }, 400);
-    }
-    const serverUrl = serverUrlResult.url;
-    if (validateServerUrl && !await validateServerUrl(serverUrl.toString(), c)) {
-      return c.json({ error: "MCP server URL not allowed" }, 403);
-    }
-    const targetResult = await validateUrl(request.url, allowLoopback);
-    if ("error" in targetResult) {
-      return c.json({ error: targetResult.error }, 400);
-    }
-    const target = targetResult.url;
-    if (request.method !== void 0 && request.method !== "POST") {
-      return c.json({ error: "Only OAuth endpoint POST is allowed" }, 405);
-    }
-    const bindingKey = canonicalUrl(serverUrl);
-    const binding = getBinding(bindings, bindingKey);
-    if (binding.endpoints.size === 0) {
-      try {
-        await hydrateBinding(
-          serverUrl,
-          binding,
-          allowLoopback,
-          timeoutMs,
-          maxResponseBodyBytes
-        );
-        bindings.set(bindingKey, binding);
-        pruneBindings(bindings);
-      } catch (error) {
-        return proxyError(c, error, enableLogging);
-      }
-    }
-    const endpointKind = binding.endpoints.get(canonicalUrl(target));
-    if (!endpointKind) {
-      return c.json(
-        { error: "OAuth endpoint is not bound to this MCP server" },
-        403
-      );
-    }
-    try {
-      const headers = filterRequestHeaders(request.headers);
-      let body = serializeBody(request.body, headers);
-      if (endpointKind === "registration") {
-        const publicOrigin = normalizeOrigin(
-          c.req.header("Origin") ?? new URL(c.req.url).origin
-        );
-        body = enforceRegistrationRedirectUri(
-          body,
-          headers,
-          new URL(callbackPath, publicOrigin).toString()
-        );
-      } else {
-        body = applyConfidentialClientAuthentication({
-          body,
-          headers,
-          bindingKey,
-          clients: confidentialClients
-        });
-      }
-      if (new TextEncoder().encode(body ?? "").byteLength > maxRequestBodyBytes) {
-        return c.json({ error: "OAuth request body too large" }, 413);
-      }
-      log(enableLogging, `POST ${endpointKind} ${target}`);
-      const upstream = await safeFetch(target, {
-        method: "POST",
-        headers,
-        body,
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(upstream.status)) {
-        return c.json(
-          { error: "OAuth endpoint redirects are not allowed" },
-          502
-        );
-      }
-      const raw = await readCapped(upstream, maxResponseBodyBytes);
-      const responseHeaders = filterResponseHeaders(upstream.headers);
-      const contentType = upstream.headers.get("content-type") ?? "";
-      let responseBody = raw;
-      if (contentType.includes("json")) {
-        try {
-          responseBody = JSON.parse(raw);
-        } catch {
-        }
-      }
-      if (endpointKind === "registration" && upstream.ok && responseBody && typeof responseBody === "object" && !Array.isArray(responseBody)) {
-        responseBody = retainConfidentialClient({
-          responseBody,
-          binding,
-          bindingKey,
-          clients: confidentialClients
-        });
-      }
-      return c.json({
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: responseHeaders,
-        body: responseBody
-      });
-    } catch (error) {
-      return proxyError(c, error, enableLogging);
-    }
-  });
-  log(enableLogging, `Mounted at ${basePath}/metadata and ${basePath}/proxy`);
-}
-async function validateUrl(value, allowLoopback) {
-  if (typeof value !== "string" || !value) {
-    return { error: "Missing or invalid URL" };
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return { error: "Invalid URL" };
-  }
-  if (url.username || url.password || url.hash) {
-    return { error: "URL credentials and fragments are not allowed" };
-  }
-  const loopback = isLoopbackHostname(url.hostname);
-  if (url.protocol !== "https:") {
-    if (!(allowLoopback && loopback && url.protocol === "http:")) {
-      return { error: "HTTPS is required" };
-    }
-  }
-  if (loopback) {
-    return allowLoopback ? { url } : { error: "Loopback URL not allowed" };
-  }
-  if (isLocalHostname(url.hostname)) {
-    return { error: "Local network URL not allowed" };
-  }
-  try {
-    const addresses = isIP(url.hostname) ? [url.hostname] : (await lookup(url.hostname, { all: true, verbatim: true })).map(
-      ({ address }) => address
-    );
-    if (addresses.length === 0 || addresses.some((address) => !isPublicAddress(address))) {
-      return { error: "Private or non-routable URL not allowed" };
-    }
-  } catch {
-    return { error: "URL hostname could not be resolved" };
-  }
-  return { url };
-}
-async function isSafeProxyTarget(value, allowLoopback = false) {
-  return !("error" in await validateUrl(value, allowLoopback));
-}
-function classifyMetadataTarget(serverUrl, target, binding) {
-  const targetUrl = canonicalUrl(target);
-  if (protectedResourceMetadataUrls(serverUrl).some(
-    (candidate) => canonicalUrl(candidate) === targetUrl
-  )) {
-    return { type: "protected-resource" };
-  }
-  for (const issuer of binding.authorizationServers) {
-    if (authorizationServerMetadataUrls(new URL(issuer)).some(
-      (candidate) => canonicalUrl(candidate) === targetUrl
-    )) {
-      return { type: "authorization-server", issuer };
-    }
-  }
-  return void 0;
-}
-function protectedResourceMetadataUrls(serverUrl) {
-  const path2 = serverUrl.pathname === "/" ? "" : serverUrl.pathname;
-  return [
-    new URL(`/.well-known/oauth-protected-resource${path2}`, serverUrl.origin),
-    new URL("/.well-known/oauth-protected-resource", serverUrl.origin)
-  ];
-}
-function authorizationServerMetadataUrls(issuer) {
-  const path2 = issuer.pathname === "/" ? "" : issuer.pathname;
-  return [
-    new URL(`/.well-known/oauth-authorization-server${path2}`, issuer.origin),
-    new URL(`/.well-known/openid-configuration${path2}`, issuer.origin),
-    new URL(`${path2 || ""}/.well-known/openid-configuration`, issuer.origin)
-  ];
-}
-async function bindProtectedResource(metadata, serverUrl, binding, allowLoopback) {
-  if (typeof metadata.resource !== "string" || canonicalUrl(new URL(metadata.resource)) !== canonicalUrl(serverUrl)) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata does not match serverUrl"
-    );
-  }
-  if (!Array.isArray(metadata.authorization_servers) || metadata.authorization_servers.length === 0) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata has no authorization servers"
-    );
-  }
-  const issuers = /* @__PURE__ */ new Set();
-  for (const value of metadata.authorization_servers) {
-    const result = await validateUrl(value, allowLoopback);
-    if ("error" in result) {
-      throw new InvalidUpstreamError(
-        `Unsafe authorization server: ${result.error}`
-      );
-    }
-    issuers.add(canonicalUrl(result.url));
-  }
-  binding.authorizationServers = issuers;
-  binding.endpoints.clear();
-  binding.tokenEndpointAuthMethods.clear();
-}
-async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowLoopback) {
-  if (typeof metadata.issuer !== "string" || canonicalUrl(new URL(metadata.issuer)) !== expectedIssuer) {
-    throw new InvalidUpstreamError(
-      "Authorization-server metadata issuer mismatch"
-    );
-  }
-  binding.endpoints.clear();
-  binding.tokenEndpointAuthMethods = new Set(
-    Array.isArray(metadata.token_endpoint_auth_methods_supported) ? metadata.token_endpoint_auth_methods_supported.filter(
-      (method) => typeof method === "string"
-    ) : []
-  );
-  for (const [field, kind] of ENDPOINT_FIELDS) {
-    const value = metadata[field];
-    if (value === void 0) continue;
-    const result = await validateUrl(value, allowLoopback);
-    if ("error" in result) {
-      throw new InvalidUpstreamError(`Unsafe ${field}: ${result.error}`);
-    }
-    binding.endpoints.set(canonicalUrl(result.url), kind);
-  }
-}
-async function hydrateBinding(serverUrl, binding, allowLoopback, timeoutMs, maxResponseBodyBytes) {
-  for (const metadataUrl of protectedResourceMetadataUrls(serverUrl)) {
-    const response = await safeFetch(metadataUrl, {
-      method: "GET",
-      headers: { Accept: "application/json" },
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (isRedirect(response.status)) {
-      throw new InvalidUpstreamError(
-        "OAuth metadata redirects are not allowed"
-      );
-    }
-    if (!response.ok) continue;
-    await bindProtectedResource(
-      parseObject(await readCapped(response, maxResponseBodyBytes)),
-      serverUrl,
-      binding,
-      allowLoopback
-    );
-    break;
-  }
-  if (binding.authorizationServers.size === 0) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata could not be discovered"
-    );
-  }
-  for (const issuer of binding.authorizationServers) {
-    let bound = false;
-    for (const metadataUrl of authorizationServerMetadataUrls(
-      new URL(issuer)
-    )) {
-      const response = await safeFetch(metadataUrl, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(response.status)) {
-        throw new InvalidUpstreamError(
-          "OAuth metadata redirects are not allowed"
-        );
-      }
-      if (!response.ok) continue;
-      await bindAuthorizationServer(
-        parseObject(await readCapped(response, maxResponseBodyBytes)),
-        issuer,
-        binding,
-        allowLoopback
-      );
-      bound = true;
-      break;
-    }
-    if (bound) break;
-  }
-  if (binding.endpoints.size === 0) {
-    throw new InvalidUpstreamError(
-      "Authorization-server metadata could not be discovered"
-    );
-  }
-  binding.updatedAt = Date.now();
-}
-async function safeFetch(url, init) {
-  return fetch(url, init);
-}
-function filterRequestHeaders(value) {
-  const result = new Headers();
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return result;
-  for (const [name, rawValue] of Object.entries(value)) {
-    const lower = name.toLowerCase();
-    if (SAFE_REQUEST_HEADERS.has(lower) && typeof rawValue === "string") {
-      result.set(lower, rawValue);
-    }
-  }
-  return result;
-}
-function filterResponseHeaders(headers) {
-  const result = {};
-  headers.forEach((value, name) => {
-    if (SAFE_RESPONSE_HEADERS.has(name.toLowerCase())) result[name] = value;
-  });
-  return result;
-}
-function serializeBody(body, headers) {
-  if (body === void 0 || body === null) return void 0;
-  if (typeof body === "string") {
-    if (!headers.has("content-type")) {
-      try {
-        JSON.parse(body);
-        headers.set("content-type", "application/json");
-      } catch {
-        headers.set("content-type", "application/x-www-form-urlencoded");
-      }
-    }
-    return body;
-  }
-  const contentType = headers.get("content-type") ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") && typeof body === "object" && !Array.isArray(body)) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(
-      body
-    )) {
-      params.append(key, String(value));
-    }
-    return params.toString();
-  }
-  if (!headers.has("content-type")) {
-    headers.set("content-type", "application/json");
-  }
-  return JSON.stringify(body);
-}
-function confidentialClientKey(bindingKey, clientId) {
-  return `${bindingKey}\0${clientId}`;
-}
-function retainConfidentialClient(options) {
-  const { responseBody, binding, bindingKey, clients } = options;
-  const clientId = responseBody.client_id;
-  const clientSecret = responseBody.client_secret;
-  if (typeof clientId !== "string" || typeof clientSecret !== "string") {
-    return responseBody;
-  }
-  const returnedMethod = responseBody.token_endpoint_auth_method;
-  const authMethod = returnedMethod === "client_secret_post" || returnedMethod === "client_secret_basic" ? returnedMethod : binding.tokenEndpointAuthMethods.has("client_secret_basic") ? "client_secret_basic" : "client_secret_post";
-  const upstreamExpiry = responseBody.client_secret_expires_at;
-  const expiresAt = upstreamExpiry === 0 ? Number.POSITIVE_INFINITY : typeof upstreamExpiry === "number" && upstreamExpiry > 0 ? upstreamExpiry * 1e3 : Date.now() + CONFIDENTIAL_CLIENT_TTL_MS;
-  pruneConfidentialClients(clients);
-  clients.set(confidentialClientKey(bindingKey, clientId), {
-    clientSecret,
-    authMethod,
-    expiresAt
-  });
-  while (clients.size > MAX_CONFIDENTIAL_CLIENTS) {
-    const oldest = clients.keys().next().value;
-    if (!oldest) break;
-    clients.delete(oldest);
-  }
-  const browserSafe = { ...responseBody };
-  delete browserSafe.client_secret;
-  delete browserSafe.client_secret_expires_at;
-  browserSafe.token_endpoint_auth_method = "none";
-  return browserSafe;
-}
-function applyConfidentialClientAuthentication(options) {
-  const { body, headers, bindingKey, clients } = options;
-  if (!body || !(headers.get("content-type") ?? "").includes(
-    "application/x-www-form-urlencoded"
-  )) {
-    return body;
-  }
-  const params = new URLSearchParams(body);
-  const clientId = params.get("client_id");
-  if (!clientId) return body;
-  const key = confidentialClientKey(bindingKey, clientId);
-  const client = clients.get(key);
-  if (!client) return body;
-  if (client.expiresAt <= Date.now()) {
-    clients.delete(key);
-    return body;
-  }
-  params.delete("client_secret");
-  if (client.authMethod === "client_secret_basic") {
-    const encoded = Buffer.from(
-      `${encodeOAuthClientCredential(clientId)}:${encodeOAuthClientCredential(client.clientSecret)}`,
-      "utf8"
-    ).toString("base64");
-    headers.set("authorization", `Basic ${encoded}`);
-  } else {
-    headers.delete("authorization");
-    params.set("client_id", clientId);
-    params.set("client_secret", client.clientSecret);
-  }
-  return params.toString();
-}
-function encodeOAuthClientCredential(value) {
-  return new URLSearchParams({ value }).toString().slice("value=".length);
-}
-function pruneConfidentialClients(clients) {
-  const now = Date.now();
-  for (const [key, client] of clients) {
-    if (client.expiresAt <= now) clients.delete(key);
-  }
-}
-async function readRequestCapped(request, maxBytes) {
-  const declared = Number(request.headers.get("content-length"));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    throw new BodyTooLargeError();
-  }
-  return readStreamCapped(request.body, maxBytes);
-}
-async function readCapped(response, maxBytes) {
-  const declared = Number(response.headers.get("content-length"));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    await response.body?.cancel();
-    throw new BodyTooLargeError();
-  }
-  return readStreamCapped(response.body, maxBytes);
-}
-async function readStreamCapped(stream, maxBytes) {
-  if (!stream) return "";
-  const reader = stream.getReader();
-  const chunks = [];
-  let size = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > maxBytes) {
-      await reader.cancel();
-      throw new BodyTooLargeError();
-    }
-    chunks.push(value);
-  }
-  const bytes = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(bytes);
-}
-function parseObject(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new InvalidUpstreamError("OAuth metadata is not valid JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new InvalidUpstreamError("OAuth metadata is not an object");
-  }
-  return parsed;
-}
-function getBinding(bindings, key) {
-  const existing = bindings.get(key);
-  if (existing && Date.now() - existing.updatedAt <= BINDING_TTL_MS) {
-    return existing;
-  }
-  bindings.delete(key);
-  return {
-    authorizationServers: /* @__PURE__ */ new Set(),
-    endpoints: /* @__PURE__ */ new Map(),
-    tokenEndpointAuthMethods: /* @__PURE__ */ new Set(),
-    updatedAt: Date.now()
-  };
-}
-function pruneBindings(bindings) {
-  const now = Date.now();
-  for (const [key, binding] of bindings) {
-    if (now - binding.updatedAt > BINDING_TTL_MS) bindings.delete(key);
-  }
-  while (bindings.size > MAX_BINDINGS) {
-    const oldest = bindings.keys().next().value;
-    if (!oldest) break;
-    bindings.delete(oldest);
-  }
-}
-function canonicalUrl(url) {
-  const copy = new URL(url);
-  copy.hash = "";
-  if (copy.protocol === "https:" && copy.port === "443" || copy.protocol === "http:" && copy.port === "80") {
-    copy.port = "";
-  }
-  return copy.toString().replace(/\/$/, "");
-}
-function enforceRegistrationRedirectUri(body, headers, callbackUrl) {
-  if (!body) return body;
-  const contentType = headers.get("content-type") ?? "";
-  if (!contentType.includes("json")) return body;
-  try {
-    const parsed = JSON.parse(body);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return body;
-    }
-    return JSON.stringify({
-      ...parsed,
-      redirect_uris: [callbackUrl]
-    });
-  } catch {
-    return body;
-  }
-}
-function normalizeOrigin(origin) {
-  const url = new URL(origin);
-  if (url.pathname !== "/" || url.search || url.hash) {
-    throw new Error(`OAuth proxy allowed origin must be an origin: ${origin}`);
-  }
-  return url.origin;
-}
-function isAllowedOrigin(origin, c, allowed) {
-  try {
-    const normalized = normalizeOrigin(origin);
-    if (normalized === new URL(c.req.url).origin || allowed.has(normalized)) {
-      return true;
-    }
-    const originUrl = new URL(normalized);
-    const forwardedHost = c.req.header("x-forwarded-host")?.split(",")[0]?.trim();
-    const requestHost = forwardedHost || c.req.header("host");
-    if (!requestHost || originUrl.host !== requestHost) return false;
-    const forwardedProto = c.req.header("x-forwarded-proto")?.split(",")[0]?.trim();
-    return !forwardedProto || `${forwardedProto}:` === originUrl.protocol;
-  } catch {
-    return false;
-  }
-}
-function corsResponse(origin) {
-  const headers = new Headers();
-  if (origin) setCorsHeaders(headers, origin);
-  headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  headers.set(
-    "Access-Control-Allow-Headers",
-    "Accept, Authorization, Content-Type"
-  );
-  headers.set("Access-Control-Max-Age", "600");
-  return new Response(null, { status: 204, headers });
-}
-function setCorsHeaders(headers, origin) {
-  headers.set("Access-Control-Allow-Origin", origin);
-  headers.append("Vary", "Origin");
-}
-async function isAuthenticated(c, authenticate) {
-  return authenticate ? authenticate(c) : true;
-}
-function isRedirect(status) {
-  return status >= 300 && status < 400;
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || normalized.startsWith("127.");
-}
-function isLocalHostname(hostname) {
-  const normalized = hostname.toLowerCase();
-  return normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa");
-}
-function isPublicAddress(address) {
-  if (address.includes(":")) {
-    const lower = address.toLowerCase();
-    if (lower.startsWith("::ffff:")) {
-      return isPublicAddress(lower.slice(7));
-    }
-    return !(lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || /^fe[89ab]/.test(lower) || lower.startsWith("ff") || lower.startsWith("2001:db8:"));
-  }
-  const parts = address.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part))) {
-    return false;
-  }
-  const [a, b, c] = parts;
-  return !(a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c === 0 || a === 192 && b === 0 && c === 2 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113 || a >= 224);
-}
-function log(enabled, message) {
-  if (enabled) console.log(`[OAuth BFF] ${message}`);
-}
-function proxyError(c, error, logging) {
-  const message = error instanceof Error ? error.message : "Unknown error";
-  if (logging) console.error("[OAuth BFF]", message);
-  if (error instanceof BodyTooLargeError) {
-    return c.json({ error: "Upstream response too large" }, 502);
-  }
-  if (error instanceof InvalidUpstreamError) {
-    return c.json({ error: error.message }, 502);
-  }
-  if (error instanceof DOMException && error.name === "TimeoutError") {
-    return c.json({ error: "OAuth upstream timed out" }, 504);
-  }
-  return c.json({ error: "OAuth upstream request failed" }, 502);
-}
-var BodyTooLargeError = class extends Error {
-};
-var InvalidUpstreamError = class extends Error {
-};
-
-// src/server/proxy/mcp-proxy.ts
-var MAX_REDIRECTS = 3;
-function isOpenEndedSseResponse(contentType, contentLength) {
-  return contentType.includes("text/event-stream") && !contentLength;
-}
-function mountMcpProxy(app2, options = {}) {
-  const basePath = options.path || "/mcp/proxy";
-  const enableLogging = options.enableLogging !== false;
-  app2.use(
-    `${basePath}/*`,
-    cors({
-      origin: "*",
-      allowHeaders: [
-        "Authorization",
-        "Content-Type",
-        "Accept",
-        "X-Target-URL",
-        "X-MCP-Target",
-        "Mcp-Session-Id",
-        "mcp-session-id",
-        "mcp-protocol-version",
-        "X-Server-Id",
-        "X-Requested-With"
-      ],
-      exposeHeaders: ["*"]
-    })
-  );
-  if (enableLogging) {
-    app2.use(`${basePath}/*`, logger());
-  }
-  app2.all(`${basePath}/*`, async (c) => {
-    try {
-      if (options.authenticate) {
-        const isAuthenticated2 = await options.authenticate(c);
-        if (!isAuthenticated2) {
-          return c.json({ error: "Unauthorized" }, 401);
-        }
-      }
-      const targetUrl = c.req.header("X-Target-URL");
-      if (!targetUrl) {
-        return c.json(
-          {
-            error: "X-Target-URL header is required",
-            usage: "Set X-Target-URL header to the MCP server URL you want to proxy to"
-          },
-          400
-        );
-      }
-      if (!await isSafeProxyTarget(targetUrl, options.allowLoopback ?? false)) {
-        return c.json(
-          {
-            error: "Invalid target URL",
-            details: "Target is not allowed by the proxy network policy"
-          },
-          403
-        );
-      }
-      if (options.validateRequest) {
-        const isValid = await options.validateRequest(targetUrl, c);
-        if (!isValid) {
-          return c.json(
-            {
-              error: "Invalid target URL",
-              details: "The requested target URL is not allowed"
-            },
-            403
-          );
-        }
-      }
-      try {
-        new URL(targetUrl);
-      } catch {
-        return c.json(
-          {
-            error: "Invalid target URL format",
-            details: "The X-Target-URL must be a valid HTTP/HTTPS URL"
-          },
-          400
-        );
-      }
-      const method = c.req.method;
-      const headers = {};
-      const requestHeaders = c.req.header();
-      for (const [key, value] of Object.entries(requestHeaders)) {
-        const lowerKey = key.toLowerCase();
-        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "origin" && lowerKey !== "referer" && lowerKey !== "cookie" && lowerKey !== "proxy-authorization" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop" && !lowerKey.startsWith("sec-fetch-")) {
-          headers[key] = value;
-        }
-      }
-      headers["Accept-Encoding"] = "identity";
-      const body = method !== "GET" && method !== "HEAD" ? new Uint8Array(await c.req.arrayBuffer()).slice() : void 0;
-      let currentUrl = targetUrl;
-      let currentMethod = method;
-      let currentBody = body;
-      for (let redirectCount = 0; ; redirectCount += 1) {
-        const response = await fetch(currentUrl, {
-          method: currentMethod,
-          headers,
-          body: currentBody,
-          redirect: "manual"
-        });
-        const location = response.headers.get("location");
-        if (!(response.status >= 300 && response.status < 400 && location)) {
-          return proxyResponse(response);
-        }
-        if (redirectCount >= MAX_REDIRECTS) {
-          return c.json({ error: "Too many upstream redirects" }, 502);
-        }
-        const redirectUrl = new URL(location, currentUrl);
-        if (!await isSafeProxyTarget(
-          redirectUrl.toString(),
-          options.allowLoopback ?? false
-        ) || options.validateRequest && !await options.validateRequest(redirectUrl.toString(), c)) {
-          return c.json({ error: "Redirect target is not allowed" }, 403);
-        }
-        if (redirectUrl.origin !== new URL(currentUrl).origin) {
-          deleteHeader(headers, "authorization");
-          deleteHeader(headers, "proxy-authorization");
-        }
-        if (response.status === 303 || (response.status === 301 || response.status === 302) && currentMethod === "POST") {
-          currentMethod = "GET";
-          currentBody = void 0;
-          deleteHeader(headers, "content-type");
-          deleteHeader(headers, "content-length");
-        }
-        currentUrl = redirectUrl.toString();
-      }
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      const targetUrl = c.req.header("X-Target-URL");
-      const isConnectionRefused = error instanceof Error && (error.message.includes("ECONNREFUSED") || error.message.includes("fetch failed"));
-      if (isConnectionRefused) {
-        console.warn(
-          `[MCP Proxy] Connection refused to ${targetUrl || "unknown target"} - server may not be running`
-        );
-      } else {
-        console.error(
-          "[MCP Proxy] Request failed:",
-          message,
-          "\nTarget URL:",
-          targetUrl || "unknown",
-          "\nError:",
-          error
-        );
-      }
-      return c.json(
-        {
-          error: "Proxy request failed",
-          details: message,
-          targetUrl: targetUrl || "unknown"
-        },
-        500
-      );
-    }
-  });
-}
-function deleteHeader(headers, name) {
-  for (const key of Object.keys(headers)) {
-    if (key.toLowerCase() === name) delete headers[key];
-  }
-}
-async function proxyResponse(response) {
-  const responseHeaders = {};
-  response.headers.forEach((value, key) => {
-    const lowerKey = key.toLowerCase();
-    if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length" && lowerKey !== "set-cookie") {
-      responseHeaders[key] = value;
-    }
-  });
-  const isTrueStream = isOpenEndedSseResponse(
-    response.headers.get("content-type") || "",
-    response.headers.get("content-length")
-  );
-  if (isTrueStream) {
-    return new Response(response.body, {
-      status: response.status,
-      statusText: response.statusText,
-      headers: responseHeaders
-    });
-  }
-  const bodyBuffer = await response.arrayBuffer();
-  responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
-  return new Response(bodyBuffer, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: responseHeaders
-  });
-}
-
-// src/server/proxy-routes.ts
-function registerInspectorProxyRoutes(app2, config, basePath = "") {
-  const p = (suffix) => `${basePath}${suffix}`;
-  const allowLoopback = config?.oauthProxyAllowLoopback ?? false;
-  const mountOAuth = config?.oauth !== false;
-  app2.get(p("/inspector/health"), (c) => {
-    return c.json({
-      status: "ok",
-      protocol: "mcp-use-inspector-preview",
-      version: 1,
-      capabilities: ["view-preview"]
-    });
-  });
-  mountMcpProxy(app2, {
-    path: p("/inspector/api/proxy"),
-    allowLoopback
-  });
-  if (mountOAuth) {
-    mountOAuthProxy(app2, {
-      basePath: p("/inspector/api/oauth"),
-      callbackPath: p("/inspector/oauth/callback"),
-      enableLogging: true,
-      allowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
-      allowLoopback
-    });
-  }
-  if (config?.autoConnectUrl !== void 0) {
-    const autoConnectUrl = config.autoConnectUrl;
-    app2.get(p("/inspector/config.json"), (c) => {
-      return c.json({ autoConnectUrl: autoConnectUrl ?? null });
-    });
-  }
-}
-
-// src/server/utils.ts
-function isValidUrl(urlString) {
-  try {
-    const url = new URL(urlString);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-async function findAvailablePort(startPort2 = 8080, maxAttempts = 100) {
-  const net = await import("net");
-  for (let port = startPort2; port < startPort2 + maxAttempts; port++) {
-    try {
-      await new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-          server.close(() => resolve());
-        });
-        server.on("error", (err) => reject(err));
-      });
-      return port;
-    } catch {
-      continue;
-    }
-  }
-  throw new Error(
-    `No available port found after trying ${maxAttempts} ports starting from ${startPort2}`
-  );
-}
-
-// src/server/cli.ts
-var args = process.argv.slice(2);
-var mcpUrl;
-var startPort = 8080;
-var noOpen = false;
-for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--url") {
-    if (i + 1 >= args.length || args[i + 1].startsWith("-")) {
-      console.error("Error: --url requires a value");
-      process.exit(1);
-    }
-    const url = args[i + 1];
-    if (!isValidUrl(url)) {
-      console.error(`Error: Invalid URL format: ${url}`);
-      console.error("URL must start with http://, https://, ws://, or wss://");
-      process.exit(1);
-    }
-    mcpUrl = url;
-    i++;
-  } else if (args[i] === "--port") {
-    if (i + 1 >= args.length || args[i + 1].startsWith("-")) {
-      console.error("Error: --port requires a value");
-      process.exit(1);
-    }
-    const parsedPort = Number.parseInt(args[i + 1], 10);
-    if (Number.isNaN(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
-      console.error(
-        `Error: Port must be a number between 1 and 65535, got: ${args[i + 1]}`
-      );
-      process.exit(1);
-    }
-    startPort = parsedPort;
-    i++;
-  } else if (args[i] === "--no-open") {
-    noOpen = true;
-  } else if (args[i] === "--version" || args[i] === "-v") {
-    console.log(getInspectorVersion());
-    process.exit(0);
-  } else if (args[i] === "--help" || args[i] === "-h") {
-    console.log(`
+</html>`}function yr(e,t,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(wr),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...t,basePath:t?.basePath??r,proxyUrl:t?.proxyUrl!==void 0?t.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:t?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>u.html(bo(a,r,s));mr(e,n),e.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(yo)),e.get(i("/inspector"),c),e.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");e.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),e.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&t?.rootRedirect!==!1&&e.get("/",u=>{let d=new URL(u.req.url);return u.redirect(`${i("/inspector")}${d.search}`)})}function vo(){let{process:e,Deno:t}=globalThis;return!(typeof t?.noColor=="boolean"?t.noColor:e!==void 0?"NO_COLOR"in e?.env:!1)}async function br(){let{navigator:e}=globalThis,t="cloudflare:workers";return!(e!==void 0&&e.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(t)).env??{})}catch{return!1}})():!vo())}var xo=e=>{let[t,r]=[",","."];return e.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+t)).join(r)},Ro=e=>{let t=Date.now()-e;return xo([t<1e3?t+"ms":Math.round(t/1e3)+"s"])},Eo=async e=>{if(await br())switch(e/100|0){case 5:return`\x1B[31m${e}\x1B[0m`;case 4:return`\x1B[33m${e}\x1B[0m`;case 3:return`\x1B[36m${e}\x1B[0m`;case 2:return`\x1B[32m${e}\x1B[0m`}return`${e}`};async function vr(e,t,r,n,o=0,s){let i=t==="<--"?`${t} ${r} ${n}`:`${t} ${r} ${n} ${await Eo(o)} ${s}`;e(i)}var xr=(e=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await vr(e,"<--",o,i);let a=Date.now();await n(),await vr(e,"-->",o,i,r.res.status,Ro(a))};import{lookup as So}from"dns/promises";import{Buffer as Po}from"buffer";import{isIP as Ao}from"net";var Co=new Set(["accept","authorization","content-type","dpop"]),Oo=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),_o=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],Or=600*1e3,To=100,Lo=1440*60*1e3,ko=500;function pt(e,t={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,authenticate:u,validateServerUrl:d}=t,h=new Set(n.map(dt)),f=new Map,g=new Map;e.use(`${r}/*`,async(p,w)=>{let m=p.req.header("Origin");if(m&&!Do(m,p,h))return p.json({error:"Origin not allowed"},403);if(p.req.method==="OPTIONS")return Fo(m);await w(),m&&Ir(p.res.headers,m)}),e.get(`${r}/metadata`,async p=>{if(!await Cr(p,u))return p.json({error:"Unauthorized"},401);let w=await F(p.req.query("serverUrl"),o);if("error"in w)return p.json({error:w.error},400);let m=w.url;if(d&&!await d(m.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let x=await F(p.req.query("url"),o);if("error"in x)return p.json({error:x.error},400);let C=x.url,L=k(m),R=Pr(f,L),b=Rr(m,C,R);if(!b&&R.authorizationServers.size===0)try{await Er(m,R,o,s,a),f.set(L,R),b=Rr(m,C,R)}catch{}if(!b)return p.json({error:"Metadata target is not bound to this MCP server"},403);try{ct(l,`GET ${C}`);let P=await Pe(C,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(Ce(P.status))return p.json({error:"OAuth metadata redirects are not allowed"},502);let v=await Ae(P,a);if(!P.ok)return p.body(v,P.status,{"Content-Type":P.headers.get("content-type")??"application/json"});let A=ut(v);return b.type==="protected-resource"?await Lr(A,m,R,o):await kr(A,b.issuer,R,o),R.updatedAt=Date.now(),f.set(L,R),Ar(f),p.body(v,200,{"Content-Type":P.headers.get("content-type")??"application/json"})}catch(P){return lt(p,P,l)}}),e.post(`${r}/proxy`,async p=>{if(!await Cr(p,u))return p.json({error:"Unauthorized"},401);let w;try{w=JSON.parse(await $o(p.req.raw,i))}catch(v){return p.json({error:v instanceof j?"Request body too large":"Invalid JSON request body"},v instanceof j?413:400)}let m=await F(w.serverUrl,o);if("error"in m)return p.json({error:m.error},400);let x=m.url;if(d&&!await d(x.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let C=await F(w.url,o);if("error"in C)return p.json({error:C.error},400);let L=C.url;if(w.method!==void 0&&w.method!=="POST")return p.json({error:"Only OAuth endpoint POST is allowed"},405);let R=k(x),b=Pr(f,R);if(b.endpoints.size===0)try{await Er(x,b,o,s,a),f.set(R,b),Ar(f)}catch(v){return lt(p,v,l)}let P=b.endpoints.get(k(L));if(!P)return p.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let v=Uo(w.headers),A=Io(w.body,v);if(P==="registration"){let Fr=dt(p.req.header("Origin")??new URL(p.req.url).origin);A=Bo(A,v,new URL(c,Fr).toString())}else A=jo({body:A,headers:v,bindingKey:R,clients:g});if(new TextEncoder().encode(A??"").byteLength>i)return p.json({error:"OAuth request body too large"},413);ct(l,`POST ${P} ${L}`);let E=await Pe(L,{method:"POST",headers:v,body:A,redirect:"manual",signal:AbortSignal.timeout(s)});if(Ce(E.status))return p.json({error:"OAuth endpoint redirects are not allowed"},502);let U=await Ae(E,a),Q=Mo(E.headers),q=E.headers.get("content-type")??"",_=U;if(q.includes("json"))try{_=JSON.parse(U)}catch{}return P==="registration"&&E.ok&&_&&typeof _=="object"&&!Array.isArray(_)&&(_=Ho({responseBody:_,binding:b,bindingKey:R,clients:g})),p.json({status:E.status,statusText:E.statusText,headers:Q,body:_})}catch(v){return lt(p,v,l)}}),ct(l,`Mounted at ${r}/metadata and ${r}/proxy`)}async function F(e,t){if(typeof e!="string"||!e)return{error:"Missing or invalid URL"};let r;try{r=new URL(e)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=qo(r.hostname);if(r.protocol!=="https:"&&!(t&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return t?{url:r}:{error:"Loopback URL not allowed"};if(zo(r.hostname))return{error:"Local network URL not allowed"};try{let o=Ao(r.hostname)?[r.hostname]:(await So(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!Hr(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function ft(e,t=!1){return!("error"in await F(e,t))}function Rr(e,t,r){let n=k(t);if(_r(e).some(o=>k(o)===n))return{type:"protected-resource"};for(let o of r.authorizationServers)if(Tr(new URL(o)).some(s=>k(s)===n))return{type:"authorization-server",issuer:o}}function _r(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-protected-resource${t}`,e.origin),new URL("/.well-known/oauth-protected-resource",e.origin)]}function Tr(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-authorization-server${t}`,e.origin),new URL(`/.well-known/openid-configuration${t}`,e.origin),new URL(`${t||""}/.well-known/openid-configuration`,e.origin)]}async function Lr(e,t,r,n){if(typeof e.resource!="string"||k(new URL(e.resource))!==k(t))throw new O("Protected-resource metadata does not match serverUrl");if(!Array.isArray(e.authorization_servers)||e.authorization_servers.length===0)throw new O("Protected-resource metadata has no authorization servers");let o=new Set;for(let s of e.authorization_servers){let i=await F(s,n);if("error"in i)throw new O(`Unsafe authorization server: ${i.error}`);o.add(k(i.url))}r.authorizationServers=o,r.endpoints.clear(),r.tokenEndpointAuthMethods.clear()}async function kr(e,t,r,n){if(typeof e.issuer!="string"||k(new URL(e.issuer))!==t)throw new O("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(e.token_endpoint_auth_methods_supported)?e.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of _o){let i=e[o];if(i===void 0)continue;let a=await F(i,n);if("error"in a)throw new O(`Unsafe ${o}: ${a.error}`);r.endpoints.set(k(a.url),s)}}async function Er(e,t,r,n,o){for(let s of _r(e)){let i=await Pe(s,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(Ce(i.status))throw new O("OAuth metadata redirects are not allowed");if(i.ok){await Lr(ut(await Ae(i,o)),e,t,r);break}}if(t.authorizationServers.size===0)throw new O("Protected-resource metadata could not be discovered");for(let s of t.authorizationServers){let i=!1;for(let a of Tr(new URL(s))){let c=await Pe(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(Ce(c.status))throw new O("OAuth metadata redirects are not allowed");if(c.ok){await kr(ut(await Ae(c,o)),s,t,r),i=!0;break}}if(i)break}if(t.endpoints.size===0)throw new O("Authorization-server metadata could not be discovered");t.updatedAt=Date.now()}async function Pe(e,t){return fetch(e,t)}function Uo(e){let t=new Headers;if(!e||typeof e!="object"||Array.isArray(e))return t;for(let[r,n]of Object.entries(e)){let o=r.toLowerCase();Co.has(o)&&typeof n=="string"&&t.set(o,n)}return t}function Mo(e){let t={};return e.forEach((r,n)=>{Oo.has(n.toLowerCase())&&(t[n]=r)}),t}function Io(e,t){if(e==null)return;if(typeof e=="string"){if(!t.has("content-type"))try{JSON.parse(e),t.set("content-type","application/json")}catch{t.set("content-type","application/x-www-form-urlencoded")}return e}if((t.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof e=="object"&&!Array.isArray(e)){let n=new URLSearchParams;for(let[o,s]of Object.entries(e))n.append(o,String(s));return n.toString()}return t.has("content-type")||t.set("content-type","application/json"),JSON.stringify(e)}function Ur(e,t){return`${e}\0${t}`}function Ho(e){let{responseBody:t,binding:r,bindingKey:n,clients:o}=e,s=t.client_id,i=t.client_secret;if(typeof s!="string"||typeof i!="string")return t;let a=t.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=t.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+Lo;for(No(o),o.set(Ur(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>ko;){let h=o.keys().next().value;if(!h)break;o.delete(h)}let d={...t};return delete d.client_secret,delete d.client_secret_expires_at,d.token_endpoint_auth_method="none",d}function jo(e){let{body:t,headers:r,bindingKey:n,clients:o}=e;if(!t||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return t;let s=new URLSearchParams(t),i=s.get("client_id");if(!i)return t;let a=Ur(n,i),c=o.get(a);if(!c)return t;if(c.expiresAt<=Date.now())return o.delete(a),t;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=Po.from(`${Sr(i)}:${Sr(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function Sr(e){return new URLSearchParams({value:e}).toString().slice(6)}function No(e){let t=Date.now();for(let[r,n]of e)n.expiresAt<=t&&e.delete(r)}async function $o(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new j;return Mr(e.body,t)}async function Ae(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw await e.body?.cancel(),new j;return Mr(e.body,t)}async function Mr(e,t){if(!e)return"";let r=e.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>t)throw await r.cancel(),new j;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function ut(e){let t;try{t=JSON.parse(e)}catch{throw new O("OAuth metadata is not valid JSON")}if(!t||typeof t!="object"||Array.isArray(t))throw new O("OAuth metadata is not an object");return t}function Pr(e,t){let r=e.get(t);return r&&Date.now()-r.updatedAt<=Or?r:(e.delete(t),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Ar(e){let t=Date.now();for(let[r,n]of e)t-n.updatedAt>Or&&e.delete(r);for(;e.size>To;){let r=e.keys().next().value;if(!r)break;e.delete(r)}}function k(e){let t=new URL(e);return t.hash="",(t.protocol==="https:"&&t.port==="443"||t.protocol==="http:"&&t.port==="80")&&(t.port=""),t.toString().replace(/\/$/,"")}function Bo(e,t,r){if(!e||!(t.get("content-type")??"").includes("json"))return e;try{let o=JSON.parse(e);return!o||typeof o!="object"||Array.isArray(o)?e:JSON.stringify({...o,redirect_uris:[r]})}catch{return e}}function dt(e){let t=new URL(e);if(t.pathname!=="/"||t.search||t.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${e}`);return t.origin}function Do(e,t,r){try{let n=dt(e);if(n===new URL(t.req.url).origin||r.has(n))return!0;let o=new URL(n),i=t.req.header("x-forwarded-host")?.split(",")[0]?.trim()||t.req.header("host");if(!i||o.host!==i)return!1;let a=t.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function Fo(e){let t=new Headers;return e&&Ir(t,e),t.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),t.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:t})}function Ir(e,t){e.set("Access-Control-Allow-Origin",t),e.append("Vary","Origin")}async function Cr(e,t){return t?t(e):!0}function Ce(e){return e>=300&&e<400}function qo(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t.endsWith(".localhost")||t==="::1"||t.startsWith("127.")}function zo(e){let t=e.toLowerCase();return t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa")}function Hr(e){if(e.includes(":")){let s=e.toLowerCase();return s.startsWith("::ffff:")?Hr(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let t=e.split(".").map(Number);if(t.length!==4||t.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=t;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function ct(e,t){e&&console.log(`[OAuth BFF] ${t}`)}function lt(e,t,r){let n=t instanceof Error?t.message:"Unknown error";return r&&console.error("[OAuth BFF]",n),t instanceof j?e.json({error:"Upstream response too large"},502):t instanceof O?e.json({error:t.message},502):t instanceof DOMException&&t.name==="TimeoutError"?e.json({error:"OAuth upstream timed out"},504):e.json({error:"OAuth upstream request failed"},502)}var j=class extends Error{},O=class extends Error{};var Wo=3;function Vo(e,t){return e.includes("text/event-stream")&&!t}function ht(e,t={}){let r=t.path||"/mcp/proxy",n=t.enableLogging!==!1;e.use(`${r}/*`,be({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&e.use(`${r}/*`,xr()),e.all(`${r}/*`,async o=>{try{if(t.authenticate&&!await t.authenticate(o))return o.json({error:"Unauthorized"},401);let s=o.req.header("X-Target-URL");if(!s)return o.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await ft(s,t.allowLoopback??!1))return o.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(t.validateRequest&&!await t.validateRequest(s,o))return o.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(s)}catch{return o.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let i=o.req.method,a={},c=o.req.header();for(let[f,g]of Object.entries(c)){let p=f.toLowerCase();!p.startsWith("x-proxy-")&&!p.startsWith("x-target-")&&!p.startsWith("x-mcp-")&&!p.startsWith("x-forwarded-")&&!p.startsWith("cf-")&&p!=="x-original-host"&&p!=="host"&&p!=="origin"&&p!=="referer"&&p!=="cookie"&&p!=="proxy-authorization"&&p!=="accept-encoding"&&p!=="cdn-loop"&&!p.startsWith("sec-fetch-")&&(a[f]=g)}a["Accept-Encoding"]="identity";let l=i!=="GET"&&i!=="HEAD"?new Uint8Array(await o.req.arrayBuffer()).slice():void 0,u=s,d=i,h=l;for(let f=0;;f+=1){let g=await fetch(u,{method:d,headers:a,body:h,redirect:"manual"}),p=g.headers.get("location");if(!(g.status>=300&&g.status<400&&p))return Go(g);if(f>=Wo)return o.json({error:"Too many upstream redirects"},502);let w=new URL(p,u);if(!await ft(w.toString(),t.allowLoopback??!1)||t.validateRequest&&!await t.validateRequest(w.toString(),o))return o.json({error:"Redirect target is not allowed"},403);w.origin!==new URL(u).origin&&(Oe(a,"authorization"),Oe(a,"proxy-authorization")),(g.status===303||(g.status===301||g.status===302)&&d==="POST")&&(d="GET",h=void 0,Oe(a,"content-type"),Oe(a,"content-length")),u=w.toString()}}catch(s){let i=s instanceof Error?s.message:"Unknown error",a=o.req.header("X-Target-URL");return s instanceof Error&&(s.message.includes("ECONNREFUSED")||s.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${a||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",i,`
+Target URL:`,a||"unknown",`
+Error:`,s),o.json({error:"Proxy request failed",details:i,targetUrl:a||"unknown"},500)}})}function Oe(e,t){for(let r of Object.keys(e))r.toLowerCase()===t&&delete e[r]}async function Go(e){let t={};if(e.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(t[s]=o)}),Vo(e.headers.get("content-type")||"",e.headers.get("content-length")))return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t});if([204,205,304].includes(e.status))return new Response(null,{status:e.status,statusText:e.statusText,headers:t});let n=await e.arrayBuffer();return t["Content-Length"]=String(n.byteLength),new Response(n,{status:e.status,statusText:e.statusText,headers:t})}function jr(e,t,r=""){let n=i=>`${r}${i}`,o=t?.oauthProxyAllowLoopback??!1,s=t?.oauth!==!1;if(e.get(n("/inspector/health"),i=>i.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),ht(e,{path:n("/inspector/api/proxy"),allowLoopback:o}),s&&pt(e,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,allowedOrigins:t?.oauthProxyAllowedOrigins??[],allowLoopback:o}),t?.autoConnectUrl!==void 0){let i=t.autoConnectUrl;e.get(n("/inspector/config.json"),a=>a.json({autoConnectUrl:i??null}))}}function Nr(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}}async function $r(e=8080,t=100){let r=await import("net");for(let n=e;n<e+t;n++)try{return await new Promise((o,s)=>{let i=r.createServer();i.listen(n,()=>{i.close(()=>o())}),i.on("error",a=>s(a))}),n}catch{continue}throw new Error(`No available port found after trying ${t} ports starting from ${e}`)}var S=process.argv.slice(2),Y,Br=8080,Dr=!1;for(let e=0;e<S.length;e++)if(S[e]==="--url"){(e+1>=S.length||S[e+1].startsWith("-"))&&(console.error("Error: --url requires a value"),process.exit(1));let t=S[e+1];Nr(t)||(console.error(`Error: Invalid URL format: ${t}`),console.error("URL must start with http://, https://, ws://, or wss://"),process.exit(1)),Y=t,e++}else if(S[e]==="--port"){(e+1>=S.length||S[e+1].startsWith("-"))&&(console.error("Error: --port requires a value"),process.exit(1));let t=Number.parseInt(S[e+1],10);(Number.isNaN(t)||t<1||t>65535)&&(console.error(`Error: Port must be a number between 1 and 65535, got: ${S[e+1]}`),process.exit(1)),Br=t,e++}else S[e]==="--no-open"?Dr=!0:S[e]==="--version"||S[e]==="-v"?(console.log(Se()),process.exit(0)):S[e]==="--help"||S[e]==="-h"?(console.log(`
 MCP Inspector - Inspect and debug MCP servers
 
 Usage:
@@ -1494,58 +116,4 @@ Examples:
   npx @mcp-use/inspector --url http://localhost:3000/mcp
   npx @mcp-use/inspector --url http://localhost:3000/mcp --port 9000
   npx @mcp-use/inspector
-`);
-    process.exit(0);
-  } else {
-    console.error(`Error: Unknown option: ${args[i]}`);
-    console.error("Run with --help to see available options.");
-    process.exit(1);
-  }
-}
-var app = new Hono();
-app.use(
-  "*",
-  cors2({
-    origin: "*",
-    exposeHeaders: ["*"]
-  })
-);
-registerInspectorProxyRoutes(app, {
-  autoConnectUrl: mcpUrl,
-  oauthProxyAllowedOrigins: [],
-  oauthProxyAllowLoopback: true
-});
-registerInspectorShell(app, {
-  inspectorMode: "standalone",
-  manufactChatUrl: process.env.MANUFACT_CHAT_URL
-});
-async function startServer() {
-  try {
-    const port = await findAvailablePort(startPort);
-    serve({
-      fetch: app.fetch,
-      port
-    });
-    console.log(`\u{1F680} MCP Inspector running on http://localhost:${port}`);
-    if (mcpUrl) {
-      console.log(`\u{1F4E1} Auto-connecting to: ${mcpUrl}`);
-    }
-    if (!noOpen) {
-      const openUrl = new URL(`http://localhost:${port}/inspector`);
-      if (mcpUrl) {
-        openUrl.searchParams.set("autoConnect", mcpUrl);
-      }
-      try {
-        await open(openUrl.toString());
-        console.log(`\u{1F310} Browser opened`);
-      } catch {
-        console.log(`\u{1F310} Please open ${openUrl} in your browser`);
-      }
-    }
-    return { port, fetch: app.fetch };
-  } catch (error) {
-    console.error("Failed to start server:", error);
-    process.exit(1);
-  }
-}
-startServer();
+`),process.exit(0)):(console.error(`Error: Unknown option: ${S[e]}`),console.error("Run with --help to see available options."),process.exit(1));var ie=new Ge;ie.use("*",be({origin:"*",exposeHeaders:["*"]}));jr(ie,{autoConnectUrl:Y,oauthProxyAllowedOrigins:[],oauthProxyAllowLoopback:!0});yr(ie,{inspectorMode:"standalone",manufactChatUrl:process.env.MANUFACT_CHAT_URL});async function Ko(){try{let e=await $r(Br);if(Pt({fetch:ie.fetch,port:e}),console.log(`\u{1F680} MCP Inspector running on http://localhost:${e}`),Y&&console.log(`\u{1F4E1} Auto-connecting to: ${Y}`),!Dr){let t=new URL(`http://localhost:${e}/inspector`);Y&&t.searchParams.set("autoConnect",Y);try{await pr(t.toString()),console.log("\u{1F310} Browser opened")}catch{console.log(`\u{1F310} Please open ${t} in your browser`)}}return{port:e,fetch:ie.fetch}}catch(e){console.error("Failed to start server:",e),process.exit(1)}}Ko();