@mcp-use/inspector 20.0.0-beta.5 → 20.0.0-beta.50

package/dist/cli.js

@@ -1,392 +1,336 @@
 #!/usr/bin/env node
+var hn=Object.create;var Pt=Object.defineProperty;var mn=Object.getOwnPropertyDescriptor;var gn=Object.getOwnPropertyNames;var wn=Object.getPrototypeOf,yn=Object.prototype.hasOwnProperty;var re=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports);var bn=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of gn(t))!yn.call(e,o)&&o!==r&&Pt(e,o,{get:()=>t[o],enumerable:!(n=mn(t,o))||n.enumerable});return e};var vn=(e,t,r)=>(r=e!=null?hn(wn(e)):{},bn(t||!e||!e.__esModule?Pt(r,"default",{value:e,enumerable:!0}):r,e));var Ar=re((bc,Pr)=>{"use strict";Pr.exports=class{constructor(t={}){this.points=t.points,this.duration=t.duration,this.blockDuration=t.blockDuration,this.execEvenly=t.execEvenly,this.execEvenlyMinDelayMs=t.execEvenlyMinDelayMs,this.keyPrefix=t.keyPrefix}get points(){return this._points}set points(t){if(Number.isFinite(t))this._points=t;else throw new Error("points must be set and must be a finite number")}get duration(){return this._duration}set duration(t){if(typeof t=="number"&&Number.isFinite(t)&&t>=0)this._duration=t;else throw new Error("duration must be set and must be a finite, non-negative number")}get msDuration(){return this.duration*1e3}get blockDuration(){return this._blockDuration}set blockDuration(t){this._blockDuration=typeof t>"u"?0:t}get msBlockDuration(){return this.blockDuration*1e3}get execEvenly(){return this._execEvenly}set execEvenly(t){this._execEvenly=typeof t>"u"?!1:!!t}get execEvenlyMinDelayMs(){return this._execEvenlyMinDelayMs===void 0?this._getExecEvenlyMinDelayMsDefault():this._execEvenlyMinDelayMs}set execEvenlyMinDelayMs(t){this._execEvenlyMinDelayMs=t}_getExecEvenlyMinDelayMsDefault(){return this.points>0?Math.ceil(this.msDuration/this.points):0}get keyPrefix(){return this._keyPrefix}set keyPrefix(t){if(typeof t>"u"&&(t="rlflx"),typeof t!="string")throw new Error("keyPrefix must be string");this._keyPrefix=t}_getKeySecDuration(t={}){return t&&t.customDuration>=0?t.customDuration:this.duration}getKey(t){return this.keyPrefix.length>0?`${this.keyPrefix}:${t}`:t}parseKey(t){return this.keyPrefix.length>0?t.substring(this.keyPrefix.length+1):t}consume(){throw new Error("You have to implement the method 'consume'!")}penalty(){throw new Error("You have to implement the method 'penalty'!")}reward(){throw new Error("You have to implement the method 'reward'!")}get(){throw new Error("You have to implement the method 'get'!")}set(){throw new Error("You have to implement the method 'set'!")}block(){throw new Error("You have to implement the method 'block'!")}delete(){throw new Error("You have to implement the method 'delete'!")}}});var Cr=re((xc,_r)=>{"use strict";_r.exports=class{constructor(t,r,n=null){this.value=t,this.expiresAt=r,this.timeoutId=n}get value(){return this._value}set value(t){this._value=parseInt(t,10)}get expiresAt(){return this._expiresAt}set expiresAt(t){t instanceof Date?this._expiresAt=t.getTime():this._expiresAt=t}get timeoutId(){return this._timeoutId}set timeoutId(t){this._timeoutId=t}}});var ht=re((Ec,Or)=>{"use strict";Or.exports=class{constructor(t,r,n,o){this.remainingPoints=typeof t>"u"?0:t,this.msBeforeNext=typeof r>"u"?0:r,this.consumedPoints=typeof n>"u"?0:n,this.isFirstInDuration=typeof o>"u"?!1:o}get msBeforeNext(){return this._msBeforeNext}set msBeforeNext(t){return this._msBeforeNext=t,this}get remainingPoints(){return this._remainingPoints}set remainingPoints(t){return this._remainingPoints=t,this}get consumedPoints(){return this._consumedPoints}set consumedPoints(t){return this._consumedPoints=t,this}get isFirstInDuration(){return this._isFirstInDuration}set isFirstInDuration(t){this._isFirstInDuration=!!t}_getDecoratedProperties(){return{remainingPoints:this.remainingPoints,msBeforeNext:this.msBeforeNext,consumedPoints:this.consumedPoints,isFirstInDuration:this.isFirstInDuration}}[Symbol.for("nodejs.util.inspect.custom")](){return this._getDecoratedProperties()}toString(){return JSON.stringify(this._getDecoratedProperties())}toJSON(){return this._getDecoratedProperties()}}});var Mr=re((Pc,Lr)=>{"use strict";var Tr=Cr(),mt=ht();Lr.exports=class{constructor(){this._storage=new Map}incrby(t,r,n){let o=this._storage.get(t);if(o){let s=o.expiresAt?o.expiresAt-Date.now():-1;return!o.expiresAt||s>0?(o.value=o.value+r,new mt(0,s,o.value,!1)):this.set(t,r,n)}return this.set(t,r,n)}set(t,r,n){let o=n*1e3,s=this._storage.get(t);s&&s.timeoutId&&clearTimeout(s.timeoutId);let i=new Tr(r,o>0?Date.now()+o:null);return this._storage.set(t,i),o>0&&(i.timeoutId=setTimeout(()=>{this._storage.delete(t)},o),i.timeoutId.unref&&i.timeoutId.unref()),new mt(0,o===0?-1:o,i.value,!0)}get(t){let r=this._storage.get(t);if(r){let n=r.expiresAt?r.expiresAt-Date.now():-1;return new mt(0,n,r.value,!1)}return null}delete(t){let r=this._storage.get(t);return r?(r.timeoutId&&clearTimeout(r.timeoutId),this._storage.delete(t),!0):!1}_restoreRecord(t,r,n){let o=Date.now(),s=n!==null;if(s&&!Number.isFinite(n)||s&&n<=o)return;let i=s?n-o:0,a=this._storage.get(t);a&&a.timeoutId&&clearTimeout(a.timeoutId);let c=new Tr(r,n);this._storage.set(t,c),i>0&&(c.timeoutId=setTimeout(()=>{this._storage.delete(t)},i),c.timeoutId.unref&&c.timeoutId.unref())}}});var Dr=re((Ac,kr)=>{"use strict";var $o=Ar(),Fo=Mr(),Ir=ht(),gt=class extends $o{constructor(t={}){super(t),this._memoryStorage=new Fo}consume(t,r=1,n={}){return new Promise((o,s)=>{let i=this.getKey(t),a=this._getKeySecDuration(n),c=this._memoryStorage.incrby(i,r,a);if(c.remainingPoints=Math.max(this.points-c.consumedPoints,0),c.consumedPoints>this.points)this.blockDuration>0&&c.consumedPoints<=this.points+r&&(c=this._memoryStorage.set(i,c.consumedPoints,this.blockDuration)),s(c);else if(this.execEvenly&&this.points>0&&c.msBeforeNext>0&&!c.isFirstInDuration){let l=Math.ceil(c.msBeforeNext/(c.remainingPoints+2));l<this.execEvenlyMinDelayMs&&(l=c.consumedPoints*this.execEvenlyMinDelayMs),c.msBeforeNext=Math.max(c.msBeforeNext-l,0),setTimeout(o,l,c)}else o(c)})}penalty(t,r=1,n={}){let o=this.getKey(t);return new Promise(s=>{let i=this._getKeySecDuration(n),a=this._memoryStorage.incrby(o,r,i);a.remainingPoints=Math.max(this.points-a.consumedPoints,0),s(a)})}reward(t,r=1,n={}){let o=this.getKey(t);return new Promise(s=>{let i=this._getKeySecDuration(n),a=this._memoryStorage.incrby(o,-r,i);a.remainingPoints=Math.max(this.points-a.consumedPoints,0),s(a)})}block(t,r){let n=r*1e3,o=this.points+1;return this._memoryStorage.set(this.getKey(t),o,r),Promise.resolve(new Ir(0,n===0?-1:n,o))}set(t,r,n){let o=(n>=0?n:this.duration)*1e3;return this._memoryStorage.set(this.getKey(t),r,n),Promise.resolve(new Ir(0,o===0?-1:o,r))}get(t){let r=this._memoryStorage.get(this.getKey(t));return r!==null&&(r.remainingPoints=Math.max(this.points-r.consumedPoints,0)),Promise.resolve(r)}delete(t){return Promise.resolve(this._memoryStorage.delete(this.getKey(t)))}dump(){let t=[];for(let[r,n]of this._memoryStorage._storage)t.push({key:this.parseKey(r),value:n.value,expiresAt:n.expiresAt});return{version:1,dumpedAt:Date.now(),storage:t}}restore(t,r=!1){if(!t||typeof t!="object"||t.version!==1)return;let n=r?{invalid:{count:0,keys:[]},expired:{count:0,keys:[]},restored:{count:0,keys:[]}}:{invalid:0,expired:0,restored:0},o=(s,i)=>{r?(n[s].count+=1,n[s].keys.push(i)):n[s]+=1};if(!Array.isArray(t.storage))return n;for(let s of t.storage){if(!s||typeof s!="object"){o("invalid","N/A");continue}let i=typeof s.key=="string"||typeof s.key=="number",a=Number.isFinite(s.value),c=s.expiresAt===null||Number.isFinite(s.expiresAt);if(!i||!a||!c){o("invalid",s.key);continue}if(s.expiresAt!==null&&s.expiresAt<=Date.now()){o("expired",s.key);continue}this._memoryStorage._restoreRecord(this.getKey(s.key),s.value,s.expiresAt),o("restored",s.key)}return n}};kr.exports=gt});import{createServer as xn}from"http";import{Http2ServerRequest as Ot,constants as Sn}from"http2";import{Http2ServerRequest as De}from"http2";import{Readable as At}from"stream";import kn from"crypto";var F=class extends Error{constructor(e,t){super(e,t),this.name="RequestError"}},En=e=>e instanceof F?e:new F(e.message,{cause:e}),Rn=global.Request,ne=class extends Rn{constructor(e,t){typeof e=="object"&&Y in e&&(e=e[Y]()),typeof t?.body?.getReader<"u"&&(t.duplex??="half"),super(e,t)}},Pn=e=>{let t=[],r=e.rawHeaders;for(let n=0;n<r.length;n+=2){let{[n]:o,[n+1]:s}=r;o.charCodeAt(0)!==58&&t.push([o,s])}return new Headers(t)},Tt=Symbol("wrapBodyStream"),An=(e,t,r,n,o)=>{let s={method:e,headers:r,signal:o.signal};if(e==="TRACE"){s.method="GET";let i=new ne(t,s);return Object.defineProperty(i,"method",{get(){return"TRACE"}}),i}if(!(e==="GET"||e==="HEAD"))if("rawBody"in n&&n.rawBody instanceof Buffer)s.body=new ReadableStream({start(i){i.enqueue(n.rawBody),i.close()}});else if(n[Tt]){let i;s.body=new ReadableStream({async pull(a){try{i||=At.toWeb(n).getReader();let{done:c,value:l}=await i.read();c?a.close():a.enqueue(l)}catch(c){a.error(c)}}})}else s.body=At.toWeb(n);return new ne(t,s)},Y=Symbol("getRequestCache"),_n=Symbol("requestCache"),fe=Symbol("incomingKey"),he=Symbol("urlKey"),Cn=Symbol("headersKey"),X=Symbol("abortControllerKey"),On=Symbol("getAbortController"),me={get method(){return this[fe].method||"GET"},get url(){return this[he]},get headers(){return this[Cn]||=Pn(this[fe])},[On](){return this[Y](),this[X]},[Y](){return this[X]||=new AbortController,this[_n]||=An(this.method,this[he],this.headers,this[fe],this[X])}};["body","bodyUsed","cache","credentials","destination","integrity","mode","redirect","referrer","referrerPolicy","signal","keepalive"].forEach(e=>{Object.defineProperty(me,e,{get(){return this[Y]()[e]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(e=>{Object.defineProperty(me,e,{value:function(){return this[Y]()[e]()}})});Object.setPrototypeOf(me,ne.prototype);var Tn=(e,t)=>{let r=Object.create(me);r[fe]=e;let n=e.url||"";if(n[0]!=="/"&&(n.startsWith("http://")||n.startsWith("https://"))){if(e instanceof De)throw new F("Absolute URL for :path is not allowed in HTTP/2");try{let a=new URL(n);r[he]=a.href}catch(a){throw new F("Invalid absolute URL",{cause:a})}return r}let o=(e instanceof De?e.authority:e.headers.host)||t;if(!o)throw new F("Missing host header");let s;if(e instanceof De){if(s=e.scheme,!(s==="http"||s==="https"))throw new F("Unsupported scheme")}else s=e.socket&&e.socket.encrypted?"https":"http";let i=new URL(`${s}://${o}${n}`);if(i.hostname.length!==o.length&&i.hostname!==o.replace(/:\d+$/,""))throw new F("Invalid host header");return r[he]=i.href,r},_t=Symbol("responseCache"),G=Symbol("getResponseCache"),q=Symbol("cache"),He=global.Response,oe=class Lt{#t;#e;[G](){return delete this[q],this[_t]||=new He(this.#t,this.#e)}constructor(t,r){let n;if(this.#t=t,r instanceof Lt){let o=r[_t];if(o){this.#e=o,this[G]();return}else this.#e=r.#e,n=new Headers(r.#e.headers)}else this.#e=r;(typeof t=="string"||typeof t?.getReader<"u"||t instanceof Blob||t instanceof Uint8Array)&&(this[q]=[r?.status||200,t,n||r?.headers])}get headers(){let t=this[q];return t?(t[2]instanceof Headers||(t[2]=new Headers(t[2]||{"content-type":"text/plain; charset=UTF-8"})),t[2]):this[G]().headers}get status(){return this[q]?.[0]??this[G]().status}get ok(){let t=this.status;return t>=200&&t<300}};["body","bodyUsed","redirected","statusText","trailers","type","url"].forEach(e=>{Object.defineProperty(oe.prototype,e,{get(){return this[G]()[e]}})});["arrayBuffer","blob","clone","formData","json","text"].forEach(e=>{Object.defineProperty(oe.prototype,e,{value:function(){return this[G]()[e]()}})});Object.setPrototypeOf(oe,He);Object.setPrototypeOf(oe.prototype,He.prototype);async function Ln(e){return Promise.race([e,Promise.resolve().then(()=>Promise.resolve(void 0))])}function Mt(e,t,r){let n=a=>{e.cancel(a).catch(()=>{})};return t.on("close",n),t.on("error",n),(r??e.read()).then(i,o),e.closed.finally(()=>{t.off("close",n),t.off("error",n)});function o(a){a&&t.destroy(a)}function s(){e.read().then(i,o)}function i({done:a,value:c}){try{if(a)t.end();else if(!t.write(c))t.once("drain",s);else return e.read().then(i,o)}catch(l){o(l)}}}function Mn(e,t){if(e.locked)throw new TypeError("ReadableStream is locked.");return t.destroyed?void 0:Mt(e.getReader(),t)}var Ne=e=>{let t={};e instanceof Headers||(e=new Headers(e??void 0));let r=[];for(let[n,o]of e)n==="set-cookie"?r.push(o):t[n]=o;return r.length>0&&(t["set-cookie"]=r),t["content-type"]??="text/plain; charset=UTF-8",t},In="x-hono-already-sent";typeof global.crypto>"u"&&(global.crypto=kn);var Be=Symbol("outgoingEnded"),Ct=Symbol("incomingDraining"),Dn=500,Un=64*1024*1024,Ue=e=>{let t=e;if(e.destroyed||t[Ct])return;if(t[Ct]=!0,e instanceof Ot){try{e.stream?.close?.(Sn.NGHTTP2_NO_ERROR)}catch{}return}let r=0,n=()=>{clearTimeout(s),e.off("data",i),e.off("end",n),e.off("error",n)},o=()=>{n();let a=e.socket;a&&!a.destroyed&&a.destroySoon()},s=setTimeout(o,Dn);s.unref?.();let i=a=>{r+=a.length,r>Un&&o()};e.on("data",i),e.on("end",n),e.on("error",n),e.resume()},Nn=()=>new Response(null,{status:400}),It=e=>new Response(null,{status:e instanceof Error&&(e.name==="TimeoutError"||e.constructor.name==="TimeoutError")?504:500}),je=(e,t)=>{let r=e instanceof Error?e:new Error("unknown error",{cause:e});r.code==="ERR_STREAM_PREMATURE_CLOSE"?console.info("The user aborted a request."):(console.error(e),t.headersSent||t.writeHead(500,{"Content-Type":"text/plain"}),t.end(`Error: ${r.message}`),t.destroy(r))},kt=e=>{"flushHeaders"in e&&e.writable&&e.flushHeaders()},Dt=async(e,t)=>{let[r,n,o]=e[q],s=!1;if(!o)o={"content-type":"text/plain; charset=UTF-8"};else if(o instanceof Headers)s=o.has("content-length"),o=Ne(o);else if(Array.isArray(o)){let i=new Headers(o);s=i.has("content-length"),o=Ne(i)}else for(let i in o)if(i.length===14&&i.toLowerCase()==="content-length"){s=!0;break}s||(typeof n=="string"?o["Content-Length"]=Buffer.byteLength(n):n instanceof Uint8Array?o["Content-Length"]=n.byteLength:n instanceof Blob&&(o["Content-Length"]=n.size)),t.writeHead(r,o),typeof n=="string"||n instanceof Uint8Array?t.end(n):n instanceof Blob?t.end(new Uint8Array(await n.arrayBuffer())):(kt(t),await Mn(n,t)?.catch(i=>je(i,t))),t[Be]?.()},jn=e=>typeof e.then=="function",Hn=async(e,t,r={})=>{if(jn(e))if(r.errorHandler)try{e=await e}catch(o){let s=await r.errorHandler(o);if(!s)return;e=s}else e=await e.catch(It);if(q in e)return Dt(e,t);let n=Ne(e.headers);if(e.body){let o=e.body.getReader(),s=[],i=!1,a;if(n["transfer-encoding"]!=="chunked"){let c=2;for(let l=0;l<c;l++){a||=o.read();let u=await Ln(a).catch(d=>{console.error(d),i=!0});if(!u){if(l===1){await new Promise(d=>setTimeout(d)),c=3;continue}break}if(a=void 0,u.value&&s.push(u.value),u.done){i=!0;break}}i&&!("content-length"in n)&&(n["content-length"]=s.reduce((l,u)=>l+u.length,0))}t.writeHead(e.status,n),s.forEach(c=>{t.write(c)}),i?t.end():(s.length===0&&kt(t),await Mt(o,t,a))}else n[In]||(t.writeHead(e.status,n),t.end());t[Be]?.()},Bn=(e,t={})=>{let r=t.autoCleanupIncoming??!0;return t.overrideGlobalObjects!==!1&&global.Request!==ne&&(Object.defineProperty(global,"Request",{value:ne}),Object.defineProperty(global,"Response",{value:oe})),async(n,o)=>{let s,i;try{i=Tn(n,t.hostname);let a=!r||n.method==="GET"||n.method==="HEAD";if(a||(n[Tt]=!0,n.on("end",()=>{a=!0}),n instanceof Ot&&(o[Be]=()=>{a||setTimeout(()=>{a||setTimeout(()=>{Ue(n)})})}),o.on("finish",()=>{a||Ue(n)})),o.on("close",()=>{i[X]&&(n.errored?i[X].abort(n.errored.toString()):o.writableFinished||i[X].abort("Client connection prematurely closed.")),a||setTimeout(()=>{a||setTimeout(()=>{Ue(n)})})}),s=e(i,{incoming:n,outgoing:o}),q in s)return Dt(s,o)}catch(a){if(s)return je(a,o);if(t.errorHandler){if(s=await t.errorHandler(i?a:En(a)),!s)return}else i?s=It(a):s=Nn()}try{return await Hn(s,o,t)}catch(a){return je(a,o)}}},$n=e=>{let t=e.fetch,r=Bn(t,{hostname:e.hostname,overrideGlobalObjects:e.overrideGlobalObjects,autoCleanupIncoming:e.autoCleanupIncoming});return(e.createServer||xn)(e.serverOptions||{},r)},Ut=(e,t)=>{let r=$n(e);return r.listen(e?.port??3e3,e.hostname,()=>{let n=r.address();t&&t(n)}),r};var $e=(e,t,r)=>(n,o)=>{let s=-1;return i(0);async function i(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,u;if(e[a]?(u=e[a][0][0],n.req.routeIndex=a):u=a===e.length&&o||void 0,u)try{c=await u(n,()=>i(a+1))}catch(d){if(d instanceof Error&&t)n.error=d,c=await t(d,n),l=!0;else throw d}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Nt=Symbol();var jt=async(e,t=Object.create(null))=>{let{all:r=!1,dot:n=!1}=t,s=(e instanceof ge?e.raw.headers:e.headers).get("Content-Type");return s?.startsWith("multipart/form-data")||s?.startsWith("application/x-www-form-urlencoded")?Fn(e,{all:r,dot:n}):{}};async function Fn(e,t){let r=await e.formData();return r?qn(r,t):{}}function qn(e,t){let r=Object.create(null);return e.forEach((n,o)=>{t.all||o.endsWith("[]")?zn(r,o,n):r[o]=n}),t.dot&&Object.entries(r).forEach(([n,o])=>{n.includes(".")&&(Wn(r,n,o),delete r[n])}),r}var zn=(e,t,r)=>{e[t]!==void 0?Array.isArray(e[t])?e[t].push(r):e[t]=[e[t],r]:t.endsWith("[]")?e[t]=[r]:e[t]=r},Wn=(e,t,r)=>{if(/(?:^|\.)__proto__\./.test(t))return;let n=e,o=t.split(".");o.forEach((s,i)=>{i===o.length-1?n[s]=r:((!n[s]||typeof n[s]!="object"||Array.isArray(n[s])||n[s]instanceof File)&&(n[s]=Object.create(null)),n=n[s])})};var qe=e=>{let t=e.split("/");return t[0]===""&&t.shift(),t},Ht=e=>{let{groups:t,path:r}=Kn(e),n=qe(r);return Vn(n,t)},Kn=e=>{let t=[];return e=e.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return t.push([o,r]),o}),{groups:t,path:e}},Vn=(e,t)=>{for(let r=t.length-1;r>=0;r--){let[n]=t[r];for(let o=e.length-1;o>=0;o--)if(e[o].includes(n)){e[o]=e[o].replace(n,t[r][1]);break}}return e},we={},Bt=(e,t)=>{if(e==="*")return"*";let r=e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${e}#${t}`;return we[n]||(r[2]?we[n]=t&&t[0]!==":"&&t[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${t})`)]:[e,r[1],new RegExp(`^${r[2]}$`)]:we[n]=[e,r[1],!0]),we[n]}return null},ye=(e,t)=>{try{return t(e)}catch{return e.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return t(r)}catch{return r}})}},Gn=e=>ye(e,decodeURI),ze=e=>{let t=e.url,r=t.indexOf("/",t.indexOf(":")+4),n=r;for(;n<t.length;n++){let o=t.charCodeAt(n);if(o===37){let s=t.indexOf("?",n),i=t.indexOf("#",n),a=s===-1?i===-1?void 0:i:i===-1?s:Math.min(s,i),c=t.slice(r,a);return Gn(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return t.slice(r,n)};var $t=e=>{let t=ze(e);return t.length>1&&t.at(-1)==="/"?t.slice(0,-1):t},N=(e,t,...r)=>(r.length&&(t=N(t,...r)),`${e?.[0]==="/"?"":"/"}${e}${t==="/"?"":`${e?.at(-1)==="/"?"":"/"}${t?.[0]==="/"?t.slice(1):t}`}`),be=e=>{if(e.charCodeAt(e.length-1)!==63||!e.includes(":"))return null;let t=e.split("/"),r=[],n="";return t.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(/\?/.test(o)){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.replace("?","");n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,i)=>i.indexOf(o)===s)},Fe=e=>/[%+]/.test(e)?(e.indexOf("+")!==-1&&(e=e.replace(/\+/g," ")),e.indexOf("%")!==-1?ye(e,We):e):e,Ft=(e,t,r)=>{let n;if(!r&&t&&!/[%+]/.test(t)){let i=e.indexOf("?",8);if(i===-1)return;for(e.startsWith(t,i+1)||(i=e.indexOf(`&${t}`,i+1));i!==-1;){let a=e.charCodeAt(i+t.length+1);if(a===61){let c=i+t.length+2,l=e.indexOf("&",c);return Fe(e.slice(c,l===-1?void 0:l))}else if(a==38||isNaN(a))return"";i=e.indexOf(`&${t}`,i+1)}if(n=/[%+]/.test(e),!n)return}let o={};n??=/[%+]/.test(e);let s=e.indexOf("?",8);for(;s!==-1;){let i=e.indexOf("&",s+1),a=e.indexOf("=",s);a>i&&i!==-1&&(a=-1);let c=e.slice(s+1,a===-1?i===-1?void 0:i:a);if(n&&(c=Fe(c)),s=i,c==="")continue;let l;a===-1?l="":(l=e.slice(a+1,i===-1?void 0:i),n&&(l=Fe(l))),r?(o[c]&&Array.isArray(o[c])||(o[c]=[]),o[c].push(l)):o[c]??=l}return t?o[t]:o},qt=Ft,zt=(e,t)=>Ft(e,t,!0),We=decodeURIComponent;var Wt=e=>ye(e,We),ge=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(e,t="/",r=[[]]){this.raw=e,this.path=t,this.#e=r,this.#t={}}param(e){return e?this.#r(e):this.#s()}#r(e){let t=this.#e[0][this.routeIndex][1][e],r=this.#o(t);return r&&/\%/.test(r)?Wt(r):r}#s(){let e={},t=Object.keys(this.#e[0][this.routeIndex][1]);for(let r of t){let n=this.#o(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(e[r]=/\%/.test(n)?Wt(n):n)}return e}#o(e){return this.#e[1]?this.#e[1][e]:e}query(e){return qt(this.url,e)}queries(e){return zt(this.url,e)}header(e){if(e)return this.raw.headers.get(e)??void 0;let t={};return this.raw.headers.forEach((r,n)=>{t[n]=r}),t}async parseBody(e){return jt(this,e)}#n=e=>{let{bodyCache:t,raw:r}=this,n=t[e];if(n)return n;let o=Object.keys(t)[0];return o?t[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[e]())):t[e]=r[e]()};json(){return this.#n("text").then(e=>JSON.parse(e))}text(){return this.#n("text")}arrayBuffer(){return this.#n("arrayBuffer")}bytes(){return this.#n("arrayBuffer").then(e=>new Uint8Array(e))}blob(){return this.#n("blob")}formData(){return this.#n("formData")}addValidatedData(e,t){this.#t[e]=t}valid(e){return this.#t[e]}get url(){return this.raw.url}get method(){return this.raw.method}get[Nt](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,e]])=>e)}get routePath(){return this.#e[0].map(([[,e]])=>e)[this.routeIndex].path}};var Kt={Stringify:1,BeforeStream:2,Stream:3},Xn=(e,t)=>{let r=new String(e);return r.isEscaped=!0,r.callbacks=t,r};var Ke=async(e,t,r,n,o)=>{typeof e=="object"&&!(e instanceof String)&&(e instanceof Promise||(e=e.toString()),e instanceof Promise&&(e=await e));let s=e.callbacks;if(!s?.length)return Promise.resolve(e);o?o[0]+=e:o=[e];let i=Promise.all(s.map(a=>a({phase:t,buffer:o,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>Ke(c,t,!1,n,o))).then(()=>o[0]));return r?Xn(await i,s):i};var Yn="text/plain; charset=UTF-8",Ve=(e,t)=>({"Content-Type":e,...t}),se=(e,t)=>new Response(e,t),Ge=class{#t;#e;env={};#r;finalized=!1;error;#s;#o;#n;#u;#c;#l;#a;#d;#p;constructor(e,t){this.#t=e,t&&(this.#o=t.executionCtx,this.env=t.env,this.#l=t.notFoundHandler,this.#p=t.path,this.#d=t.matchResult)}get req(){return this.#e??=new ge(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#o&&"respondWith"in this.#o)return this.#o;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#o)return this.#o;throw Error("This context has no ExecutionContext")}get res(){return this.#n||=se(null,{headers:this.#a??=new Headers})}set res(e){if(this.#n&&e){e=se(e.body,e);for(let[t,r]of this.#n.headers.entries())if(t!=="content-type")if(t==="set-cookie"){let n=this.#n.headers.getSetCookie();e.headers.delete("set-cookie");for(let o of n)e.headers.append("set-cookie",o)}else e.headers.set(t,r)}this.#n=e,this.finalized=!0}render=(...e)=>(this.#c??=t=>this.html(t),this.#c(...e));setLayout=e=>this.#u=e;getLayout=()=>this.#u;setRenderer=e=>{this.#c=e};header=(e,t,r)=>{this.finalized&&(this.#n=se(this.#n.body,this.#n));let n=this.#n?this.#n.headers:this.#a??=new Headers;t===void 0?n.delete(e):r?.append?n.append(e,t):n.set(e,t)};status=e=>{this.#s=e};set=(e,t)=>{this.#r??=new Map,this.#r.set(e,t)};get=e=>this.#r?this.#r.get(e):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(e,t,r){let n=this.#n?new Headers(this.#n.headers):this.#a??new Headers;if(typeof t=="object"&&"headers"in t){let s=t.headers instanceof Headers?t.headers:new Headers(t.headers);for(let[i,a]of s)i.toLowerCase()==="set-cookie"?n.append(i,a):n.set(i,a)}if(r)for(let[s,i]of Object.entries(r))if(typeof i=="string")n.set(s,i);else{n.delete(s);for(let a of i)n.append(s,a)}let o=typeof t=="number"?t:t?.status??this.#s;return se(e,{status:o,headers:n})}newResponse=(...e)=>this.#i(...e);body=(e,t,r)=>this.#i(e,t,r);text=(e,t,r)=>!this.#a&&!this.#s&&!t&&!r&&!this.finalized?new Response(e):this.#i(e,t,Ve(Yn,r));json=(e,t,r)=>this.#i(JSON.stringify(e),t,Ve("application/json",r));html=(e,t,r)=>{let n=o=>this.#i(o,t,Ve("text/html; charset=UTF-8",r));return typeof e=="object"?Ke(e,Kt.Stringify,!1,{}).then(n):n(e)};redirect=(e,t)=>{let r=String(e);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,t??302)};notFound=()=>(this.#l??=()=>se(),this.#l(this))};var x="ALL",Vt="all",Gt=["get","post","put","delete","options","patch"],ve="Can not add a route since the matcher is already built.",xe=class extends Error{};var Xt="__COMPOSED_HANDLER";var Jn=e=>e.text("404 Not Found",404),Yt=(e,t)=>{if("getResponse"in e){let r=e.getResponse();return t.newResponse(r.body,r)}return console.error(e),t.text("Internal Server Error",500)},Jt=class Qt{get;post;put;delete;options;patch;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(t={}){[...Gt,Vt].forEach(s=>{this[s]=(i,...a)=>(typeof i=="string"?this.#t=i:this.#s(s,this.#t,i),a.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,i,...a)=>{for(let c of[i].flat()){this.#t=c;for(let l of[s].flat())a.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...i)=>(typeof s=="string"?this.#t=s:(this.#t="*",i.unshift(s)),i.forEach(a=>{this.#s(x,this.#t,a)}),this);let{strict:n,...o}=t;Object.assign(this,o),this.getPath=n??!0?t.getPath??ze:$t}#e(){let t=new Qt({router:this.router,getPath:this.getPath});return t.errorHandler=this.errorHandler,t.#r=this.#r,t.routes=this.routes,t}#r=Jn;errorHandler=Yt;route(t,r){let n=this.basePath(t);return r.routes.map(o=>{let s;r.errorHandler===Yt?s=o.handler:(s=async(i,a)=>(await $e([],r.errorHandler)(i,()=>o.handler(i,a))).res,s[Xt]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(t){let r=this.#e();return r._basePath=N(this._basePath,t),r}onError=t=>(this.errorHandler=t,this);notFound=t=>(this.#r=t,this);mount(t,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let i=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=N(this._basePath,t),l=c==="/"?0:c.length;return u=>{let d=new URL(u.url);return d.pathname=this.getPath(u).slice(l)||"/",new Request(d,u)}})();let a=async(c,l)=>{let u=await r(o(c.req.raw),...i(c));if(u)return u;await l()};return this.#s(x,N(t,"*"),a),this}#s(t,r,n,o){t=t.toUpperCase(),r=N(this._basePath,r);let s={basePath:o!==void 0?N(this._basePath,o):this._basePath,path:r,method:t,handler:n};this.router.add(t,r,[n,s]),this.routes.push(s)}#o(t,r){if(t instanceof Error)return this.errorHandler(t,r);throw t}#n(t,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#n(t,r,n,"GET")))();let s=this.getPath(t,{env:n}),i=this.router.match(o,s),a=new Ge(t,{path:s,matchResult:i,env:n,executionCtx:r,notFoundHandler:this.#r});if(i[0].length===1){let l;try{l=i[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#o(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#o(u,a)):l??this.#r(a)}let c=$e(i[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#o(l,a)}})()}fetch=(t,...r)=>this.#n(t,r[1],r[0],t.method);request=(t,r,n,o)=>t instanceof Request?this.fetch(r?new Request(t,r):t,n,o):(t=t.toString(),this.fetch(new Request(/^https?:\/\//.test(t)?t:`http://localhost${N("/",t)}`,r),n,o));fire=()=>{addEventListener("fetch",t=>{t.respondWith(this.#n(t.request,t,void 0,t.request.method))})}};var Se=[];function Xe(e,t){let r=this.buildAllMatchers(),n=((o,s)=>{let i=r[o]||r[x],a=i[2][s];if(a)return a;let c=s.match(i[0]);if(!c)return[[],Se];let l=c.indexOf("",1);return[i[1][l],c]});return this.match=n,n(e,t)}var Ee="[^/]+",ie=".*",ae="(?:|/.*)",z=Symbol(),Qn=new Set(".\\+*[^]$()");function Zn(e,t){return e.length===1?t.length===1?e<t?-1:1:-1:t.length===1||e===ie||e===ae?1:t===ie||t===ae?-1:e===Ee?1:t===Ee?-1:e.length===t.length?e<t?-1:1:t.length-e.length}var Zt=class Ye{#t;#e;#r=Object.create(null);insert(t,r,n,o,s){if(t.length===0){if(this.#t!==void 0)throw z;if(s)return;this.#t=r;return}let[i,...a]=t,c=i==="*"?a.length===0?["","",ie]:["","",Ee]:i==="/*"?["","",ae]:i.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),l;if(c){let u=c[1],d=c[2]||Ee;if(u&&c[2]&&(d===".*"||(d=d.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(d))))throw z;if(l=this.#r[d],!l){if(Object.keys(this.#r).some(f=>f!==ie&&f!==ae))throw z;if(s)return;l=this.#r[d]=new Ye,u!==""&&(l.#e=o.varIndex++)}!s&&u!==""&&n.push([u,l.#e])}else if(l=this.#r[i],!l){if(Object.keys(this.#r).some(u=>u.length>1&&u!==ie&&u!==ae))throw z;if(s)return;l=this.#r[i]=new Ye}l.insert(a,r,n,o,s)}buildRegExpStr(){let r=Object.keys(this.#r).sort(Zn).map(n=>{let o=this.#r[n];return(typeof o.#e=="number"?`(${n})@${o.#e}`:Qn.has(n)?`\\${n}`:n)+o.buildRegExpStr()});return typeof this.#t=="number"&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var er=class{#t={varIndex:0};#e=new Zt;insert(e,t,r){let n=[],o=[];for(let i=0;;){let a=!1;if(e=e.replace(/\{[^}]+\}/g,c=>{let l=`@\\${i}`;return o[i]=[l,c],i++,a=!0,l}),!a)break}let s=e.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=o.length-1;i>=0;i--){let[a]=o[i];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,o[i][1]);break}}return this.#e.insert(s,t,n,this.#t,r),n}buildRegExp(){let e=this.#e.buildRegExpStr();if(e==="")return[/^$/,[],[]];let t=0,r=[],n=[];return e=e.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,i)=>s!==void 0?(r[++t]=Number(s),"$()"):(i!==void 0&&(n[Number(i)]=++t),"")),[new RegExp(`^${e}`),r,n]}};var eo=[/^$/,[],Object.create(null)],tr=Object.create(null);function rr(e){return tr[e]??=new RegExp(e==="*"?"":`^${e.replace(/\/\*$|([.\\+*[^\]$()])/g,(t,r)=>r?`\\${r}`:"(?:|/.*)")}$`)}function to(){tr=Object.create(null)}function ro(e){let t=new er,r=[];if(e.length===0)return eo;let n=e.map(l=>[!/\*|\/:/.test(l[0]),...l]).sort(([l,u],[d,f])=>l?1:d?-1:u.length-f.length),o=Object.create(null);for(let l=0,u=-1,d=n.length;l<d;l++){let[f,h,w]=n[l];f?o[h]=[w.map(([g])=>[g,Object.create(null)]),Se]:u++;let y;try{y=t.insert(h,u,f)}catch(g){throw g===z?new xe(h):g}f||(r[u]=w.map(([g,p])=>{let m=Object.create(null);for(p-=1;p>=0;p--){let[v,T]=y[p];m[v]=T}return[g,m]}))}let[s,i,a]=t.buildRegExp();for(let l=0,u=r.length;l<u;l++)for(let d=0,f=r[l].length;d<f;d++){let h=r[l][d]?.[1];if(!h)continue;let w=Object.keys(h);for(let y=0,g=w.length;y<g;y++)h[w[y]]=a[h[w[y]]]}let c=[];for(let l in i)c[l]=r[i[l]];return[s,c,o]}function J(e,t){if(e){for(let r of Object.keys(e).sort((n,o)=>o.length-n.length))if(rr(r).test(t))return[...e[r]]}}var Re=class{name="RegExpRouter";#t;#e;constructor(){this.#t={[x]:Object.create(null)},this.#e={[x]:Object.create(null)}}add(e,t,r){let n=this.#t,o=this.#e;if(!n||!o)throw new Error(ve);n[e]||[n,o].forEach(a=>{a[e]=Object.create(null),Object.keys(a[x]).forEach(c=>{a[e][c]=[...a[x][c]]})}),t==="/*"&&(t="*");let s=(t.match(/\/:/g)||[]).length;if(/\*$/.test(t)){let a=rr(t);e===x?Object.keys(n).forEach(c=>{n[c][t]||=J(n[c],t)||J(n[x],t)||[]}):n[e][t]||=J(n[e],t)||J(n[x],t)||[],Object.keys(n).forEach(c=>{(e===x||e===c)&&Object.keys(n[c]).forEach(l=>{a.test(l)&&n[c][l].push([r,s])})}),Object.keys(o).forEach(c=>{(e===x||e===c)&&Object.keys(o[c]).forEach(l=>a.test(l)&&o[c][l].push([r,s]))});return}let i=be(t)||[t];for(let a=0,c=i.length;a<c;a++){let l=i[a];Object.keys(o).forEach(u=>{(e===x||e===u)&&(o[u][l]||=[...J(n[u],l)||J(n[x],l)||[]],o[u][l].push([r,s-c+a+1]))})}}match=Xe;buildAllMatchers(){let e=Object.create(null);return Object.keys(this.#e).concat(Object.keys(this.#t)).forEach(t=>{e[t]||=this.#r(t)}),this.#t=this.#e=void 0,to(),e}#r(e){let t=[],r=e===x;return[this.#t,this.#e].forEach(n=>{let o=n[e]?Object.keys(n[e]).map(s=>[s,n[e][s]]):[];o.length!==0?(r||=!0,t.push(...o)):e!==x&&t.push(...Object.keys(n[x]).map(s=>[s,n[x][s]]))}),r?ro(t):null}};var Je=class{name="SmartRouter";#t=[];#e=[];constructor(e){this.#t=e.routers}add(e,t,r){if(!this.#e)throw new Error(ve);this.#e.push([e,t,r])}match(e,t){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,i;for(;s<o;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);i=a.match(e,t)}catch(c){if(c instanceof xe)continue;throw c}this.match=a.match.bind(a),this.#t=[a],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var ce=Object.create(null),no=e=>{for(let t in e)return!0;return!1},nr=class or{#t;#e;#r;#s=0;#o=ce;constructor(t,r,n){if(this.#e=n||Object.create(null),this.#t=[],t&&r){let o=Object.create(null);o[t]={handler:r,possibleKeys:[],score:0},this.#t=[o]}this.#r=[]}insert(t,r,n){this.#s=++this.#s;let o=this,s=Ht(r),i=[];for(let a=0,c=s.length;a<c;a++){let l=s[a],u=s[a+1],d=Bt(l,u),f=Array.isArray(d)?d[0]:l;if(f in o.#e){o=o.#e[f],d&&i.push(d[1]);continue}o.#e[f]=new or,d&&(o.#r.push(d),i.push(d[1])),o=o.#e[f]}return o.#t.push({[t]:{handler:n,possibleKeys:i.filter((a,c,l)=>l.indexOf(a)===c),score:this.#s}}),o}#n(t,r,n,o,s){for(let i=0,a=r.#t.length;i<a;i++){let c=r.#t[i],l=c[n]||c[x],u={};if(l!==void 0&&(l.params=Object.create(null),t.push(l),o!==ce||s&&s!==ce))for(let d=0,f=l.possibleKeys.length;d<f;d++){let h=l.possibleKeys[d],w=u[l.score];l.params[h]=s?.[h]&&!w?s[h]:o[h]??s?.[h],u[l.score]=!0}}}search(t,r){let n=[];this.#o=ce;let s=[this],i=qe(r),a=[],c=i.length,l=null;for(let u=0;u<c;u++){let d=i[u],f=u===c-1,h=[];for(let y=0,g=s.length;y<g;y++){let p=s[y],m=p.#e[d];m&&(m.#o=p.#o,f?(m.#e["*"]&&this.#n(n,m.#e["*"],t,p.#o),this.#n(n,m,t,p.#o)):h.push(m));for(let v=0,T=p.#r.length;v<T;v++){let L=p.#r[v],E=p.#o===ce?{}:{...p.#o};if(L==="*"){let P=p.#e["*"];P&&(this.#n(n,P,t,p.#o),P.#o=E,h.push(P));continue}let[R,A,S]=L;if(!d&&!(S instanceof RegExp))continue;let b=p.#e[R];if(S instanceof RegExp){if(l===null){l=new Array(c);let H=r[0]==="/"?1:0;for(let B=0;B<c;B++)l[B]=H,H+=i[B].length+1}let P=r.substring(l[u]),M=S.exec(P);if(M){if(E[A]=M[0],this.#n(n,b,t,p.#o,E),no(b.#e)){b.#o=E;let H=M[0].match(/\//)?.length??0;(a[H]||=[]).push(b)}continue}}(S===!0||S.test(d))&&(E[A]=d,f?(this.#n(n,b,t,E,p.#o),b.#e["*"]&&this.#n(n,b.#e["*"],t,E,p.#o)):(b.#o=E,h.push(b)))}}let w=a.shift();s=w?h.concat(w):h}return n.length>1&&n.sort((u,d)=>u.score-d.score),[n.map(({handler:u,params:d})=>[u,d])]}};var Qe=class{name="TrieRouter";#t;constructor(){this.#t=new nr}add(e,t,r){let n=be(t);if(n){for(let o=0,s=n.length;o<s;o++)this.#t.insert(e,n[o],r);return}this.#t.insert(e,t,r)}match(e,t){return this.#t.search(e,t)}};var Ze=class extends Jt{constructor(e={}){super(e),this.router=e.router??new Je({routers:[new Re,new Qe]})}};var Pe=e=>{let t={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH"],allowHeaders:[],exposeHeaders:[],...e},r=(o=>typeof o=="string"?o==="*"?()=>o:s=>o===s?s:null:typeof o=="function"?o:s=>o.includes(s)?s:null)(t.origin),n=(o=>typeof o=="function"?o:Array.isArray(o)?()=>o:()=>[])(t.allowMethods);return async function(s,i){function a(l,u){s.res.headers.set(l,u)}let c=await r(s.req.header("origin")||"",s);if(c&&a("Access-Control-Allow-Origin",c),t.credentials&&a("Access-Control-Allow-Credentials","true"),t.exposeHeaders?.length&&a("Access-Control-Expose-Headers",t.exposeHeaders.join(",")),s.req.method==="OPTIONS"){t.origin!=="*"&&a("Vary","Origin"),t.maxAge!=null&&a("Access-Control-Max-Age",t.maxAge.toString());let l=await n(s.req.header("origin")||"",s);l.length&&a("Access-Control-Allow-Methods",l.join(","));let u=t.allowHeaders;if(!u?.length){let d=s.req.header("Access-Control-Request-Headers");d&&(u=d.split(/\s*,\s*/))}return u?.length&&(a("Access-Control-Allow-Headers",u.join(",")),s.res.headers.append("Vary","Access-Control-Request-Headers")),s.res.headers.delete("Content-Length"),s.res.headers.delete("Content-Type"),new Response(null,{headers:s.res.headers,status:204,statusText:"No Content"})}await i(),t.origin!=="*"&&s.header("Vary","Origin",{append:!0})}};import xr from"process";import Sr from"path";import{fileURLToPath as Uo}from"url";import No from"child_process";import jo,{constants as Ho}from"fs/promises";import{promisify as mo}from"util";import go from"child_process";import ot,{constants as dr}from"fs/promises";import ar from"process";import co from"os";import lo from"fs";import io from"fs";import sr from"fs";var et;function oo(){try{return sr.statSync("/.dockerenv"),!0}catch{return!1}}function so(){try{return sr.readFileSync("/proc/self/cgroup","utf8").includes("docker")}catch{return!1}}function tt(){return et===void 0&&(et=oo()||so()),et}var rt,ao=()=>{try{return io.statSync("/run/.containerenv"),!0}catch{return!1}};function Q(){return rt===void 0&&(rt=ao()||tt()),rt}var ir=()=>{if(ar.platform!=="linux")return!1;if(co.release().toLowerCase().includes("microsoft"))return!Q();try{return lo.readFileSync("/proc/version","utf8").toLowerCase().includes("microsoft")?!Q():!1}catch{return!1}},k=ar.env.__IS_WSL_TEST__?ir:ir();import cr from"process";import{Buffer as uo}from"buffer";import{promisify as po}from"util";import fo from"child_process";import Sa,{constants as Ea}from"fs/promises";var ho=po(fo.execFile),nt=()=>`${cr.env.SYSTEMROOT||cr.env.windir||String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;var O=async(e,t={})=>{let{powerShellPath:r,...n}=t,o=O.encodeCommand(e);return ho(r??nt(),[...O.argumentsPrefix,o],{encoding:"utf8",...n})};O.argumentsPrefix=["-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-EncodedCommand"];O.encodeCommand=e=>uo.from(e,"utf16le").toString("base64");O.escapeArgument=e=>`'${String(e).replaceAll("'","''")}'`;function lr(e){for(let t of e.split(`
+`)){if(/^\s*#/.test(t))continue;let r=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(t);if(r)return r.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var wo=mo(go.execFile),yo=(()=>{let e="/mnt/",t;return async function(){if(t)return t;let r="/etc/wsl.conf",n=!1;try{await ot.access(r,dr.F_OK),n=!0}catch{}if(!n)return e;let o=await ot.readFile(r,{encoding:"utf8"}),s=lr(o);return s===void 0?e:(t=s,t=t.endsWith("/")?t:`${t}/`,t)}})(),bo=async()=>`${await yo()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`,Ae=k?bo:nt,ur,pr=async()=>(ur??=(async()=>{try{let e=await Ae();return await ot.access(e,dr.X_OK),!0}catch{return!1}})(),ur),fr=async()=>{let e=await Ae(),t=String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`,{stdout:r}=await O(t,{powerShellPath:e});return r.trim()},hr=async e=>{if(/^[a-z]+:\/\//i.test(e))return e;try{let{stdout:t}=await wo("wslpath",["-aw",e],{encoding:"utf8"});return t.trim()}catch{return e}};function W(e,t,r){let n=o=>Object.defineProperty(e,t,{value:o,enumerable:!0,writable:!0});return Object.defineProperty(e,t,{configurable:!0,enumerable:!0,get(){let o=r();return n(o),o},set(o){n(o)}}),e}import{promisify as Lo}from"util";import ut from"process";import{execFile as Mo}from"child_process";import{promisify as vo}from"util";import xo from"process";import{execFile as So}from"child_process";var Eo=vo(So);async function st(){if(xo.platform!=="darwin")throw new Error("macOS only");let{stdout:e}=await Eo("defaults",["read","com.apple.LaunchServices/com.apple.launchservices.secure","LSHandlers"]),r=/LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(e)?.groups.id??"com.apple.Safari";return r==="com.apple.safari"?"com.apple.Safari":r}import Ro from"process";import{promisify as Po}from"util";import{execFile as Ao,execFileSync as Fa}from"child_process";var _o=Po(Ao);async function mr(e,{humanReadableOutput:t=!0,signal:r}={}){if(Ro.platform!=="darwin")throw new Error("macOS only");let n=t?[]:["-ss"],o={};r&&(o.signal=r);let{stdout:s}=await _o("osascript",["-e",e,n],o);return s.trim()}async function it(e){return mr(`tell application "Finder" to set app_path to application file id "${e}" as string
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`)}import{promisify as Co}from"util";import{execFile as Oo}from"child_process";var To=Co(Oo),_e={MSEdgeHTM:{name:"Edge",id:"com.microsoft.edge"},MSEdgeBHTML:{name:"Edge Beta",id:"com.microsoft.edge.beta"},MSEdgeDHTML:{name:"Edge Dev",id:"com.microsoft.edge.dev"},AppXq0fevzme2pys62n3e0fbqa7peapykr8v:{name:"Edge",id:"com.microsoft.edge.old"},ChromeHTML:{name:"Chrome",id:"com.google.chrome"},ChromeBHTML:{name:"Chrome Beta",id:"com.google.chrome.beta"},ChromeDHTML:{name:"Chrome Dev",id:"com.google.chrome.dev"},ChromiumHTM:{name:"Chromium",id:"org.chromium.Chromium"},BraveHTML:{name:"Brave",id:"com.brave.Browser"},BraveBHTML:{name:"Brave Beta",id:"com.brave.Browser.beta"},BraveDHTML:{name:"Brave Dev",id:"com.brave.Browser.dev"},BraveSSHTM:{name:"Brave Nightly",id:"com.brave.Browser.nightly"},FirefoxURL:{name:"Firefox",id:"org.mozilla.firefox"},OperaStable:{name:"Opera",id:"com.operasoftware.Opera"},VivaldiHTM:{name:"Vivaldi",id:"com.vivaldi.Vivaldi"},"IE.HTTP":{name:"Internet Explorer",id:"com.microsoft.ie"}},ct=new Map(Object.entries(_e)),at=class extends Error{};async function lt(e=To){let{stdout:t}=await e("reg",["QUERY"," HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice","/v","ProgId"]),r=/ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(t);if(!r)throw new at(`Cannot find Windows browser in stdout: ${JSON.stringify(t)}`);let{id:n}=r.groups,o=n.lastIndexOf("."),s=n.lastIndexOf("-"),i=o===-1?void 0:n.slice(0,o),a=s===-1?void 0:n.slice(0,s);return _e[n]??_e[i]??_e[a]??{name:n,id:n}}var Io=Lo(Mo),ko=e=>e.toLowerCase().replaceAll(/(?:^|\s|-)\S/g,t=>t.toUpperCase());async function dt(){if(ut.platform==="darwin"){let e=await st();return{name:await it(e),id:e}}if(ut.platform==="linux"){let{stdout:e}=await Io("xdg-mime",["query","default","x-scheme-handler/http"]),t=e.trim();return{name:ko(t.replace(/.desktop$/,"").replace("-"," ")),id:t}}if(ut.platform==="win32")return lt();throw new Error("Only macOS, Linux, and Windows are supported")}import pt from"process";var Do=!!(pt.env.SSH_CONNECTION||pt.env.SSH_CLIENT||pt.env.SSH_TTY),gr=Do;var Ce=Symbol("fallbackAttempt"),ft=import.meta.url?Sr.dirname(Uo(import.meta.url)):"",wr=Sr.join(ft,"xdg-open"),{platform:Z,arch:yr}=xr,br=async(e,t)=>{if(e.length===0)return;let r=[];for(let n of e)try{return await t(n)}catch(o){r.push(o)}throw new AggregateError(r,"Failed to open in all supported apps")},Oe=async e=>{e={wait:!1,background:!1,newInstance:!1,allowNonzeroExitCode:!1,...e};let t=e[Ce]===!0;if(delete e[Ce],Array.isArray(e.app))return br(e.app,l=>Oe({...e,app:l,[Ce]:!0}));let{name:r,arguments:n=[]}=e.app??{};if(n=[...n],Array.isArray(r))return br(r,l=>Oe({...e,app:{name:l,arguments:n},[Ce]:!0}));if(r==="browser"||r==="browserPrivate"){let l={"com.google.chrome":"chrome","google-chrome.desktop":"chrome","com.brave.browser":"brave","org.mozilla.firefox":"firefox","firefox.desktop":"firefox","com.microsoft.msedge":"edge","com.microsoft.edge":"edge","com.microsoft.edgemac":"edge","microsoft-edge.desktop":"edge","com.apple.safari":"safari"},u={chrome:"--incognito",brave:"--incognito",firefox:"--private-window",edge:"--inPrivate"},d;if(k){let f=await fr();d=ct.get(f)??{}}else d=await dt();if(d.id in l){let f=l[d.id.toLowerCase()];if(r==="browserPrivate"){if(f==="safari")throw new Error("Safari doesn't support opening in private mode via command line");n.push(u[f])}return Oe({...e,app:{name:ee[f],arguments:n}})}throw new Error(`${d.name} is not supported as a default browser`)}let o,s=[],i={},a=!1;if(k&&!Q()&&!gr&&!r&&(a=await pr()),Z==="darwin")o="open",e.wait&&s.push("--wait-apps"),e.background&&s.push("--background"),e.newInstance&&s.push("--new"),r&&s.push("-a",r);else if(Z==="win32"||a){o=await Ae(),s.push(...O.argumentsPrefix),k||(i.windowsVerbatimArguments=!0),k&&e.target&&(e.target=await hr(e.target));let l=["$ProgressPreference = 'SilentlyContinue';","Start"];e.wait&&l.push("-Wait"),r?(l.push(O.escapeArgument(r)),e.target&&n.push(e.target)):e.target&&l.push(O.escapeArgument(e.target)),n.length>0&&(n=n.map(u=>O.escapeArgument(u)),l.push("-ArgumentList",n.join(","))),e.target=O.encodeCommand(l.join(" ")),e.wait||(i.stdio="ignore")}else{if(r)o=r;else{let l=!ft||ft==="/",u=!1;try{await jo.access(wr,Ho.X_OK),u=!0}catch{}o=xr.versions.electron??(Z==="android"||l||!u)?"xdg-open":wr}n.length>0&&s.push(...n),e.wait||(i.stdio="ignore",i.detached=!0)}Z==="darwin"&&n.length>0&&s.push("--args",...n),e.target&&s.push(e.target);let c=No.spawn(o,s,i);return e.wait?new Promise((l,u)=>{c.once("error",u),c.once("close",d=>{if(!e.allowNonzeroExitCode&&d!==0){u(new Error(`Exited with code ${d}`));return}l(c)})}):t?new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.once("close",d=>{if(c.off("error",u),d!==0){u(new Error(`Exited with code ${d}`));return}c.unref(),l(c)})})}):(c.unref(),new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.off("error",u),l(c)})}))},Bo=(e,t)=>{if(typeof e!="string")throw new TypeError("Expected a `target`");return Oe({...t,target:e})};function vr(e){if(typeof e=="string"||Array.isArray(e))return e;let{[yr]:t}=e;if(!t)throw new Error(`${yr} is not supported`);return t}function le({[Z]:e},{wsl:t}={}){if(t&&k)return vr(t);if(!e)throw new Error(`${Z} is not supported`);return vr(e)}var ee={browser:"browser",browserPrivate:"browserPrivate"};W(ee,"chrome",()=>le({darwin:"google chrome",win32:"chrome",linux:["google-chrome","google-chrome-stable","chromium","chromium-browser"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",x64:["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe","/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]}}));W(ee,"brave",()=>le({darwin:"brave browser",win32:"brave",linux:["brave-browser","brave"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",x64:["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe","/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]}}));W(ee,"firefox",()=>le({darwin:"firefox",win32:String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,linux:"firefox"},{wsl:"/mnt/c/Program Files/Mozilla Firefox/firefox.exe"}));W(ee,"edge",()=>le({darwin:"microsoft edge",win32:"msedge",linux:["microsoft-edge","microsoft-edge-dev"]},{wsl:"/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"}));W(ee,"safari",()=>le({darwin:"Safari"}));var Er=Bo;function Rr(e=""){return`<link rel="icon" type="image/svg+xml" href="${`${e.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as Ur,readFileSync as Wo}from"fs";import U from"path";import{fileURLToPath as Ko}from"url";import{gunzipSync as Vo}from"zlib";var D=vn(Dr(),1);function te(e,t){return e.header("Retry-After",String(qo(t))),e.json({error:"Too Many Requests"},429)}function qo(e){return e&&typeof e=="object"&&"msBeforeNext"in e&&typeof e.msBeforeNext=="number"&&Number.isFinite(e.msBeforeNext)?Math.max(1,Math.ceil(e.msBeforeNext/1e3)):60}var Go={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Xo(){let e=U.dirname(Ko(import.meta.url));for(let t of[U.resolve(e,"app"),U.resolve(e,"../app"),U.resolve(e,"../../dist/app")])if(Ur(U.join(t,"inspector.js.gz")))return t;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function Nr(e,t="/inspector/assets"){let r=Xo(),n=new Map,o=new D.default({points:600,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return te(i,c)}return a()};e.use(`${t}/*`,s),e.get(`${t}/*`,async i=>{let a=i.req.path.slice(t.length),c=a.startsWith("/")?a.slice(1):a;if(!c||c.includes(".."))return i.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=U.resolve(r,l),d=r.endsWith(U.sep)?r:`${r}${U.sep}`;if(!u.startsWith(d)||!Ur(u))return i.notFound();let f=U.extname(c),h=l.endsWith(".gz"),w=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(i.req.header("accept-encoding")??""),y=Wo(u),g=h&&!w?n.get(u)??Yo(n,u,y):y,p=g.buffer.slice(g.byteOffset,g.byteOffset+g.byteLength);return i.body(p,200,{"Content-Type":Go[f]??"application/octet-stream",...h&&w?{"Content-Encoding":"gzip"}:{},...h?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Yo(e,t,r){let n=Vo(r);return e.set(t,n),n}var jr={name:"@mcp-use/inspector",type:"module",version:"20.0.0-beta.50",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"npm run clean && npm run build:client-exports && npm run build:server && npm run build:app && npm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",prepublishOnly:"pnpm --filter @mcp-use/client build && pnpm build",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.0-alpha.0","@mcp-use/client":"^2.0.0-alpha.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"workspace:*",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^1.19.13","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.12.12","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^7.12.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",zod:"^4.2.0"}};var Qo=jr.version;function Te(){return Qo}var Zo=`<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; img-src * data: blob: 'unsafe-inline'; media-src * blob: data:; font-src * blob: data:; script-src * 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data:; style-src * blob: data: 'unsafe-inline'; connect-src * data: blob: about:; frame-src * blob: data: http://localhost:* https://localhost:* http://127.0.0.1:* https://127.0.0.1:*;"
+    />
+    <title>MCP Apps Sandbox Proxy</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; width: 100%; overflow: hidden; }
+      * { box-sizing: border-box; }
+      iframe { display: block; background-color: transparent; border: 0px none transparent; padding: 0px; width: 100%; height: 100%; }
+    </style>
+  </head>
+  <body>
+    <script>
+      function sanitizeDomain(domain) {
+        if (typeof domain !== "string") return "";
+        return domain.replace(/['"<>;]/g, "").trim();
+      }
 
-// src/server/cli.ts
-import { serve } from "@hono/node-server";
-import { Hono } from "hono";
-import { cors as cors2 } from "hono/cors";
-import { logger as logger2 } from "hono/logger";
-import open from "open";
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+        const allowList = [];
+        if (permissions.camera) allowList.push("camera *");
+        if (permissions.microphone) allowList.push("microphone *");
+        if (permissions.geolocation) allowList.push("geolocation *");
+        if (permissions.clipboardWrite) allowList.push("clipboard-write *");
+        return allowList.join("; ");
+      }
 
-// src/server/asset-urls.ts
-var JSDELIVR_INSPECTOR_TAG = "beta";
-var DEFAULT_REMOTE_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspector@${JSDELIVR_INSPECTOR_TAG}/dist/cdn/inspector.js`;
-function inspectorStylesUrl(assetsUrl) {
-  return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
-}
-function isDefaultJsdelivrInspectorUrl(url) {
-  return url.startsWith("https://cdn.jsdelivr.net/npm/@mcp-use/inspector@");
-}
-function withInspectorCacheBust(assetsUrl) {
-  if (!isDefaultJsdelivrInspectorUrl(assetsUrl)) return assetsUrl;
-  const sep = assetsUrl.includes("?") ? "&" : "?";
-  return `${assetsUrl}${sep}cb=${crypto.randomUUID()}`;
-}
-function resolveInspectorAssetUrls(inspectorMode2, basePath) {
-  const envUrl = process.env.INSPECTOR_ASSETS_URL ?? process.env.MCP_USE_INSPECTOR_ASSETS_URL;
-  if (envUrl) {
-    return {
-      jsUrl: envUrl,
-      cssUrl: inspectorStylesUrl(envUrl),
-      useLocal: false
-    };
-  }
-  const legacyBase = process.env.INSPECTOR_CDN_BASE;
-  if (legacyBase) {
-    const base = legacyBase.replace(/\/$/, "");
-    if (/\.js(?:$|[?#])/.test(base)) {
-      return {
-        jsUrl: base,
-        cssUrl: inspectorStylesUrl(base),
-        useLocal: false
-      };
-    }
-    return {
-      jsUrl: `${base}/inspector.js`,
-      cssUrl: `${base}/inspector.css`,
-      useLocal: false
-    };
-  }
-  if (inspectorMode2 === "standalone") {
-    const prefix = basePath;
-    return {
-      jsUrl: `${prefix}/dist/cdn/inspector.js`,
-      cssUrl: `${prefix}/dist/cdn/inspector.css`,
-      useLocal: true
-    };
-  }
-  const jsUrl = DEFAULT_REMOTE_ASSETS_URL;
-  return {
-    jsUrl,
-    cssUrl: inspectorStylesUrl(jsUrl),
-    useLocal: false
-  };
-}
+      function buildCSP(csp) {
+        if (!csp) {
+          return [
+            "default-src 'none'",
+            "script-src 'unsafe-inline'",
+            "style-src 'unsafe-inline'",
+            "img-src data:",
+            "font-src data:",
+            "media-src data:",
+            "connect-src 'none'",
+            "frame-src 'none'",
+            "object-src 'none'",
+            "base-uri 'none'",
+          ].join("; ");
+        }
 
-// src/server/favicon-links.ts
-var FAVICON_CACHE_VERSION = "4";
-var INSPECTOR_FAVICON_ASSETS = [
-  "favicon.svg",
-  "favicon-96x96.png",
-  "favicon.ico",
-  "apple-touch-icon.png",
-  "site.webmanifest",
-  "web-app-manifest-192x192.png",
-  "web-app-manifest-512x512.png",
-  "favicon-black.svg",
-  "favicon-white.svg"
-];
-function renderInspectorFaviconLinks(basePath = "") {
-  const prefix = basePath.replace(/\/$/, "");
-  const href = `${prefix}/favicon-black.svg?v=${FAVICON_CACHE_VERSION}`;
-  return `<link rel="icon" type="image/svg+xml" href="${href}" />`;
-}
+        const connectDomains = (csp.connectDomains || []).map(sanitizeDomain).filter(Boolean);
+        const resourceDomains = (csp.resourceDomains || []).map(sanitizeDomain).filter(Boolean);
+        const frameDomains = (csp.frameDomains || []).map(sanitizeDomain).filter(Boolean);
+        const baseUriDomains = (csp.baseUriDomains || []).map(sanitizeDomain).filter(Boolean);
+        const scriptDirectives = (csp.scriptDirectives || []).filter(function(d) { return typeof d === "string" && d.length > 0; });
 
-// src/server/favicon-static.ts
-import { existsSync, readFileSync } from "fs";
-import path from "path";
-import { fileURLToPath } from "url";
-var CONTENT_TYPES = {
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".ico": "image/x-icon",
-  ".webmanifest": "application/manifest+json"
-};
-function resolveFaviconDir() {
-  const here = path.dirname(fileURLToPath(import.meta.url));
-  for (const dir of [
-    path.resolve(here, "cdn"),
-    // dist/cli.js (bundled)
-    path.resolve(here, "../cdn"),
-    // dist/server/*.js
-    path.resolve(here, "../../public")
-    // src/server/*.ts (dev)
-  ]) {
-    if (existsSync(path.join(dir, "favicon-black.svg"))) {
-      return dir;
-    }
-  }
-  throw new Error(
-    "Inspector favicon assets not found (expected dist/cdn or public/)"
-  );
-}
-function registerInspectorFaviconStatic(app2, basePath = "") {
-  const faviconDir = resolveFaviconDir();
-  const p = (suffix) => `${basePath}${suffix}`;
-  for (const file of INSPECTOR_FAVICON_ASSETS) {
-    app2.get(p(`/${file}`), (c) => {
-      try {
-        const data = readFileSync(path.join(faviconDir, file));
-        const ext = path.extname(file);
-        return c.body(data, 200, {
-          "Content-Type": CONTENT_TYPES[ext] ?? "application/octet-stream",
-          "Cache-Control": "public, max-age=3600"
-        });
-      } catch {
-        return c.notFound();
+        const connectSrc = connectDomains.length > 0 ? connectDomains.join(" ") : "'none'";
+        const resourceSrc = resourceDomains.length > 0 ? ["data:", "blob:", ...resourceDomains].join(" ") : "data: blob:";
+        const frameSrc = frameDomains.length > 0 ? frameDomains.join(" ") : "'none'";
+        const baseUri = baseUriDomains.length > 0 ? baseUriDomains.join(" ") : "'none'";
+        const scriptSrcParts = ["'unsafe-inline'", resourceSrc];
+        if (scriptDirectives.length > 0) scriptSrcParts.push(scriptDirectives.join(" "));
+
+        return [
+          "default-src 'none'",
+          "script-src " + scriptSrcParts.join(" "),
+          "style-src 'unsafe-inline' " + resourceSrc,
+          "img-src " + resourceSrc,
+          "font-src " + resourceSrc,
+          "media-src " + resourceSrc,
+          "connect-src " + connectSrc,
+          "frame-src " + frameSrc,
+          "object-src 'none'",
+          "base-uri " + baseUri,
+        ].join("; ");
+      }
+
+      function buildViolationListenerScript() {
+        return \`<script>
+document.addEventListener('securitypolicyviolation', function(e) {
+  var violation = {
+    type: 'mcp-apps:csp-violation',
+    directive: e.violatedDirective,
+    blockedUri: e.blockedURI,
+    sourceFile: e.sourceFile || null,
+    lineNumber: e.lineNumber || null,
+    columnNumber: e.columnNumber || null,
+    effectiveDirective: e.effectiveDirective,
+    originalPolicy: e.originalPolicy,
+    disposition: e.disposition,
+    timestamp: Date.now()
+  };
+  console.warn('[MCP Apps CSP Violation]', violation.directive, ':', violation.blockedUri);
+  window.parent.postMessage(violation, '*');
+});
+
+function serializeConsoleArgs(args) {
+  try {
+    return Array.from(args || []).map(function(arg) {
+      if (arg instanceof Error) {
+        return {
+          type: 'Error',
+          message: arg.message,
+          stack: arg.stack,
+          name: arg.name,
+        };
+      }
+      if (typeof arg === 'object' && arg !== null) {
+        try {
+          return JSON.parse(JSON.stringify(arg));
+        } catch (e) {
+          return String(arg);
+        }
       }
+      return arg;
     });
+  } catch (e) {
+    return [String(args)];
   }
 }
 
-// src/server/static-assets.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import path2 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
-var CONTENT_TYPES2 = {
-  ".js": "application/javascript",
-  ".css": "text/css",
-  ".svg": "image/svg+xml",
-  ".png": "image/png",
-  ".ico": "image/x-icon",
-  ".webmanifest": "application/manifest+json"
-};
-function resolveDistCdnDir() {
-  const here = path2.dirname(fileURLToPath2(import.meta.url));
-  for (const dir of [
-    path2.resolve(here, "cdn"),
-    // dist/cli.js (bundled)
-    path2.resolve(here, "../cdn")
-    // dist/server/*.js
-  ]) {
-    if (existsSync2(path2.join(dir, "inspector.js"))) {
-      return dir;
-    }
-  }
-  throw new Error(
-    "Inspector bundle not found (expected dist/cdn/inspector.js)"
-  );
-}
-function registerInspectorStaticAssets(app2, basePath = "") {
-  const cdnDir = resolveDistCdnDir();
-  const mountPath = `${basePath}/dist/cdn`;
-  app2.get(`${mountPath}/*`, (c) => {
-    const subPath = c.req.path.slice(mountPath.length);
-    const relative = subPath.startsWith("/") ? subPath.slice(1) : subPath;
-    if (!relative || relative.includes("..")) {
-      return c.notFound();
-    }
-    const file = path2.resolve(cdnDir, relative);
-    const root = cdnDir.endsWith(path2.sep) ? cdnDir : `${cdnDir}${path2.sep}`;
-    if (!file.startsWith(root) || !existsSync2(file)) {
-      return c.notFound();
-    }
-    const ext = path2.extname(file);
-    return c.body(readFileSync2(file), 200, {
-      "Content-Type": CONTENT_TYPES2[ext] ?? "application/octet-stream",
-      "Cache-Control": "public, max-age=3600"
-    });
-  });
+function sendConsoleToParent(level, args) {
+  try {
+    window.parent.postMessage({
+      type: 'iframe-console-log',
+      level: level,
+      args: serializeConsoleArgs(args),
+      timestamp: new Date().toISOString(),
+      url: window.location.href,
+    }, '*');
+  } catch (e) {}
 }
 
-// package.json
-var package_default = {
-  name: "@mcp-use/inspector",
-  type: "module",
-  version: "20.0.0-beta.4",
-  description: "MCP Inspector - A tool for inspecting and debugging MCP servers",
-  author: "",
-  license: "MIT",
-  homepage: "https://github.com/mcp-use/mcp-use#readme",
-  repository: {
-    type: "git",
-    url: "git+https://github.com/mcp-use/mcp-use.git",
-    directory: "libraries/typescript/packages/inspector"
-  },
-  bugs: {
-    url: "https://github.com/mcp-use/mcp-use/issues"
-  },
-  keywords: [
-    "mcp",
-    "inspector",
-    "debug",
-    "tools"
-  ],
-  exports: {
-    ".": {
-      types: "./dist/server/index.d.ts",
-      import: "./dist/server/index.js"
-    },
-    "./proxy": {
-      types: "./dist/server/proxy-routes.d.ts",
-      import: "./dist/server/proxy-routes.js"
-    },
-    "./client": {
-      types: "./dist/client/index.d.ts",
-      import: "./dist/client/index.js"
-    }
-  },
-  main: "./dist/server/index.js",
-  types: "./dist/server/index.d.ts",
-  bin: {
-    "mcp-inspect": "./dist/cli.js"
-  },
-  files: [
-    "dist"
-  ],
-  scripts: {
-    dev: "rimraf node_modules/.vite && VITE_MANUFACT_CHAT_URL=${VITE_MANUFACT_CHAT_URL:-http://localhost:8000/api/v1/inspector/chat/stream} vite --strictPort",
-    "dev:client": "pnpm run dev",
-    "dev:server": "VITE_DEV=true tsx watch src/server/server.ts",
-    "dev:standalone": "tsx watch src/server/server.ts",
-    build: "npm run build:client && npm run build:client-exports && npm run build:server && npm run build:cli && npm run build:cdn",
-    "build:cdn": "vite build --config vite.cdn.config.ts",
-    "watch:cdn": "vite build --watch --config vite.cdn.config.ts",
-    "preview:cdn": "vite preview --config vite.cdn.config.ts --host 127.0.0.1",
-    "serve:cdn": "pnpm build:cdn && pnpm preview:cdn",
-    "analyze:cdn": "ANALYZE=true vite build --config vite.cdn.config.ts",
-    "build:client": "vite build",
-    "build:client-exports": "tsup --config tsup.client.ts && tsc -p tsconfig.client.json --emitDeclarationOnly --declaration",
-    "build:server": "tsup 'src/server/**/*.ts' --format esm --out-dir dist/server && tsc -p tsconfig.server.json --emitDeclarationOnly --declaration",
-    "build:cli": "tsup src/server/cli.ts --format esm --out-dir dist/",
-    prepublishOnly: "pnpm --filter @mcp-use/client build && pnpm build",
-    start: "node dist/cli.js --port 3000",
-    preview: "vite preview",
-    "type-check": "tsc --noEmit",
-    lint: "eslint .",
-    "lint:fix": "eslint . --fix",
-    "test:e2e": "playwright test",
-    "test:e2e:ui": "playwright test --ui",
-    "test:e2e:debug": "playwright test --debug",
-    "test:e2e:builtin": "node tests/e2e/scripts/run-test-matrix.mjs builtin",
-    "test:e2e:prod": "node tests/e2e/scripts/run-test-matrix.mjs prod",
-    "test:e2e:mix": "node tests/e2e/scripts/run-test-matrix.mjs mix",
-    "test:e2e:prod:ui": "TEST_MODE=production playwright test --ui",
-    "test:e2e:codegen": "playwright codegen http://localhost:3000/inspector",
-    "test:e2e:report": "playwright show-report",
-    "test:e2e:python": "node tests/e2e/scripts/run-python-e2e.mjs",
-    "test:unit": "vitest run",
-    "test:unit:watch": "vitest",
-    "test:e2e:tunnel": "node tests/e2e/scripts/run-tunnel-test.mjs",
-    "install:yarn": "yarn install",
-    "install:pnpm": "pnpm install",
-    "install:npm": "npm install",
-    "lint:yarn": "yarn eslint . --fix",
-    "lint:npm": "npm run lint:fix",
-    "lint:pnpm": "pnpm lint:fix"
-  },
-  engines: {
-    node: ">=22.22.2"
-  },
-  peerDependencies: {
-    "@mcp-use/client": "^2.0.0-alpha.0",
-    express: "^4.21.2 || ^5.0.0",
-    react: "^18.0.0 || ^19.0.0",
-    "react-dom": "^18.0.0 || ^19.0.0",
-    "react-router": "^7.12.0"
-  },
-  peerDependenciesMeta: {
-    express: {
-      optional: true
-    }
-  },
-  dependencies: {
-    "@base-ui/react": "^1.6.0",
-    "@hono/node-server": "^1.19.13",
-    "@mcp-use/agent": "workspace:*",
-    "@mcp-use/client": "workspace:*",
-    "class-variance-authority": "^0.7.1",
-    clsx: "^2.1.1",
-    hono: "^4.12.12",
-    "lucide-react": "^0.562.0",
-    "markdown-to-jsx": "^9.7.4",
-    motion: "^12.34.2",
-    open: "^11.0.0",
-    "react-resizable-panels": "^4.6.4",
-    sonner: "^2.0.7",
-    "tailwind-merge": "^3.5.0"
-  },
-  publishConfig: {
-    access: "public"
-  },
-  devDependencies: {
-    "@playwright/test": "^1.58.2",
-    "@tailwindcss/vite": "^4.2.0",
-    "@types/express": "^5.0.6",
-    "mcp-use": "workspace:*",
-    "@vitejs/plugin-react": "^6.0.0",
-    emulate: "0.5.0",
-    eslint: "^9.39.2",
-    express: "^5.2.1",
-    "oauth2-mock-server": "^8.2.2",
-    react: "^19.2.3",
-    "react-dom": "^19.2.3",
-    "react-router": "^7.12.0",
-    "rollup-plugin-visualizer": "^6.0.3",
-    tailwindcss: "^4.2.0",
-    tsup: "^8.5.1",
-    tsx: "^4.21.0",
-    "tw-animate-css": "^1.4.0",
-    typescript: "^5.9.3",
-    vite: "^8.0.16",
-    vitest: "^4.1.0",
-    "wait-on": "^9.0.4",
-    zod: "^4.2.0"
-  }
+var originalConsoleError = console.error.bind(console);
+console.error = function() {
+  var args = Array.from(arguments);
+  originalConsoleError.apply(console, args);
+  sendConsoleToParent('error', args);
 };
 
-// src/server/version.ts
-var VERSION = package_default.version;
-function getInspectorVersion() {
-  return VERSION;
-}
+window.addEventListener('error', function(event) {
+  sendConsoleToParent('error', [{
+    message: event.message,
+    filename: event.filename,
+    lineno: event.lineno,
+    colno: event.colno,
+    error: event.error ? {
+      message: event.error.message,
+      stack: event.error.stack,
+      name: event.error.name,
+    } : null,
+  }]);
+});
+
+window.addEventListener('unhandledrejection', function(event) {
+  sendConsoleToParent('error', [{
+    message: 'Unhandled Promise Rejection',
+    reason: event.reason ? String(event.reason) : 'Unknown',
+    error: event.reason instanceof Error ? {
+      message: event.reason.message,
+      stack: event.reason.stack,
+      name: event.reason.name,
+    } : null,
+  }]);
+});
+</\` + \`script>\`;
+      }
+
+      function injectCSP(html, cspValue) {
+        const cspMeta = '<meta http-equiv="Content-Security-Policy" content="' + cspValue + '">';
+        const violationListener = buildViolationListenerScript();
+        const injection = cspMeta + violationListener;
+
+        if (html.includes("<head>")) {
+          return html.replace("<head>", "<head>" + injection);
+        } else if (html.includes("<HEAD>")) {
+          return html.replace("<HEAD>", "<HEAD>" + injection);
+        } else if (html.includes("<html>")) {
+          return html.replace("<html>", "<html><head>" + injection + "</head>");
+        } else if (html.includes("<HTML>")) {
+          return html.replace("<HTML>", "<HTML><head>" + injection + "</head>");
+        } else if (html.includes("<!DOCTYPE") || html.includes("<!doctype")) {
+          return html.replace(/(<!DOCTYPE[^>]*>|<!doctype[^>]*>)/i, "$1<head>" + injection + "</head>");
+        } else {
+          return injection + html;
+        }
+      }
+
+      // Query params from host (csp_mode, permissions, widget_csp). AppFrame only
+      // sends { html, csp } in sandbox-resource-ready; we carry the rest on the URL.
+      // Blob URLs cannot reliably carry search params, so the CDN shell injects
+      // window.__SANDBOX_SEARCH__ via buildSandboxProxyBlobHtml.
+      const query = new URLSearchParams(
+        typeof window.__SANDBOX_SEARCH__ === "string"
+          ? window.__SANDBOX_SEARCH__
+          : location.search
+      );
+      const queryCspMode = query.get("csp_mode") || "permissive";
+      let queryPermissions = null;
+      let queryWidgetCsp = null;
+      try {
+        const rawPerm = query.get("permissions");
+        if (rawPerm) queryPermissions = JSON.parse(rawPerm);
+      } catch (e) {}
+      try {
+        const rawCsp = query.get("widget_csp");
+        if (rawCsp) queryWidgetCsp = JSON.parse(rawCsp);
+      } catch (e) {}
+
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+      document.body.appendChild(inner);
 
-// src/server/cdn-shell.ts
-var INSPECTOR_VERSION = getInspectorVersion();
-var OAUTH_POPUP_CLOSED_HTML = `<!doctype html>
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          if (event.data && event.data.method === "ui/notifications/sandbox-resource-ready") {
+            const params = event.data.params || {};
+            const html = params.html;
+            const sandbox = params.sandbox;
+            // Prefer message csp when present; fall back to URL widget_csp
+            const csp = params.csp != null ? params.csp : queryWidgetCsp;
+            const permissions = params.permissions != null ? params.permissions : queryPermissions;
+            const permissive =
+              typeof params.permissive === "boolean"
+                ? params.permissive
+                : queryCspMode === "permissive";
+            if (typeof sandbox === "string") {
+              inner.setAttribute("sandbox", sandbox);
+            }
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              if (permissive) {
+                const permissiveCsp = [
+                  "default-src * 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about:",
+                  "script-src * 'unsafe-inline' 'unsafe-eval' data: blob:",
+                  "style-src * 'unsafe-inline' data: blob:",
+                  "img-src * data: blob: https: http:",
+                  "media-src * data: blob: https: http:",
+                  "font-src * data: blob: https: http:",
+                  "connect-src * data: blob: https: http: ws: wss: about:",
+                  "frame-src * data: blob: https: http: about:",
+                  "object-src * data: blob:",
+                  "base-uri *",
+                  "form-action *",
+                ].join("; ");
+                const processedHtml = injectCSP(html, permissiveCsp);
+                inner.srcdoc = processedHtml;
+              } else {
+                const cspValue = buildCSP(csp);
+                const processedHtml = injectCSP(html, cspValue);
+                inner.srcdoc = processedHtml;
+              }
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          window.parent.postMessage(event.data, "*");
+        }
+      });
+
+      window.parent.postMessage({
+        jsonrpc: "2.0",
+        method: "ui/notifications/sandbox-proxy-ready",
+        params: {},
+      }, "*");
+    </script>
+  </body>
+</html>`;function Hr(e){let r="<script>window.__SANDBOX_SEARCH__ = "+JSON.stringify(e).replace(/</g,"\\u003c")+";</script>";return Zo.replace("<body>","<body>"+r)}var Br=Te();function es(e){let t=e.hostname==="localhost"?"127.0.0.1":e.hostname==="127.0.0.1"||e.hostname==="::1"?"localhost":void 0;if(!t)return;let r=new URL(e.origin);return r.hostname=t,r.origin}var ts=`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
 <body><div>Signed in. You can close this window.</div>
 <script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
-</body></html>`;
-function generateCdnShellHtml(config, basePath, assets) {
-  const scripts = [];
-  if (config?.basePath !== void 0) {
-    scripts.push(
-      `<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(config.basePath)};</script>`
-    );
-  }
-  if (config?.devMode) {
-    scripts.push(`<script>window.__MCP_DEV_MODE__ = true;</script>`);
-  }
-  if (config?.sandboxOrigin) {
-    scripts.push(
-      `<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(config.sandboxOrigin)};</script>`
-    );
-  }
-  if (config?.proxyUrl !== void 0) {
-    scripts.push(
-      `<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(config.proxyUrl)};</script>`
-    );
-  }
-  if (config?.inspectorMode) {
-    scripts.push(
-      `<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(config.inspectorMode)};</script>`
-    );
-  }
-  if (config?.manufactChatUrl) {
-    scripts.push(
-      `<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(config.manufactChatUrl)};</script>`
-    );
-  }
-  if (config?.disableTelemetry) {
-    scripts.push(
-      `<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>`
-    );
-  }
-  const runtimeScripts = scripts.join("\n    ");
-  return `<!doctype html>
+</body></html>`;function rs(e,t,r){let n=[];e?.basePath!==void 0&&n.push(`<script>window.__MCP_BASE_PATH__ = ${JSON.stringify(e.basePath)};</script>`),e?.devMode&&n.push("<script>window.__MCP_DEV_MODE__ = true;</script>"),e?.sandboxOrigin&&n.push(`<script>window.__MCP_SANDBOX_ORIGIN__ = ${JSON.stringify(e.sandboxOrigin)};</script>`),e?.proxyUrl!==void 0&&n.push(`<script>window.__MCP_PROXY_URL__ = ${JSON.stringify(e.proxyUrl)};</script>`),e?.inspectorMode&&n.push(`<script>window.__MCP_INSPECTOR_MODE__ = ${JSON.stringify(e.inspectorMode)};</script>`),e?.manufactChatUrl&&n.push(`<script>window.__MANUFACT_CHAT_URL__ = ${JSON.stringify(e.manufactChatUrl)};</script>`),e?.disableTelemetry&&n.push('<script>window.__MCP_USE_ANONYMIZED_TELEMETRY__ = false;try{localStorage.setItem("MCP_USE_ANONYMIZED_TELEMETRY","false");}catch(e){}</script>'),process.env.MCP_USE_DEV_CLI==="1"&&n.push("<script>window.__MCP_DEV_CLI__ = true;</script>");let o=n.join(`
+    `);return`<!doctype html>
 <html lang="en">
   <head>
     <meta charset="UTF-8" />
-    ${renderInspectorFaviconLinks(basePath)}
+    ${Rr(`${t}/inspector/assets`)}
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=Ubuntu:wght@400;500;700&display=swap" rel="stylesheet" />
-    <link rel="stylesheet" href="${assets.cssUrl}" />
+    <link rel="stylesheet" href="${r.cssUrl}" />
     <title>Inspector | mcp-use</title>
     <meta name="description" content="Free, open-source MCP Inspector by mcp-use. Connect to any MCP server, test tools, prompts, and resources, inspect RPC logs, and debug MCP apps \u2014 all in your browser." />
-    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(INSPECTOR_VERSION)};</script>
-    ${runtimeScripts}
+    <style>
+      :root { color-scheme: light dark; }
+      html, body { height: 100%; margin: 0; background-color: #f3f3f3; }
+      #root { height: 100%; }
+      .mcp-boot {
+        display: flex;
+        height: 100%;
+        align-items: center;
+        justify-content: center;
+        background-color: #f3f3f3;
+      }
+      .mcp-boot-inner {
+        display: flex;
+        flex-direction: column;
+        align-items: center;
+        gap: 16px;
+      }
+      .mcp-boot-spinner {
+        width: 32px;
+        height: 32px;
+        color: #52525b;
+        animation: mcp-boot-spin 1s linear infinite;
+      }
+      .mcp-boot-label {
+        margin: 0;
+        font-family: Ubuntu, sans-serif;
+        font-size: 0.875rem;
+        line-height: 1.25rem;
+        color: #52525b;
+      }
+      @keyframes mcp-boot-spin {
+        to { transform: rotate(360deg); }
+      }
+      @media (prefers-color-scheme: dark) {
+        html, body { background-color: #000; }
+        .mcp-boot { background-color: #000; }
+        .mcp-boot-spinner, .mcp-boot-label { color: #a1a1aa; }
+      }
+    </style>
+    <script>window.__INSPECTOR_VERSION__ = ${JSON.stringify(Br)};</script>
+    ${o}
   </head>
   <body>
     <script>
@@ -402,972 +346,32 @@ function generateCdnShellHtml(config, basePath, assets) {
         };
       }
     </script>
-    <div id="root"></div>
-    <script type="module" src="${assets.jsUrl}"></script>
+    <div id="root">
+      <div class="mcp-boot">
+        <div class="mcp-boot-inner">
+          <svg
+            class="mcp-boot-spinner"
+            xmlns="http://www.w3.org/2000/svg"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            role="status"
+            aria-label="Loading"
+          >
+            <path d="M21 12a9 9 0 1 1-6.219-8.56" />
+          </svg>
+          <p class="mcp-boot-label">Connecting to MCP server...</p>
+        </div>
+      </div>
+    </div>
+    <script type="module" src="${r.jsUrl}"></script>
   </body>
-</html>`;
-}
-function registerInspectorCdnShell(app2, config, basePath = "") {
-  const assets = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
-  const p = (suffix) => `${basePath}${suffix}`;
-  const effectiveConfig = {
-    ...config,
-    basePath: config?.basePath ?? basePath,
-    proxyUrl: config?.proxyUrl !== void 0 ? config.proxyUrl : p("/inspector/api/proxy"),
-    disableTelemetry: config?.disableTelemetry ?? process.env.MCP_USE_ANONYMIZED_TELEMETRY === "false"
-  };
-  const serveShell = (c) => {
-    const base = resolveInspectorAssetUrls(config?.inspectorMode, basePath);
-    const jsUrl = withInspectorCacheBust(base.jsUrl);
-    return c.html(
-      generateCdnShellHtml(effectiveConfig, basePath, {
-        jsUrl,
-        cssUrl: inspectorStylesUrl(jsUrl)
-      })
-    );
-  };
-  registerInspectorFaviconStatic(app2, basePath);
-  app2.get(
-    p("/inspector/oauth-popup-closed.html"),
-    (c) => c.html(OAUTH_POPUP_CLOSED_HTML)
-  );
-  app2.get(p("/inspector"), serveShell);
-  app2.get(`${p("/inspector")}/`, serveShell);
-  const apiPrefix = p("/inspector/api/");
-  app2.get(p("/inspector/*"), (c) => {
-    if (c.req.path.startsWith(apiPrefix)) {
-      return c.notFound();
-    }
-    return serveShell(c);
-  });
-  app2.post(p("/inspector/*"), (c) => {
-    if (c.req.path.startsWith(apiPrefix)) {
-      return c.notFound();
-    }
-    return serveShell(c);
-  });
-  if (basePath === "") {
-    app2.get("/", (c) => {
-      const url = new URL(c.req.url);
-      return c.redirect(`${p("/inspector")}${url.search}`);
-    });
-  }
-  if (assets.useLocal) {
-    registerInspectorStaticAssets(app2, basePath);
-  }
-}
-
-// src/server/proxy/mcp-proxy.ts
-import { cors } from "hono/cors";
-import { logger } from "hono/logger";
-
-// src/server/proxy/oauth-proxy.ts
-import { lookup } from "dns/promises";
-import { isIP } from "net";
-var SAFE_REQUEST_HEADERS = /* @__PURE__ */ new Set([
-  "accept",
-  "authorization",
-  "content-type",
-  "dpop"
-]);
-var SAFE_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
-  "cache-control",
-  "content-type",
-  "dpop-nonce",
-  "expires",
-  "pragma",
-  "retry-after",
-  "www-authenticate"
-]);
-var ENDPOINT_FIELDS = [
-  ["registration_endpoint", "registration"],
-  ["token_endpoint", "token"],
-  ["revocation_endpoint", "revocation"],
-  ["introspection_endpoint", "introspection"]
-];
-var BINDING_TTL_MS = 10 * 60 * 1e3;
-var MAX_BINDINGS = 100;
-function mountOAuthProxy(app2, options = {}) {
-  const {
-    basePath = "/oauth",
-    allowedOrigins = [],
-    allowLoopback = false,
-    timeoutMs = 1e4,
-    maxRequestBodyBytes = 64 * 1024,
-    maxResponseBodyBytes = 1024 * 1024,
-    enableLogging = true,
-    authenticate,
-    validateServerUrl
-  } = options;
-  const origins = new Set(allowedOrigins.map(normalizeOrigin));
-  const bindings = /* @__PURE__ */ new Map();
-  app2.use(`${basePath}/*`, async (c, next) => {
-    const origin = c.req.header("Origin");
-    if (origin && !isAllowedOrigin(origin, c.req.url, origins)) {
-      return c.json({ error: "Origin not allowed" }, 403);
-    }
-    if (c.req.method === "OPTIONS") {
-      return corsResponse(origin);
-    }
-    await next();
-    if (origin) setCorsHeaders(c.res.headers, origin);
-  });
-  app2.get(`${basePath}/metadata`, async (c) => {
-    if (!await isAuthenticated(c, authenticate)) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-    const serverUrlResult = await validateUrl(
-      c.req.query("serverUrl"),
-      allowLoopback
-    );
-    if ("error" in serverUrlResult) {
-      return c.json({ error: serverUrlResult.error }, 400);
-    }
-    const serverUrl = serverUrlResult.url;
-    if (validateServerUrl && !await validateServerUrl(serverUrl.toString(), c)) {
-      return c.json({ error: "MCP server URL not allowed" }, 403);
-    }
-    const targetResult = await validateUrl(c.req.query("url"), allowLoopback);
-    if ("error" in targetResult) {
-      return c.json({ error: targetResult.error }, 400);
-    }
-    const target = targetResult.url;
-    const key = canonicalUrl(serverUrl);
-    const binding = getBinding(bindings, key);
-    let metadataKind = classifyMetadataTarget(serverUrl, target, binding);
-    if (!metadataKind && binding.authorizationServers.size === 0) {
-      try {
-        await hydrateBinding(
-          serverUrl,
-          binding,
-          allowLoopback,
-          timeoutMs,
-          maxResponseBodyBytes
-        );
-        bindings.set(key, binding);
-        metadataKind = classifyMetadataTarget(serverUrl, target, binding);
-      } catch {
-      }
-    }
-    if (!metadataKind) {
-      return c.json(
-        { error: "Metadata target is not bound to this MCP server" },
-        403
-      );
-    }
-    try {
-      log(enableLogging, `GET ${target}`);
-      const upstream = await safeFetch(target, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(upstream.status)) {
-        return c.json(
-          { error: "OAuth metadata redirects are not allowed" },
-          502
-        );
-      }
-      const raw = await readCapped(upstream, maxResponseBodyBytes);
-      if (!upstream.ok) {
-        return c.body(raw, upstream.status, {
-          "Content-Type": upstream.headers.get("content-type") ?? "application/json"
-        });
-      }
-      const metadata = parseObject(raw);
-      if (metadataKind.type === "protected-resource") {
-        await bindProtectedResource(
-          metadata,
-          serverUrl,
-          binding,
-          allowLoopback
-        );
-      } else {
-        await bindAuthorizationServer(
-          metadata,
-          metadataKind.issuer,
-          binding,
-          allowLoopback
-        );
-      }
-      binding.updatedAt = Date.now();
-      bindings.set(key, binding);
-      pruneBindings(bindings);
-      return c.body(raw, 200, {
-        "Content-Type": upstream.headers.get("content-type") ?? "application/json"
-      });
-    } catch (error) {
-      return proxyError(c, error, enableLogging);
-    }
-  });
-  app2.post(`${basePath}/proxy`, async (c) => {
-    if (!await isAuthenticated(c, authenticate)) {
-      return c.json({ error: "Unauthorized" }, 401);
-    }
-    let request;
-    try {
-      request = JSON.parse(
-        await readRequestCapped(c.req.raw, maxRequestBodyBytes)
-      );
-    } catch (error) {
-      return c.json(
-        {
-          error: error instanceof BodyTooLargeError ? "Request body too large" : "Invalid JSON request body"
-        },
-        error instanceof BodyTooLargeError ? 413 : 400
-      );
-    }
-    const serverUrlResult = await validateUrl(request.serverUrl, allowLoopback);
-    if ("error" in serverUrlResult) {
-      return c.json({ error: serverUrlResult.error }, 400);
-    }
-    const serverUrl = serverUrlResult.url;
-    if (validateServerUrl && !await validateServerUrl(serverUrl.toString(), c)) {
-      return c.json({ error: "MCP server URL not allowed" }, 403);
-    }
-    const targetResult = await validateUrl(request.url, allowLoopback);
-    if ("error" in targetResult) {
-      return c.json({ error: targetResult.error }, 400);
-    }
-    const target = targetResult.url;
-    if (request.method !== void 0 && request.method !== "POST") {
-      return c.json({ error: "Only OAuth endpoint POST is allowed" }, 405);
-    }
-    const bindingKey = canonicalUrl(serverUrl);
-    const binding = getBinding(bindings, bindingKey);
-    if (binding.endpoints.size === 0) {
-      try {
-        await hydrateBinding(
-          serverUrl,
-          binding,
-          allowLoopback,
-          timeoutMs,
-          maxResponseBodyBytes
-        );
-        bindings.set(bindingKey, binding);
-        pruneBindings(bindings);
-      } catch (error) {
-        return proxyError(c, error, enableLogging);
-      }
-    }
-    const endpointKind = binding.endpoints.get(canonicalUrl(target));
-    if (!endpointKind) {
-      return c.json(
-        { error: "OAuth endpoint is not bound to this MCP server" },
-        403
-      );
-    }
-    try {
-      const headers = filterRequestHeaders(request.headers);
-      const body = serializeBody(request.body, headers);
-      if (new TextEncoder().encode(body ?? "").byteLength > maxRequestBodyBytes) {
-        return c.json({ error: "OAuth request body too large" }, 413);
-      }
-      log(enableLogging, `POST ${endpointKind} ${target}`);
-      const upstream = await safeFetch(target, {
-        method: "POST",
-        headers,
-        body,
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(upstream.status)) {
-        return c.json(
-          { error: "OAuth endpoint redirects are not allowed" },
-          502
-        );
-      }
-      const raw = await readCapped(upstream, maxResponseBodyBytes);
-      const responseHeaders = filterResponseHeaders(upstream.headers);
-      const contentType = upstream.headers.get("content-type") ?? "";
-      let responseBody = raw;
-      if (contentType.includes("json")) {
-        try {
-          responseBody = JSON.parse(raw);
-        } catch {
-        }
-      }
-      return c.json({
-        status: upstream.status,
-        statusText: upstream.statusText,
-        headers: responseHeaders,
-        body: responseBody
-      });
-    } catch (error) {
-      return proxyError(c, error, enableLogging);
-    }
-  });
-  log(enableLogging, `Mounted at ${basePath}/metadata and ${basePath}/proxy`);
-}
-async function validateUrl(value, allowLoopback) {
-  if (typeof value !== "string" || !value) {
-    return { error: "Missing or invalid URL" };
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return { error: "Invalid URL" };
-  }
-  if (url.username || url.password || url.hash) {
-    return { error: "URL credentials and fragments are not allowed" };
-  }
-  const loopback = isLoopbackHostname(url.hostname);
-  if (url.protocol !== "https:") {
-    if (!(allowLoopback && loopback && url.protocol === "http:")) {
-      return { error: "HTTPS is required" };
-    }
-  }
-  if (loopback) {
-    return allowLoopback ? { url } : { error: "Loopback URL not allowed" };
-  }
-  if (isLocalHostname(url.hostname)) {
-    return { error: "Local network URL not allowed" };
-  }
-  try {
-    const addresses = isIP(url.hostname) ? [url.hostname] : (await lookup(url.hostname, { all: true, verbatim: true })).map(
-      ({ address }) => address
-    );
-    if (addresses.length === 0 || addresses.some((address) => !isPublicAddress(address))) {
-      return { error: "Private or non-routable URL not allowed" };
-    }
-  } catch {
-    return { error: "URL hostname could not be resolved" };
-  }
-  return { url };
-}
-async function isSafeProxyTarget(value, allowLoopback = false) {
-  return !("error" in await validateUrl(value, allowLoopback));
-}
-function classifyMetadataTarget(serverUrl, target, binding) {
-  const targetUrl = canonicalUrl(target);
-  if (protectedResourceMetadataUrls(serverUrl).some(
-    (candidate) => canonicalUrl(candidate) === targetUrl
-  )) {
-    return { type: "protected-resource" };
-  }
-  for (const issuer of binding.authorizationServers) {
-    if (authorizationServerMetadataUrls(new URL(issuer)).some(
-      (candidate) => canonicalUrl(candidate) === targetUrl
-    )) {
-      return { type: "authorization-server", issuer };
-    }
-  }
-  return void 0;
-}
-function protectedResourceMetadataUrls(serverUrl) {
-  const path3 = serverUrl.pathname === "/" ? "" : serverUrl.pathname;
-  return [
-    new URL(`/.well-known/oauth-protected-resource${path3}`, serverUrl.origin),
-    new URL("/.well-known/oauth-protected-resource", serverUrl.origin)
-  ];
-}
-function authorizationServerMetadataUrls(issuer) {
-  const path3 = issuer.pathname === "/" ? "" : issuer.pathname;
-  return [
-    new URL(`/.well-known/oauth-authorization-server${path3}`, issuer.origin),
-    new URL(`/.well-known/openid-configuration${path3}`, issuer.origin),
-    new URL(`${path3 || ""}/.well-known/openid-configuration`, issuer.origin)
-  ];
-}
-async function bindProtectedResource(metadata, serverUrl, binding, allowLoopback) {
-  if (typeof metadata.resource !== "string" || canonicalUrl(new URL(metadata.resource)) !== canonicalUrl(serverUrl)) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata does not match serverUrl"
-    );
-  }
-  if (!Array.isArray(metadata.authorization_servers) || metadata.authorization_servers.length === 0) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata has no authorization servers"
-    );
-  }
-  const issuers = /* @__PURE__ */ new Set();
-  for (const value of metadata.authorization_servers) {
-    const result = await validateUrl(value, allowLoopback);
-    if ("error" in result) {
-      throw new InvalidUpstreamError(
-        `Unsafe authorization server: ${result.error}`
-      );
-    }
-    issuers.add(canonicalUrl(result.url));
-  }
-  binding.authorizationServers = issuers;
-  binding.endpoints.clear();
-}
-async function bindAuthorizationServer(metadata, expectedIssuer, binding, allowLoopback) {
-  if (typeof metadata.issuer !== "string" || canonicalUrl(new URL(metadata.issuer)) !== expectedIssuer) {
-    throw new InvalidUpstreamError(
-      "Authorization-server metadata issuer mismatch"
-    );
-  }
-  binding.endpoints.clear();
-  for (const [field, kind] of ENDPOINT_FIELDS) {
-    const value = metadata[field];
-    if (value === void 0) continue;
-    const result = await validateUrl(value, allowLoopback);
-    if ("error" in result) {
-      throw new InvalidUpstreamError(`Unsafe ${field}: ${result.error}`);
-    }
-    binding.endpoints.set(canonicalUrl(result.url), kind);
-  }
-}
-async function hydrateBinding(serverUrl, binding, allowLoopback, timeoutMs, maxResponseBodyBytes) {
-  for (const metadataUrl of protectedResourceMetadataUrls(serverUrl)) {
-    const response = await safeFetch(metadataUrl, {
-      method: "GET",
-      headers: { Accept: "application/json" },
-      redirect: "manual",
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    if (isRedirect(response.status)) {
-      throw new InvalidUpstreamError(
-        "OAuth metadata redirects are not allowed"
-      );
-    }
-    if (!response.ok) continue;
-    await bindProtectedResource(
-      parseObject(await readCapped(response, maxResponseBodyBytes)),
-      serverUrl,
-      binding,
-      allowLoopback
-    );
-    break;
-  }
-  if (binding.authorizationServers.size === 0) {
-    throw new InvalidUpstreamError(
-      "Protected-resource metadata could not be discovered"
-    );
-  }
-  for (const issuer of binding.authorizationServers) {
-    let bound = false;
-    for (const metadataUrl of authorizationServerMetadataUrls(
-      new URL(issuer)
-    )) {
-      const response = await safeFetch(metadataUrl, {
-        method: "GET",
-        headers: { Accept: "application/json" },
-        redirect: "manual",
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-      if (isRedirect(response.status)) {
-        throw new InvalidUpstreamError(
-          "OAuth metadata redirects are not allowed"
-        );
-      }
-      if (!response.ok) continue;
-      await bindAuthorizationServer(
-        parseObject(await readCapped(response, maxResponseBodyBytes)),
-        issuer,
-        binding,
-        allowLoopback
-      );
-      bound = true;
-      break;
-    }
-    if (bound) break;
-  }
-  if (binding.endpoints.size === 0) {
-    throw new InvalidUpstreamError(
-      "Authorization-server metadata could not be discovered"
-    );
-  }
-  binding.updatedAt = Date.now();
-}
-async function safeFetch(url, init) {
-  return fetch(url, init);
-}
-function filterRequestHeaders(value) {
-  const result = new Headers();
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    return result;
-  for (const [name, rawValue] of Object.entries(value)) {
-    const lower = name.toLowerCase();
-    if (SAFE_REQUEST_HEADERS.has(lower) && typeof rawValue === "string") {
-      result.set(lower, rawValue);
-    }
-  }
-  return result;
-}
-function filterResponseHeaders(headers) {
-  const result = {};
-  headers.forEach((value, name) => {
-    if (SAFE_RESPONSE_HEADERS.has(name.toLowerCase())) result[name] = value;
-  });
-  return result;
-}
-function serializeBody(body, headers) {
-  if (body === void 0 || body === null) return void 0;
-  if (typeof body === "string") return body;
-  const contentType = headers.get("content-type") ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded") && typeof body === "object" && !Array.isArray(body)) {
-    const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(
-      body
-    )) {
-      params.append(key, String(value));
-    }
-    return params.toString();
-  }
-  if (!headers.has("content-type")) {
-    headers.set("content-type", "application/json");
-  }
-  return JSON.stringify(body);
-}
-async function readRequestCapped(request, maxBytes) {
-  const declared = Number(request.headers.get("content-length"));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    throw new BodyTooLargeError();
-  }
-  return readStreamCapped(request.body, maxBytes);
-}
-async function readCapped(response, maxBytes) {
-  const declared = Number(response.headers.get("content-length"));
-  if (Number.isFinite(declared) && declared > maxBytes) {
-    await response.body?.cancel();
-    throw new BodyTooLargeError();
-  }
-  return readStreamCapped(response.body, maxBytes);
-}
-async function readStreamCapped(stream, maxBytes) {
-  if (!stream) return "";
-  const reader = stream.getReader();
-  const chunks = [];
-  let size = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    size += value.byteLength;
-    if (size > maxBytes) {
-      await reader.cancel();
-      throw new BodyTooLargeError();
-    }
-    chunks.push(value);
-  }
-  const bytes = new Uint8Array(size);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(bytes);
-}
-function parseObject(value) {
-  let parsed;
-  try {
-    parsed = JSON.parse(value);
-  } catch {
-    throw new InvalidUpstreamError("OAuth metadata is not valid JSON");
-  }
-  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-    throw new InvalidUpstreamError("OAuth metadata is not an object");
-  }
-  return parsed;
-}
-function getBinding(bindings, key) {
-  const existing = bindings.get(key);
-  if (existing && Date.now() - existing.updatedAt <= BINDING_TTL_MS) {
-    return existing;
-  }
-  bindings.delete(key);
-  return {
-    authorizationServers: /* @__PURE__ */ new Set(),
-    endpoints: /* @__PURE__ */ new Map(),
-    updatedAt: Date.now()
-  };
-}
-function pruneBindings(bindings) {
-  const now = Date.now();
-  for (const [key, binding] of bindings) {
-    if (now - binding.updatedAt > BINDING_TTL_MS) bindings.delete(key);
-  }
-  while (bindings.size > MAX_BINDINGS) {
-    const oldest = bindings.keys().next().value;
-    if (!oldest) break;
-    bindings.delete(oldest);
-  }
-}
-function canonicalUrl(url) {
-  const copy = new URL(url);
-  copy.hash = "";
-  if (copy.protocol === "https:" && copy.port === "443" || copy.protocol === "http:" && copy.port === "80") {
-    copy.port = "";
-  }
-  return copy.toString().replace(/\/$/, "");
-}
-function normalizeOrigin(origin) {
-  const url = new URL(origin);
-  if (url.pathname !== "/" || url.search || url.hash) {
-    throw new Error(`OAuth proxy allowed origin must be an origin: ${origin}`);
-  }
-  return url.origin;
-}
-function isAllowedOrigin(origin, requestUrl, allowed) {
-  try {
-    const normalized = normalizeOrigin(origin);
-    return normalized === new URL(requestUrl).origin || allowed.has(normalized);
-  } catch {
-    return false;
-  }
-}
-function corsResponse(origin) {
-  const headers = new Headers();
-  if (origin) setCorsHeaders(headers, origin);
-  headers.set("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-  headers.set(
-    "Access-Control-Allow-Headers",
-    "Accept, Authorization, Content-Type"
-  );
-  headers.set("Access-Control-Max-Age", "600");
-  return new Response(null, { status: 204, headers });
-}
-function setCorsHeaders(headers, origin) {
-  headers.set("Access-Control-Allow-Origin", origin);
-  headers.append("Vary", "Origin");
-}
-async function isAuthenticated(c, authenticate) {
-  return authenticate ? authenticate(c) : true;
-}
-function isRedirect(status) {
-  return status >= 300 && status < 400;
-}
-function isLoopbackHostname(hostname) {
-  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  return normalized === "localhost" || normalized.endsWith(".localhost") || normalized === "::1" || normalized.startsWith("127.");
-}
-function isLocalHostname(hostname) {
-  const normalized = hostname.toLowerCase();
-  return normalized.endsWith(".local") || normalized.endsWith(".internal") || normalized.endsWith(".home.arpa");
-}
-function isPublicAddress(address) {
-  if (address.includes(":")) {
-    const lower = address.toLowerCase();
-    if (lower.startsWith("::ffff:")) {
-      return isPublicAddress(lower.slice(7));
-    }
-    return !(lower === "::" || lower === "::1" || lower.startsWith("fc") || lower.startsWith("fd") || /^fe[89ab]/.test(lower) || lower.startsWith("ff") || lower.startsWith("2001:db8:"));
-  }
-  const parts = address.split(".").map(Number);
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part))) {
-    return false;
-  }
-  const [a, b, c] = parts;
-  return !(a === 0 || a === 10 || a === 127 || a === 100 && b >= 64 && b <= 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 0 && c === 0 || a === 192 && b === 0 && c === 2 || a === 192 && b === 168 || a === 198 && (b === 18 || b === 19) || a === 198 && b === 51 && c === 100 || a === 203 && b === 0 && c === 113 || a >= 224);
-}
-function log(enabled, message) {
-  if (enabled) console.log(`[OAuth BFF] ${message}`);
-}
-function proxyError(c, error, logging) {
-  const message = error instanceof Error ? error.message : "Unknown error";
-  if (logging) console.error("[OAuth BFF]", message);
-  if (error instanceof BodyTooLargeError) {
-    return c.json({ error: "Upstream response too large" }, 502);
-  }
-  if (error instanceof InvalidUpstreamError) {
-    return c.json({ error: error.message }, 502);
-  }
-  if (error instanceof DOMException && error.name === "TimeoutError") {
-    return c.json({ error: "OAuth upstream timed out" }, 504);
-  }
-  return c.json({ error: "OAuth upstream request failed" }, 502);
-}
-var BodyTooLargeError = class extends Error {
-};
-var InvalidUpstreamError = class extends Error {
-};
-
-// src/server/proxy/mcp-proxy.ts
-function isOpenEndedSseResponse(contentType, contentLength) {
-  return contentType.includes("text/event-stream") && !contentLength;
-}
-function mountMcpProxy(app2, options = {}) {
-  const basePath = options.path || "/mcp/proxy";
-  const enableLogging = options.enableLogging !== false;
-  app2.use(
-    `${basePath}/*`,
-    cors({
-      origin: "*",
-      allowHeaders: [
-        "Authorization",
-        "Content-Type",
-        "Accept",
-        "X-Target-URL",
-        "X-MCP-Target",
-        "Mcp-Session-Id",
-        "mcp-session-id",
-        "mcp-protocol-version",
-        "X-Server-Id",
-        "X-Requested-With"
-      ],
-      exposeHeaders: ["*"]
-    })
-  );
-  if (enableLogging) {
-    app2.use(`${basePath}/*`, logger());
-  }
-  app2.all(`${basePath}/*`, async (c) => {
-    try {
-      if (options.authenticate) {
-        const isAuthenticated2 = await options.authenticate(c);
-        if (!isAuthenticated2) {
-          return c.json({ error: "Unauthorized" }, 401);
-        }
-      }
-      const targetUrl = c.req.header("X-Target-URL");
-      if (!targetUrl) {
-        return c.json(
-          {
-            error: "X-Target-URL header is required",
-            usage: "Set X-Target-URL header to the MCP server URL you want to proxy to"
-          },
-          400
-        );
-      }
-      if (!await isSafeProxyTarget(targetUrl, options.allowLoopback ?? false)) {
-        return c.json(
-          {
-            error: "Invalid target URL",
-            details: "Target is not allowed by the proxy network policy"
-          },
-          403
-        );
-      }
-      if (options.validateRequest) {
-        const isValid = await options.validateRequest(targetUrl, c);
-        if (!isValid) {
-          return c.json(
-            {
-              error: "Invalid target URL",
-              details: "The requested target URL is not allowed"
-            },
-            403
-          );
-        }
-      }
-      try {
-        new URL(targetUrl);
-      } catch {
-        return c.json(
-          {
-            error: "Invalid target URL format",
-            details: "The X-Target-URL must be a valid HTTP/HTTPS URL"
-          },
-          400
-        );
-      }
-      const method = c.req.method;
-      const headers = {};
-      const requestHeaders = c.req.header();
-      for (const [key, value] of Object.entries(requestHeaders)) {
-        const lowerKey = key.toLowerCase();
-        if (!lowerKey.startsWith("x-proxy-") && !lowerKey.startsWith("x-target-") && !lowerKey.startsWith("x-mcp-") && !lowerKey.startsWith("x-forwarded-") && !lowerKey.startsWith("cf-") && lowerKey !== "x-original-host" && lowerKey !== "host" && lowerKey !== "accept-encoding" && lowerKey !== "cdn-loop") {
-          headers[key] = value;
-        }
-      }
-      headers["Accept-Encoding"] = "identity";
-      try {
-        const targetUrlObj = new URL(targetUrl);
-        headers.Host = targetUrlObj.host;
-      } catch {
-        return c.json({ error: "Invalid target URL" }, 400);
-      }
-      const body = method !== "GET" && method !== "HEAD" ? new Uint8Array(await c.req.arrayBuffer()).slice() : void 0;
-      const response = await fetch(targetUrl, {
-        method,
-        headers,
-        body,
-        redirect: "manual"
-      });
-      if (response.status >= 300 && response.status < 400) {
-        const location = response.headers.get("location");
-        if (location) {
-          const redirectUrl = new URL(location, targetUrl).toString();
-          if (!await isSafeProxyTarget(
-            redirectUrl,
-            options.allowLoopback ?? false
-          ) || options.validateRequest && !await options.validateRequest(redirectUrl, c)) {
-            return c.json({ error: "Redirect target is not allowed" }, 403);
-          }
-          const redirectResponse = await fetch(redirectUrl, {
-            method,
-            headers,
-            body,
-            redirect: "manual"
-          });
-          const redirectHeaders = {};
-          redirectResponse.headers.forEach((value, key) => {
-            const lowerKey = key.toLowerCase();
-            if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-              redirectHeaders[key] = value;
-            }
-          });
-          return new Response(redirectResponse.body, {
-            status: redirectResponse.status,
-            statusText: redirectResponse.statusText,
-            headers: redirectHeaders
-          });
-        }
-      }
-      const responseHeaders = {};
-      response.headers.forEach((value, key) => {
-        const lowerKey = key.toLowerCase();
-        if (lowerKey !== "content-encoding" && lowerKey !== "transfer-encoding" && lowerKey !== "content-length") {
-          responseHeaders[key] = value;
-        }
-      });
-      const contentType = response.headers.get("content-type") || "";
-      const upstreamContentLength = response.headers.get("content-length");
-      const isTrueStream = isOpenEndedSseResponse(
-        contentType,
-        upstreamContentLength
-      );
-      if (isTrueStream) {
-        return new Response(response.body, {
-          status: response.status,
-          statusText: response.statusText,
-          headers: responseHeaders
-        });
-      }
-      const bodyBuffer = await response.arrayBuffer();
-      responseHeaders["Content-Length"] = String(bodyBuffer.byteLength);
-      return new Response(bodyBuffer, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: responseHeaders
-      });
-    } catch (error) {
-      const message = error instanceof Error ? error.message : "Unknown error";
-      const targetUrl = c.req.header("X-Target-URL");
-      const isConnectionRefused = error instanceof Error && (error.message.includes("ECONNREFUSED") || error.message.includes("fetch failed"));
-      if (isConnectionRefused) {
-        console.warn(
-          `[MCP Proxy] Connection refused to ${targetUrl || "unknown target"} - server may not be running`
-        );
-      } else {
-        console.error(
-          "[MCP Proxy] Request failed:",
-          message,
-          "\nTarget URL:",
-          targetUrl || "unknown",
-          "\nError:",
-          error
-        );
-      }
-      return c.json(
-        {
-          error: "Proxy request failed",
-          details: message,
-          targetUrl: targetUrl || "unknown"
-        },
-        500
-      );
-    }
-  });
-}
-
-// src/server/proxy-routes.ts
-function registerInspectorProxyRoutes(app2, config, basePath = "") {
-  const p = (suffix) => `${basePath}${suffix}`;
-  const allowLoopback = config?.oauthProxyAllowLoopback ?? false;
-  const mountOAuth = config?.oauth !== false;
-  app2.get(p("/inspector/health"), (c) => {
-    return c.json({
-      status: "ok",
-      protocol: "mcp-use-inspector-preview",
-      version: 1,
-      capabilities: ["view-preview"]
-    });
-  });
-  mountMcpProxy(app2, {
-    path: p("/inspector/api/proxy"),
-    allowLoopback
-  });
-  if (mountOAuth) {
-    mountOAuthProxy(app2, {
-      basePath: p("/inspector/api/oauth"),
-      enableLogging: true,
-      allowedOrigins: config?.oauthProxyAllowedOrigins ?? [],
-      allowLoopback
-    });
-  }
-  if (config?.autoConnectUrl !== void 0) {
-    const autoConnectUrl = config.autoConnectUrl;
-    app2.get(p("/inspector/config.json"), (c) => {
-      return c.json({ autoConnectUrl: autoConnectUrl ?? null });
-    });
-  }
-}
-
-// src/server/utils.ts
-function isValidUrl(urlString) {
-  try {
-    const url = new URL(urlString);
-    return url.protocol === "http:" || url.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
-async function findAvailablePort(startPort2 = 8080, maxAttempts = 100) {
-  const net = await import("net");
-  for (let port = startPort2; port < startPort2 + maxAttempts; port++) {
-    try {
-      await new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-          server.close(() => resolve());
-        });
-        server.on("error", (err) => reject(err));
-      });
-      return port;
-    } catch {
-      continue;
-    }
-  }
-  throw new Error(
-    `No available port found after trying ${maxAttempts} ports starting from ${startPort2}`
-  );
-}
-
-// src/server/cli.ts
-var args = process.argv.slice(2);
-var mcpUrl;
-var startPort = 8080;
-var noOpen = false;
-for (let i = 0; i < args.length; i++) {
-  if (args[i] === "--url") {
-    if (i + 1 >= args.length || args[i + 1].startsWith("-")) {
-      console.error("Error: --url requires a value");
-      process.exit(1);
-    }
-    const url = args[i + 1];
-    if (!isValidUrl(url)) {
-      console.error(`Error: Invalid URL format: ${url}`);
-      console.error("URL must start with http://, https://, ws://, or wss://");
-      process.exit(1);
-    }
-    mcpUrl = url;
-    i++;
-  } else if (args[i] === "--port") {
-    if (i + 1 >= args.length || args[i + 1].startsWith("-")) {
-      console.error("Error: --port requires a value");
-      process.exit(1);
-    }
-    const parsedPort = Number.parseInt(args[i + 1], 10);
-    if (Number.isNaN(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
-      console.error(
-        `Error: Port must be a number between 1 and 65535, got: ${args[i + 1]}`
-      );
-      process.exit(1);
-    }
-    startPort = parsedPort;
-    i++;
-  } else if (args[i] === "--no-open") {
-    noOpen = true;
-  } else if (args[i] === "--version" || args[i] === "-v") {
-    console.log(getInspectorVersion());
-    process.exit(0);
-  } else if (args[i] === "--help" || args[i] === "-h") {
-    console.log(`
+</html>`}function $r(e,t,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(Br),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...t,basePath:t?.basePath??r,proxyUrl:t?.proxyUrl!==void 0?t.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:t?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let d=new URL(u.req.url),f={...a,sandboxOrigin:a.sandboxOrigin??es(d)??null};return u.html(rs(f,r,s))};Nr(e,n),e.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(ts)),e.get(i("/inspector/sandbox"),u=>u.html(Hr(new URL(u.req.url).search))),e.get(i("/inspector"),c),e.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");e.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),e.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&t?.rootRedirect!==!1&&e.get("/",u=>{let d=new URL(u.req.url);return u.redirect(`${i("/inspector")}${d.search}`)})}function ns(){let{process:e,Deno:t}=globalThis;return!(typeof t?.noColor=="boolean"?t.noColor:e!==void 0?"NO_COLOR"in e?.env:!1)}async function Fr(){let{navigator:e}=globalThis,t="cloudflare:workers";return!(e!==void 0&&e.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(t)).env??{})}catch{return!1}})():!ns())}var os=e=>{let[t,r]=[",","."];return e.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+t)).join(r)},ss=e=>{let t=Date.now()-e;return os([t<1e3?t+"ms":Math.round(t/1e3)+"s"])},is=async e=>{if(await Fr())switch(e/100|0){case 5:return`\x1B[31m${e}\x1B[0m`;case 4:return`\x1B[33m${e}\x1B[0m`;case 3:return`\x1B[36m${e}\x1B[0m`;case 2:return`\x1B[32m${e}\x1B[0m`}return`${e}`};async function qr(e,t,r,n,o=0,s){let i=t==="<--"?`${t} ${r} ${n}`:`${t} ${r} ${n} ${await is(o)} ${s}`;e(i)}var zr=(e=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await qr(e,"<--",o,i);let a=Date.now();await n(),await qr(e,"-->",o,i,r.res.status,ss(a))};import{lookup as as}from"dns/promises";import{Buffer as cs}from"buffer";import{isIP as ls}from"net";var us=new Set(["accept","authorization","content-type","dpop"]),ds=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),ps=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],Jr=600*1e3,fs=100,hs=1440*60*1e3,ms=500;function xt(e,t={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,authenticate:u,validateServerUrl:d,rateLimiter:f=new D.default({points:120,duration:60})}=t,h=new Set(n.map(vt)),w=new Map,y=new Map,g=async(p,m)=>{try{await f.consume(p.req)}catch(v){return te(p,v)}return m()};e.use(`${r}/*`,async(p,m)=>{let v=p.req.header("Origin");if(v&&!Rs(v,p,h))return p.json({error:"Origin not allowed"},403);if(p.req.method==="OPTIONS")return Ps(v);await m(),v&&on(p.res.headers,v)}),e.use(`${r}/*`,g),e.get(`${r}/metadata`,async p=>{if(!await Yr(p,u))return p.json({error:"Unauthorized"},401);let m=await V(p.req.query("serverUrl"),o);if("error"in m)return p.json({error:m.error},400);let v=m.url;if(d&&!await d(v.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let T=await V(p.req.query("url"),o);if("error"in T)return p.json({error:T.error},400);let L=T.url,E=I(v),R=Gr(w,E),A=Wr(v,L,R);if(!A&&R.authorizationServers.size===0)try{await Kr(v,R,o,s,a),w.set(E,R),A=Wr(v,L,R)}catch{}if(!A)return p.json({error:"Metadata target is not bound to this MCP server"},403);try{wt(l,`GET ${L}`);let S=await Le(L,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(Ie(S.status))return p.json({error:"OAuth metadata redirects are not allowed"},502);let b=await Me(S,a);if(!S.ok)return p.body(b,S.status,{"Content-Type":S.headers.get("content-type")??"application/json"});let P=bt(b);return A.type==="protected-resource"?await en(P,v,R,o):await tn(P,A.issuer,R,o),R.updatedAt=Date.now(),w.set(E,R),Xr(w),p.body(b,200,{"Content-Type":S.headers.get("content-type")??"application/json"})}catch(S){return yt(p,S,l)}}),e.post(`${r}/proxy`,async p=>{if(!await Yr(p,u))return p.json({error:"Unauthorized"},401);let m;try{m=JSON.parse(await Ss(p.req.raw,i))}catch(b){return p.json({error:b instanceof j?"Request body too large":"Invalid JSON request body"},b instanceof j?413:400)}let v=await V(m.serverUrl,o);if("error"in v)return p.json({error:v.error},400);let T=v.url;if(d&&!await d(T.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let L=await V(m.url,o);if("error"in L)return p.json({error:L.error},400);let E=L.url;if(m.method!==void 0&&m.method!=="POST")return p.json({error:"Only OAuth endpoint POST is allowed"},405);let R=I(T),A=Gr(w,R);if(A.endpoints.size===0)try{await Kr(T,A,o,s,a),w.set(R,A),Xr(w)}catch(b){return yt(p,b,l)}let S=A.endpoints.get(I(E));if(!S)return p.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let b=gs(m.headers),P=ys(m.body,b);if(S==="registration"){let fn=vt(p.req.header("Origin")??new URL(p.req.url).origin);P=Es(P,b,new URL(c,fn).toString())}else P=vs({body:P,headers:b,bindingKey:R,clients:y});if(new TextEncoder().encode(P??"").byteLength>i)return p.json({error:"OAuth request body too large"},413);wt(l,`POST ${S} ${E}`);let M=await Le(E,{method:"POST",headers:b,body:P,redirect:"manual",signal:AbortSignal.timeout(s)});if(Ie(M.status))return p.json({error:"OAuth endpoint redirects are not allowed"},502);let H=await Me(M,a),B=ws(M.headers),pn=M.headers.get("content-type")??"",$=H;if(pn.includes("json"))try{$=JSON.parse(H)}catch{}return S==="registration"&&M.ok&&$&&typeof $=="object"&&!Array.isArray($)&&($=bs({responseBody:$,binding:A,bindingKey:R,clients:y})),p.json({status:M.status,statusText:M.statusText,headers:B,body:$})}catch(b){return yt(p,b,l)}}),wt(l,`Mounted at ${r}/metadata and ${r}/proxy`)}async function V(e,t){if(typeof e!="string"||!e)return{error:"Missing or invalid URL"};let r;try{r=new URL(e)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=As(r.hostname);if(r.protocol!=="https:"&&!(t&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return t?{url:r}:{error:"Loopback URL not allowed"};if(_s(r.hostname))return{error:"Local network URL not allowed"};try{let o=ls(r.hostname)?[r.hostname]:(await as(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!sn(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function St(e,t=!1){return!("error"in await V(e,t))}function Wr(e,t,r){let n=I(t);if(Qr(e).some(o=>I(o)===n))return{type:"protected-resource"};for(let o of r.authorizationServers)if(Zr(new URL(o)).some(s=>I(s)===n))return{type:"authorization-server",issuer:o}}function Qr(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-protected-resource${t}`,e.origin),new URL("/.well-known/oauth-protected-resource",e.origin)]}function Zr(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-authorization-server${t}`,e.origin),new URL(`/.well-known/openid-configuration${t}`,e.origin),new URL(`${t||""}/.well-known/openid-configuration`,e.origin)]}async function en(e,t,r,n){if(typeof e.resource!="string"||I(new URL(e.resource))!==I(t))throw new _("Protected-resource metadata does not match serverUrl");if(!Array.isArray(e.authorization_servers)||e.authorization_servers.length===0)throw new _("Protected-resource metadata has no authorization servers");let o=new Set;for(let s of e.authorization_servers){let i=await V(s,n);if("error"in i)throw new _(`Unsafe authorization server: ${i.error}`);o.add(I(i.url))}r.authorizationServers=o,r.endpoints.clear(),r.tokenEndpointAuthMethods.clear()}async function tn(e,t,r,n){if(typeof e.issuer!="string"||I(new URL(e.issuer))!==t)throw new _("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(e.token_endpoint_auth_methods_supported)?e.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of ps){let i=e[o];if(i===void 0)continue;let a=await V(i,n);if("error"in a)throw new _(`Unsafe ${o}: ${a.error}`);r.endpoints.set(I(a.url),s)}}async function Kr(e,t,r,n,o){for(let s of Qr(e)){let i=await Le(s,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(Ie(i.status))throw new _("OAuth metadata redirects are not allowed");if(i.ok){await en(bt(await Me(i,o)),e,t,r);break}}if(t.authorizationServers.size===0)throw new _("Protected-resource metadata could not be discovered");for(let s of t.authorizationServers){let i=!1;for(let a of Zr(new URL(s))){let c=await Le(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(Ie(c.status))throw new _("OAuth metadata redirects are not allowed");if(c.ok){await tn(bt(await Me(c,o)),s,t,r),i=!0;break}}if(i)break}if(t.endpoints.size===0)throw new _("Authorization-server metadata could not be discovered");t.updatedAt=Date.now()}async function Le(e,t){return fetch(e,t)}function gs(e){let t=new Headers;if(!e||typeof e!="object"||Array.isArray(e))return t;for(let[r,n]of Object.entries(e)){let o=r.toLowerCase();us.has(o)&&typeof n=="string"&&t.set(o,n)}return t}function ws(e){let t={};return e.forEach((r,n)=>{ds.has(n.toLowerCase())&&(t[n]=r)}),t}function ys(e,t){if(e==null)return;if(typeof e=="string"){if(!t.has("content-type"))try{JSON.parse(e),t.set("content-type","application/json")}catch{t.set("content-type","application/x-www-form-urlencoded")}return e}if((t.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof e=="object"&&!Array.isArray(e)){let n=new URLSearchParams;for(let[o,s]of Object.entries(e))n.append(o,String(s));return n.toString()}return t.has("content-type")||t.set("content-type","application/json"),JSON.stringify(e)}function rn(e,t){return`${e}\0${t}`}function bs(e){let{responseBody:t,binding:r,bindingKey:n,clients:o}=e,s=t.client_id,i=t.client_secret;if(typeof s!="string"||typeof i!="string")return t;let a=t.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=t.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+hs;for(xs(o),o.set(rn(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>ms;){let f=o.keys().next().value;if(!f)break;o.delete(f)}let d={...t};return delete d.client_secret,delete d.client_secret_expires_at,d.token_endpoint_auth_method="none",d}function vs(e){let{body:t,headers:r,bindingKey:n,clients:o}=e;if(!t||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return t;let s=new URLSearchParams(t),i=s.get("client_id");if(!i)return t;let a=rn(n,i),c=o.get(a);if(!c)return t;if(c.expiresAt<=Date.now())return o.delete(a),t;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=cs.from(`${Vr(i)}:${Vr(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function Vr(e){return new URLSearchParams({value:e}).toString().slice(6)}function xs(e){let t=Date.now();for(let[r,n]of e)n.expiresAt<=t&&e.delete(r)}async function Ss(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new j;return nn(e.body,t)}async function Me(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw await e.body?.cancel(),new j;return nn(e.body,t)}async function nn(e,t){if(!e)return"";let r=e.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>t)throw await r.cancel(),new j;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function bt(e){let t;try{t=JSON.parse(e)}catch{throw new _("OAuth metadata is not valid JSON")}if(!t||typeof t!="object"||Array.isArray(t))throw new _("OAuth metadata is not an object");return t}function Gr(e,t){let r=e.get(t);return r&&Date.now()-r.updatedAt<=Jr?r:(e.delete(t),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Xr(e){let t=Date.now();for(let[r,n]of e)t-n.updatedAt>Jr&&e.delete(r);for(;e.size>fs;){let r=e.keys().next().value;if(!r)break;e.delete(r)}}function I(e){let t=new URL(e);return t.hash="",(t.protocol==="https:"&&t.port==="443"||t.protocol==="http:"&&t.port==="80")&&(t.port=""),t.toString().replace(/\/$/,"")}function Es(e,t,r){if(!e||!(t.get("content-type")??"").includes("json"))return e;try{let o=JSON.parse(e);return!o||typeof o!="object"||Array.isArray(o)?e:JSON.stringify({...o,redirect_uris:[r]})}catch{return e}}function vt(e){let t=new URL(e);if(t.pathname!=="/"||t.search||t.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${e}`);return t.origin}function Rs(e,t,r){try{let n=vt(e);if(n===new URL(t.req.url).origin||r.has(n))return!0;let o=new URL(n),i=t.req.header("x-forwarded-host")?.split(",")[0]?.trim()||t.req.header("host");if(!i||o.host!==i)return!1;let a=t.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function Ps(e){let t=new Headers;return e&&on(t,e),t.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),t.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:t})}function on(e,t){e.set("Access-Control-Allow-Origin",t),e.append("Vary","Origin")}async function Yr(e,t){return t?t(e):!0}function Ie(e){return e>=300&&e<400}function As(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t.endsWith(".localhost")||t==="::1"||t.startsWith("127.")}function _s(e){let t=e.toLowerCase();return t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa")}function sn(e){if(e.includes(":")){let s=e.toLowerCase();return s.startsWith("::ffff:")?sn(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let t=e.split(".").map(Number);if(t.length!==4||t.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=t;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function wt(e,t){e&&console.log(`[OAuth BFF] ${t}`)}function yt(e,t,r){let n=t instanceof Error?t.message:"Unknown error";return r&&console.error("[OAuth BFF]",n),t instanceof j?e.json({error:"Upstream response too large"},502):t instanceof _?e.json({error:t.message},502):t instanceof DOMException&&t.name==="TimeoutError"?e.json({error:"OAuth upstream timed out"},504):e.json({error:"OAuth upstream request failed"},502)}var j=class extends Error{},_=class extends Error{};var Cs=3;function Os(e,t){return e.includes("text/event-stream")&&!t}function Et(e,t={}){let r=t.path||"/mcp/proxy",n=t.enableLogging!==!1,o=t.rateLimiter??new D.default({points:120,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return te(i,c)}return a()};e.use(`${r}/*`,Pe({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&e.use(`${r}/*`,zr()),e.use(`${r}/*`,s),e.all(`${r}/*`,async i=>{try{if(t.authenticate&&!await t.authenticate(i))return i.json({error:"Unauthorized"},401);let a=i.req.header("X-Target-URL");if(!a)return i.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await St(a,t.allowLoopback??!1))return i.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(t.validateRequest&&!await t.validateRequest(a,i))return i.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(a)}catch{return i.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let c=i.req.method,l={},u=i.req.header();for(let[y,g]of Object.entries(u)){let p=y.toLowerCase();!p.startsWith("x-proxy-")&&!p.startsWith("x-target-")&&!p.startsWith("x-mcp-")&&!p.startsWith("x-forwarded-")&&!p.startsWith("cf-")&&p!=="x-original-host"&&p!=="host"&&p!=="origin"&&p!=="referer"&&p!=="cookie"&&p!=="proxy-authorization"&&p!=="accept-encoding"&&p!=="cdn-loop"&&!p.startsWith("sec-fetch-")&&(l[y]=g)}l["Accept-Encoding"]="identity";let d=c!=="GET"&&c!=="HEAD"?new Uint8Array(await i.req.arrayBuffer()).slice():void 0,f=a,h=c,w=d;for(let y=0;;y+=1){let g=await fetch(f,{method:h,headers:l,body:w,redirect:"manual"}),p=g.headers.get("location");if(!(g.status>=300&&g.status<400&&p))return Ts(g);if(y>=Cs)return i.json({error:"Too many upstream redirects"},502);let m=new URL(p,f);if(!await St(m.toString(),t.allowLoopback??!1)||t.validateRequest&&!await t.validateRequest(m.toString(),i))return i.json({error:"Redirect target is not allowed"},403);m.origin!==new URL(f).origin&&(ke(l,"authorization"),ke(l,"proxy-authorization")),(g.status===303||(g.status===301||g.status===302)&&h==="POST")&&(h="GET",w=void 0,ke(l,"content-type"),ke(l,"content-length")),f=m.toString()}}catch(a){let c=a instanceof Error?a.message:"Unknown error",l=i.req.header("X-Target-URL");return a instanceof Error&&(a.message.includes("ECONNREFUSED")||a.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${l||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",c,`
+Target URL:`,l||"unknown",`
+Error:`,a),i.json({error:"Proxy request failed",details:c,targetUrl:l||"unknown"},500)}})}function ke(e,t){for(let r of Object.keys(e))r.toLowerCase()===t&&delete e[r]}async function Ts(e){let t={};if(e.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(t[s]=o)}),Os(e.headers.get("content-type")||"",e.headers.get("content-length")))return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t});if([204,205,304].includes(e.status))return new Response(null,{status:e.status,statusText:e.statusText,headers:t});let n=await e.arrayBuffer();return t["Content-Length"]=String(n.byteLength),new Response(n,{status:e.status,statusText:e.statusText,headers:t})}function an(e,t,r=""){let n=a=>`${r}${a}`,o=t?.oauthProxyAllowLoopback??!1,s=t?.oauth!==!1,i=new D.default({points:120,duration:60});if(e.get(n("/inspector/health"),a=>a.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),Et(e,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:i}),s&&xt(e,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,allowedOrigins:t?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:i}),t?.autoConnectUrl!==void 0){let a=t.autoConnectUrl;e.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:a??null}))}}function cn(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}}async function ln(e=8080,t=100){let r=await import("net");for(let n=e;n<e+t;n++)try{return await new Promise((o,s)=>{let i=r.createServer();i.listen(n,()=>{i.close(()=>o())}),i.on("error",a=>s(a))}),n}catch{continue}throw new Error(`No available port found after trying ${t} ports starting from ${e}`)}function Rt(e){if(!(e instanceof Error))return`UnknownError (${typeof e})`;let t=/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(e.name)?e.name:"Error",r=e.code,n=typeof r=="string"&&/^[A-Z][A-Z0-9_]{0,31}$/.test(r)?r:void 0;return n?`${t} (${n})`:t}var C=process.argv.slice(2),de,un=8080,dn=!1;for(let e=0;e<C.length;e++)if(C[e]==="--url"){(e+1>=C.length||C[e+1].startsWith("-"))&&(console.error("Error: --url requires a value"),process.exit(1));let t=C[e+1];cn(t)||(console.error("Error: Invalid URL format."),console.error("URL must start with http://, https://, ws://, or wss://"),process.exit(1)),de=t,e++}else if(C[e]==="--port"){(e+1>=C.length||C[e+1].startsWith("-"))&&(console.error("Error: --port requires a value"),process.exit(1));let t=Number.parseInt(C[e+1],10);(Number.isNaN(t)||t<1||t>65535)&&(console.error("Error: Port must be a number between 1 and 65535."),process.exit(1)),un=t,e++}else C[e]==="--no-open"?dn=!0:C[e]==="--version"||C[e]==="-v"?(console.log(Te()),process.exit(0)):C[e]==="--help"||C[e]==="-h"?(console.log(`
 MCP Inspector - Inspect and debug MCP servers
 
 Usage:
@@ -1384,60 +388,4 @@ Examples:
   npx @mcp-use/inspector --url http://localhost:3000/mcp
   npx @mcp-use/inspector --url http://localhost:3000/mcp --port 9000
   npx @mcp-use/inspector
-`);
-    process.exit(0);
-  } else {
-    console.error(`Error: Unknown option: ${args[i]}`);
-    console.error("Run with --help to see available options.");
-    process.exit(1);
-  }
-}
-var app = new Hono();
-app.use(
-  "*",
-  cors2({
-    origin: "*",
-    exposeHeaders: ["*"]
-  })
-);
-app.use("/inspector/api/proxy/*", logger2());
-var inspectorMode = process.env.MCP_INSPECTOR_MODE ?? (process.env.RAILWAY_ENVIRONMENT_NAME ? "cloud" : "standalone");
-registerInspectorProxyRoutes(app, {
-  autoConnectUrl: mcpUrl,
-  oauthProxyAllowedOrigins: [],
-  oauthProxyAllowLoopback: inspectorMode === "standalone"
-});
-registerInspectorCdnShell(app, {
-  inspectorMode,
-  manufactChatUrl: process.env.MANUFACT_CHAT_URL
-});
-async function startServer() {
-  try {
-    const port = await findAvailablePort(startPort);
-    serve({
-      fetch: app.fetch,
-      port
-    });
-    console.log(`\u{1F680} MCP Inspector running on http://localhost:${port}`);
-    if (mcpUrl) {
-      console.log(`\u{1F4E1} Auto-connecting to: ${mcpUrl}`);
-    }
-    if (!noOpen) {
-      const openUrl = new URL(`http://localhost:${port}/inspector`);
-      if (mcpUrl) {
-        openUrl.searchParams.set("autoConnect", mcpUrl);
-      }
-      try {
-        await open(openUrl.toString());
-        console.log(`\u{1F310} Browser opened`);
-      } catch {
-        console.log(`\u{1F310} Please open ${openUrl} in your browser`);
-      }
-    }
-    return { port, fetch: app.fetch };
-  } catch (error) {
-    console.error("Failed to start server:", error);
-    process.exit(1);
-  }
-}
-startServer();
+`),process.exit(0)):(console.error("Error: Unknown option."),console.error("Run with --help to see available options."),process.exit(1));var pe=new Ze;pe.use("*",Pe({origin:"*",exposeHeaders:["*"]}));an(pe,{autoConnectUrl:de,oauthProxyAllowedOrigins:[],oauthProxyAllowLoopback:!0});$r(pe,{inspectorMode:"standalone",manufactChatUrl:process.env.MANUFACT_CHAT_URL});async function Ls(){try{let e=await ln(un);if(Ut({fetch:pe.fetch,port:e}),console.log(`MCP Inspector started at http://localhost:${e}/inspector`),de&&console.log("Auto-connect configured."),!dn){let t=new URL(`http://localhost:${e}/inspector`);de&&t.searchParams.set("autoConnect",de);try{await Er(t.toString()),console.log("Browser opened.")}catch(r){console.log(`Browser could not be opened automatically. Open ${t.toString()} manually.`),console.error(`Browser open error: ${Rt(r)}`)}}return{port:e,fetch:pe.fetch}}catch(e){console.error(`Failed to start server (StartupError): ${Rt(e)}`),process.exit(1)}}Ls();