@mcp-use/inspector 20.3.13 → 20.3.14-canary.0

package/dist/cli.js

@@ -5,7 +5,7 @@ ${n.join(`\r
 \r
 `)},Wo=e=>{let t=e.socket.encrypted?"https":"http",r=new URL(e.url??"/",`${t}://${e.headers.host??"localhost"}`),n=new Headers;for(let o in e.headers){let s=e.headers[o];s&&n.append(o,Array.isArray(s)?s[0]:s)}return new Request(r,{headers:n})},zo=e=>{let{server:t,fetchCallback:r,wss:n}=e,o=new Map;n.on("connection",(a,c)=>{let l=o.get(c);l&&(l.resolve(a),o.delete(c))});let s=a=>{let c=o.get(a);c&&(o.delete(a),c.reject(new Error("WebSocket handshake aborted")))},i=(a,c)=>new Promise((l,u)=>{o.set(a,{resolve:l,reject:u,connectionSymbol:c})});t.on("upgrade",async(a,c,l)=>{if(a.headers.upgrade?.toLowerCase()!=="websocket")return;let u={incoming:a,outgoing:void 0,wss:n,[fr]:i},d=400,f;try{let b=await r(Wo(a),u);b instanceof Response&&(d=b.status,f=b.headers)}catch{t.listenerCount("upgrade")===1&&Zt(c,500);return}let h=o.get(a);if(!h||h.connectionSymbol!==u[dr]){s(a),t.listenerCount("upgrade")===1&&Zt(c,d,f);return}let y=b=>{pr(b,f)},m=()=>s(a);c.once("close",m),n.on("headers",y);try{n.handleUpgrade(a,c,l,b=>{c.off("close",m),n.emit("connection",b,a)})}finally{n.off("headers",y)}}),t.on("close",()=>{n.close()})},Fi=qt(async(e,t,r)=>{if(e.req.header("upgrade")?.toLowerCase()!=="websocket")return;let n=e.env,o=n[fr];if(!o||!n.incoming)return new Response(null,{status:500});let s=$o();return n[dr]=s,(async()=>{let i;try{i=await o(n.incoming,s)}catch{return}let a=[],c=(d,f)=>{a.push([d,f])};i.on("message",c);let l={binaryType:"arraybuffer",close(d,f){i.close(d,f)},protocol:i.protocol,raw:i,get readyState(){return i.readyState},send(d,f){i.send(d,{compress:f?.compress})},url:new URL(e.req.url)};try{t?.onOpen?.(new Event("open"),l)}catch(d){(r?.onError??console.error)(d)}let u=(d,f)=>{let h=Array.isArray(d)?d:[d];for(let y of h)try{t?.onMessage?.(new MessageEvent("message",{data:f?y instanceof ArrayBuffer?y:y.buffer.slice(y.byteOffset,y.byteOffset+y.byteLength):typeof y=="string"?y:Buffer.from(y).toString("utf-8")}),l)}catch(m){(r?.onError??console.error)(m)}};i.off("message",c);for(let d of a)u(...d);i.on("message",(d,f)=>{u(d,f)}),i.on("close",(d,f)=>{try{t?.onClose?.(new Ho("close",{code:d,reason:f.toString()}),l)}catch(h){(r?.onError??console.error)(h)}}),i.on("error",d=>{try{t?.onError?.(new jo("error",{error:d}),l)}catch(f){(r?.onError??console.error)(f)}})})(),new Response}),qo=e=>{let t=e.fetch,r=Bo(t,{hostname:e.hostname,overrideGlobalObjects:e.overrideGlobalObjects,autoCleanupIncoming:e.autoCleanupIncoming}),n=(e.createServer||io)(e.serverOptions||{},r);if(e.websocket&&e.websocket.server){if(e.websocket.server.options.noServer!==!0)throw new Error("WebSocket server must be created with { noServer: true } option");zo({server:n,fetchCallback:t,wss:e.websocket.server})}return n},hr=(e,t)=>{let r=qo(e);return r.listen(e?.port??3e3,e.hostname,()=>{let n=r.address();t&&t(n)}),r};var rt=(e,t,r)=>(n,o)=>{let s=-1;return i(0);async function i(a){if(a<=s)throw new Error("next() called multiple times");s=a;let c,l=!1,u;if(e[a]?(u=e[a][0][0],n.req.routeIndex=a):u=a===e.length&&o||void 0,u)try{c=await u(n,()=>i(a+1))}catch(d){if(d instanceof Error&&t)n.error=d,c=await t(d,n),l=!0;else throw d}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var mr=Symbol();var gr=(e,t)=>new Response(e,{headers:{"Content-Type":t.replace(/^[^;]+/,n=>n.toLowerCase())}}).formData();var yr=32,Ko=1e4,_e=e=>"headers"in e,vr=async(e,t=Object.create(null))=>{let{all:r=!1,dot:n=!1}=t,i=(_e(e)?e.headers:e.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return i==="multipart/form-data"||i==="application/x-www-form-urlencoded"?Vo(e,{all:r,dot:n}):{}};async function Vo(e,t){if(!_e(e)&&e.bodyCache.formData)return wr(await e.bodyCache.formData,t);let r=_e(e)?e.headers:e.raw.headers,n=await e.arrayBuffer(),o=gr(n,r.get("Content-Type")||"");_e(e)||(e.bodyCache.formData=o);let s=await o;return s?wr(s,t):{}}function wr(e,t){let r=Object.create(null),n={count:0};return e.forEach((o,s)=>{t.all||s.endsWith("[]")?Go(r,s,o):r[s]=o}),t.dot&&Object.entries(r).forEach(([o,s])=>{o.includes(".")&&(Yo(r,o,s,n),delete r[o])}),r}var Go=(e,t,r)=>{e[t]!==void 0?Array.isArray(e[t])?e[t].push(r):e[t]=[e[t],r]:t.endsWith("[]")?e[t]=[r]:e[t]=r},Yo=(e,t,r,n)=>{if(/(?:^|\.)__proto__\./.test(t))return;let o=e,s=t.split(".",yr+2);s.length>yr+1&&br(),s.forEach((i,a)=>{a===s.length-1?o[i]=r:((!o[i]||typeof o[i]!="object"||Array.isArray(o[i])||o[i]instanceof File)&&(n.count++>=Ko&&br(),o[i]=Object.create(null)),o=o[i])})},br=()=>{throw new Error("Nesting limit exceeded")};var ot=e=>{let t=e.split("/");return t[0]===""&&t.shift(),t},xr=e=>{let{groups:t,path:r}=Xo(e),n=ot(r);return Jo(n,t)},Xo=e=>{let t=[];return e=e.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return t.push([o,r]),o}),{groups:t,path:e}},Jo=(e,t)=>{for(let r=t.length-1;r>=0;r--){let[n]=t[r];for(let o=e.length-1;o>=0;o--)if(e[o].includes(n)){e[o]=e[o].replace(n,t[r][1]);break}}return e},Te={},Er=(e,t)=>{if(e==="*")return"*";let r=e.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${e}#${t}`;return Te[n]||(r[2]?Te[n]=t&&t[0]!==":"&&t[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${t})`)]:[e,r[1],new RegExp(`^${r[2]}$`)]:Te[n]=[e,r[1],!0]),Te[n]}return null},Sr=(e,t)=>{try{return t(e)}catch{return e.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return t(r)}catch{return r}})}},Qo=e=>Sr(e,decodeURI),st=e=>{let t=e.url,r=t.indexOf("/",t.indexOf(":")+4),n=r;for(;n<t.length;n++){let o=t.charCodeAt(n);if(o===37){let s=t.indexOf("?",n),i=t.indexOf("#",n),a=s===-1?i===-1?void 0:i:i===-1?s:Math.min(s,i),c=t.slice(r,a);return Qo(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return t.slice(r,n)};var Rr=e=>{let t=st(e);return t.length>1&&t.at(-1)==="/"?t.slice(0,-1):t},G=(e,t,...r)=>(r.length&&(t=G(t,...r)),`${e?.[0]==="/"?"":"/"}${e}${t==="/"?"":`${e?.at(-1)==="/"?"":"/"}${t?.[0]==="/"?t.slice(1):t}`}`),Oe=e=>{if(e.charCodeAt(e.length-1)!==63||!e.includes(":"))return null;let t=e.split("/"),r=[],n="";return t.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(o.charCodeAt(o.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.slice(0,-1);n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,i)=>i.indexOf(o)===s)},Le=e=>e.indexOf("%")!==-1?Sr(e,Zo):e,nt=e=>(e.indexOf("+")!==-1&&(e=e.replace(/\+/g," ")),Le(e)),Pr=(e,t,r)=>{let n=e.indexOf("#",8);n!==-1&&(e=e.slice(0,n));let o;if(!r&&t&&t.indexOf("%")===-1&&t.indexOf("+")===-1){let a=e.indexOf("?",8);if(a===-1)return;for(e.startsWith(t,a+1)||(a=e.indexOf(`&${t}`,a+1));a!==-1;){let c=e.charCodeAt(a+t.length+1);if(c===61){let l=a+t.length+2,u=e.indexOf("&",l);return nt(e.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";a=e.indexOf(`&${t}`,a+1)}if(o=/[%+]/.test(e),!o)return}let s=Object.create(null);o??=/[%+]/.test(e);let i=e.indexOf("?",8);for(;i!==-1;){let a=e.indexOf("&",i+1),c=e.indexOf("=",i);c>a&&a!==-1&&(c=-1);let l=e.slice(i+1,c===-1?a===-1?void 0:a:c);if(o&&(l=nt(l)),i=a,l==="")continue;let u;c===-1?u="":(u=e.slice(c+1,a===-1?void 0:a),o&&(u=nt(u))),r?(s[l]&&Array.isArray(s[l])||(s[l]=[]),s[l].push(u)):s[l]??=u}return t?s[t]:s},Ar=Pr,Cr=(e,t)=>Pr(e,t,!0),Zo=decodeURIComponent;var _r=class{raw;#e;#t;routeIndex=0;path;bodyCache={};constructor(e,t="/",r=[[]]){this.raw=e,this.path=t,this.#t=r}param(e){return e?this.#r(e):this.#s()}#r(e){let t=this.#t[0][this.routeIndex]?.[1][e],r=this.#n(t);return r&&Le(r)}#s(){let e={},t=Object.keys(this.#t[0][this.routeIndex]?.[1]??{});for(let r of t){let n=this.#n(this.#t[0][this.routeIndex][1][r]);n!==void 0&&(e[r]=Le(n))}return e}#n(e){return this.#t[1]?this.#t[1][e]:e}query(e){return Ar(this.url,e)}queries(e){return Cr(this.url,e)}header(e){if(e)return this.raw.headers.get(e)??void 0;let t=Object.create(null);return this.raw.headers.forEach((r,n)=>{t[n]=r}),t}async parseBody(e){return vr(this,e)}#o=e=>{let{bodyCache:t,raw:r}=this,n=t[e];if(n)return n;for(let o in t)return t[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[e]()));return t[e]=r[e]()};json(){return this.#o("text").then(e=>JSON.parse(e))}text(){return this.#o("text")}arrayBuffer(){return this.#o("arrayBuffer")}bytes(){return this.#o("arrayBuffer").then(e=>new Uint8Array(e))}blob(){return this.#o("blob")}formData(){return this.#o("formData")}addValidatedData(e,t){(this.#e??={})[e]=t}valid(e){return this.#e?.[e]}get url(){return this.raw.url}get method(){return this.raw.method}get[mr](){return this.#t}get matchedRoutes(){return this.#t[0].map(([[,e]])=>e)}get routePath(){return this.#t[0].map(([[,e]])=>e)[this.routeIndex].path}};var Tr={Stringify:1,BeforeStream:2,Stream:3},es=(e,t)=>{let r=new String(e);return r.isEscaped=!0,r.callbacks=t,r};var it=async(e,t,r,n,o)=>{typeof e=="object"&&!(e instanceof String)&&(e instanceof Promise||(e=e.toString()),e instanceof Promise&&(e=await e));let s=e.callbacks;if(!s?.length)return Promise.resolve(e);o?o[0]+=e:o=[e];let i=Promise.all(s.map(a=>a({phase:t,buffer:o,context:n}))).then(a=>Promise.all(a.filter(Boolean).map(c=>it(c,t,!1,n,o))).then(()=>o[0]));return r?es(await i,s):i};var ts="text/plain; charset=UTF-8",at=(e,t)=>({"Content-Type":e,...t}),ye=(e,t)=>new Response(e,t),ct=class{#e;#t;env={};#r;finalized=!1;error;#s;#n;#o;#u;#c;#l;#a;#d;#f;constructor(e,t){this.#e=e,t&&(this.#n=t.executionCtx,this.env=t.env,this.#l=t.notFoundHandler,this.#f=t.path,this.#d=t.matchResult)}get req(){return this.#t??=new _r(this.#e,this.#f,this.#d),this.#t}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#o||=ye(null,{headers:this.#a??=new Headers})}set res(e){if(this.#o&&e){e=ye(e.body,e);for(let[t,r]of this.#o.headers.entries())if(t!=="content-type")if(t==="set-cookie"){let n=this.#o.headers.getSetCookie();e.headers.delete("set-cookie");for(let o of n)e.headers.append("set-cookie",o)}else e.headers.set(t,r)}this.#o=e,this.finalized=!0}render=(...e)=>(this.#c??=t=>this.html(t),this.#c(...e));setLayout=e=>this.#u=e;getLayout=()=>this.#u;setRenderer=e=>{this.#c=e};header=(e,t,r)=>{this.finalized&&(this.#o=ye(this.#o.body,this.#o));let n=this.#o?this.#o.headers:this.#a??=new Headers;t===void 0?n.delete(e):r?.append?n.append(e,t):n.set(e,t)};status=e=>{this.#s=e};set=(e,t)=>{this.#r??=new Map,this.#r.set(e,t)};get=e=>this.#r?this.#r.get(e):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(e,t,r){let n=this.#o?new Headers(this.#o.headers):this.#a;if(typeof t=="object"&&t.headers){n??=new Headers;for(let[s,i]of new Headers(t.headers))s==="set-cookie"?n.append(s,i):n.set(s,i)}if(r){if(!n){let s=0;for(let i in r)if(++s>1||typeof r[i]!="string"){n=new Headers;break}}if(n)for(let s in r){let i=r[s];if(typeof i=="string")n.set(s,i);else{n.delete(s);for(let a of i)n.append(s,a)}}}let o=typeof t=="number"?t:t?.status??this.#s;return ye(e,{status:o,headers:n??r})}newResponse=(...e)=>this.#i(...e);body=(e,t,r)=>this.#i(e,t,r);text=(e,t,r)=>!this.#a&&!this.#s&&!t&&!r&&!this.finalized?new Response(e):this.#i(e,t,at(ts,r));json=(e,t,r)=>this.#i(JSON.stringify(e),t,at("application/json",r));html=(e,t,r)=>{let n=o=>this.#i(o,t,at("text/html; charset=UTF-8",r));return typeof e=="object"?it(e,Tr.Stringify,!1,{}).then(n):n(e)};redirect=(e,t)=>{let r=String(e);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,t??302)};notFound=()=>(this.#l??=()=>ye(),this.#l(this))};var C="ALL",Or="all",Lr=["get","post","put","delete","options","patch","query"],Me="Can not add a route since the matcher is already built.",Ie=class extends Error{};var Mr="__COMPOSED_HANDLER";var rs=e=>e.text("404 Not Found",404),Ir=(e,t)=>{if("getResponse"in e){let r=e.getResponse();return t.newResponse(r.body,r)}return console.error(e),t.text("Internal Server Error",500)},kr=class Dr{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#e="/";routes=[];constructor(t={}){[...Lr,Or].forEach(s=>{this[s]=(i,...a)=>(typeof i=="string"?this.#e=i:this.#s(s,this.#e,i),a.forEach(c=>{this.#s(s,this.#e,c)}),this)}),this.on=(s,i,...a)=>{for(let c of[i].flat()){this.#e=c;for(let l of[s].flat())a.map(u=>{this.#s(l.toUpperCase(),this.#e,u)})}return this},this.use=(s,...i)=>(typeof s=="string"?this.#e=s:(this.#e="*",i.unshift(s)),i.forEach(a=>{this.#s(C,this.#e,a)}),this);let{strict:n,...o}=t;Object.assign(this,o),this.getPath=n??!0?t.getPath??st:Rr}#t(){let t=new Dr({router:this.router,getPath:this.getPath});return t.errorHandler=this.errorHandler,t.#r=this.#r,t.routes=this.routes,t}#r=rs;errorHandler=Ir;route(t,r){let n=this.basePath(t);return r.routes.map(o=>{let s;r.errorHandler===Ir?s=o.handler:(s=async(i,a)=>(await rt([],r.errorHandler)(i,()=>o.handler(i,a))).res,s[Mr]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(t){let r=this.#t();return r._basePath=G(this._basePath,t),r}onError=t=>(this.errorHandler=t,this);notFound=t=>(this.#r=t,this);mount(t,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let i=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=G(this._basePath,t),l=c==="/"?0:c.length;return u=>{let d=new URL(u.url);return d.pathname=this.getPath(u).slice(l)||"/",new Request(d,u)}})();let a=async(c,l)=>{let u=await r(o(c.req.raw),...i(c));if(u)return u;await l()};return this.#s(C,G(t,"*"),a),this}#s(t,r,n,o){t=t.toUpperCase(),r=G(this._basePath,r);let s={basePath:o!==void 0?G(this._basePath,o):this._basePath,path:r,method:t,handler:n};this.router.add(t,r,[n,s]),this.routes.push(s)}#n(t,r){if(t instanceof Error)return this.errorHandler(t,r);throw t}#o(t,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#o(t,r,n,"GET")))();let s=this.getPath(t,{env:n}),i=this.router.match(o,s),a=new ct(t,{path:s,matchResult:i,env:n,executionCtx:r,notFoundHandler:this.#r});if(i[0].length===1){let l;try{l=i[0][0][0][0](a,async()=>{a.res=await this.#r(a)})}catch(u){return this.#n(u,a)}return l instanceof Promise?l.then(u=>u||(a.finalized?a.res:this.#r(a))).catch(u=>this.#n(u,a)):l??this.#r(a)}let c=rt(i[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(a);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,a)}})()}fetch=(t,...r)=>this.#o(t,r[1],r[0],t.method);request=(t,r,n,o)=>t instanceof Request?this.fetch(r?new Request(t,r):t,n,o):(t=t.toString(),this.fetch(new Request(/^https?:\/\//.test(t)?t:`http://localhost${G("/",t)}`,r),n,o));fire=()=>{addEventListener("fetch",t=>{t.respondWith(this.#o(t.request,t,void 0,t.request.method))})}};var E=()=>Object.create(null);var ke=[];function lt(e,t){let r=this.buildAllMatchers(),n=((o,s)=>{let i=r[o]||r[C],a=i[2][s];if(a)return a;let c=s.match(i[0]);if(!c)return[[],ke];let l=c.indexOf("",1);return[i[1][l],c]});return this.match=n,n(e,t)}var ae="[^/]+",X=".*",$="(?:|/.*)",Y=Symbol(),Nr=new Set(".\\+*[^]$()");function ns(e,t){return e.length===1?t.length===1?e<t?-1:1:-1:t.length===1?1:e===X||e===$?t===$?-1:1:t===X||t===$?-1:e===ae?1:t===ae?-1:e.length===t.length?e<t?-1:1:t.length-e.length}var Ur=class ut{#e;#t;#r=E();insert(t,r,n,o,s){let i=this;for(let a=0,c=t.length;a<c;a++){let l=t[a],u=l.length===1?l==="*"?a===c-1?["","",X]:["","",ae]:null:l==="/*"?["","",$]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),d;if(u){let f=u[1],h=u[2]||ae;if(f&&u[2]&&(h===".*"||(h=h.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(h))||h.length===1&&Nr.has(h)))throw Y;if(d=i.#r[h],!d){if(h!==X&&h!==$){for(let y in i.#r)if((h.length>1||y.length>1)&&y!==X&&y!==$)throw Y}d=i.#r[h]=new ut}f!==""&&(d.#t??=o.varIndex++,n.push([f,d.#t]))}else if(d=i.#r[l],!d){for(let f in i.#r)if(f.length>1&&f!==X&&f!==$)throw Y;d=i.#r[l]=new ut}i=d}if(i.#e!==void 0)throw Y;i.#e=s?-1:r}buildRegExpStr(){let r=Object.keys(this.#r).sort(ns).map(n=>{let o=this.#r[n],s=o.buildRegExpStr();return s===""?"":(typeof o.#t=="number"?`(${n})@${o.#t}`:Nr.has(n)?`\\${n}`:n)+s}).filter(Boolean);return typeof this.#e=="number"&&this.#e!==-1&&r.unshift(`#${this.#e}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var dt=class{#e={varIndex:0};#t=new Ur;#r=0;paths=E();insert(e,t){if(t){this.#t.insert(e.split(""),0,[],this.#e,!0);return}let r=[],n=[],o=e;for(let i=0;;){let a=!1;if(o=o.replace(/\{[^}]+\}/g,c=>{let l=`@\\${i}`;return n[i]=[l,c],i++,a=!0,l}),!a)break}let s=o.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let i=n.length-1;i>=0;i--){let[a]=n[i];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(a)!==-1){s[c]=s[c].replace(a,n[i][1]);break}}this.#t.insert(s,this.#r,r,this.#e,!1),this.paths[e]=[this.#r++,r]}buildRegExp(){let e=this.#t.buildRegExpStr();if(e==="")return[/^$/,[],[]];let t=0,r=[],n=[];return e=e.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,i)=>s!==void 0?(r[++t]=Number(s),"$()"):(i!==void 0&&(n[Number(i)]=++t),"")),[new RegExp(`^${e}`),r,n]}};var Br=E();function Hr(e){return Br[e]??=new RegExp(`^${e.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(t,r)=>r?`\\${r}`:t==="/*"?$:t==="*"?X:`/:${ae}`)}$`)}function De(e,t){for(let r of Object.keys(e).sort((n,o)=>o.length-n.length))if(Hr(r).test(t))return[...e[r]]}var Ne=class{name="RegExpRouter";#e;#t;#r;constructor(){this.#e={[C]:E()},this.#t={[C]:E()},this.#r={[C]:new dt}}#s(e,t){try{this.#r[e].insert(t,!/\*|\/:/.test(t))}catch(r){throw r===Y?new Ie(t):r}}add(e,t,r){let n=this.#e,o=this.#t;if(!n)throw new Error(Me);if(!n[e]){this.#r[e]=new dt;for(let a of[n,o]){a[e]=E();for(let c in a[C])a[e][c]=[...a[C][c]],this.#s(e,c)}}t==="/*"&&(t="*");let s=e===C?Object.keys(n):[e];if(/\*$/.test(t)){let a=Hr(t);for(let c of s)n[c][t]||(this.#s(c,t),n[c][t]=De(n[c],t)||De(n[C],t)||[]);for(let c of[n,o])for(let l of s)for(let u in c[l])a.test(u)&&c[l][u].push([r,t]);return}let i=Oe(t)||[t];for(let a of i)for(let c of s)o[c][a]||(this.#s(c,a),o[c][a]=De(n[c],a)||De(n[C],a)||[]),o[c][a].push([r,a])}match=lt;buildAllMatchers(){let e=E();for(let t of Object.keys(this.#t))e[t]=this.#n(t);return this.#e=this.#t=this.#r=void 0,Br=E(),e}#n(e){let t=this.#e[e],r=this.#t[e],n=this.#r[e],o=E(),s=[],[i,a,c]=n.buildRegExp();for(let l of[t,r])for(let u in l){let d=l[u],f=n.paths[u];if(!f){o[u]=[d.map(([h])=>[h,E()]),ke];continue}s[f[0]]=d.map(([h,y])=>[h,n.paths[y][1].reduceRight((m,[b],w)=>(m[b]=c[f[1][w][1]],m),E())])}return[i,a.map(l=>s[l]),o]}};var ft=class{name="SmartRouter";#e=[];#t=[];constructor(e){this.#e=e.routers}add(e,t,r){if(!this.#t)throw new Error(Me);this.#t.push([e,t,r])}match(e,t){if(!this.#t)throw new Error("Fatal error");let r=this.#e,n=this.#t,o=r.length,s=0,i;for(;s<o;s++){let a=r[s];try{for(let c=0,l=n.length;c<l;c++)a.add(...n[c]);i=a.match(e,t)}catch(c){if(c instanceof Ie)continue;throw c}this.match=a.match.bind(a),this.#e=[a],this.#t=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,i}get activeRouter(){if(this.#t||this.#e.length!==1)throw new Error("No active router has been determined yet.");return this.#e[0]}};var pt=E(),os=0,jr=class $r{#e=[];#t=E();#r=[];#s;#n=pt;insert(t,r,n){let o=this,s=xr(r),i=new Set,a=0;for(let c of s){let l=s[++a],u=Er(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),d=Array.isArray(u),f=d?u[0]:u||c,h=o.#t[f]||=new $r;u&&!h.#s&&(h.#s=u,o.#r.push(h)),o=h,d&&i.add(u[1])}o.#e.push({[t]:{handler:n,possibleKeys:[...i],score:++os}})}#o(t,r,n,o,s){for(let i=0,a=r.#e.length;i<a;i++){let c=r.#e[i],l=c[n]||c[C];if(l){l.params=E(),t.push(l);for(let u=0,d=l.possibleKeys.length;u<d;u++){let f=l.possibleKeys[u];l.params[f]=s?.[f]&&!u?s[f]:o[f]??s?.[f]}}}}search(t,r){let n=[];this.#n=pt;let s=[this],i=ot(r),a=[],c=i.length,l=null;for(let u=0;u<c;u++){let d=i[u],f=u===c-1,h=[];for(let m=0,b=s.length;m<b;m++){let w=s[m],p=w.#t[d];p&&(p.#n=w.#n,f?(p.#t["*"]&&this.#o(n,p.#t["*"],t,w.#n),this.#o(n,p,t,w.#n)):h.push(p));for(let g of w.#r){let v=g.#s,S=w.#n===pt?{}:{...w.#n};if(typeof v=="string"){(v==="*"||d.startsWith(v.slice(0,-1)))&&(this.#o(n,g,t,w.#n),v==="*"&&(g.#n=S,h.push(g)));continue}let[,M,O]=v;if(!(!d&&O===!0)){if(O!==!0){if(!l){l=[];let A=r[0]==="/"?1:0;for(let x=0;x<c;x++)l[x]=A,A+=i[x].length+1}let R=r.slice(l[u]),P=O.exec(R);if(P){S[M]=P[0],this.#o(n,g,t,w.#n,S),P[0].length===R.length&&g.#t["*"]&&this.#o(n,g.#t["*"],t,w.#n,S);for(let A in g.#t){g.#n=S;let x=P[0].match(/\//g)?.length??0;(a[x]||=[]).push(g);break}continue}}(O===!0||O.test(d))&&(S[M]=d,f?(this.#o(n,g,t,S,w.#n),g.#t["*"]&&this.#o(n,g.#t["*"],t,S,w.#n)):(g.#n=S,h.push(g)))}}}let y=a.shift();s=y?h.concat(y):h}return n[1]&&n.sort((u,d)=>u.score-d.score),[n.map(({handler:u,params:d})=>[u,d])]}};var ht=class{name="TrieRouter";#e=new jr;add(e,t,r){for(let n of Oe(t)||[t])this.#e.insert(e,n,r)}match(e,t){return this.#e.search(e,t)}};var mt=class extends kr{constructor(e={}){super(e),this.router=e.router??new ft({routers:[new Ne,new ht]})}};var Ue=e=>{let t={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...e},r=t.exposeHeaders?.length?t.exposeHeaders.join(","):void 0,n=t.allowHeaders?.length?t.allowHeaders.join(","):void 0,o=(i=>typeof i=="string"?i==="*"?()=>i:a=>i===a?a:null:typeof i=="function"?i:a=>i.includes(a)?a:null)(t.origin),s=(i=>{if(typeof i=="function")return async(a,c)=>(await i(a,c)).join(",");if(Array.isArray(i)){let a=i.join(",");return()=>a}else return()=>""})(t.allowMethods);return async function(a,c){function l(d,f){a.res.headers.set(d,f)}let u=await o(a.req.header("origin")||"",a);if(u&&l("Access-Control-Allow-Origin",u),t.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),a.req.method==="OPTIONS"){t.origin!=="*"&&a.res.headers.append("Vary","Origin"),t.maxAge!=null&&l("Access-Control-Max-Age",t.maxAge.toString());let d=await s(a.req.header("origin")||"",a);d&&l("Access-Control-Allow-Methods",d);let f=n;if(!f){let h=a.req.header("Access-Control-Request-Headers");h&&(f=h.split(",").map(y=>y.trim()).join(","))}return f&&(l("Access-Control-Allow-Headers",f),a.res.headers.append("Vary","Access-Control-Request-Headers")),a.res.headers.delete("Content-Length"),a.res.headers.delete("Content-Type"),new Response(null,{headers:a.res.headers,status:204,statusText:"No Content"})}await c(),t.origin!=="*"&&a.header("Vary","Origin",{append:!0})}};import on from"process";import sn from"path";import{fileURLToPath as Ns}from"url";import Us from"child_process";import Bs,{constants as Hs}from"fs/promises";import{promisify as ms}from"util";import gs from"child_process";import vt,{constants as Gr}from"fs/promises";import zr from"process";import ls from"os";import us from"fs";import as from"fs";import Fr from"fs";var gt;function ss(){try{return Fr.statSync("/.dockerenv"),!0}catch{return!1}}function is(){try{return Fr.readFileSync("/proc/self/cgroup","utf8").includes("docker")}catch{return!1}}function yt(){return gt===void 0&&(gt=ss()||is()),gt}var wt,cs=()=>{try{return as.statSync("/run/.containerenv"),!0}catch{return!1}};function ce(){return wt===void 0&&(wt=cs()||yt()),wt}var Wr=()=>{if(zr.platform!=="linux")return!1;if(ls.release().toLowerCase().includes("microsoft"))return!ce();try{return us.readFileSync("/proc/version","utf8").toLowerCase().includes("microsoft")?!ce():!1}catch{return!1}},F=zr.env.__IS_WSL_TEST__?Wr:Wr();import qr from"process";import{Buffer as ds}from"buffer";import{promisify as fs}from"util";import ps from"child_process";import Bc,{constants as Hc}from"fs/promises";var hs=fs(ps.execFile),bt=()=>`${qr.env.SYSTEMROOT||qr.env.windir||String.raw`C:\Windows`}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`;var L=async(e,t={})=>{let{powerShellPath:r,...n}=t,o=L.encodeCommand(e);return hs(r??bt(),[...L.argumentsPrefix,o],{encoding:"utf8",...n})};L.argumentsPrefix=["-NoProfile","-NonInteractive","-ExecutionPolicy","Bypass","-EncodedCommand"];L.encodeCommand=e=>ds.from(e,"utf16le").toString("base64");L.escapeArgument=e=>`'${String(e).replaceAll("'","''")}'`;function Kr(e){for(let t of e.split(`
 `)){if(/^\s*#/.test(t))continue;let r=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(t);if(r)return r.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var ys=ms(gs.execFile),ws=(()=>{let e="/mnt/",t;return async function(){if(t)return t;let r="/etc/wsl.conf",n=!1;try{await vt.access(r,Gr.F_OK),n=!0}catch{}if(!n)return e;let o=await vt.readFile(r,{encoding:"utf8"}),s=Kr(o);return s===void 0?e:(t=s,t=t.endsWith("/")?t:`${t}/`,t)}})(),bs=async()=>`${await ws()}c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe`,Be=F?bs:bt,Vr,Yr=async()=>(Vr??=(async()=>{try{let e=await Be();return await vt.access(e,Gr.X_OK),!0}catch{return!1}})(),Vr),Xr=async()=>{let e=await Be(),t=String.raw`(Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice").ProgId`,{stdout:r}=await L(t,{powerShellPath:e});return r.trim()},Jr=async e=>{if(/^[a-z]+:\/\//i.test(e))return e;try{let{stdout:t}=await ys("wslpath",["-aw",e],{encoding:"utf8"});return t.trim()}catch{return e}};function ee(e,t,r){let n=o=>Object.defineProperty(e,t,{value:o,enumerable:!0,writable:!0});return Object.defineProperty(e,t,{configurable:!0,enumerable:!0,get(){let o=r();return n(o),o},set(o){n(o)}}),e}import{promisify as Ls}from"util";import At from"process";import{execFile as Ms}from"child_process";import{promisify as vs}from"util";import xs from"process";import{execFile as Es}from"child_process";var Ss=vs(Es);async function xt(){if(xs.platform!=="darwin")throw new Error("macOS only");let{stdout:e}=await Ss("defaults",["read","com.apple.LaunchServices/com.apple.launchservices.secure","LSHandlers"]),r=/LSHandlerRoleAll = "(?!-)(?<id>[^"]+?)";\s+?LSHandlerURLScheme = (?:http|https);/.exec(e)?.groups.id??"com.apple.Safari";return r==="com.apple.safari"?"com.apple.Safari":r}import Rs from"process";import{promisify as Ps}from"util";import{execFile as As,execFileSync as ol}from"child_process";var Cs=Ps(As);async function Qr(e,{humanReadableOutput:t=!0,signal:r}={}){if(Rs.platform!=="darwin")throw new Error("macOS only");let n=t?[]:["-ss"],o={};r&&(o.signal=r);let{stdout:s}=await Cs("osascript",["-e",e,n],o);return s.trim()}async function Et(e){return Qr(`tell application "Finder" to set app_path to application file id "${e}" as string
-tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`)}import{promisify as _s}from"util";import{execFile as Ts}from"child_process";var Os=_s(Ts),He={MSEdgeHTM:{name:"Edge",id:"com.microsoft.edge"},MSEdgeBHTML:{name:"Edge Beta",id:"com.microsoft.edge.beta"},MSEdgeDHTML:{name:"Edge Dev",id:"com.microsoft.edge.dev"},AppXq0fevzme2pys62n3e0fbqa7peapykr8v:{name:"Edge",id:"com.microsoft.edge.old"},ChromeHTML:{name:"Chrome",id:"com.google.chrome"},ChromeBHTML:{name:"Chrome Beta",id:"com.google.chrome.beta"},ChromeDHTML:{name:"Chrome Dev",id:"com.google.chrome.dev"},ChromiumHTM:{name:"Chromium",id:"org.chromium.Chromium"},BraveHTML:{name:"Brave",id:"com.brave.Browser"},BraveBHTML:{name:"Brave Beta",id:"com.brave.Browser.beta"},BraveDHTML:{name:"Brave Dev",id:"com.brave.Browser.dev"},BraveSSHTM:{name:"Brave Nightly",id:"com.brave.Browser.nightly"},FirefoxURL:{name:"Firefox",id:"org.mozilla.firefox"},OperaStable:{name:"Opera",id:"com.operasoftware.Opera"},VivaldiHTM:{name:"Vivaldi",id:"com.vivaldi.Vivaldi"},"IE.HTTP":{name:"Internet Explorer",id:"com.microsoft.ie"}},Rt=new Map(Object.entries(He)),St=class extends Error{};async function Pt(e=Os){let{stdout:t}=await e("reg",["QUERY"," HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice","/v","ProgId"]),r=/ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(t);if(!r)throw new St(`Cannot find Windows browser in stdout: ${JSON.stringify(t)}`);let{id:n}=r.groups,o=n.lastIndexOf("."),s=n.lastIndexOf("-"),i=o===-1?void 0:n.slice(0,o),a=s===-1?void 0:n.slice(0,s);return He[n]??He[i]??He[a]??{name:n,id:n}}var Is=Ls(Ms),ks=e=>e.toLowerCase().replaceAll(/(?:^|\s|-)\S/g,t=>t.toUpperCase());async function Ct(){if(At.platform==="darwin"){let e=await xt();return{name:await Et(e),id:e}}if(At.platform==="linux"){let{stdout:e}=await Is("xdg-mime",["query","default","x-scheme-handler/http"]),t=e.trim();return{name:ks(t.replace(/.desktop$/,"").replace("-"," ")),id:t}}if(At.platform==="win32")return Pt();throw new Error("Only macOS, Linux, and Windows are supported")}import _t from"process";var Ds=!!(_t.env.SSH_CONNECTION||_t.env.SSH_CLIENT||_t.env.SSH_TTY),Zr=Ds;var je=Symbol("fallbackAttempt"),Tt=import.meta.url?sn.dirname(Ns(import.meta.url)):"",en=sn.join(Tt,"xdg-open"),{platform:le,arch:tn}=on,rn=async(e,t)=>{if(e.length===0)return;let r=[];for(let n of e)try{return await t(n)}catch(o){r.push(o)}throw new AggregateError(r,"Failed to open in all supported apps")},$e=async e=>{e={wait:!1,background:!1,newInstance:!1,allowNonzeroExitCode:!1,...e};let t=e[je]===!0;if(delete e[je],Array.isArray(e.app))return rn(e.app,l=>$e({...e,app:l,[je]:!0}));let{name:r,arguments:n=[]}=e.app??{};if(n=[...n],Array.isArray(r))return rn(r,l=>$e({...e,app:{name:l,arguments:n},[je]:!0}));if(r==="browser"||r==="browserPrivate"){let l={"com.google.chrome":"chrome","google-chrome.desktop":"chrome","com.brave.browser":"brave","org.mozilla.firefox":"firefox","firefox.desktop":"firefox","com.microsoft.msedge":"edge","com.microsoft.edge":"edge","com.microsoft.edgemac":"edge","microsoft-edge.desktop":"edge","com.apple.safari":"safari"},u={chrome:"--incognito",brave:"--incognito",firefox:"--private-window",edge:"--inPrivate"},d;if(F){let f=await Xr();d=Rt.get(f)??{}}else d=await Ct();if(d.id in l){let f=l[d.id.toLowerCase()];if(r==="browserPrivate"){if(f==="safari")throw new Error("Safari doesn't support opening in private mode via command line");n.push(u[f])}return $e({...e,app:{name:ue[f],arguments:n}})}throw new Error(`${d.name} is not supported as a default browser`)}let o,s=[],i={},a=!1;if(F&&!ce()&&!Zr&&!r&&(a=await Yr()),le==="darwin")o="open",e.wait&&s.push("--wait-apps"),e.background&&s.push("--background"),e.newInstance&&s.push("--new"),r&&s.push("-a",r);else if(le==="win32"||a){o=await Be(),s.push(...L.argumentsPrefix),F||(i.windowsVerbatimArguments=!0),F&&e.target&&(e.target=await Jr(e.target));let l=["$ProgressPreference = 'SilentlyContinue';","Start"];e.wait&&l.push("-Wait"),r?(l.push(L.escapeArgument(r)),e.target&&n.push(e.target)):e.target&&l.push(L.escapeArgument(e.target)),n.length>0&&(n=n.map(u=>L.escapeArgument(u)),l.push("-ArgumentList",n.join(","))),e.target=L.encodeCommand(l.join(" ")),e.wait||(i.stdio="ignore")}else{if(r)o=r;else{let l=!Tt||Tt==="/",u=!1;try{await Bs.access(en,Hs.X_OK),u=!0}catch{}o=on.versions.electron??(le==="android"||l||!u)?"xdg-open":en}n.length>0&&s.push(...n),e.wait||(i.stdio="ignore",i.detached=!0)}le==="darwin"&&n.length>0&&s.push("--args",...n),e.target&&s.push(e.target);let c=Us.spawn(o,s,i);return e.wait?new Promise((l,u)=>{c.once("error",u),c.once("close",d=>{if(!e.allowNonzeroExitCode&&d!==0){u(new Error(`Exited with code ${d}`));return}l(c)})}):t?new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.once("close",d=>{if(c.off("error",u),d!==0){u(new Error(`Exited with code ${d}`));return}c.unref(),l(c)})})}):(c.unref(),new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.off("error",u),l(c)})}))},js=(e,t)=>{if(typeof e!="string")throw new TypeError("Expected a `target`");return $e({...t,target:e})};function nn(e){if(typeof e=="string"||Array.isArray(e))return e;let{[tn]:t}=e;if(!t)throw new Error(`${tn} is not supported`);return t}function we({[le]:e},{wsl:t}={}){if(t&&F)return nn(t);if(!e)throw new Error(`${le} is not supported`);return nn(e)}var ue={browser:"browser",browserPrivate:"browserPrivate"};ee(ue,"chrome",()=>we({darwin:"google chrome",win32:"chrome",linux:["google-chrome","google-chrome-stable","chromium","chromium-browser"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",x64:["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe","/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]}}));ee(ue,"brave",()=>we({darwin:"brave browser",win32:"brave",linux:["brave-browser","brave"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",x64:["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe","/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]}}));ee(ue,"firefox",()=>we({darwin:"firefox",win32:String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,linux:"firefox"},{wsl:"/mnt/c/Program Files/Mozilla Firefox/firefox.exe"}));ee(ue,"edge",()=>we({darwin:"microsoft edge",win32:"msedge",linux:["microsoft-edge","microsoft-edge-dev"]},{wsl:"/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"}));ee(ue,"safari",()=>we({darwin:"Safari"}));var an=js;function cn(e=""){return`<link rel="icon" type="image/svg+xml" href="${`${e.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as vn,readFileSync as qs}from"fs";import z from"path";import{fileURLToPath as Ks}from"url";import{gunzipSync as Vs}from"zlib";var W=oo(bn(),1);function de(e,t){return e.header("Retry-After",String(Ws(t))),e.json({error:"Too Many Requests"},429)}function Ws(e){return e&&typeof e=="object"&&"msBeforeNext"in e&&typeof e.msBeforeNext=="number"&&Number.isFinite(e.msBeforeNext)?Math.max(1,Math.ceil(e.msBeforeNext/1e3)):60}var Gs={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Ys(){let e=z.dirname(Ks(import.meta.url));for(let t of[z.resolve(e,"app"),z.resolve(e,"../app"),z.resolve(e,"../../dist/app")])if(vn(z.join(t,"inspector.js.gz")))return t;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function xn(e,t="/inspector/assets"){let r=Ys(),n=new Map,o=new W.default({points:600,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return de(i,c)}return a()};e.use(`${t}/*`,s),e.get(`${t}/*`,async i=>{let a=i.req.path.slice(t.length),c=a.startsWith("/")?a.slice(1):a;if(!c||c.includes(".."))return i.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=z.resolve(r,l),d=r.endsWith(z.sep)?r:`${r}${z.sep}`;if(!u.startsWith(d)||!vn(u))return i.notFound();let f=z.extname(c),h=l.endsWith(".gz"),y=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(i.req.header("accept-encoding")??""),m=qs(u),b=h&&!y?n.get(u)??Xs(n,u,m):m,w=b.buffer.slice(b.byteOffset,b.byteOffset+b.byteLength);return i.body(w,200,{"Content-Type":Gs[f]??"application/octet-stream",...h&&y?{"Content-Encoding":"gzip"}:{},...h?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Xs(e,t,r){let n=Vs(r);return e.set(t,n),n}var En={name:"@mcp-use/inspector",type:"module",version:"20.3.13",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"},"./client/styles.css":{default:"./dist/client/styles.css"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"pnpm run clean && pnpm run build:client-exports && pnpm run build:server && pnpm run build:app && pnpm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts && node scripts/copy-client-styles.mjs","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs",test:"vitest run","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.16 || ^2.0.17 || ^2.0.18 || ^2.0.19","@mcp-use/client":"^2.0.1 || ^2.1.0 || ^2.1.1 || ^2.1.2 || ^2.1.3 || ^2.1.4 || ^2.1.5 || ^2.2.0 || ^2.2.1 || ^2.2.2 || ^2.2.3 || ^2.2.4 || ^2.2.5 || ^2.3.0 || ^2.3.1 || ^2.3.2 || ^2.3.3 || ^2.3.4","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},"mcp-use":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^2.0.5","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.13.5",jsdom:"^27.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^8.3.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",yaml:"^2.8.3",zod:"^4.2.0"}};var Qs=En.version;function Fe(){return Qs}var Zs=`<!doctype html>
+tell application "System Events" to get value of property list item "CFBundleName" of property list file (app_path & ":Contents:Info.plist")`)}import{promisify as _s}from"util";import{execFile as Ts}from"child_process";var Os=_s(Ts),He={MSEdgeHTM:{name:"Edge",id:"com.microsoft.edge"},MSEdgeBHTML:{name:"Edge Beta",id:"com.microsoft.edge.beta"},MSEdgeDHTML:{name:"Edge Dev",id:"com.microsoft.edge.dev"},AppXq0fevzme2pys62n3e0fbqa7peapykr8v:{name:"Edge",id:"com.microsoft.edge.old"},ChromeHTML:{name:"Chrome",id:"com.google.chrome"},ChromeBHTML:{name:"Chrome Beta",id:"com.google.chrome.beta"},ChromeDHTML:{name:"Chrome Dev",id:"com.google.chrome.dev"},ChromiumHTM:{name:"Chromium",id:"org.chromium.Chromium"},BraveHTML:{name:"Brave",id:"com.brave.Browser"},BraveBHTML:{name:"Brave Beta",id:"com.brave.Browser.beta"},BraveDHTML:{name:"Brave Dev",id:"com.brave.Browser.dev"},BraveSSHTM:{name:"Brave Nightly",id:"com.brave.Browser.nightly"},FirefoxURL:{name:"Firefox",id:"org.mozilla.firefox"},OperaStable:{name:"Opera",id:"com.operasoftware.Opera"},VivaldiHTM:{name:"Vivaldi",id:"com.vivaldi.Vivaldi"},"IE.HTTP":{name:"Internet Explorer",id:"com.microsoft.ie"}},Rt=new Map(Object.entries(He)),St=class extends Error{};async function Pt(e=Os){let{stdout:t}=await e("reg",["QUERY"," HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice","/v","ProgId"]),r=/ProgId\s*REG_SZ\s*(?<id>\S+)/.exec(t);if(!r)throw new St(`Cannot find Windows browser in stdout: ${JSON.stringify(t)}`);let{id:n}=r.groups,o=n.lastIndexOf("."),s=n.lastIndexOf("-"),i=o===-1?void 0:n.slice(0,o),a=s===-1?void 0:n.slice(0,s);return He[n]??He[i]??He[a]??{name:n,id:n}}var Is=Ls(Ms),ks=e=>e.toLowerCase().replaceAll(/(?:^|\s|-)\S/g,t=>t.toUpperCase());async function Ct(){if(At.platform==="darwin"){let e=await xt();return{name:await Et(e),id:e}}if(At.platform==="linux"){let{stdout:e}=await Is("xdg-mime",["query","default","x-scheme-handler/http"]),t=e.trim();return{name:ks(t.replace(/.desktop$/,"").replace("-"," ")),id:t}}if(At.platform==="win32")return Pt();throw new Error("Only macOS, Linux, and Windows are supported")}import _t from"process";var Ds=!!(_t.env.SSH_CONNECTION||_t.env.SSH_CLIENT||_t.env.SSH_TTY),Zr=Ds;var je=Symbol("fallbackAttempt"),Tt=import.meta.url?sn.dirname(Ns(import.meta.url)):"",en=sn.join(Tt,"xdg-open"),{platform:le,arch:tn}=on,rn=async(e,t)=>{if(e.length===0)return;let r=[];for(let n of e)try{return await t(n)}catch(o){r.push(o)}throw new AggregateError(r,"Failed to open in all supported apps")},$e=async e=>{e={wait:!1,background:!1,newInstance:!1,allowNonzeroExitCode:!1,...e};let t=e[je]===!0;if(delete e[je],Array.isArray(e.app))return rn(e.app,l=>$e({...e,app:l,[je]:!0}));let{name:r,arguments:n=[]}=e.app??{};if(n=[...n],Array.isArray(r))return rn(r,l=>$e({...e,app:{name:l,arguments:n},[je]:!0}));if(r==="browser"||r==="browserPrivate"){let l={"com.google.chrome":"chrome","google-chrome.desktop":"chrome","com.brave.browser":"brave","org.mozilla.firefox":"firefox","firefox.desktop":"firefox","com.microsoft.msedge":"edge","com.microsoft.edge":"edge","com.microsoft.edgemac":"edge","microsoft-edge.desktop":"edge","com.apple.safari":"safari"},u={chrome:"--incognito",brave:"--incognito",firefox:"--private-window",edge:"--inPrivate"},d;if(F){let f=await Xr();d=Rt.get(f)??{}}else d=await Ct();if(d.id in l){let f=l[d.id.toLowerCase()];if(r==="browserPrivate"){if(f==="safari")throw new Error("Safari doesn't support opening in private mode via command line");n.push(u[f])}return $e({...e,app:{name:ue[f],arguments:n}})}throw new Error(`${d.name} is not supported as a default browser`)}let o,s=[],i={},a=!1;if(F&&!ce()&&!Zr&&!r&&(a=await Yr()),le==="darwin")o="open",e.wait&&s.push("--wait-apps"),e.background&&s.push("--background"),e.newInstance&&s.push("--new"),r&&s.push("-a",r);else if(le==="win32"||a){o=await Be(),s.push(...L.argumentsPrefix),F||(i.windowsVerbatimArguments=!0),F&&e.target&&(e.target=await Jr(e.target));let l=["$ProgressPreference = 'SilentlyContinue';","Start"];e.wait&&l.push("-Wait"),r?(l.push(L.escapeArgument(r)),e.target&&n.push(e.target)):e.target&&l.push(L.escapeArgument(e.target)),n.length>0&&(n=n.map(u=>L.escapeArgument(u)),l.push("-ArgumentList",n.join(","))),e.target=L.encodeCommand(l.join(" ")),e.wait||(i.stdio="ignore")}else{if(r)o=r;else{let l=!Tt||Tt==="/",u=!1;try{await Bs.access(en,Hs.X_OK),u=!0}catch{}o=on.versions.electron??(le==="android"||l||!u)?"xdg-open":en}n.length>0&&s.push(...n),e.wait||(i.stdio="ignore",i.detached=!0)}le==="darwin"&&n.length>0&&s.push("--args",...n),e.target&&s.push(e.target);let c=Us.spawn(o,s,i);return e.wait?new Promise((l,u)=>{c.once("error",u),c.once("close",d=>{if(!e.allowNonzeroExitCode&&d!==0){u(new Error(`Exited with code ${d}`));return}l(c)})}):t?new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.once("close",d=>{if(c.off("error",u),d!==0){u(new Error(`Exited with code ${d}`));return}c.unref(),l(c)})})}):(c.unref(),new Promise((l,u)=>{c.once("error",u),c.once("spawn",()=>{c.off("error",u),l(c)})}))},js=(e,t)=>{if(typeof e!="string")throw new TypeError("Expected a `target`");return $e({...t,target:e})};function nn(e){if(typeof e=="string"||Array.isArray(e))return e;let{[tn]:t}=e;if(!t)throw new Error(`${tn} is not supported`);return t}function we({[le]:e},{wsl:t}={}){if(t&&F)return nn(t);if(!e)throw new Error(`${le} is not supported`);return nn(e)}var ue={browser:"browser",browserPrivate:"browserPrivate"};ee(ue,"chrome",()=>we({darwin:"google chrome",win32:"chrome",linux:["google-chrome","google-chrome-stable","chromium","chromium-browser"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe",x64:["/mnt/c/Program Files/Google/Chrome/Application/chrome.exe","/mnt/c/Program Files (x86)/Google/Chrome/Application/chrome.exe"]}}));ee(ue,"brave",()=>we({darwin:"brave browser",win32:"brave",linux:["brave-browser","brave"]},{wsl:{ia32:"/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe",x64:["/mnt/c/Program Files/BraveSoftware/Brave-Browser/Application/brave.exe","/mnt/c/Program Files (x86)/BraveSoftware/Brave-Browser/Application/brave.exe"]}}));ee(ue,"firefox",()=>we({darwin:"firefox",win32:String.raw`C:\Program Files\Mozilla Firefox\firefox.exe`,linux:"firefox"},{wsl:"/mnt/c/Program Files/Mozilla Firefox/firefox.exe"}));ee(ue,"edge",()=>we({darwin:"microsoft edge",win32:"msedge",linux:["microsoft-edge","microsoft-edge-dev"]},{wsl:"/mnt/c/Program Files (x86)/Microsoft/Edge/Application/msedge.exe"}));ee(ue,"safari",()=>we({darwin:"Safari"}));var an=js;function cn(e=""){return`<link rel="icon" type="image/svg+xml" href="${`${e.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as vn,readFileSync as qs}from"fs";import z from"path";import{fileURLToPath as Ks}from"url";import{gunzipSync as Vs}from"zlib";var W=oo(bn(),1);function de(e,t){return e.header("Retry-After",String(Ws(t))),e.json({error:"Too Many Requests"},429)}function Ws(e){return e&&typeof e=="object"&&"msBeforeNext"in e&&typeof e.msBeforeNext=="number"&&Number.isFinite(e.msBeforeNext)?Math.max(1,Math.ceil(e.msBeforeNext/1e3)):60}var Gs={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Ys(){let e=z.dirname(Ks(import.meta.url));for(let t of[z.resolve(e,"app"),z.resolve(e,"../app"),z.resolve(e,"../../dist/app")])if(vn(z.join(t,"inspector.js.gz")))return t;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function xn(e,t="/inspector/assets"){let r=Ys(),n=new Map,o=new W.default({points:600,duration:60}),s=async(i,a)=>{try{await o.consume(i.req)}catch(c){return de(i,c)}return a()};e.use(`${t}/*`,s),e.get(`${t}/*`,async i=>{let a=i.req.path.slice(t.length),c=a.startsWith("/")?a.slice(1):a;if(!c||c.includes(".."))return i.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=z.resolve(r,l),d=r.endsWith(z.sep)?r:`${r}${z.sep}`;if(!u.startsWith(d)||!vn(u))return i.notFound();let f=z.extname(c),h=l.endsWith(".gz"),y=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(i.req.header("accept-encoding")??""),m=qs(u),b=h&&!y?n.get(u)??Xs(n,u,m):m,w=b.buffer.slice(b.byteOffset,b.byteOffset+b.byteLength);return i.body(w,200,{"Content-Type":Gs[f]??"application/octet-stream",...h&&y?{"Content-Encoding":"gzip"}:{},...h?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Xs(e,t,r){let n=Vs(r);return e.set(t,n),n}var En={name:"@mcp-use/inspector",type:"module",version:"20.3.14-canary.0",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"},"./client/styles.css":{default:"./dist/client/styles.css"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"pnpm run clean && pnpm run build:client-exports && pnpm run build:server && pnpm run build:app && pnpm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts && node scripts/copy-client-styles.mjs","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs",test:"vitest run","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.16 || ^2.0.17 || ^2.0.18 || ^2.0.19","@mcp-use/client":"^2.0.1 || ^2.1.0 || ^2.1.1 || ^2.1.2 || ^2.1.3 || ^2.1.4 || ^2.1.5 || ^2.2.0 || ^2.2.1 || ^2.2.2 || ^2.2.3 || ^2.2.4 || ^2.2.5 || ^2.3.0 || ^2.3.1 || ^2.3.2 || ^2.3.3 || ^2.3.4","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1 || ^2.7.2-canary.0",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},"mcp-use":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^2.0.5","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.13.5",jsdom:"^27.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^8.3.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",yaml:"^2.8.3",zod:"^4.2.0"}};var Qs=En.version;function Fe(){return Qs}var Zs=`<!doctype html>
 <html>
   <head>
     <meta charset="utf-8" />
@@ -375,9 +375,9 @@ window.addEventListener('unhandledrejection', function(event) {
     </div>
     <script type="module" src="${r.jsUrl}"></script>
   </body>
-</html>`}function Pn(e,t,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(Rn),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...t,basePath:t?.basePath??r,proxyUrl:t?.proxyUrl!==void 0?t.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:t?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let d=new URL(u.req.url),f={...a,sandboxOrigin:a.sandboxOrigin??ei(d)??null};return u.html(ri(f,r,s))};xn(e,n),e.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(ti)),e.get(i("/inspector/sandbox"),u=>u.html(Sn(new URL(u.req.url).search))),e.get(i("/inspector"),c),e.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");e.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),e.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&t?.rootRedirect!==!1&&e.get("/",u=>{let d=new URL(u.req.url);return u.redirect(`${i("/inspector")}${d.search}`)})}function ni(){let{process:e,Deno:t}=globalThis;return!(typeof t?.noColor=="boolean"?t.noColor:e!==void 0?"NO_COLOR"in e?.env:!1)}async function An(){let{navigator:e}=globalThis,t="cloudflare:workers";return!(e!==void 0&&e.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(t)).env??{})}catch{return!1}})():!ni())}var oi=e=>{let[t,r]=[",","."];return e.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+t)).join(r)},si=e=>{let t=Date.now()-e;return oi([t<1e3?t+"ms":Math.round(t/1e3)+"s"])},ii=async e=>{if(await An())switch(e/100|0){case 5:return`\x1B[31m${e}\x1B[0m`;case 4:return`\x1B[33m${e}\x1B[0m`;case 3:return`\x1B[36m${e}\x1B[0m`;case 2:return`\x1B[32m${e}\x1B[0m`}return`${e}`};async function Cn(e,t,r,n,o=0,s){let i=t==="<--"?`${t} ${r} ${n}`:`${t} ${r} ${n} ${await ii(o)} ${s}`;e(i)}var It=(e=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await Cn(e,"<--",o,i);let a=Date.now();await n(),await Cn(e,"-->",o,i,r.res.status,si(a))};import{lookup as ai}from"dns/promises";import{Buffer as ci}from"buffer";import{isIP as li}from"net";var ui=new Set(["accept","authorization","content-type","dpop"]),di=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),fi=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],kn=600*1e3,pi=100,hi=1440*60*1e3,mi=500;function Bt(e,t={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,logPrefix:u,authenticate:d,validateServerUrl:f,rateLimiter:h=new W.default({points:120,duration:60})}=t,y=new Set(n.map(Ut)),m=new Map,b=new Map,w=async(p,g)=>{try{await h.consume(p.req)}catch(v){return de(p,v)}return g()};e.use(`${r}/*`,async(p,g)=>{let v=p.req.header("Origin");if(v&&!Ai(v,p,y))return p.json({error:"Origin not allowed"},403);if(p.req.method==="OPTIONS")return Ci(v);await g(),v&&$n(p.res.headers,v)}),e.use(`${r}/*`,w),e.get(`${r}/metadata`,async p=>{if(!await In(p,d))return p.json({error:"Unauthorized"},401);let g=await re(p.req.query("serverUrl"),o);if("error"in g)return p.json({error:g.error},400);let v=g.url;if(f&&!await f(v.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let S=await re(p.req.query("url"),o);if("error"in S)return p.json({error:S.error},400);let M=S.url,O=I(v),R=Ln(m,O),P=_n(v,M,R);if(!P&&R.authorizationServers.size===0)try{await Tn(v,R,o,s,a),m.set(O,R),P=_n(v,M,R)}catch{}if(!P)return p.json({error:"Metadata target is not bound to this MCP server"},403);try{kt(l,u,`GET ${M}`);let A=await We(M,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(qe(A.status))return p.json({error:"OAuth metadata redirects are not allowed"},502);let x=await ze(A,a);if(!A.ok)return p.body(x,A.status,{"Content-Type":A.headers.get("content-type")??"application/json"});let k=Nt(x);return P.type==="protected-resource"?await Un(k,v,P.resourceIdentifier,R,o):await Bn(k,P.issuer,R,o),R.updatedAt=Date.now(),m.set(O,R),Mn(m),p.body(x,200,{"Content-Type":A.headers.get("content-type")??"application/json"})}catch(A){return Dt(p,A,l,u)}}),e.post(`${r}/proxy`,async p=>{if(!await In(p,d))return p.json({error:"Unauthorized"},401);let g;try{g=JSON.parse(await Ri(p.req.raw,i))}catch(x){return p.json({error:x instanceof J?"Request body too large":"Invalid JSON request body"},x instanceof J?413:400)}let v=await re(g.serverUrl,o);if("error"in v)return p.json({error:v.error},400);let S=v.url;if(f&&!await f(S.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let M=await re(g.url,o);if("error"in M)return p.json({error:M.error},400);let O=M.url;if(g.method!==void 0&&g.method!=="POST")return p.json({error:"Only OAuth endpoint POST is allowed"},405);let R=I(S),P=Ln(m,R);if(P.endpoints.size===0)try{await Tn(S,P,o,s,a),m.set(R,P),Mn(m)}catch(x){return Dt(p,x,l,u)}let A=P.endpoints.get(I(O));if(!A)return p.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let x=wi(g.headers),k=vi(g.body,x);if(A==="registration"){let Jn=Ut(p.req.header("Origin")??new URL(p.req.url).origin);k=Pi(k,x,new URL(c,Jn).toString())}else k=Ei({body:k,headers:x,bindingKey:R,clients:b});if(new TextEncoder().encode(k??"").byteLength>i)return p.json({error:"OAuth request body too large"},413);kt(l,u,`POST ${A} ${O}`);let Q=await We(O,{method:"POST",headers:x,body:k,redirect:"manual",signal:AbortSignal.timeout(s)});if(qe(Q.status))return p.json({error:"OAuth endpoint redirects are not allowed"},502);let Ft=await ze(Q,a),Yn=bi(Q.headers),Xn=Q.headers.get("content-type")??"",Z=Ft;if(Xn.includes("json"))try{Z=JSON.parse(Ft)}catch{}return A==="registration"&&Q.ok&&Z&&typeof Z=="object"&&!Array.isArray(Z)&&(Z=xi({responseBody:Z,binding:P,bindingKey:R,clients:b})),p.json({status:Q.status,statusText:Q.statusText,headers:Yn,body:Z})}catch(x){return Dt(p,x,l,u)}}),kt(l,u,`Mounted at ${r}/metadata and ${r}/proxy`)}async function re(e,t){if(typeof e!="string"||!e)return{error:"Missing or invalid URL"};let r;try{r=new URL(e)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=Fn(r.hostname);if(r.protocol!=="https:"&&!(t&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return t?{url:r}:{error:"Loopback URL not allowed"};if(_i(r.hostname))return{error:"Local network URL not allowed"};try{let o=li(r.hostname)?[r.hostname]:(await ai(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!Wn(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Ht(e,t=!1){return!("error"in await re(e,t))}function _n(e,t,r){let n=I(t),o=Dn(e).find(s=>I(s.url)===n);if(o)return{type:"protected-resource",resourceIdentifier:o.resourceIdentifier};for(let s of r.authorizationServers)if(Nn(new URL(s)).some(i=>I(i)===n))return{type:"authorization-server",issuer:s}}function Dn(e){let t=e.pathname==="/"?"":e.pathname;return[{url:new URL(`/.well-known/oauth-protected-resource${t}`,e.origin),resourceIdentifier:e},{url:new URL("/.well-known/oauth-protected-resource",e.origin),resourceIdentifier:new URL(e.origin)}]}function Nn(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-authorization-server${t}`,e.origin),new URL(`/.well-known/openid-configuration${t}`,e.origin),new URL(`${t||""}/.well-known/openid-configuration`,e.origin)]}async function Un(e,t,r,n,o){let s=gi(e.resource,o),i=s!==void 0&&I(s)===I(r),a=s!==void 0&&yi(t,s);if(!i&&!a)throw new _("Protected-resource metadata does not match serverUrl");if(!Array.isArray(e.authorization_servers)||e.authorization_servers.length===0)throw new _("Protected-resource metadata has no authorization servers");let c=new Set;for(let l of e.authorization_servers){let u=await re(l,o);if("error"in u)throw new _(`Unsafe authorization server: ${u.error}`);c.add(I(u.url))}n.authorizationServers=c,n.endpoints.clear(),n.tokenEndpointAuthMethods.clear()}function gi(e,t){if(!(typeof e!="string"||e.length===0))try{let r=new URL(e);return!(r.protocol==="https:"||t&&r.protocol==="http:"&&Fn(r.hostname))||r.username||r.password||r.hash?void 0:r}catch{return}}function yi(e,t){if(e.origin!==t.origin||e.pathname.length<t.pathname.length)return!1;let r=e.pathname.endsWith("/")?e.pathname:`${e.pathname}/`,n=t.pathname.endsWith("/")?t.pathname:`${t.pathname}/`;return r.startsWith(n)}async function Bn(e,t,r,n){if(typeof e.issuer!="string"||I(new URL(e.issuer))!==t)throw new _("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(e.token_endpoint_auth_methods_supported)?e.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of fi){let i=e[o];if(i===void 0)continue;let a=await re(i,n);if("error"in a)throw new _(`Unsafe ${o}: ${a.error}`);r.endpoints.set(I(a.url),s)}}async function Tn(e,t,r,n,o){for(let s of Dn(e)){let i=await We(s.url,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(qe(i.status))throw new _("OAuth metadata redirects are not allowed");if(i.ok){await Un(Nt(await ze(i,o)),e,s.resourceIdentifier,t,r);break}}if(t.authorizationServers.size===0)throw new _("Protected-resource metadata could not be discovered");for(let s of t.authorizationServers){let i=!1;for(let a of Nn(new URL(s))){let c=await We(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(qe(c.status))throw new _("OAuth metadata redirects are not allowed");if(c.ok){await Bn(Nt(await ze(c,o)),s,t,r),i=!0;break}}if(i)break}if(t.endpoints.size===0)throw new _("Authorization-server metadata could not be discovered");t.updatedAt=Date.now()}async function We(e,t){return fetch(e,t)}function wi(e){let t=new Headers;if(!e||typeof e!="object"||Array.isArray(e))return t;for(let[r,n]of Object.entries(e)){let o=r.toLowerCase();ui.has(o)&&typeof n=="string"&&t.set(o,n)}return t}function bi(e){let t={};return e.forEach((r,n)=>{di.has(n.toLowerCase())&&(t[n]=r)}),t}function vi(e,t){if(e==null)return;if(typeof e=="string"){if(!t.has("content-type"))try{JSON.parse(e),t.set("content-type","application/json")}catch{t.set("content-type","application/x-www-form-urlencoded")}return e}if((t.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof e=="object"&&!Array.isArray(e)){let n=new URLSearchParams;for(let[o,s]of Object.entries(e))n.append(o,String(s));return n.toString()}return t.has("content-type")||t.set("content-type","application/json"),JSON.stringify(e)}function Hn(e,t){return`${e}\0${t}`}function xi(e){let{responseBody:t,binding:r,bindingKey:n,clients:o}=e,s=t.client_id,i=t.client_secret;if(typeof s!="string"||typeof i!="string")return t;let a=t.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=t.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+hi;for(Si(o),o.set(Hn(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>mi;){let f=o.keys().next().value;if(!f)break;o.delete(f)}let d={...t};return delete d.client_secret,delete d.client_secret_expires_at,d.token_endpoint_auth_method="none",d}function Ei(e){let{body:t,headers:r,bindingKey:n,clients:o}=e;if(!t||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return t;let s=new URLSearchParams(t),i=s.get("client_id");if(!i)return t;let a=Hn(n,i),c=o.get(a);if(!c)return t;if(c.expiresAt<=Date.now())return o.delete(a),t;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=ci.from(`${On(i)}:${On(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function On(e){return new URLSearchParams({value:e}).toString().slice(6)}function Si(e){let t=Date.now();for(let[r,n]of e)n.expiresAt<=t&&e.delete(r)}async function Ri(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new J;return jn(e.body,t)}async function ze(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw await e.body?.cancel(),new J;return jn(e.body,t)}async function jn(e,t){if(!e)return"";let r=e.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>t)throw await r.cancel(),new J;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function Nt(e){let t;try{t=JSON.parse(e)}catch{throw new _("OAuth metadata is not valid JSON")}if(!t||typeof t!="object"||Array.isArray(t))throw new _("OAuth metadata is not an object");return t}function Ln(e,t){let r=e.get(t);return r&&Date.now()-r.updatedAt<=kn?r:(e.delete(t),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Mn(e){let t=Date.now();for(let[r,n]of e)t-n.updatedAt>kn&&e.delete(r);for(;e.size>pi;){let r=e.keys().next().value;if(!r)break;e.delete(r)}}function I(e){let t=new URL(e);return t.hash="",(t.protocol==="https:"&&t.port==="443"||t.protocol==="http:"&&t.port==="80")&&(t.port=""),t.toString().replace(/\/$/,"")}function Pi(e,t,r){if(!e||!(t.get("content-type")??"").includes("json"))return e;try{let o=JSON.parse(e);return!o||typeof o!="object"||Array.isArray(o)?e:JSON.stringify({...o,redirect_uris:[r]})}catch{return e}}function Ut(e){let t=new URL(e);if(t.pathname!=="/"||t.search||t.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${e}`);return t.origin}function Ai(e,t,r){try{let n=Ut(e);if(n===new URL(t.req.url).origin||r.has(n))return!0;let o=new URL(n),i=t.req.header("x-forwarded-host")?.split(",")[0]?.trim()||t.req.header("host");if(!i||o.host!==i)return!1;let a=t.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function Ci(e){let t=new Headers;return e&&$n(t,e),t.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),t.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:t})}function $n(e,t){e.set("Access-Control-Allow-Origin",t),e.append("Vary","Origin")}async function In(e,t){return t?t(e):!0}function qe(e){return e>=300&&e<400}function Fn(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t.endsWith(".localhost")||t==="::1"||t.startsWith("127.")}function _i(e){let t=e.toLowerCase();return t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa")}function Wn(e){if(e.includes(":")){let s=e.toLowerCase();return s.startsWith("::ffff:")?Wn(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let t=e.split(".").map(Number);if(t.length!==4||t.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=t;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function kt(e,t,r){e&&console.log(t===void 0?`[OAuth BFF] ${r}`:`${t} [OAuth BFF] ${r}`)}function Dt(e,t,r,n){let o=t instanceof Error?t.message:"Unknown error";return r&&console.error(n===void 0?"[OAuth BFF]":`${n} [OAuth BFF]`,o),t instanceof J?e.json({error:"Upstream response too large"},502):t instanceof _?e.json({error:t.message},502):t instanceof DOMException&&t.name==="TimeoutError"?e.json({error:"OAuth upstream timed out"},504):e.json({error:"OAuth upstream request failed"},502)}var J=class extends Error{},_=class extends Error{};var Ti=3;function Oi(e,t){return e.includes("text/event-stream")&&!t}function jt(e,t={}){let r=t.path||"/mcp/proxy",n=t.enableLogging!==!1,o=t.logPrefix,s=t.rateLimiter??new W.default({points:120,duration:60}),i=async(a,c)=>{try{await s.consume(a.req)}catch(l){return de(a,l)}return c()};e.use(`${r}/*`,Ue({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&e.use(`${r}/*`,o===void 0?It():It((a,...c)=>console.log(o,a,...c))),e.use(`${r}/*`,i),e.all(`${r}/*`,async a=>{try{if(t.authenticate&&!await t.authenticate(a))return a.json({error:"Unauthorized"},401);let c=a.req.header("X-Target-URL");if(!c)return a.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Ht(c,t.allowLoopback??!1))return a.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(t.validateRequest&&!await t.validateRequest(c,a))return a.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(c)}catch{return a.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let l=a.req.method,u={},d=a.req.header();for(let[b,w]of Object.entries(d)){let p=b.toLowerCase();!p.startsWith("x-proxy-")&&!p.startsWith("x-target-")&&!p.startsWith("x-mcp-")&&!p.startsWith("x-forwarded-")&&!p.startsWith("cf-")&&p!=="x-original-host"&&p!=="host"&&p!=="origin"&&p!=="referer"&&p!=="cookie"&&p!=="proxy-authorization"&&p!=="accept-encoding"&&p!=="cdn-loop"&&!p.startsWith("sec-fetch-")&&(u[b]=w)}u["Accept-Encoding"]="identity";let f=l!=="GET"&&l!=="HEAD"?new Uint8Array(await a.req.arrayBuffer()).slice():void 0,h=c,y=l,m=f;for(let b=0;;b+=1){let w=await fetch(h,{method:y,headers:u,body:m,redirect:"manual"}),p=w.headers.get("location");if(!(w.status>=300&&w.status<400&&p))return Li(w);if(b>=Ti)return a.json({error:"Too many upstream redirects"},502);let g=new URL(p,h);if(!await Ht(g.toString(),t.allowLoopback??!1)||t.validateRequest&&!await t.validateRequest(g.toString(),a))return a.json({error:"Redirect target is not allowed"},403);g.origin!==new URL(h).origin&&(Ke(u,"authorization"),Ke(u,"proxy-authorization")),(w.status===303||(w.status===301||w.status===302)&&y==="POST")&&(y="GET",m=void 0,Ke(u,"content-type"),Ke(u,"content-length")),h=g.toString()}}catch(c){let l=c instanceof Error?c.message:"Unknown error",u=a.req.header("X-Target-URL");return c instanceof Error&&(c.message.includes("ECONNREFUSED")||c.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${u||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",l,`
-Target URL:`,u||"unknown",`
-Error:`,c),a.json({error:"Proxy request failed",details:l,targetUrl:u||"unknown"},500)}})}function Ke(e,t){for(let r of Object.keys(e))r.toLowerCase()===t&&delete e[r]}async function Li(e){let t={};if(e.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(t[s]=o)}),Oi(e.headers.get("content-type")||"",e.headers.get("content-length")))return t["x-accel-buffering"]="no",t["cache-control"]??="no-cache, no-transform",new Response(e.body,{status:e.status,statusText:e.statusText,headers:t});if([204,205,304].includes(e.status))return new Response(null,{status:e.status,statusText:e.statusText,headers:t});let n=await e.arrayBuffer();return t["Content-Length"]=String(n.byteLength),new Response(n,{status:e.status,statusText:e.statusText,headers:t})}function zn(e,t,r=""){let n=a=>`${r}${a}`,o=t?.oauthProxyAllowLoopback??!1,s=t?.oauth!==!1,i=new W.default({points:120,duration:60});if(e.get(n("/inspector/health"),a=>a.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),jt(e,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:i,logPrefix:t?.logPrefix}),s&&Bt(e,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,logPrefix:t?.logPrefix,allowedOrigins:t?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:i}),t?.autoConnectUrl!==void 0){let a=t.autoConnectUrl;e.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:a??null}))}}function qn(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}}async function Kn(e=8080,t=100){let r=await import("net");for(let n=e;n<e+t;n++)try{return await new Promise((o,s)=>{let i=r.createServer();i.listen(n,()=>{i.close(()=>o())}),i.on("error",a=>s(a))}),n}catch{continue}throw new Error(`No available port found after trying ${t} ports starting from ${e}`)}function $t(e){if(!(e instanceof Error))return`UnknownError (${typeof e})`;let t=/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(e.name)?e.name:"Error",r=e.code,n=typeof r=="string"&&/^[A-Z][A-Z0-9_]{0,31}$/.test(r)?r:void 0;return n?`${t} (${n})`:t}var T=process.argv.slice(2),ve,Vn=8080,Gn=!1;for(let e=0;e<T.length;e++)if(T[e]==="--url"){(e+1>=T.length||T[e+1].startsWith("-"))&&(console.error("Error: --url requires a value"),process.exit(1));let t=T[e+1];qn(t)||(console.error("Error: Invalid URL format."),console.error("URL must start with http://, https://, ws://, or wss://"),process.exit(1)),ve=t,e++}else if(T[e]==="--port"){(e+1>=T.length||T[e+1].startsWith("-"))&&(console.error("Error: --port requires a value"),process.exit(1));let t=Number.parseInt(T[e+1],10);(Number.isNaN(t)||t<1||t>65535)&&(console.error("Error: Port must be a number between 1 and 65535."),process.exit(1)),Vn=t,e++}else T[e]==="--no-open"?Gn=!0:T[e]==="--version"||T[e]==="-v"?(console.log(Fe()),process.exit(0)):T[e]==="--help"||T[e]==="-h"?(console.log(`
+</html>`}function Pn(e,t,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(Rn),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},i=u=>`${r}${u}`,a={...t,basePath:t?.basePath??r,proxyUrl:t?.proxyUrl!==void 0?t.proxyUrl:i("/inspector/api/proxy"),disableTelemetry:t?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let d=new URL(u.req.url),f={...a,sandboxOrigin:a.sandboxOrigin??ei(d)??null};return u.html(ri(f,r,s))};xn(e,n),e.get(i("/inspector/oauth-popup-closed.html"),u=>u.html(ti)),e.get(i("/inspector/sandbox"),u=>u.html(Sn(new URL(u.req.url).search))),e.get(i("/inspector"),c),e.get(`${i("/inspector")}/`,c);let l=i("/inspector/api/");e.get(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),e.post(i("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&t?.rootRedirect!==!1&&e.get("/",u=>{let d=new URL(u.req.url);return u.redirect(`${i("/inspector")}${d.search}`)})}function ni(){let{process:e,Deno:t}=globalThis;return!(typeof t?.noColor=="boolean"?t.noColor:e!==void 0?"NO_COLOR"in e?.env:!1)}async function An(){let{navigator:e}=globalThis,t="cloudflare:workers";return!(e!==void 0&&e.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(t)).env??{})}catch{return!1}})():!ni())}var oi=e=>{let[t,r]=[",","."];return e.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+t)).join(r)},si=e=>{let t=Date.now()-e;return oi([t<1e3?t+"ms":Math.round(t/1e3)+"s"])},ii=async e=>{if(await An())switch(e/100|0){case 5:return`\x1B[31m${e}\x1B[0m`;case 4:return`\x1B[33m${e}\x1B[0m`;case 3:return`\x1B[36m${e}\x1B[0m`;case 2:return`\x1B[32m${e}\x1B[0m`}return`${e}`};async function Cn(e,t,r,n,o=0,s){let i=t==="<--"?`${t} ${r} ${n}`:`${t} ${r} ${n} ${await ii(o)} ${s}`;e(i)}var It=(e=console.log)=>async function(r,n){let{method:o,url:s}=r.req,i=s.slice(s.indexOf("/",8));await Cn(e,"<--",o,i);let a=Date.now();await n(),await Cn(e,"-->",o,i,r.res.status,si(a))};import{lookup as ai}from"dns/promises";import{Buffer as ci}from"buffer";import{isIP as li}from"net";var ui=new Set(["accept","authorization","content-type","dpop"]),di=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),fi=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],kn=600*1e3,pi=100,hi=1440*60*1e3,mi=500;function Bt(e,t={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:i=64*1024,maxResponseBodyBytes:a=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,logPrefix:u,authenticate:d,validateServerUrl:f,rateLimiter:h=new W.default({points:120,duration:60})}=t,y=new Set(n.map(Ut)),m=new Map,b=new Map,w=async(p,g)=>{try{await h.consume(p.req)}catch(v){return de(p,v)}return g()};e.use(`${r}/*`,async(p,g)=>{let v=p.req.header("Origin");if(v&&!Ai(v,p,y))return p.json({error:"Origin not allowed"},403);if(p.req.method==="OPTIONS")return Ci(v);await g(),v&&$n(p.res.headers,v)}),e.use(`${r}/*`,w),e.get(`${r}/metadata`,async p=>{if(!await In(p,d))return p.json({error:"Unauthorized"},401);let g=await re(p.req.query("serverUrl"),o);if("error"in g)return p.json({error:g.error},400);let v=g.url;if(f&&!await f(v.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let S=await re(p.req.query("url"),o);if("error"in S)return p.json({error:S.error},400);let M=S.url,O=I(v),R=Ln(m,O),P=_n(v,M,R);if(!P&&R.authorizationServers.size===0)try{await Tn(v,R,o,s,a),m.set(O,R),P=_n(v,M,R)}catch{}if(!P)return p.json({error:"Metadata target is not bound to this MCP server"},403);try{kt(l,u,`GET ${M}`);let A=await We(M,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(qe(A.status))return p.json({error:"OAuth metadata redirects are not allowed"},502);let x=await ze(A,a);if(!A.ok)return p.body(x,A.status,{"Content-Type":A.headers.get("content-type")??"application/json"});let k=Nt(x);return P.type==="protected-resource"?await Un(k,v,P.resourceIdentifier,R,o):await Bn(k,P.issuer,R,o),R.updatedAt=Date.now(),m.set(O,R),Mn(m),p.body(x,200,{"Content-Type":A.headers.get("content-type")??"application/json"})}catch(A){return Dt(p,A,l,u)}}),e.post(`${r}/proxy`,async p=>{if(!await In(p,d))return p.json({error:"Unauthorized"},401);let g;try{g=JSON.parse(await Ri(p.req.raw,i))}catch(x){return p.json({error:x instanceof J?"Request body too large":"Invalid JSON request body"},x instanceof J?413:400)}let v=await re(g.serverUrl,o);if("error"in v)return p.json({error:v.error},400);let S=v.url;if(f&&!await f(S.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let M=await re(g.url,o);if("error"in M)return p.json({error:M.error},400);let O=M.url;if(g.method!==void 0&&g.method!=="POST")return p.json({error:"Only OAuth endpoint POST is allowed"},405);let R=I(S),P=Ln(m,R);if(P.endpoints.size===0)try{await Tn(S,P,o,s,a),m.set(R,P),Mn(m)}catch(x){return Dt(p,x,l,u)}let A=P.endpoints.get(I(O));if(!A)return p.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let x=wi(g.headers),k=vi(g.body,x);if(A==="registration"){let Jn=Ut(p.req.header("Origin")??new URL(p.req.url).origin);k=Pi(k,x,new URL(c,Jn).toString())}else k=Ei({body:k,headers:x,bindingKey:R,clients:b});if(new TextEncoder().encode(k??"").byteLength>i)return p.json({error:"OAuth request body too large"},413);kt(l,u,`POST ${A} ${O}`);let Q=await We(O,{method:"POST",headers:x,body:k,redirect:"manual",signal:AbortSignal.timeout(s)});if(qe(Q.status))return p.json({error:"OAuth endpoint redirects are not allowed"},502);let Ft=await ze(Q,a),Yn=bi(Q.headers),Xn=Q.headers.get("content-type")??"",Z=Ft;if(Xn.includes("json"))try{Z=JSON.parse(Ft)}catch{}return A==="registration"&&Q.ok&&Z&&typeof Z=="object"&&!Array.isArray(Z)&&(Z=xi({responseBody:Z,binding:P,bindingKey:R,clients:b})),p.json({status:Q.status,statusText:Q.statusText,headers:Yn,body:Z})}catch(x){return Dt(p,x,l,u)}}),kt(l,u,`Mounted at ${r}/metadata and ${r}/proxy`)}async function re(e,t){if(typeof e!="string"||!e)return{error:"Missing or invalid URL"};let r;try{r=new URL(e)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=Fn(r.hostname);if(r.protocol!=="https:"&&!(t&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return t?{url:r}:{error:"Loopback URL not allowed"};if(_i(r.hostname))return{error:"Local network URL not allowed"};try{let o=li(r.hostname)?[r.hostname]:(await ai(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!Wn(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Ht(e,t=!1){return!("error"in await re(e,t))}function _n(e,t,r){let n=I(t),o=Dn(e).find(s=>I(s.url)===n);if(o)return{type:"protected-resource",resourceIdentifier:o.resourceIdentifier};for(let s of r.authorizationServers)if(Nn(new URL(s)).some(i=>I(i)===n))return{type:"authorization-server",issuer:s}}function Dn(e){let t=e.pathname==="/"?"":e.pathname;return[{url:new URL(`/.well-known/oauth-protected-resource${t}`,e.origin),resourceIdentifier:e},{url:new URL("/.well-known/oauth-protected-resource",e.origin),resourceIdentifier:new URL(e.origin)}]}function Nn(e){let t=e.pathname==="/"?"":e.pathname;return[new URL(`/.well-known/oauth-authorization-server${t}`,e.origin),new URL(`/.well-known/openid-configuration${t}`,e.origin),new URL(`${t||""}/.well-known/openid-configuration`,e.origin)]}async function Un(e,t,r,n,o){let s=gi(e.resource,o),i=s!==void 0&&I(s)===I(r),a=s!==void 0&&yi(t,s);if(!i&&!a)throw new _("Protected-resource metadata does not match serverUrl");if(!Array.isArray(e.authorization_servers)||e.authorization_servers.length===0)throw new _("Protected-resource metadata has no authorization servers");let c=new Set;for(let l of e.authorization_servers){let u=await re(l,o);if("error"in u)throw new _(`Unsafe authorization server: ${u.error}`);c.add(I(u.url))}n.authorizationServers=c,n.endpoints.clear(),n.tokenEndpointAuthMethods.clear()}function gi(e,t){if(!(typeof e!="string"||e.length===0))try{let r=new URL(e);return!(r.protocol==="https:"||t&&r.protocol==="http:"&&Fn(r.hostname))||r.username||r.password||r.hash?void 0:r}catch{return}}function yi(e,t){if(e.origin!==t.origin||e.pathname.length<t.pathname.length)return!1;let r=e.pathname.endsWith("/")?e.pathname:`${e.pathname}/`,n=t.pathname.endsWith("/")?t.pathname:`${t.pathname}/`;return r.startsWith(n)}async function Bn(e,t,r,n){if(typeof e.issuer!="string"||I(new URL(e.issuer))!==t)throw new _("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(e.token_endpoint_auth_methods_supported)?e.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of fi){let i=e[o];if(i===void 0)continue;let a=await re(i,n);if("error"in a)throw new _(`Unsafe ${o}: ${a.error}`);r.endpoints.set(I(a.url),s)}}async function Tn(e,t,r,n,o){for(let s of Dn(e)){let i=await We(s.url,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(qe(i.status))throw new _("OAuth metadata redirects are not allowed");if(i.ok){await Un(Nt(await ze(i,o)),e,s.resourceIdentifier,t,r);break}}if(t.authorizationServers.size===0)throw new _("Protected-resource metadata could not be discovered");for(let s of t.authorizationServers){let i=!1;for(let a of Nn(new URL(s))){let c=await We(a,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(qe(c.status))throw new _("OAuth metadata redirects are not allowed");if(c.ok){await Bn(Nt(await ze(c,o)),s,t,r),i=!0;break}}if(i)break}if(t.endpoints.size===0)throw new _("Authorization-server metadata could not be discovered");t.updatedAt=Date.now()}async function We(e,t){return fetch(e,t)}function wi(e){let t=new Headers;if(!e||typeof e!="object"||Array.isArray(e))return t;for(let[r,n]of Object.entries(e)){let o=r.toLowerCase();ui.has(o)&&typeof n=="string"&&t.set(o,n)}return t}function bi(e){let t={};return e.forEach((r,n)=>{di.has(n.toLowerCase())&&(t[n]=r)}),t}function vi(e,t){if(e==null)return;if(typeof e=="string"){if(!t.has("content-type"))try{JSON.parse(e),t.set("content-type","application/json")}catch{t.set("content-type","application/x-www-form-urlencoded")}return e}if((t.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof e=="object"&&!Array.isArray(e)){let n=new URLSearchParams;for(let[o,s]of Object.entries(e))n.append(o,String(s));return n.toString()}return t.has("content-type")||t.set("content-type","application/json"),JSON.stringify(e)}function Hn(e,t){return`${e}\0${t}`}function xi(e){let{responseBody:t,binding:r,bindingKey:n,clients:o}=e,s=t.client_id,i=t.client_secret;if(typeof s!="string"||typeof i!="string")return t;let a=t.token_endpoint_auth_method,c=a==="client_secret_post"||a==="client_secret_basic"?a:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=t.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+hi;for(Si(o),o.set(Hn(n,s),{clientSecret:i,authMethod:c,expiresAt:u});o.size>mi;){let f=o.keys().next().value;if(!f)break;o.delete(f)}let d={...t};return delete d.client_secret,delete d.client_secret_expires_at,d.token_endpoint_auth_method="none",d}function Ei(e){let{body:t,headers:r,bindingKey:n,clients:o}=e;if(!t||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return t;let s=new URLSearchParams(t),i=s.get("client_id");if(!i)return t;let a=Hn(n,i),c=o.get(a);if(!c)return t;if(c.expiresAt<=Date.now())return o.delete(a),t;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=ci.from(`${On(i)}:${On(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",i),s.set("client_secret",c.clientSecret);return s.toString()}function On(e){return new URLSearchParams({value:e}).toString().slice(6)}function Si(e){let t=Date.now();for(let[r,n]of e)n.expiresAt<=t&&e.delete(r)}async function Ri(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw new J;return jn(e.body,t)}async function ze(e,t){let r=Number(e.headers.get("content-length"));if(Number.isFinite(r)&&r>t)throw await e.body?.cancel(),new J;return jn(e.body,t)}async function jn(e,t){if(!e)return"";let r=e.getReader(),n=[],o=0;for(;;){let{done:a,value:c}=await r.read();if(a)break;if(o+=c.byteLength,o>t)throw await r.cancel(),new J;n.push(c)}let s=new Uint8Array(o),i=0;for(let a of n)s.set(a,i),i+=a.byteLength;return new TextDecoder().decode(s)}function Nt(e){let t;try{t=JSON.parse(e)}catch{throw new _("OAuth metadata is not valid JSON")}if(!t||typeof t!="object"||Array.isArray(t))throw new _("OAuth metadata is not an object");return t}function Ln(e,t){let r=e.get(t);return r&&Date.now()-r.updatedAt<=kn?r:(e.delete(t),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Mn(e){let t=Date.now();for(let[r,n]of e)t-n.updatedAt>kn&&e.delete(r);for(;e.size>pi;){let r=e.keys().next().value;if(!r)break;e.delete(r)}}function I(e){let t=new URL(e);return t.hash="",(t.protocol==="https:"&&t.port==="443"||t.protocol==="http:"&&t.port==="80")&&(t.port=""),t.toString().replace(/\/$/,"")}function Pi(e,t,r){if(!e||!(t.get("content-type")??"").includes("json"))return e;try{let o=JSON.parse(e);return!o||typeof o!="object"||Array.isArray(o)?e:JSON.stringify({...o,redirect_uris:[r]})}catch{return e}}function Ut(e){let t=new URL(e);if(t.pathname!=="/"||t.search||t.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${e}`);return t.origin}function Ai(e,t,r){try{let n=Ut(e);if(n===new URL(t.req.url).origin||r.has(n))return!0;let o=new URL(n),i=t.req.header("x-forwarded-host")?.split(",")[0]?.trim()||t.req.header("host");if(!i||o.host!==i)return!1;let a=t.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!a||`${a}:`===o.protocol}catch{return!1}}function Ci(e){let t=new Headers;return e&&$n(t,e),t.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),t.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),t.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:t})}function $n(e,t){e.set("Access-Control-Allow-Origin",t),e.append("Vary","Origin")}async function In(e,t){return t?t(e):!0}function qe(e){return e>=300&&e<400}function Fn(e){let t=e.toLowerCase().replace(/^\[|\]$/g,"");return t==="localhost"||t.endsWith(".localhost")||t==="::1"||t.startsWith("127.")}function _i(e){let t=e.toLowerCase();return t.endsWith(".local")||t.endsWith(".internal")||t.endsWith(".home.arpa")}function Wn(e){if(e.includes(":")){let s=e.toLowerCase();return s.startsWith("::ffff:")?Wn(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let t=e.split(".").map(Number);if(t.length!==4||t.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=t;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function kt(e,t,r){e&&console.log(t===void 0?`[OAuth BFF] ${r}`:`${t} [OAuth BFF] ${r}`)}function Dt(e,t,r,n){let o=t instanceof Error?t.message:"Unknown error";return r&&console.error(n===void 0?"[OAuth BFF]":`${n} [OAuth BFF]`,o),t instanceof J?e.json({error:"Upstream response too large"},502):t instanceof _?e.json({error:t.message},502):t instanceof DOMException&&t.name==="TimeoutError"?e.json({error:"OAuth upstream timed out"},504):e.json({error:"OAuth upstream request failed"},502)}var J=class extends Error{},_=class extends Error{};var Ti=3;function Oi(e,t){return e.includes("text/event-stream")&&!t}function jt(e,t={}){let r=t.path||"/mcp/proxy",n=t.enableLogging!==!1,o=t.logPrefix,s=t.rateLimiter??new W.default({points:120,duration:60}),i=async(a,c)=>{try{await s.consume(a.req)}catch(l){return de(a,l)}return c()};e.use(`${r}/*`,Ue({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&e.use(`${r}/*`,o===void 0?It():It((a,...c)=>console.log(o,a,...c))),e.use(`${r}/*`,i),e.all(`${r}/*`,async a=>{try{if(t.authenticate&&!await t.authenticate(a))return a.json({error:"Unauthorized"},401);let c=a.req.header("X-Target-URL");if(!c)return a.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Ht(c,t.allowLoopback??!1))return a.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(t.validateRequest&&!await t.validateRequest(c,a))return a.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(c)}catch{return a.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let l=a.req.method,u={},d=a.req.header();for(let[b,w]of Object.entries(d)){let p=b.toLowerCase();!p.startsWith("x-proxy-")&&!p.startsWith("x-target-")&&!p.startsWith("x-mcp-")&&!p.startsWith("x-forwarded-")&&!p.startsWith("cf-")&&p!=="x-original-host"&&p!=="host"&&p!=="origin"&&p!=="referer"&&p!=="cookie"&&p!=="proxy-authorization"&&p!=="accept-encoding"&&p!=="cdn-loop"&&!p.startsWith("sec-fetch-")&&(u[b]=w)}u["Accept-Encoding"]="identity";let f=l!=="GET"&&l!=="HEAD"?new Uint8Array(await a.req.arrayBuffer()).slice():void 0,h=c,y=l,m=f;for(let b=0;;b+=1){let w=await fetch(h,{method:y,headers:u,body:m,redirect:"manual",signal:a.req.raw.signal}),p=w.headers.get("location");if(!(w.status>=300&&w.status<400&&p))return await Li(w);if(b>=Ti)return a.json({error:"Too many upstream redirects"},502);let g=new URL(p,h);if(!await Ht(g.toString(),t.allowLoopback??!1)||t.validateRequest&&!await t.validateRequest(g.toString(),a))return a.json({error:"Redirect target is not allowed"},403);g.origin!==new URL(h).origin&&(Ke(u,"authorization"),Ke(u,"proxy-authorization")),(w.status===303||(w.status===301||w.status===302)&&y==="POST")&&(y="GET",m=void 0,Ke(u,"content-type"),Ke(u,"content-length")),h=g.toString()}}catch(c){let l=c instanceof Error?c.message:"Unknown error",{signal:u}=a.req.raw;if(u.aborted&&(c===u.reason||c instanceof Error&&c.name==="AbortError"))return new Response(null,{status:499});let d=a.req.header("X-Target-URL");return c instanceof Error&&(c.message.includes("ECONNREFUSED")||c.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${d||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",l,`
+Target URL:`,d||"unknown",`
+Error:`,c),a.json({error:"Proxy request failed",details:l,targetUrl:d||"unknown"},500)}})}function Ke(e,t){for(let r of Object.keys(e))r.toLowerCase()===t&&delete e[r]}async function Li(e){let t={};if(e.headers.forEach((o,s)=>{let i=s.toLowerCase();i!=="content-encoding"&&i!=="transfer-encoding"&&i!=="content-length"&&i!=="set-cookie"&&(t[s]=o)}),Oi(e.headers.get("content-type")||"",e.headers.get("content-length")))return t["x-accel-buffering"]="no",t["cache-control"]??="no-cache, no-transform",new Response(e.body,{status:e.status,statusText:e.statusText,headers:t});if([204,205,304].includes(e.status))return new Response(null,{status:e.status,statusText:e.statusText,headers:t});let n=await e.arrayBuffer();return t["Content-Length"]=String(n.byteLength),new Response(n,{status:e.status,statusText:e.statusText,headers:t})}function zn(e,t,r=""){let n=a=>`${r}${a}`,o=t?.oauthProxyAllowLoopback??!1,s=t?.oauth!==!1,i=new W.default({points:120,duration:60});if(e.get(n("/inspector/health"),a=>a.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),jt(e,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:i,logPrefix:t?.logPrefix}),s&&Bt(e,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,logPrefix:t?.logPrefix,allowedOrigins:t?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:i}),t?.autoConnectUrl!==void 0){let a=t.autoConnectUrl;e.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:a??null}))}}function qn(e){try{let t=new URL(e);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}}async function Kn(e=8080,t=100){let r=await import("net");for(let n=e;n<e+t;n++)try{return await new Promise((o,s)=>{let i=r.createServer();i.listen(n,()=>{i.close(()=>o())}),i.on("error",a=>s(a))}),n}catch{continue}throw new Error(`No available port found after trying ${t} ports starting from ${e}`)}function $t(e){if(!(e instanceof Error))return`UnknownError (${typeof e})`;let t=/^[A-Za-z][A-Za-z0-9_.-]{0,63}$/.test(e.name)?e.name:"Error",r=e.code,n=typeof r=="string"&&/^[A-Z][A-Z0-9_]{0,31}$/.test(r)?r:void 0;return n?`${t} (${n})`:t}var T=process.argv.slice(2),ve,Vn=8080,Gn=!1;for(let e=0;e<T.length;e++)if(T[e]==="--url"){(e+1>=T.length||T[e+1].startsWith("-"))&&(console.error("Error: --url requires a value"),process.exit(1));let t=T[e+1];qn(t)||(console.error("Error: Invalid URL format."),console.error("URL must start with http://, https://, ws://, or wss://"),process.exit(1)),ve=t,e++}else if(T[e]==="--port"){(e+1>=T.length||T[e+1].startsWith("-"))&&(console.error("Error: --port requires a value"),process.exit(1));let t=Number.parseInt(T[e+1],10);(Number.isNaN(t)||t<1||t>65535)&&(console.error("Error: Port must be a number between 1 and 65535."),process.exit(1)),Vn=t,e++}else T[e]==="--no-open"?Gn=!0:T[e]==="--version"||T[e]==="-v"?(console.log(Fe()),process.exit(0)):T[e]==="--help"||T[e]==="-h"?(console.log(`
 MCP Inspector - Inspect and debug MCP servers
 
 Usage:

package/dist/server/index.js

@@ -1,4 +1,4 @@
-var rr=Object.create;var Ne=Object.defineProperty;var nr=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var sr=Object.getPrototypeOf,ir=Object.prototype.hasOwnProperty;var V=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var ar=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of or(e))!ir.call(t,o)&&o!==r&&Ne(t,o,{get:()=>e[o],enumerable:!(n=nr(e,o))||n.enumerable});return t};var cr=(t,e,r)=>(r=t!=null?rr(sr(t)):{},ar(e||!t||!t.__esModule?Ne(r,"default",{value:t,enumerable:!0}):r,t));var pt=V((es,dt)=>{"use strict";dt.exports=class{constructor(e={}){this.points=e.points,this.duration=e.duration,this.blockDuration=e.blockDuration,this.execEvenly=e.execEvenly,this.execEvenlyMinDelayMs=e.execEvenlyMinDelayMs,this.keyPrefix=e.keyPrefix}get points(){return this._points}set points(e){if(Number.isFinite(e))this._points=e;else throw new Error("points must be set and must be a finite number")}get duration(){return this._duration}set duration(e){if(typeof e=="number"&&Number.isFinite(e)&&e>=0)this._duration=e;else throw new Error("duration must be set and must be a finite, non-negative number")}get msDuration(){return this.duration*1e3}get blockDuration(){return this._blockDuration}set blockDuration(e){this._blockDuration=typeof e>"u"?0:e}get msBlockDuration(){return this.blockDuration*1e3}get execEvenly(){return this._execEvenly}set execEvenly(e){this._execEvenly=typeof e>"u"?!1:!!e}get execEvenlyMinDelayMs(){return this._execEvenlyMinDelayMs===void 0?this._getExecEvenlyMinDelayMsDefault():this._execEvenlyMinDelayMs}set execEvenlyMinDelayMs(e){this._execEvenlyMinDelayMs=e}_getExecEvenlyMinDelayMsDefault(){return this.points>0?Math.ceil(this.msDuration/this.points):0}get keyPrefix(){return this._keyPrefix}set keyPrefix(e){if(typeof e>"u"&&(e="rlflx"),typeof e!="string")throw new Error("keyPrefix must be string");this._keyPrefix=e}_getKeySecDuration(e={}){return e&&e.customDuration>=0?e.customDuration:this.duration}getKey(e){return this.keyPrefix.length>0?`${this.keyPrefix}:${e}`:e}parseKey(e){return this.keyPrefix.length>0?e.substring(this.keyPrefix.length+1):e}consume(){throw new Error("You have to implement the method 'consume'!")}penalty(){throw new Error("You have to implement the method 'penalty'!")}reward(){throw new Error("You have to implement the method 'reward'!")}get(){throw new Error("You have to implement the method 'get'!")}set(){throw new Error("You have to implement the method 'set'!")}block(){throw new Error("You have to implement the method 'block'!")}delete(){throw new Error("You have to implement the method 'delete'!")}}});var ft=V((rs,ht)=>{"use strict";ht.exports=class{constructor(e,r,n=null){this.value=e,this.expiresAt=r,this.timeoutId=n}get value(){return this._value}set value(e){this._value=parseInt(e,10)}get expiresAt(){return this._expiresAt}set expiresAt(e){e instanceof Date?this._expiresAt=e.getTime():this._expiresAt=e}get timeoutId(){return this._timeoutId}set timeoutId(e){this._timeoutId=e}}});var Re=V((os,mt)=>{"use strict";mt.exports=class{constructor(e,r,n,o){this.remainingPoints=typeof e>"u"?0:e,this.msBeforeNext=typeof r>"u"?0:r,this.consumedPoints=typeof n>"u"?0:n,this.isFirstInDuration=typeof o>"u"?!1:o}get msBeforeNext(){return this._msBeforeNext}set msBeforeNext(e){return this._msBeforeNext=e,this}get remainingPoints(){return this._remainingPoints}set remainingPoints(e){return this._remainingPoints=e,this}get consumedPoints(){return this._consumedPoints}set consumedPoints(e){return this._consumedPoints=e,this}get isFirstInDuration(){return this._isFirstInDuration}set isFirstInDuration(e){this._isFirstInDuration=!!e}_getDecoratedProperties(){return{remainingPoints:this.remainingPoints,msBeforeNext:this.msBeforeNext,consumedPoints:this.consumedPoints,isFirstInDuration:this.isFirstInDuration}}[Symbol.for("nodejs.util.inspect.custom")](){return this._getDecoratedProperties()}toString(){return JSON.stringify(this._getDecoratedProperties())}toJSON(){return this._getDecoratedProperties()}}});var wt=V((is,yt)=>{"use strict";var gt=ft(),Pe=Re();yt.exports=class{constructor(){this._storage=new Map}incrby(e,r,n){let o=this._storage.get(e);if(o){let s=o.expiresAt?o.expiresAt-Date.now():-1;return!o.expiresAt||s>0?(o.value=o.value+r,new Pe(0,s,o.value,!1)):this.set(e,r,n)}return this.set(e,r,n)}set(e,r,n){let o=n*1e3,s=this._storage.get(e);s&&s.timeoutId&&clearTimeout(s.timeoutId);let a=new gt(r,o>0?Date.now()+o:null);return this._storage.set(e,a),o>0&&(a.timeoutId=setTimeout(()=>{this._storage.delete(e)},o),a.timeoutId.unref&&a.timeoutId.unref()),new Pe(0,o===0?-1:o,a.value,!0)}get(e){let r=this._storage.get(e);if(r){let n=r.expiresAt?r.expiresAt-Date.now():-1;return new Pe(0,n,r.value,!1)}return null}delete(e){let r=this._storage.get(e);return r?(r.timeoutId&&clearTimeout(r.timeoutId),this._storage.delete(e),!0):!1}_restoreRecord(e,r,n){let o=Date.now(),s=n!==null;if(s&&!Number.isFinite(n)||s&&n<=o)return;let a=s?n-o:0,i=this._storage.get(e);i&&i.timeoutId&&clearTimeout(i.timeoutId);let c=new gt(r,n);this._storage.set(e,c),a>0&&(c.timeoutId=setTimeout(()=>{this._storage.delete(e)},a),c.timeoutId.unref&&c.timeoutId.unref())}}});var vt=V((as,xt)=>{"use strict";var Rr=pt(),Pr=wt(),bt=Re(),_e=class extends Rr{constructor(e={}){super(e),this._memoryStorage=new Pr}consume(e,r=1,n={}){return new Promise((o,s)=>{let a=this.getKey(e),i=this._getKeySecDuration(n),c=this._memoryStorage.incrby(a,r,i);if(c.remainingPoints=Math.max(this.points-c.consumedPoints,0),c.consumedPoints>this.points)this.blockDuration>0&&c.consumedPoints<=this.points+r&&(c=this._memoryStorage.set(a,c.consumedPoints,this.blockDuration)),s(c);else if(this.execEvenly&&this.points>0&&c.msBeforeNext>0&&!c.isFirstInDuration){let l=Math.ceil(c.msBeforeNext/(c.remainingPoints+2));l<this.execEvenlyMinDelayMs&&(l=c.consumedPoints*this.execEvenlyMinDelayMs),c.msBeforeNext=Math.max(c.msBeforeNext-l,0),setTimeout(o,l,c)}else o(c)})}penalty(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let a=this._getKeySecDuration(n),i=this._memoryStorage.incrby(o,r,a);i.remainingPoints=Math.max(this.points-i.consumedPoints,0),s(i)})}reward(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let a=this._getKeySecDuration(n),i=this._memoryStorage.incrby(o,-r,a);i.remainingPoints=Math.max(this.points-i.consumedPoints,0),s(i)})}block(e,r){let n=r*1e3,o=this.points+1;return this._memoryStorage.set(this.getKey(e),o,r),Promise.resolve(new bt(0,n===0?-1:n,o))}set(e,r,n){let o=(n>=0?n:this.duration)*1e3;return this._memoryStorage.set(this.getKey(e),r,n),Promise.resolve(new bt(0,o===0?-1:o,r))}get(e){let r=this._memoryStorage.get(this.getKey(e));return r!==null&&(r.remainingPoints=Math.max(this.points-r.consumedPoints,0)),Promise.resolve(r)}delete(e){return Promise.resolve(this._memoryStorage.delete(this.getKey(e)))}dump(){let e=[];for(let[r,n]of this._memoryStorage._storage)e.push({key:this.parseKey(r),value:n.value,expiresAt:n.expiresAt});return{version:1,dumpedAt:Date.now(),storage:e}}restore(e,r=!1){if(!e||typeof e!="object"||e.version!==1)return;let n=r?{invalid:{count:0,keys:[]},expired:{count:0,keys:[]},restored:{count:0,keys:[]}}:{invalid:0,expired:0,restored:0},o=(s,a)=>{r?(n[s].count+=1,n[s].keys.push(a)):n[s]+=1};if(!Array.isArray(e.storage))return n;for(let s of e.storage){if(!s||typeof s!="object"){o("invalid","N/A");continue}let a=typeof s.key=="string"||typeof s.key=="number",i=Number.isFinite(s.value),c=s.expiresAt===null||Number.isFinite(s.expiresAt);if(!a||!i||!c){o("invalid",s.key);continue}if(s.expiresAt!==null&&s.expiresAt<=Date.now()){o("expired",s.key);continue}this._memoryStorage._restoreRecord(this.getKey(s.key),s.value,s.expiresAt),o("restored",s.key)}return n}};xt.exports=_e});var ce=(t,e,r)=>(n,o)=>{let s=-1;return a(0);async function a(i){if(i<=s)throw new Error("next() called multiple times");s=i;let c,l=!1,u;if(t[i]?(u=t[i][0][0],n.req.routeIndex=i):u=i===t.length&&o||void 0,u)try{c=await u(n,()=>a(i+1))}catch(p){if(p instanceof Error&&e)n.error=p,c=await e(p,n),l=!0;else throw p}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Ue=Symbol();var je=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,n=>n.toLowerCase())}}).formData();var He=32,lr=1e4,G=t=>"headers"in t,qe=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,a=(G(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return a==="multipart/form-data"||a==="application/x-www-form-urlencoded"?ur(t,{all:r,dot:n}):{}};async function ur(t,e){if(!G(t)&&t.bodyCache.formData)return $e(await t.bodyCache.formData,e);let r=G(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),o=je(n,r.get("Content-Type")||"");G(t)||(t.bodyCache.formData=o);let s=await o;return s?$e(s,e):{}}function $e(t,e){let r=Object.create(null),n={count:0};return t.forEach((o,s)=>{e.all||s.endsWith("[]")?dr(r,s,o):r[s]=o}),e.dot&&Object.entries(r).forEach(([o,s])=>{o.includes(".")&&(pr(r,o,s,n),delete r[o])}),r}var dr=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},pr=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let o=t,s=e.split(".",He+2);s.length>He+1&&Be(),s.forEach((a,i)=>{i===s.length-1?o[a]=r:((!o[a]||typeof o[a]!="object"||Array.isArray(o[a])||o[a]instanceof File)&&(n.count++>=lr&&Be(),o[a]=Object.create(null)),o=o[a])})},Be=()=>{throw new Error("Nesting limit exceeded")};var ue=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ze=t=>{let{groups:e,path:r}=hr(t),n=ue(r);return fr(n,e)},hr=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return e.push([o,r]),o}),{groups:e,path:t}},fr=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let o=t.length-1;o>=0;o--)if(t[o].includes(n)){t[o]=t[o].replace(n,e[r][1]);break}}return t},X={},Fe=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return X[n]||(r[2]?X[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:X[n]=[t,r[1],!0]),X[n]}return null},We=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},mr=t=>We(t,decodeURI),de=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let o=e.charCodeAt(n);if(o===37){let s=e.indexOf("?",n),a=e.indexOf("#",n),i=s===-1?a===-1?void 0:a:a===-1?s:Math.min(s,a),c=e.slice(r,i);return mr(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return e.slice(r,n)};var Ve=t=>{let e=de(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},N=(t,e,...r)=>(r.length&&(e=N(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Y=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(o.charCodeAt(o.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.slice(0,-1);n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,a)=>a.indexOf(o)===s)},Q=t=>t.indexOf("%")!==-1?We(t,gr):t,le=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Q(t)),Ke=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let o;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let i=t.indexOf("?",8);if(i===-1)return;for(t.startsWith(e,i+1)||(i=t.indexOf(`&${e}`,i+1));i!==-1;){let c=t.charCodeAt(i+e.length+1);if(c===61){let l=i+e.length+2,u=t.indexOf("&",l);return le(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";i=t.indexOf(`&${e}`,i+1)}if(o=/[%+]/.test(t),!o)return}let s=Object.create(null);o??=/[%+]/.test(t);let a=t.indexOf("?",8);for(;a!==-1;){let i=t.indexOf("&",a+1),c=t.indexOf("=",a);c>i&&i!==-1&&(c=-1);let l=t.slice(a+1,c===-1?i===-1?void 0:i:c);if(o&&(l=le(l)),a=i,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,i===-1?void 0:i),o&&(u=le(u))),r?(s[l]&&Array.isArray(s[l])||(s[l]=[]),s[l].push(u)):s[l]??=u}return e?s[e]:s},Je=Ke,Ge=(t,e)=>Ke(t,e,!0),gr=decodeURIComponent;var Xe=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#e=r}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#e[0][this.routeIndex]?.[1][t],r=this.#n(e);return r&&Q(r)}#s(){let t={},e=Object.keys(this.#e[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#n(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Q(n))}return t}#n(t){return this.#e[1]?this.#e[1][t]:t}query(t){return Je(this.url,t)}queries(t){return Ge(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return qe(this,t)}#o=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let o in e)return e[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[t]()));return e[t]=r[t]()};json(){return this.#o("text").then(t=>JSON.parse(t))}text(){return this.#o("text")}arrayBuffer(){return this.#o("arrayBuffer")}bytes(){return this.#o("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#o("blob")}formData(){return this.#o("formData")}addValidatedData(t,e){(this.#t??={})[t]=e}valid(t){return this.#t?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[Ue](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,t]])=>t)}get routePath(){return this.#e[0].map(([[,t]])=>t)[this.routeIndex].path}};var Ye={Stringify:1,BeforeStream:2,Stream:3},yr=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var pe=async(t,e,r,n,o)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);o?o[0]+=t:o=[t];let a=Promise.all(s.map(i=>i({phase:e,buffer:o,context:n}))).then(i=>Promise.all(i.filter(Boolean).map(c=>pe(c,e,!1,n,o))).then(()=>o[0]));return r?yr(await a,s):a};var wr="text/plain; charset=UTF-8",he=(t,e)=>({"Content-Type":t,...e}),K=(t,e)=>new Response(t,e),fe=class{#t;#e;env={};#r;finalized=!1;error;#s;#n;#o;#u;#c;#l;#a;#d;#p;constructor(t,e){this.#t=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#e??=new Xe(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#o||=K(null,{headers:this.#a??=new Headers})}set res(t){if(this.#o&&t){t=K(t.body,t);for(let[e,r]of this.#o.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#o.headers.getSetCookie();t.headers.delete("set-cookie");for(let o of n)t.headers.append("set-cookie",o)}else t.headers.set(e,r)}this.#o=t,this.finalized=!0}render=(...t)=>(this.#c??=e=>this.html(e),this.#c(...t));setLayout=t=>this.#u=t;getLayout=()=>this.#u;setRenderer=t=>{this.#c=t};header=(t,e,r)=>{this.finalized&&(this.#o=K(this.#o.body,this.#o));let n=this.#o?this.#o.headers:this.#a??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(t,e,r){let n=this.#o?new Headers(this.#o.headers):this.#a;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[s,a]of new Headers(e.headers))s==="set-cookie"?n.append(s,a):n.set(s,a)}if(r){if(!n){let s=0;for(let a in r)if(++s>1||typeof r[a]!="string"){n=new Headers;break}}if(n)for(let s in r){let a=r[s];if(typeof a=="string")n.set(s,a);else{n.delete(s);for(let i of a)n.append(s,i)}}}let o=typeof e=="number"?e:e?.status??this.#s;return K(t,{status:o,headers:n??r})}newResponse=(...t)=>this.#i(...t);body=(t,e,r)=>this.#i(t,e,r);text=(t,e,r)=>!this.#a&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#i(t,e,he(wr,r));json=(t,e,r)=>this.#i(JSON.stringify(t),e,he("application/json",r));html=(t,e,r)=>{let n=o=>this.#i(o,e,he("text/html; charset=UTF-8",r));return typeof t=="object"?pe(t,Ye.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>K(),this.#l(this))};var A="ALL",Qe="all",Ze=["get","post","put","delete","options","patch","query"],Z="Can not add a route since the matcher is already built.",ee=class extends Error{};var et="__COMPOSED_HANDLER";var br=t=>t.text("404 Not Found",404),tt=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},rt=class nt{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[...Ze,Qe].forEach(s=>{this[s]=(a,...i)=>(typeof a=="string"?this.#t=a:this.#s(s,this.#t,a),i.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,a,...i)=>{for(let c of[a].flat()){this.#t=c;for(let l of[s].flat())i.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...a)=>(typeof s=="string"?this.#t=s:(this.#t="*",a.unshift(s)),a.forEach(i=>{this.#s(A,this.#t,i)}),this);let{strict:n,...o}=e;Object.assign(this,o),this.getPath=n??!0?e.getPath??de:Ve}#e(){let e=new nt({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=br;errorHandler=tt;route(e,r){let n=this.basePath(e);return r.routes.map(o=>{let s;r.errorHandler===tt?s=o.handler:(s=async(a,i)=>(await ce([],r.errorHandler)(a,()=>o.handler(a,i))).res,s[et]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(e){let r=this.#e();return r._basePath=N(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let a=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=N(this._basePath,e),l=c==="/"?0:c.length;return u=>{let p=new URL(u.url);return p.pathname=this.getPath(u).slice(l)||"/",new Request(p,u)}})();let i=async(c,l)=>{let u=await r(o(c.req.raw),...a(c));if(u)return u;await l()};return this.#s(A,N(e,"*"),i),this}#s(e,r,n,o){e=e.toUpperCase(),r=N(this._basePath,r);let s={basePath:o!==void 0?N(this._basePath,o):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#o(e,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#o(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),a=this.router.match(o,s),i=new fe(e,{path:s,matchResult:a,env:n,executionCtx:r,notFoundHandler:this.#r});if(a[0].length===1){let l;try{l=a[0][0][0][0](i,async()=>{i.res=await this.#r(i)})}catch(u){return this.#n(u,i)}return l instanceof Promise?l.then(u=>u||(i.finalized?i.res:this.#r(i))).catch(u=>this.#n(u,i)):l??this.#r(i)}let c=ce(a[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(i);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,i)}})()}fetch=(e,...r)=>this.#o(e,r[1],r[0],e.method);request=(e,r,n,o)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,o):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${N("/",e)}`,r),n,o));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#o(e.request,e,void 0,e.request.method))})}};var R=()=>Object.create(null);var te=[];function me(t,e){let r=this.buildAllMatchers(),n=((o,s)=>{let a=r[o]||r[A],i=a[2][s];if(i)return i;let c=s.match(a[0]);if(!c)return[[],te];let l=c.indexOf("",1);return[a[1][l],c]});return this.match=n,n(t,e)}var F="[^/]+",j=".*",I="(?:|/.*)",U=Symbol(),ot=new Set(".\\+*[^]$()");function xr(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===j||t===I?e===I?-1:1:e===j||e===I?-1:t===F?1:e===F?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var st=class ge{#t;#e;#r=R();insert(e,r,n,o,s){let a=this;for(let i=0,c=e.length;i<c;i++){let l=e[i],u=l.length===1?l==="*"?i===c-1?["","",j]:["","",F]:null:l==="/*"?["","",I]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),p;if(u){let h=u[1],f=u[2]||F;if(h&&u[2]&&(f===".*"||(f=f.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(f))||f.length===1&&ot.has(f)))throw U;if(p=a.#r[f],!p){if(f!==j&&f!==I){for(let x in a.#r)if((f.length>1||x.length>1)&&x!==j&&x!==I)throw U}p=a.#r[f]=new ge}h!==""&&(p.#e??=o.varIndex++,n.push([h,p.#e]))}else if(p=a.#r[l],!p){for(let h in a.#r)if(h.length>1&&h!==j&&h!==I)throw U;p=a.#r[l]=new ge}a=p}if(a.#t!==void 0)throw U;a.#t=s?-1:r}buildRegExpStr(){let r=Object.keys(this.#r).sort(xr).map(n=>{let o=this.#r[n],s=o.buildRegExpStr();return s===""?"":(typeof o.#e=="number"?`(${n})@${o.#e}`:ot.has(n)?`\\${n}`:n)+s}).filter(Boolean);return typeof this.#t=="number"&&this.#t!==-1&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var ye=class{#t={varIndex:0};#e=new st;#r=0;paths=R();insert(t,e){if(e){this.#e.insert(t.split(""),0,[],this.#t,!0);return}let r=[],n=[],o=t;for(let a=0;;){let i=!1;if(o=o.replace(/\{[^}]+\}/g,c=>{let l=`@\\${a}`;return n[a]=[l,c],a++,i=!0,l}),!i)break}let s=o.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let a=n.length-1;a>=0;a--){let[i]=n[a];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(i)!==-1){s[c]=s[c].replace(i,n[a][1]);break}}this.#e.insert(s,this.#r,r,this.#t,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#e.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,a)=>s!==void 0?(r[++e]=Number(s),"$()"):(a!==void 0&&(n[Number(a)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var it=R();function at(t){return it[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?I:e==="*"?j:`/:${F}`)}$`)}function re(t,e){for(let r of Object.keys(t).sort((n,o)=>o.length-n.length))if(at(r).test(e))return[...t[r]]}var ne=class{name="RegExpRouter";#t;#e;#r;constructor(){this.#t={[A]:R()},this.#e={[A]:R()},this.#r={[A]:new ye}}#s(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===U?new ee(e):r}}add(t,e,r){let n=this.#t,o=this.#e;if(!n)throw new Error(Z);if(!n[t]){this.#r[t]=new ye;for(let i of[n,o]){i[t]=R();for(let c in i[A])i[t][c]=[...i[A][c]],this.#s(t,c)}}e==="/*"&&(e="*");let s=t===A?Object.keys(n):[t];if(/\*$/.test(e)){let i=at(e);for(let c of s)n[c][e]||(this.#s(c,e),n[c][e]=re(n[c],e)||re(n[A],e)||[]);for(let c of[n,o])for(let l of s)for(let u in c[l])i.test(u)&&c[l][u].push([r,e]);return}let a=Y(e)||[e];for(let i of a)for(let c of s)o[c][i]||(this.#s(c,i),o[c][i]=re(n[c],i)||re(n[A],i)||[]),o[c][i].push([r,i])}match=me;buildAllMatchers(){let t=R();for(let e of Object.keys(this.#e))t[e]=this.#n(e);return this.#t=this.#e=this.#r=void 0,it=R(),t}#n(t){let e=this.#t[t],r=this.#e[t],n=this.#r[t],o=R(),s=[],[a,i,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let p=l[u],h=n.paths[u];if(!h){o[u]=[p.map(([f])=>[f,R()]),te];continue}s[h[0]]=p.map(([f,x])=>[f,n.paths[x][1].reduceRight((b,[v],g)=>(b[v]=c[h[1][g][1]],b),R())])}return[a,i.map(l=>s[l]),o]}};var we=class{name="SmartRouter";#t=[];#e=[];constructor(t){this.#t=t.routers}add(t,e,r){if(!this.#e)throw new Error(Z);this.#e.push([t,e,r])}match(t,e){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,a;for(;s<o;s++){let i=r[s];try{for(let c=0,l=n.length;c<l;c++)i.add(...n[c]);a=i.match(t,e)}catch(c){if(c instanceof ee)continue;throw c}this.match=i.match.bind(i),this.#t=[i],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,a}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var be=R(),vr=0,ct=class lt{#t=[];#e=R();#r=[];#s;#n=be;insert(e,r,n){let o=this,s=ze(r),a=new Set,i=0;for(let c of s){let l=s[++i],u=Fe(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),p=Array.isArray(u),h=p?u[0]:u||c,f=o.#e[h]||=new lt;u&&!f.#s&&(f.#s=u,o.#r.push(f)),o=f,p&&a.add(u[1])}o.#t.push({[e]:{handler:n,possibleKeys:[...a],score:++vr}})}#o(e,r,n,o,s){for(let a=0,i=r.#t.length;a<i;a++){let c=r.#t[a],l=c[n]||c[A];if(l){l.params=R(),e.push(l);for(let u=0,p=l.possibleKeys.length;u<p;u++){let h=l.possibleKeys[u];l.params[h]=s?.[h]&&!u?s[h]:o[h]??s?.[h]}}}}search(e,r){let n=[];this.#n=be;let s=[this],a=ue(r),i=[],c=a.length,l=null;for(let u=0;u<c;u++){let p=a[u],h=u===c-1,f=[];for(let b=0,v=s.length;b<v;b++){let g=s[b],d=g.#e[p];d&&(d.#n=g.#n,h?(d.#e["*"]&&this.#o(n,d.#e["*"],e,g.#n),this.#o(n,d,e,g.#n)):f.push(d));for(let m of g.#r){let y=m.#s,P=g.#n===be?{}:{...g.#n};if(typeof y=="string"){(y==="*"||p.startsWith(y.slice(0,-1)))&&(this.#o(n,m,e,g.#n),y==="*"&&(m.#n=P,f.push(m)));continue}let[,L,O]=y;if(!(!p&&O===!0)){if(O!==!0){if(!l){l=[];let S=r[0]==="/"?1:0;for(let w=0;w<c;w++)l[w]=S,S+=a[w].length+1}let _=r.slice(l[u]),E=O.exec(_);if(E){P[L]=E[0],this.#o(n,m,e,g.#n,P),E[0].length===_.length&&m.#e["*"]&&this.#o(n,m.#e["*"],e,g.#n,P);for(let S in m.#e){m.#n=P;let w=E[0].match(/\//g)?.length??0;(i[w]||=[]).push(m);break}continue}}(O===!0||O.test(p))&&(P[L]=p,h?(this.#o(n,m,e,P,g.#n),m.#e["*"]&&this.#o(n,m.#e["*"],e,P,g.#n)):(m.#n=P,f.push(m)))}}}let x=i.shift();s=x?f.concat(x):f}return n[1]&&n.sort((u,p)=>u.score-p.score),[n.map(({handler:u,params:p})=>[u,p])]}};var xe=class{name="TrieRouter";#t=new ct;add(t,e,r){for(let n of Y(e)||[e])this.#t.insert(t,n,r)}match(t,e){return this.#t.search(t,e)}};var ve=class extends rt{constructor(t={}){super(t),this.router=t.router??new we({routers:[new ne,new xe]})}};import{Readable as fn}from"stream";function ut(t=""){return`<link rel="icon" type="image/svg+xml" href="${`${t.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as Rt,readFileSync as Sr}from"fs";import k from"path";import{fileURLToPath as Ar}from"url";import{gunzipSync as Cr}from"zlib";var D=cr(vt(),1);function W(t,e){return t.header("Retry-After",String(_r(e))),t.json({error:"Too Many Requests"},429)}function _r(t){return t&&typeof t=="object"&&"msBeforeNext"in t&&typeof t.msBeforeNext=="number"&&Number.isFinite(t.msBeforeNext)?Math.max(1,Math.ceil(t.msBeforeNext/1e3)):60}var Or={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Lr(){let t=k.dirname(Ar(import.meta.url));for(let e of[k.resolve(t,"app"),k.resolve(t,"../app"),k.resolve(t,"../../dist/app")])if(Rt(k.join(e,"inspector.js.gz")))return e;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function Pt(t,e="/inspector/assets"){let r=Lr(),n=new Map,o=new D.default({points:600,duration:60}),s=async(a,i)=>{try{await o.consume(a.req)}catch(c){return W(a,c)}return i()};t.use(`${e}/*`,s),t.get(`${e}/*`,async a=>{let i=a.req.path.slice(e.length),c=i.startsWith("/")?i.slice(1):i;if(!c||c.includes(".."))return a.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=k.resolve(r,l),p=r.endsWith(k.sep)?r:`${r}${k.sep}`;if(!u.startsWith(p)||!Rt(u))return a.notFound();let h=k.extname(c),f=l.endsWith(".gz"),x=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(a.req.header("accept-encoding")??""),b=Sr(u),v=f&&!x?n.get(u)??Tr(n,u,b):b,g=v.buffer.slice(v.byteOffset,v.byteOffset+v.byteLength);return a.body(g,200,{"Content-Type":Or[h]??"application/octet-stream",...f&&x?{"Content-Encoding":"gzip"}:{},...f?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Tr(t,e,r){let n=Cr(r);return t.set(e,n),n}var _t={name:"@mcp-use/inspector",type:"module",version:"20.3.13",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"},"./client/styles.css":{default:"./dist/client/styles.css"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"pnpm run clean && pnpm run build:client-exports && pnpm run build:server && pnpm run build:app && pnpm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts && node scripts/copy-client-styles.mjs","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs",test:"vitest run","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.16 || ^2.0.17 || ^2.0.18 || ^2.0.19","@mcp-use/client":"^2.0.1 || ^2.1.0 || ^2.1.1 || ^2.1.2 || ^2.1.3 || ^2.1.4 || ^2.1.5 || ^2.2.0 || ^2.2.1 || ^2.2.2 || ^2.2.3 || ^2.2.4 || ^2.2.5 || ^2.3.0 || ^2.3.1 || ^2.3.2 || ^2.3.3 || ^2.3.4","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},"mcp-use":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^2.0.5","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.13.5",jsdom:"^27.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^8.3.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",yaml:"^2.8.3",zod:"^4.2.0"}};var Ir=_t.version;function Et(){return Ir}var Dr=`<!doctype html>
+var rr=Object.create;var Ne=Object.defineProperty;var nr=Object.getOwnPropertyDescriptor;var or=Object.getOwnPropertyNames;var sr=Object.getPrototypeOf,ir=Object.prototype.hasOwnProperty;var V=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports);var ar=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of or(e))!ir.call(t,o)&&o!==r&&Ne(t,o,{get:()=>e[o],enumerable:!(n=nr(e,o))||n.enumerable});return t};var cr=(t,e,r)=>(r=t!=null?rr(sr(t)):{},ar(e||!t||!t.__esModule?Ne(r,"default",{value:t,enumerable:!0}):r,t));var pt=V((es,dt)=>{"use strict";dt.exports=class{constructor(e={}){this.points=e.points,this.duration=e.duration,this.blockDuration=e.blockDuration,this.execEvenly=e.execEvenly,this.execEvenlyMinDelayMs=e.execEvenlyMinDelayMs,this.keyPrefix=e.keyPrefix}get points(){return this._points}set points(e){if(Number.isFinite(e))this._points=e;else throw new Error("points must be set and must be a finite number")}get duration(){return this._duration}set duration(e){if(typeof e=="number"&&Number.isFinite(e)&&e>=0)this._duration=e;else throw new Error("duration must be set and must be a finite, non-negative number")}get msDuration(){return this.duration*1e3}get blockDuration(){return this._blockDuration}set blockDuration(e){this._blockDuration=typeof e>"u"?0:e}get msBlockDuration(){return this.blockDuration*1e3}get execEvenly(){return this._execEvenly}set execEvenly(e){this._execEvenly=typeof e>"u"?!1:!!e}get execEvenlyMinDelayMs(){return this._execEvenlyMinDelayMs===void 0?this._getExecEvenlyMinDelayMsDefault():this._execEvenlyMinDelayMs}set execEvenlyMinDelayMs(e){this._execEvenlyMinDelayMs=e}_getExecEvenlyMinDelayMsDefault(){return this.points>0?Math.ceil(this.msDuration/this.points):0}get keyPrefix(){return this._keyPrefix}set keyPrefix(e){if(typeof e>"u"&&(e="rlflx"),typeof e!="string")throw new Error("keyPrefix must be string");this._keyPrefix=e}_getKeySecDuration(e={}){return e&&e.customDuration>=0?e.customDuration:this.duration}getKey(e){return this.keyPrefix.length>0?`${this.keyPrefix}:${e}`:e}parseKey(e){return this.keyPrefix.length>0?e.substring(this.keyPrefix.length+1):e}consume(){throw new Error("You have to implement the method 'consume'!")}penalty(){throw new Error("You have to implement the method 'penalty'!")}reward(){throw new Error("You have to implement the method 'reward'!")}get(){throw new Error("You have to implement the method 'get'!")}set(){throw new Error("You have to implement the method 'set'!")}block(){throw new Error("You have to implement the method 'block'!")}delete(){throw new Error("You have to implement the method 'delete'!")}}});var ft=V((rs,ht)=>{"use strict";ht.exports=class{constructor(e,r,n=null){this.value=e,this.expiresAt=r,this.timeoutId=n}get value(){return this._value}set value(e){this._value=parseInt(e,10)}get expiresAt(){return this._expiresAt}set expiresAt(e){e instanceof Date?this._expiresAt=e.getTime():this._expiresAt=e}get timeoutId(){return this._timeoutId}set timeoutId(e){this._timeoutId=e}}});var Re=V((os,mt)=>{"use strict";mt.exports=class{constructor(e,r,n,o){this.remainingPoints=typeof e>"u"?0:e,this.msBeforeNext=typeof r>"u"?0:r,this.consumedPoints=typeof n>"u"?0:n,this.isFirstInDuration=typeof o>"u"?!1:o}get msBeforeNext(){return this._msBeforeNext}set msBeforeNext(e){return this._msBeforeNext=e,this}get remainingPoints(){return this._remainingPoints}set remainingPoints(e){return this._remainingPoints=e,this}get consumedPoints(){return this._consumedPoints}set consumedPoints(e){return this._consumedPoints=e,this}get isFirstInDuration(){return this._isFirstInDuration}set isFirstInDuration(e){this._isFirstInDuration=!!e}_getDecoratedProperties(){return{remainingPoints:this.remainingPoints,msBeforeNext:this.msBeforeNext,consumedPoints:this.consumedPoints,isFirstInDuration:this.isFirstInDuration}}[Symbol.for("nodejs.util.inspect.custom")](){return this._getDecoratedProperties()}toString(){return JSON.stringify(this._getDecoratedProperties())}toJSON(){return this._getDecoratedProperties()}}});var wt=V((is,yt)=>{"use strict";var gt=ft(),Pe=Re();yt.exports=class{constructor(){this._storage=new Map}incrby(e,r,n){let o=this._storage.get(e);if(o){let s=o.expiresAt?o.expiresAt-Date.now():-1;return!o.expiresAt||s>0?(o.value=o.value+r,new Pe(0,s,o.value,!1)):this.set(e,r,n)}return this.set(e,r,n)}set(e,r,n){let o=n*1e3,s=this._storage.get(e);s&&s.timeoutId&&clearTimeout(s.timeoutId);let a=new gt(r,o>0?Date.now()+o:null);return this._storage.set(e,a),o>0&&(a.timeoutId=setTimeout(()=>{this._storage.delete(e)},o),a.timeoutId.unref&&a.timeoutId.unref()),new Pe(0,o===0?-1:o,a.value,!0)}get(e){let r=this._storage.get(e);if(r){let n=r.expiresAt?r.expiresAt-Date.now():-1;return new Pe(0,n,r.value,!1)}return null}delete(e){let r=this._storage.get(e);return r?(r.timeoutId&&clearTimeout(r.timeoutId),this._storage.delete(e),!0):!1}_restoreRecord(e,r,n){let o=Date.now(),s=n!==null;if(s&&!Number.isFinite(n)||s&&n<=o)return;let a=s?n-o:0,i=this._storage.get(e);i&&i.timeoutId&&clearTimeout(i.timeoutId);let c=new gt(r,n);this._storage.set(e,c),a>0&&(c.timeoutId=setTimeout(()=>{this._storage.delete(e)},a),c.timeoutId.unref&&c.timeoutId.unref())}}});var vt=V((as,xt)=>{"use strict";var Rr=pt(),Pr=wt(),bt=Re(),Ee=class extends Rr{constructor(e={}){super(e),this._memoryStorage=new Pr}consume(e,r=1,n={}){return new Promise((o,s)=>{let a=this.getKey(e),i=this._getKeySecDuration(n),c=this._memoryStorage.incrby(a,r,i);if(c.remainingPoints=Math.max(this.points-c.consumedPoints,0),c.consumedPoints>this.points)this.blockDuration>0&&c.consumedPoints<=this.points+r&&(c=this._memoryStorage.set(a,c.consumedPoints,this.blockDuration)),s(c);else if(this.execEvenly&&this.points>0&&c.msBeforeNext>0&&!c.isFirstInDuration){let l=Math.ceil(c.msBeforeNext/(c.remainingPoints+2));l<this.execEvenlyMinDelayMs&&(l=c.consumedPoints*this.execEvenlyMinDelayMs),c.msBeforeNext=Math.max(c.msBeforeNext-l,0),setTimeout(o,l,c)}else o(c)})}penalty(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let a=this._getKeySecDuration(n),i=this._memoryStorage.incrby(o,r,a);i.remainingPoints=Math.max(this.points-i.consumedPoints,0),s(i)})}reward(e,r=1,n={}){let o=this.getKey(e);return new Promise(s=>{let a=this._getKeySecDuration(n),i=this._memoryStorage.incrby(o,-r,a);i.remainingPoints=Math.max(this.points-i.consumedPoints,0),s(i)})}block(e,r){let n=r*1e3,o=this.points+1;return this._memoryStorage.set(this.getKey(e),o,r),Promise.resolve(new bt(0,n===0?-1:n,o))}set(e,r,n){let o=(n>=0?n:this.duration)*1e3;return this._memoryStorage.set(this.getKey(e),r,n),Promise.resolve(new bt(0,o===0?-1:o,r))}get(e){let r=this._memoryStorage.get(this.getKey(e));return r!==null&&(r.remainingPoints=Math.max(this.points-r.consumedPoints,0)),Promise.resolve(r)}delete(e){return Promise.resolve(this._memoryStorage.delete(this.getKey(e)))}dump(){let e=[];for(let[r,n]of this._memoryStorage._storage)e.push({key:this.parseKey(r),value:n.value,expiresAt:n.expiresAt});return{version:1,dumpedAt:Date.now(),storage:e}}restore(e,r=!1){if(!e||typeof e!="object"||e.version!==1)return;let n=r?{invalid:{count:0,keys:[]},expired:{count:0,keys:[]},restored:{count:0,keys:[]}}:{invalid:0,expired:0,restored:0},o=(s,a)=>{r?(n[s].count+=1,n[s].keys.push(a)):n[s]+=1};if(!Array.isArray(e.storage))return n;for(let s of e.storage){if(!s||typeof s!="object"){o("invalid","N/A");continue}let a=typeof s.key=="string"||typeof s.key=="number",i=Number.isFinite(s.value),c=s.expiresAt===null||Number.isFinite(s.expiresAt);if(!a||!i||!c){o("invalid",s.key);continue}if(s.expiresAt!==null&&s.expiresAt<=Date.now()){o("expired",s.key);continue}this._memoryStorage._restoreRecord(this.getKey(s.key),s.value,s.expiresAt),o("restored",s.key)}return n}};xt.exports=Ee});var ce=(t,e,r)=>(n,o)=>{let s=-1;return a(0);async function a(i){if(i<=s)throw new Error("next() called multiple times");s=i;let c,l=!1,u;if(t[i]?(u=t[i][0][0],n.req.routeIndex=i):u=i===t.length&&o||void 0,u)try{c=await u(n,()=>a(i+1))}catch(d){if(d instanceof Error&&e)n.error=d,c=await e(d,n),l=!0;else throw d}else n.finalized===!1&&r&&(c=await r(n));return c&&(n.finalized===!1||l)&&(n.res=c),n}};var Ue=Symbol();var je=(t,e)=>new Response(t,{headers:{"Content-Type":e.replace(/^[^;]+/,n=>n.toLowerCase())}}).formData();var He=32,lr=1e4,G=t=>"headers"in t,qe=async(t,e=Object.create(null))=>{let{all:r=!1,dot:n=!1}=e,a=(G(t)?t.headers:t.raw.headers).get("Content-Type")?.split(";")[0].trim().toLowerCase();return a==="multipart/form-data"||a==="application/x-www-form-urlencoded"?ur(t,{all:r,dot:n}):{}};async function ur(t,e){if(!G(t)&&t.bodyCache.formData)return $e(await t.bodyCache.formData,e);let r=G(t)?t.headers:t.raw.headers,n=await t.arrayBuffer(),o=je(n,r.get("Content-Type")||"");G(t)||(t.bodyCache.formData=o);let s=await o;return s?$e(s,e):{}}function $e(t,e){let r=Object.create(null),n={count:0};return t.forEach((o,s)=>{e.all||s.endsWith("[]")?dr(r,s,o):r[s]=o}),e.dot&&Object.entries(r).forEach(([o,s])=>{o.includes(".")&&(pr(r,o,s,n),delete r[o])}),r}var dr=(t,e,r)=>{t[e]!==void 0?Array.isArray(t[e])?t[e].push(r):t[e]=[t[e],r]:e.endsWith("[]")?t[e]=[r]:t[e]=r},pr=(t,e,r,n)=>{if(/(?:^|\.)__proto__\./.test(e))return;let o=t,s=e.split(".",He+2);s.length>He+1&&Be(),s.forEach((a,i)=>{i===s.length-1?o[a]=r:((!o[a]||typeof o[a]!="object"||Array.isArray(o[a])||o[a]instanceof File)&&(n.count++>=lr&&Be(),o[a]=Object.create(null)),o=o[a])})},Be=()=>{throw new Error("Nesting limit exceeded")};var ue=t=>{let e=t.split("/");return e[0]===""&&e.shift(),e},ze=t=>{let{groups:e,path:r}=hr(t),n=ue(r);return fr(n,e)},hr=t=>{let e=[];return t=t.replace(/\{[^}]+\}/g,(r,n)=>{let o=`@${n}`;return e.push([o,r]),o}),{groups:e,path:t}},fr=(t,e)=>{for(let r=e.length-1;r>=0;r--){let[n]=e[r];for(let o=t.length-1;o>=0;o--)if(t[o].includes(n)){t[o]=t[o].replace(n,e[r][1]);break}}return t},X={},Fe=(t,e)=>{if(t==="*")return"*";let r=t.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/);if(r){let n=`${t}#${e}`;return X[n]||(r[2]?X[n]=e&&e[0]!==":"&&e[0]!=="*"?[n,r[1],new RegExp(`^${r[2]}(?=/${e})`)]:[t,r[1],new RegExp(`^${r[2]}$`)]:X[n]=[t,r[1],!0]),X[n]}return null},We=(t,e)=>{try{return e(t)}catch{return t.replace(/(?:%[0-9A-Fa-f]{2})+/g,r=>{try{return e(r)}catch{return r}})}},mr=t=>We(t,decodeURI),de=t=>{let e=t.url,r=e.indexOf("/",e.indexOf(":")+4),n=r;for(;n<e.length;n++){let o=e.charCodeAt(n);if(o===37){let s=e.indexOf("?",n),a=e.indexOf("#",n),i=s===-1?a===-1?void 0:a:a===-1?s:Math.min(s,a),c=e.slice(r,i);return mr(c.includes("%25")?c.replace(/%25/g,"%2525"):c)}else if(o===63||o===35)break}return e.slice(r,n)};var Ve=t=>{let e=de(t);return e.length>1&&e.at(-1)==="/"?e.slice(0,-1):e},N=(t,e,...r)=>(r.length&&(e=N(e,...r)),`${t?.[0]==="/"?"":"/"}${t}${e==="/"?"":`${t?.at(-1)==="/"?"":"/"}${e?.[0]==="/"?e.slice(1):e}`}`),Y=t=>{if(t.charCodeAt(t.length-1)!==63||!t.includes(":"))return null;let e=t.split("/"),r=[],n="";return e.forEach(o=>{if(o!==""&&!/\:/.test(o))n+="/"+o;else if(/\:/.test(o))if(o.charCodeAt(o.length-1)===63){r.length===0&&n===""?r.push("/"):r.push(n);let s=o.slice(0,-1);n+="/"+s,r.push(n)}else n+="/"+o}),r.filter((o,s,a)=>a.indexOf(o)===s)},Q=t=>t.indexOf("%")!==-1?We(t,gr):t,le=t=>(t.indexOf("+")!==-1&&(t=t.replace(/\+/g," ")),Q(t)),Ke=(t,e,r)=>{let n=t.indexOf("#",8);n!==-1&&(t=t.slice(0,n));let o;if(!r&&e&&e.indexOf("%")===-1&&e.indexOf("+")===-1){let i=t.indexOf("?",8);if(i===-1)return;for(t.startsWith(e,i+1)||(i=t.indexOf(`&${e}`,i+1));i!==-1;){let c=t.charCodeAt(i+e.length+1);if(c===61){let l=i+e.length+2,u=t.indexOf("&",l);return le(t.slice(l,u===-1?void 0:u))}else if(c==38||isNaN(c))return"";i=t.indexOf(`&${e}`,i+1)}if(o=/[%+]/.test(t),!o)return}let s=Object.create(null);o??=/[%+]/.test(t);let a=t.indexOf("?",8);for(;a!==-1;){let i=t.indexOf("&",a+1),c=t.indexOf("=",a);c>i&&i!==-1&&(c=-1);let l=t.slice(a+1,c===-1?i===-1?void 0:i:c);if(o&&(l=le(l)),a=i,l==="")continue;let u;c===-1?u="":(u=t.slice(c+1,i===-1?void 0:i),o&&(u=le(u))),r?(s[l]&&Array.isArray(s[l])||(s[l]=[]),s[l].push(u)):s[l]??=u}return e?s[e]:s},Je=Ke,Ge=(t,e)=>Ke(t,e,!0),gr=decodeURIComponent;var Xe=class{raw;#t;#e;routeIndex=0;path;bodyCache={};constructor(t,e="/",r=[[]]){this.raw=t,this.path=e,this.#e=r}param(t){return t?this.#r(t):this.#s()}#r(t){let e=this.#e[0][this.routeIndex]?.[1][t],r=this.#n(e);return r&&Q(r)}#s(){let t={},e=Object.keys(this.#e[0][this.routeIndex]?.[1]??{});for(let r of e){let n=this.#n(this.#e[0][this.routeIndex][1][r]);n!==void 0&&(t[r]=Q(n))}return t}#n(t){return this.#e[1]?this.#e[1][t]:t}query(t){return Je(this.url,t)}queries(t){return Ge(this.url,t)}header(t){if(t)return this.raw.headers.get(t)??void 0;let e=Object.create(null);return this.raw.headers.forEach((r,n)=>{e[n]=r}),e}async parseBody(t){return qe(this,t)}#o=t=>{let{bodyCache:e,raw:r}=this,n=e[t];if(n)return n;for(let o in e)return e[o].then(s=>(o==="json"&&(s=JSON.stringify(s)),new Response(s)[t]()));return e[t]=r[t]()};json(){return this.#o("text").then(t=>JSON.parse(t))}text(){return this.#o("text")}arrayBuffer(){return this.#o("arrayBuffer")}bytes(){return this.#o("arrayBuffer").then(t=>new Uint8Array(t))}blob(){return this.#o("blob")}formData(){return this.#o("formData")}addValidatedData(t,e){(this.#t??={})[t]=e}valid(t){return this.#t?.[t]}get url(){return this.raw.url}get method(){return this.raw.method}get[Ue](){return this.#e}get matchedRoutes(){return this.#e[0].map(([[,t]])=>t)}get routePath(){return this.#e[0].map(([[,t]])=>t)[this.routeIndex].path}};var Ye={Stringify:1,BeforeStream:2,Stream:3},yr=(t,e)=>{let r=new String(t);return r.isEscaped=!0,r.callbacks=e,r};var pe=async(t,e,r,n,o)=>{typeof t=="object"&&!(t instanceof String)&&(t instanceof Promise||(t=t.toString()),t instanceof Promise&&(t=await t));let s=t.callbacks;if(!s?.length)return Promise.resolve(t);o?o[0]+=t:o=[t];let a=Promise.all(s.map(i=>i({phase:e,buffer:o,context:n}))).then(i=>Promise.all(i.filter(Boolean).map(c=>pe(c,e,!1,n,o))).then(()=>o[0]));return r?yr(await a,s):a};var wr="text/plain; charset=UTF-8",he=(t,e)=>({"Content-Type":t,...e}),K=(t,e)=>new Response(t,e),fe=class{#t;#e;env={};#r;finalized=!1;error;#s;#n;#o;#u;#c;#l;#a;#d;#p;constructor(t,e){this.#t=t,e&&(this.#n=e.executionCtx,this.env=e.env,this.#l=e.notFoundHandler,this.#p=e.path,this.#d=e.matchResult)}get req(){return this.#e??=new Xe(this.#t,this.#p,this.#d),this.#e}get event(){if(this.#n&&"respondWith"in this.#n)return this.#n;throw Error("This context has no FetchEvent")}get executionCtx(){if(this.#n)return this.#n;throw Error("This context has no ExecutionContext")}get res(){return this.#o||=K(null,{headers:this.#a??=new Headers})}set res(t){if(this.#o&&t){t=K(t.body,t);for(let[e,r]of this.#o.headers.entries())if(e!=="content-type")if(e==="set-cookie"){let n=this.#o.headers.getSetCookie();t.headers.delete("set-cookie");for(let o of n)t.headers.append("set-cookie",o)}else t.headers.set(e,r)}this.#o=t,this.finalized=!0}render=(...t)=>(this.#c??=e=>this.html(e),this.#c(...t));setLayout=t=>this.#u=t;getLayout=()=>this.#u;setRenderer=t=>{this.#c=t};header=(t,e,r)=>{this.finalized&&(this.#o=K(this.#o.body,this.#o));let n=this.#o?this.#o.headers:this.#a??=new Headers;e===void 0?n.delete(t):r?.append?n.append(t,e):n.set(t,e)};status=t=>{this.#s=t};set=(t,e)=>{this.#r??=new Map,this.#r.set(t,e)};get=t=>this.#r?this.#r.get(t):void 0;get var(){return this.#r?Object.fromEntries(this.#r):{}}#i(t,e,r){let n=this.#o?new Headers(this.#o.headers):this.#a;if(typeof e=="object"&&e.headers){n??=new Headers;for(let[s,a]of new Headers(e.headers))s==="set-cookie"?n.append(s,a):n.set(s,a)}if(r){if(!n){let s=0;for(let a in r)if(++s>1||typeof r[a]!="string"){n=new Headers;break}}if(n)for(let s in r){let a=r[s];if(typeof a=="string")n.set(s,a);else{n.delete(s);for(let i of a)n.append(s,i)}}}let o=typeof e=="number"?e:e?.status??this.#s;return K(t,{status:o,headers:n??r})}newResponse=(...t)=>this.#i(...t);body=(t,e,r)=>this.#i(t,e,r);text=(t,e,r)=>!this.#a&&!this.#s&&!e&&!r&&!this.finalized?new Response(t):this.#i(t,e,he(wr,r));json=(t,e,r)=>this.#i(JSON.stringify(t),e,he("application/json",r));html=(t,e,r)=>{let n=o=>this.#i(o,e,he("text/html; charset=UTF-8",r));return typeof t=="object"?pe(t,Ye.Stringify,!1,{}).then(n):n(t)};redirect=(t,e)=>{let r=String(t);return this.header("Location",/[^\x00-\xFF]/.test(r)?encodeURI(r):r),this.newResponse(null,e??302)};notFound=()=>(this.#l??=()=>K(),this.#l(this))};var A="ALL",Qe="all",Ze=["get","post","put","delete","options","patch","query"],Z="Can not add a route since the matcher is already built.",ee=class extends Error{};var et="__COMPOSED_HANDLER";var br=t=>t.text("404 Not Found",404),tt=(t,e)=>{if("getResponse"in t){let r=t.getResponse();return e.newResponse(r.body,r)}return console.error(t),e.text("Internal Server Error",500)},rt=class nt{get;post;put;delete;options;patch;query;all;on;use;router;getPath;_basePath="/";#t="/";routes=[];constructor(e={}){[...Ze,Qe].forEach(s=>{this[s]=(a,...i)=>(typeof a=="string"?this.#t=a:this.#s(s,this.#t,a),i.forEach(c=>{this.#s(s,this.#t,c)}),this)}),this.on=(s,a,...i)=>{for(let c of[a].flat()){this.#t=c;for(let l of[s].flat())i.map(u=>{this.#s(l.toUpperCase(),this.#t,u)})}return this},this.use=(s,...a)=>(typeof s=="string"?this.#t=s:(this.#t="*",a.unshift(s)),a.forEach(i=>{this.#s(A,this.#t,i)}),this);let{strict:n,...o}=e;Object.assign(this,o),this.getPath=n??!0?e.getPath??de:Ve}#e(){let e=new nt({router:this.router,getPath:this.getPath});return e.errorHandler=this.errorHandler,e.#r=this.#r,e.routes=this.routes,e}#r=br;errorHandler=tt;route(e,r){let n=this.basePath(e);return r.routes.map(o=>{let s;r.errorHandler===tt?s=o.handler:(s=async(a,i)=>(await ce([],r.errorHandler)(a,()=>o.handler(a,i))).res,s[et]=o.handler),n.#s(o.method,o.path,s,o.basePath)}),this}basePath(e){let r=this.#e();return r._basePath=N(this._basePath,e),r}onError=e=>(this.errorHandler=e,this);notFound=e=>(this.#r=e,this);mount(e,r,n){let o,s;n&&(typeof n=="function"?s=n:(s=n.optionHandler,n.replaceRequest===!1?o=c=>c:o=n.replaceRequest));let a=s?c=>{let l=s(c);return Array.isArray(l)?l:[l]}:c=>{let l;try{l=c.executionCtx}catch{}return[c.env,l]};o||=(()=>{let c=N(this._basePath,e),l=c==="/"?0:c.length;return u=>{let d=new URL(u.url);return d.pathname=this.getPath(u).slice(l)||"/",new Request(d,u)}})();let i=async(c,l)=>{let u=await r(o(c.req.raw),...a(c));if(u)return u;await l()};return this.#s(A,N(e,"*"),i),this}#s(e,r,n,o){e=e.toUpperCase(),r=N(this._basePath,r);let s={basePath:o!==void 0?N(this._basePath,o):this._basePath,path:r,method:e,handler:n};this.router.add(e,r,[n,s]),this.routes.push(s)}#n(e,r){if(e instanceof Error)return this.errorHandler(e,r);throw e}#o(e,r,n,o){if(o==="HEAD")return(async()=>new Response(null,await this.#o(e,r,n,"GET")))();let s=this.getPath(e,{env:n}),a=this.router.match(o,s),i=new fe(e,{path:s,matchResult:a,env:n,executionCtx:r,notFoundHandler:this.#r});if(a[0].length===1){let l;try{l=a[0][0][0][0](i,async()=>{i.res=await this.#r(i)})}catch(u){return this.#n(u,i)}return l instanceof Promise?l.then(u=>u||(i.finalized?i.res:this.#r(i))).catch(u=>this.#n(u,i)):l??this.#r(i)}let c=ce(a[0],this.errorHandler,this.#r);return(async()=>{try{let l=await c(i);if(!l.finalized)throw new Error("Context is not finalized. Did you forget to return a Response object or `await next()`?");return l.res}catch(l){return this.#n(l,i)}})()}fetch=(e,...r)=>this.#o(e,r[1],r[0],e.method);request=(e,r,n,o)=>e instanceof Request?this.fetch(r?new Request(e,r):e,n,o):(e=e.toString(),this.fetch(new Request(/^https?:\/\//.test(e)?e:`http://localhost${N("/",e)}`,r),n,o));fire=()=>{addEventListener("fetch",e=>{e.respondWith(this.#o(e.request,e,void 0,e.request.method))})}};var R=()=>Object.create(null);var te=[];function me(t,e){let r=this.buildAllMatchers(),n=((o,s)=>{let a=r[o]||r[A],i=a[2][s];if(i)return i;let c=s.match(a[0]);if(!c)return[[],te];let l=c.indexOf("",1);return[a[1][l],c]});return this.match=n,n(t,e)}var F="[^/]+",j=".*",I="(?:|/.*)",U=Symbol(),ot=new Set(".\\+*[^]$()");function xr(t,e){return t.length===1?e.length===1?t<e?-1:1:-1:e.length===1?1:t===j||t===I?e===I?-1:1:e===j||e===I?-1:t===F?1:e===F?-1:t.length===e.length?t<e?-1:1:e.length-t.length}var st=class ge{#t;#e;#r=R();insert(e,r,n,o,s){let a=this;for(let i=0,c=e.length;i<c;i++){let l=e[i],u=l.length===1?l==="*"?i===c-1?["","",j]:["","",F]:null:l==="/*"?["","",I]:l.match(/^\:([^\{\}]+)(?:\{(.+)\})?$/),d;if(u){let h=u[1],f=u[2]||F;if(h&&u[2]&&(f===".*"||(f=f.replace(/^\((?!\?:)(?=[^)]+\)$)/,"(?:"),/\((?!\?:)/.test(f))||f.length===1&&ot.has(f)))throw U;if(d=a.#r[f],!d){if(f!==j&&f!==I){for(let x in a.#r)if((f.length>1||x.length>1)&&x!==j&&x!==I)throw U}d=a.#r[f]=new ge}h!==""&&(d.#e??=o.varIndex++,n.push([h,d.#e]))}else if(d=a.#r[l],!d){for(let h in a.#r)if(h.length>1&&h!==j&&h!==I)throw U;d=a.#r[l]=new ge}a=d}if(a.#t!==void 0)throw U;a.#t=s?-1:r}buildRegExpStr(){let r=Object.keys(this.#r).sort(xr).map(n=>{let o=this.#r[n],s=o.buildRegExpStr();return s===""?"":(typeof o.#e=="number"?`(${n})@${o.#e}`:ot.has(n)?`\\${n}`:n)+s}).filter(Boolean);return typeof this.#t=="number"&&this.#t!==-1&&r.unshift(`#${this.#t}`),r.length===0?"":r.length===1?r[0]:"(?:"+r.join("|")+")"}};var ye=class{#t={varIndex:0};#e=new st;#r=0;paths=R();insert(t,e){if(e){this.#e.insert(t.split(""),0,[],this.#t,!0);return}let r=[],n=[],o=t;for(let a=0;;){let i=!1;if(o=o.replace(/\{[^}]+\}/g,c=>{let l=`@\\${a}`;return n[a]=[l,c],a++,i=!0,l}),!i)break}let s=o.match(/(?::[^\/]+)|(?:\/\*$)|./g)||[];for(let a=n.length-1;a>=0;a--){let[i]=n[a];for(let c=s.length-1;c>=0;c--)if(s[c].indexOf(i)!==-1){s[c]=s[c].replace(i,n[a][1]);break}}this.#e.insert(s,this.#r,r,this.#t,!1),this.paths[t]=[this.#r++,r]}buildRegExp(){let t=this.#e.buildRegExpStr();if(t==="")return[/^$/,[],[]];let e=0,r=[],n=[];return t=t.replace(/#(\d+)|@(\d+)|\.\*\$/g,(o,s,a)=>s!==void 0?(r[++e]=Number(s),"$()"):(a!==void 0&&(n[Number(a)]=++e),"")),[new RegExp(`^${t}`),r,n]}};var it=R();function at(t){return it[t]??=new RegExp(`^${t.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g,(e,r)=>r?`\\${r}`:e==="/*"?I:e==="*"?j:`/:${F}`)}$`)}function re(t,e){for(let r of Object.keys(t).sort((n,o)=>o.length-n.length))if(at(r).test(e))return[...t[r]]}var ne=class{name="RegExpRouter";#t;#e;#r;constructor(){this.#t={[A]:R()},this.#e={[A]:R()},this.#r={[A]:new ye}}#s(t,e){try{this.#r[t].insert(e,!/\*|\/:/.test(e))}catch(r){throw r===U?new ee(e):r}}add(t,e,r){let n=this.#t,o=this.#e;if(!n)throw new Error(Z);if(!n[t]){this.#r[t]=new ye;for(let i of[n,o]){i[t]=R();for(let c in i[A])i[t][c]=[...i[A][c]],this.#s(t,c)}}e==="/*"&&(e="*");let s=t===A?Object.keys(n):[t];if(/\*$/.test(e)){let i=at(e);for(let c of s)n[c][e]||(this.#s(c,e),n[c][e]=re(n[c],e)||re(n[A],e)||[]);for(let c of[n,o])for(let l of s)for(let u in c[l])i.test(u)&&c[l][u].push([r,e]);return}let a=Y(e)||[e];for(let i of a)for(let c of s)o[c][i]||(this.#s(c,i),o[c][i]=re(n[c],i)||re(n[A],i)||[]),o[c][i].push([r,i])}match=me;buildAllMatchers(){let t=R();for(let e of Object.keys(this.#e))t[e]=this.#n(e);return this.#t=this.#e=this.#r=void 0,it=R(),t}#n(t){let e=this.#t[t],r=this.#e[t],n=this.#r[t],o=R(),s=[],[a,i,c]=n.buildRegExp();for(let l of[e,r])for(let u in l){let d=l[u],h=n.paths[u];if(!h){o[u]=[d.map(([f])=>[f,R()]),te];continue}s[h[0]]=d.map(([f,x])=>[f,n.paths[x][1].reduceRight((b,[v],g)=>(b[v]=c[h[1][g][1]],b),R())])}return[a,i.map(l=>s[l]),o]}};var we=class{name="SmartRouter";#t=[];#e=[];constructor(t){this.#t=t.routers}add(t,e,r){if(!this.#e)throw new Error(Z);this.#e.push([t,e,r])}match(t,e){if(!this.#e)throw new Error("Fatal error");let r=this.#t,n=this.#e,o=r.length,s=0,a;for(;s<o;s++){let i=r[s];try{for(let c=0,l=n.length;c<l;c++)i.add(...n[c]);a=i.match(t,e)}catch(c){if(c instanceof ee)continue;throw c}this.match=i.match.bind(i),this.#t=[i],this.#e=void 0;break}if(s===o)throw new Error("Fatal error");return this.name=`SmartRouter + ${this.activeRouter.name}`,a}get activeRouter(){if(this.#e||this.#t.length!==1)throw new Error("No active router has been determined yet.");return this.#t[0]}};var be=R(),vr=0,ct=class lt{#t=[];#e=R();#r=[];#s;#n=be;insert(e,r,n){let o=this,s=ze(r),a=new Set,i=0;for(let c of s){let l=s[++i],u=Fe(c,l)||(l===void 0&&c&&c.indexOf("*")===c.length-1?c:null),d=Array.isArray(u),h=d?u[0]:u||c,f=o.#e[h]||=new lt;u&&!f.#s&&(f.#s=u,o.#r.push(f)),o=f,d&&a.add(u[1])}o.#t.push({[e]:{handler:n,possibleKeys:[...a],score:++vr}})}#o(e,r,n,o,s){for(let a=0,i=r.#t.length;a<i;a++){let c=r.#t[a],l=c[n]||c[A];if(l){l.params=R(),e.push(l);for(let u=0,d=l.possibleKeys.length;u<d;u++){let h=l.possibleKeys[u];l.params[h]=s?.[h]&&!u?s[h]:o[h]??s?.[h]}}}}search(e,r){let n=[];this.#n=be;let s=[this],a=ue(r),i=[],c=a.length,l=null;for(let u=0;u<c;u++){let d=a[u],h=u===c-1,f=[];for(let b=0,v=s.length;b<v;b++){let g=s[b],p=g.#e[d];p&&(p.#n=g.#n,h?(p.#e["*"]&&this.#o(n,p.#e["*"],e,g.#n),this.#o(n,p,e,g.#n)):f.push(p));for(let m of g.#r){let y=m.#s,P=g.#n===be?{}:{...g.#n};if(typeof y=="string"){(y==="*"||d.startsWith(y.slice(0,-1)))&&(this.#o(n,m,e,g.#n),y==="*"&&(m.#n=P,f.push(m)));continue}let[,L,O]=y;if(!(!d&&O===!0)){if(O!==!0){if(!l){l=[];let S=r[0]==="/"?1:0;for(let w=0;w<c;w++)l[w]=S,S+=a[w].length+1}let E=r.slice(l[u]),_=O.exec(E);if(_){P[L]=_[0],this.#o(n,m,e,g.#n,P),_[0].length===E.length&&m.#e["*"]&&this.#o(n,m.#e["*"],e,g.#n,P);for(let S in m.#e){m.#n=P;let w=_[0].match(/\//g)?.length??0;(i[w]||=[]).push(m);break}continue}}(O===!0||O.test(d))&&(P[L]=d,h?(this.#o(n,m,e,P,g.#n),m.#e["*"]&&this.#o(n,m.#e["*"],e,P,g.#n)):(m.#n=P,f.push(m)))}}}let x=i.shift();s=x?f.concat(x):f}return n[1]&&n.sort((u,d)=>u.score-d.score),[n.map(({handler:u,params:d})=>[u,d])]}};var xe=class{name="TrieRouter";#t=new ct;add(t,e,r){for(let n of Y(e)||[e])this.#t.insert(t,n,r)}match(t,e){return this.#t.search(t,e)}};var ve=class extends rt{constructor(t={}){super(t),this.router=t.router??new we({routers:[new ne,new xe]})}};import{Readable as fn}from"stream";function ut(t=""){return`<link rel="icon" type="image/svg+xml" href="${`${t.replace(/\/$/,"")}/favicon-black.svg?v=4`}" />`}import{existsSync as Rt,readFileSync as Sr}from"fs";import k from"path";import{fileURLToPath as Ar}from"url";import{gunzipSync as Cr}from"zlib";var D=cr(vt(),1);function W(t,e){return t.header("Retry-After",String(Er(e))),t.json({error:"Too Many Requests"},429)}function Er(t){return t&&typeof t=="object"&&"msBeforeNext"in t&&typeof t.msBeforeNext=="number"&&Number.isFinite(t.msBeforeNext)?Math.max(1,Math.ceil(t.msBeforeNext/1e3)):60}var Or={".js":"application/javascript",".css":"text/css",".svg":"image/svg+xml",".png":"image/png",".ico":"image/x-icon",".webmanifest":"application/manifest+json"};function Lr(){let t=k.dirname(Ar(import.meta.url));for(let e of[k.resolve(t,"app"),k.resolve(t,"../app"),k.resolve(t,"../../dist/app")])if(Rt(k.join(e,"inspector.js.gz")))return e;throw new Error("Inspector bundle not found (expected dist/app/inspector.js.gz)")}function Pt(t,e="/inspector/assets"){let r=Lr(),n=new Map,o=new D.default({points:600,duration:60}),s=async(a,i)=>{try{await o.consume(a.req)}catch(c){return W(a,c)}return i()};t.use(`${e}/*`,s),t.get(`${e}/*`,async a=>{let i=a.req.path.slice(e.length),c=i.startsWith("/")?i.slice(1):i;if(!c||c.includes(".."))return a.notFound();let l=c==="inspector.js"||c==="inspector.css"?`${c}.gz`:c,u=k.resolve(r,l),d=r.endsWith(k.sep)?r:`${r}${k.sep}`;if(!u.startsWith(d)||!Rt(u))return a.notFound();let h=k.extname(c),f=l.endsWith(".gz"),x=/(?:^|,)\s*gzip\s*(?:,|$)/i.test(a.req.header("accept-encoding")??""),b=Sr(u),v=f&&!x?n.get(u)??Tr(n,u,b):b,g=v.buffer.slice(v.byteOffset,v.byteOffset+v.byteLength);return a.body(g,200,{"Content-Type":Or[h]??"application/octet-stream",...f&&x?{"Content-Encoding":"gzip"}:{},...f?{Vary:"Accept-Encoding"}:{},"Cache-Control":"no-cache"})})}function Tr(t,e,r){let n=Cr(r);return t.set(e,n),n}var Et={name:"@mcp-use/inspector",type:"module",version:"20.3.14-canary.0",description:"MCP Inspector - A tool for inspecting and debugging MCP servers",author:"",license:"MIT",homepage:"https://github.com/mcp-use/mcp-use#readme",repository:{type:"git",url:"git+https://github.com/mcp-use/mcp-use.git",directory:"libraries/typescript/packages/inspector"},bugs:{url:"https://github.com/mcp-use/mcp-use/issues"},keywords:["mcp","inspector","debug","tools"],exports:{".":{types:"./dist/server/index.d.ts",import:"./dist/server/index.js"},"./client":{types:"./dist/client/index.d.ts",import:"./dist/client/index.js"},"./client/styles.css":{default:"./dist/client/styles.css"}},main:"./dist/server/index.js",types:"./dist/server/index.d.ts",bin:{"mcp-inspect":"./dist/cli.js"},files:["dist"],scripts:{dev:"rimraf node_modules/.vite && vite --strictPort","dev:client":"pnpm run dev","dev:server":"VITE_DEV=true tsx watch src/server/server.ts","dev:standalone":"tsx watch src/server/server.ts",clean:"rimraf dist",build:"pnpm run clean && pnpm run build:client-exports && pnpm run build:server && pnpm run build:app && pnpm run verify:package","build:app":"vite build --config vite.app.config.ts && node scripts/compress-app.mjs","watch:app":"vite build --watch --config vite.app.config.ts","preview:app":"vite preview --config vite.app.config.ts --host 127.0.0.1","serve:app":"pnpm build:app && pnpm preview:app","analyze:app":"ANALYZE=true vite build --config vite.app.config.ts","build:client-exports":"tsup --config tsup.client.ts && node scripts/copy-client-styles.mjs","build:server":"tsup --config tsup.server.ts","verify:package":"node scripts/verify-package.mjs",start:"node dist/cli.js --port 3000",preview:"vite preview","type-check":"tsc --noEmit",lint:"eslint .","lint:fix":"eslint . --fix","test:e2e":"playwright test","test:e2e:ui":"playwright test --ui","test:e2e:debug":"playwright test --debug","test:e2e:builtin":"node tests/e2e/scripts/run-test-matrix.mjs builtin","test:e2e:prod":"node tests/e2e/scripts/run-test-matrix.mjs prod","test:e2e:mix":"node tests/e2e/scripts/run-test-matrix.mjs mix","test:e2e:prod:ui":"TEST_MODE=production playwright test --ui","test:e2e:codegen":"playwright codegen http://localhost:3000/inspector","test:e2e:report":"playwright show-report","test:e2e:python":"node tests/e2e/scripts/run-python-e2e.mjs",test:"vitest run","test:unit":"vitest run","test:unit:watch":"vitest","test:e2e:tunnel":"node tests/e2e/scripts/run-tunnel-test.mjs","install:pnpm":"pnpm install","install:npm":"npm install","lint:npm":"npm run lint:fix","lint:pnpm":"pnpm lint:fix"},engines:{node:">=22.22.2"},peerDependencies:{"@base-ui/react":"^1.6.0","@mcp-use/agent":"^2.0.16 || ^2.0.17 || ^2.0.18 || ^2.0.19","@mcp-use/client":"^2.0.1 || ^2.1.0 || ^2.1.1 || ^2.1.2 || ^2.1.3 || ^2.1.4 || ^2.1.5 || ^2.2.0 || ^2.2.1 || ^2.2.2 || ^2.2.3 || ^2.2.4 || ^2.2.5 || ^2.3.0 || ^2.3.1 || ^2.3.2 || ^2.3.3 || ^2.3.4","class-variance-authority":"^0.7.1",clsx:"^2.1.1",express:"^4.21.2 || ^5.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4","mcp-use":"^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1 || ^2.7.2-canary.0",motion:"^12.34.2",react:"^18.0.0 || ^19.0.0","react-dom":"^18.0.0 || ^19.0.0","react-resizable-panels":"^4.6.4",sonner:"^2.0.7","tailwind-merge":"^3.5.0"},peerDependenciesMeta:{"@base-ui/react":{optional:!0},"@mcp-use/agent":{optional:!0},"@mcp-use/client":{optional:!0},"class-variance-authority":{optional:!0},clsx:{optional:!0},express:{optional:!0},"lucide-react":{optional:!0},"markdown-to-jsx":{optional:!0},"mcp-use":{optional:!0},motion:{optional:!0},react:{optional:!0},"react-dom":{optional:!0},"react-resizable-panels":{optional:!0},sonner:{optional:!0},"tailwind-merge":{optional:!0}},dependencies:{},publishConfig:{access:"public"},devDependencies:{"@base-ui/react":"^1.6.0","@hono/node-server":"^2.0.5","@mcp-use/agent":"workspace:*","@mcp-use/client":"workspace:*","@playwright/test":"^1.58.2","@tailwindcss/vite":"^4.2.0","@types/express":"^5.0.6","@vitejs/plugin-react":"^6.0.0","class-variance-authority":"^0.7.1",clsx:"^2.1.1",emulate:"0.5.0",eslint:"^9.39.2",express:"^5.2.1",hono:"^4.13.5",jsdom:"^27.0.0","lucide-react":"^0.562.0","markdown-to-jsx":"^9.7.4",motion:"^12.34.2","oauth2-mock-server":"^8.2.2",open:"^11.0.0",react:"^19.2.3","react-dom":"^19.2.3","react-router":"^8.3.0","react-resizable-panels":"^4.6.4","rate-limiter-flexible":"^11.2.0","rollup-plugin-visualizer":"^6.0.3",sonner:"^2.0.7","tailwind-merge":"^3.5.0",tailwindcss:"^4.2.0",tsup:"^8.5.1",tsx:"^4.21.0","tw-animate-css":"^1.4.0",typescript:"^5.9.3",vite:"^8.0.16",vitest:"^4.1.0","wait-on":"^9.0.4",yaml:"^2.8.3",zod:"^4.2.0"}};var Ir=Et.version;function _t(){return Ir}var Dr=`<!doctype html>
 <html>
   <head>
     <meta charset="utf-8" />
@@ -272,7 +272,7 @@ window.addEventListener('unhandledrejection', function(event) {
   </body>
 </html>`;function St(t){let r="<script>window.__SANDBOX_SEARCH__ = "+JSON.stringify(t).replace(/</g,"\\u003c")+";</script>";return Dr.replace(`        const scriptSrcParts = ["'unsafe-inline'", "'unsafe-eval'", resourceSrc];
 `,`        const scriptSrcParts = ["'unsafe-inline'", resourceSrc];
-`).replace("<body>","<body>"+r)}var At=Et();function kr(t){let e=t.hostname==="localhost"?"127.0.0.1":t.hostname==="127.0.0.1"||t.hostname==="::1"?"localhost":void 0;if(!e)return;let r=new URL(t.origin);return r.hostname=e,r.origin}var Nr=`<!doctype html>
+`).replace("<body>","<body>"+r)}var At=_t();function kr(t){let e=t.hostname==="localhost"?"127.0.0.1":t.hostname==="127.0.0.1"||t.hostname==="::1"?"localhost":void 0;if(!e)return;let r=new URL(t.origin);return r.hostname=e,r.origin}var Nr=`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><title>Signed in</title><meta name="robots" content="noindex"><style>html,body{margin:0;height:100%;display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#4b5563;background:#fff}</style></head>
 <body><div>Signed in. You can close this window.</div>
 <script>try{if(window.opener&&!window.opener.closed)window.opener.postMessage({type:"manufact:oauth-complete"},"*")}catch(e){}try{window.close()}catch(e){}</script>
@@ -368,6 +368,6 @@ window.addEventListener('unhandledrejection', function(event) {
     </div>
     <script type="module" src="${r.jsUrl}"></script>
   </body>
-</html>`}function Ct(t,e,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(At),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},a=u=>`${r}${u}`,i={...e,basePath:e?.basePath??r,proxyUrl:e?.proxyUrl!==void 0?e.proxyUrl:a("/inspector/api/proxy"),disableTelemetry:e?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let p=new URL(u.req.url),h={...i,sandboxOrigin:i.sandboxOrigin??kr(p)??null};return u.html(Ur(h,r,s))};Pt(t,n),t.get(a("/inspector/oauth-popup-closed.html"),u=>u.html(Nr)),t.get(a("/inspector/sandbox"),u=>u.html(St(new URL(u.req.url).search))),t.get(a("/inspector"),c),t.get(`${a("/inspector")}/`,c);let l=a("/inspector/api/");t.get(a("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),t.post(a("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&e?.rootRedirect!==!1&&t.get("/",u=>{let p=new URL(u.req.url);return u.redirect(`${a("/inspector")}${p.search}`)})}var Ot=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,o=(a=>typeof a=="string"?a==="*"?()=>a:i=>a===i?i:null:typeof a=="function"?a:i=>a.includes(i)?i:null)(e.origin),s=(a=>{if(typeof a=="function")return async(i,c)=>(await a(i,c)).join(",");if(Array.isArray(a)){let i=a.join(",");return()=>i}else return()=>""})(e.allowMethods);return async function(i,c){function l(p,h){i.res.headers.set(p,h)}let u=await o(i.req.header("origin")||"",i);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),i.req.method==="OPTIONS"){e.origin!=="*"&&i.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let p=await s(i.req.header("origin")||"",i);p&&l("Access-Control-Allow-Methods",p);let h=n;if(!h){let f=i.req.header("Access-Control-Request-Headers");f&&(h=f.split(",").map(x=>x.trim()).join(","))}return h&&(l("Access-Control-Allow-Headers",h),i.res.headers.append("Vary","Access-Control-Request-Headers")),i.res.headers.delete("Content-Length"),i.res.headers.delete("Content-Type"),new Response(null,{headers:i.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&i.header("Vary","Origin",{append:!0})}};function jr(){let{process:t,Deno:e}=globalThis;return!(typeof e?.noColor=="boolean"?e.noColor:t!==void 0?"NO_COLOR"in t?.env:!1)}async function Lt(){let{navigator:t}=globalThis,e="cloudflare:workers";return!(t!==void 0&&t.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(e)).env??{})}catch{return!1}})():!jr())}var Hr=t=>{let[e,r]=[",","."];return t.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+e)).join(r)},$r=t=>{let e=Date.now()-t;return Hr([e<1e3?e+"ms":Math.round(e/1e3)+"s"])},Br=async t=>{if(await Lt())switch(t/100|0){case 5:return`\x1B[31m${t}\x1B[0m`;case 4:return`\x1B[33m${t}\x1B[0m`;case 3:return`\x1B[36m${t}\x1B[0m`;case 2:return`\x1B[32m${t}\x1B[0m`}return`${t}`};async function Tt(t,e,r,n,o=0,s){let a=e==="<--"?`${e} ${r} ${n}`:`${e} ${r} ${n} ${await Br(o)} ${s}`;t(a)}var Ee=(t=console.log)=>async function(r,n){let{method:o,url:s}=r.req,a=s.slice(s.indexOf("/",8));await Tt(t,"<--",o,a);let i=Date.now();await n(),await Tt(t,"-->",o,a,r.res.status,$r(i))};import{lookup as qr}from"dns/promises";import{Buffer as zr}from"buffer";import{isIP as Fr}from"net";var Wr=new Set(["accept","authorization","content-type","dpop"]),Vr=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),Kr=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],jt=600*1e3,Jr=100,Gr=1440*60*1e3,Xr=500;function Le(t,e={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:a=64*1024,maxResponseBodyBytes:i=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,logPrefix:u,authenticate:p,validateServerUrl:h,rateLimiter:f=new D.default({points:120,duration:60})}=e,x=new Set(n.map(Oe)),b=new Map,v=new Map,g=async(d,m)=>{try{await f.consume(d.req)}catch(y){return W(d,y)}return m()};t.use(`${r}/*`,async(d,m)=>{let y=d.req.header("Origin");if(y&&!cn(y,d,x))return d.json({error:"Origin not allowed"},403);if(d.req.method==="OPTIONS")return ln(y);await m(),y&&Wt(d.res.headers,y)}),t.use(`${r}/*`,g),t.get(`${r}/metadata`,async d=>{if(!await Ut(d,p))return d.json({error:"Unauthorized"},401);let m=await z(d.req.query("serverUrl"),o);if("error"in m)return d.json({error:m.error},400);let y=m.url;if(h&&!await h(y.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let P=await z(d.req.query("url"),o);if("error"in P)return d.json({error:P.error},400);let L=P.url,O=T(y),_=kt(b,O),E=Mt(y,L,_);if(!E&&_.authorizationServers.size===0)try{await It(y,_,o,s,i),b.set(O,_),E=Mt(y,L,_)}catch{}if(!E)return d.json({error:"Metadata target is not bound to this MCP server"},403);try{Se(l,u,`GET ${L}`);let S=await oe(L,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(ie(S.status))return d.json({error:"OAuth metadata redirects are not allowed"},502);let w=await se(S,i);if(!S.ok)return d.body(w,S.status,{"Content-Type":S.headers.get("content-type")??"application/json"});let M=Ce(w);return E.type==="protected-resource"?await Bt(M,y,E.resourceIdentifier,_,o):await qt(M,E.issuer,_,o),_.updatedAt=Date.now(),b.set(O,_),Nt(b),d.body(w,200,{"Content-Type":S.headers.get("content-type")??"application/json"})}catch(S){return Ae(d,S,l,u)}}),t.post(`${r}/proxy`,async d=>{if(!await Ut(d,p))return d.json({error:"Unauthorized"},401);let m;try{m=JSON.parse(await sn(d.req.raw,a))}catch(w){return d.json({error:w instanceof H?"Request body too large":"Invalid JSON request body"},w instanceof H?413:400)}let y=await z(m.serverUrl,o);if("error"in y)return d.json({error:y.error},400);let P=y.url;if(h&&!await h(P.toString(),d))return d.json({error:"MCP server URL not allowed"},403);let L=await z(m.url,o);if("error"in L)return d.json({error:L.error},400);let O=L.url;if(m.method!==void 0&&m.method!=="POST")return d.json({error:"Only OAuth endpoint POST is allowed"},405);let _=T(P),E=kt(b,_);if(E.endpoints.size===0)try{await It(P,E,o,s,i),b.set(_,E),Nt(b)}catch(w){return Ae(d,w,l,u)}let S=E.endpoints.get(T(O));if(!S)return d.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let w=Zr(m.headers),M=tn(m.body,w);if(S==="registration"){let tr=Oe(d.req.header("Origin")??new URL(d.req.url).origin);M=an(M,w,new URL(c,tr).toString())}else M=nn({body:M,headers:w,bindingKey:_,clients:v});if(new TextEncoder().encode(M??"").byteLength>a)return d.json({error:"OAuth request body too large"},413);Se(l,u,`POST ${S} ${O}`);let $=await oe(O,{method:"POST",headers:w,body:M,redirect:"manual",signal:AbortSignal.timeout(s)});if(ie($.status))return d.json({error:"OAuth endpoint redirects are not allowed"},502);let ke=await se($,i),Zt=en($.headers),er=$.headers.get("content-type")??"",B=ke;if(er.includes("json"))try{B=JSON.parse(ke)}catch{}return S==="registration"&&$.ok&&B&&typeof B=="object"&&!Array.isArray(B)&&(B=rn({responseBody:B,binding:E,bindingKey:_,clients:v})),d.json({status:$.status,statusText:$.statusText,headers:Zt,body:B})}catch(w){return Ae(d,w,l,u)}}),Se(l,u,`Mounted at ${r}/metadata and ${r}/proxy`)}async function z(t,e){if(typeof t!="string"||!t)return{error:"Missing or invalid URL"};let r;try{r=new URL(t)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=Vt(r.hostname);if(r.protocol!=="https:"&&!(e&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return e?{url:r}:{error:"Loopback URL not allowed"};if(un(r.hostname))return{error:"Local network URL not allowed"};try{let o=Fr(r.hostname)?[r.hostname]:(await qr(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!Kt(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Te(t,e=!1){return!("error"in await z(t,e))}function Mt(t,e,r){let n=T(e),o=Ht(t).find(s=>T(s.url)===n);if(o)return{type:"protected-resource",resourceIdentifier:o.resourceIdentifier};for(let s of r.authorizationServers)if($t(new URL(s)).some(a=>T(a)===n))return{type:"authorization-server",issuer:s}}function Ht(t){let e=t.pathname==="/"?"":t.pathname;return[{url:new URL(`/.well-known/oauth-protected-resource${e}`,t.origin),resourceIdentifier:t},{url:new URL("/.well-known/oauth-protected-resource",t.origin),resourceIdentifier:new URL(t.origin)}]}function $t(t){let e=t.pathname==="/"?"":t.pathname;return[new URL(`/.well-known/oauth-authorization-server${e}`,t.origin),new URL(`/.well-known/openid-configuration${e}`,t.origin),new URL(`${e||""}/.well-known/openid-configuration`,t.origin)]}async function Bt(t,e,r,n,o){let s=Yr(t.resource,o),a=s!==void 0&&T(s)===T(r),i=s!==void 0&&Qr(e,s);if(!a&&!i)throw new C("Protected-resource metadata does not match serverUrl");if(!Array.isArray(t.authorization_servers)||t.authorization_servers.length===0)throw new C("Protected-resource metadata has no authorization servers");let c=new Set;for(let l of t.authorization_servers){let u=await z(l,o);if("error"in u)throw new C(`Unsafe authorization server: ${u.error}`);c.add(T(u.url))}n.authorizationServers=c,n.endpoints.clear(),n.tokenEndpointAuthMethods.clear()}function Yr(t,e){if(!(typeof t!="string"||t.length===0))try{let r=new URL(t);return!(r.protocol==="https:"||e&&r.protocol==="http:"&&Vt(r.hostname))||r.username||r.password||r.hash?void 0:r}catch{return}}function Qr(t,e){if(t.origin!==e.origin||t.pathname.length<e.pathname.length)return!1;let r=t.pathname.endsWith("/")?t.pathname:`${t.pathname}/`,n=e.pathname.endsWith("/")?e.pathname:`${e.pathname}/`;return r.startsWith(n)}async function qt(t,e,r,n){if(typeof t.issuer!="string"||T(new URL(t.issuer))!==e)throw new C("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(t.token_endpoint_auth_methods_supported)?t.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of Kr){let a=t[o];if(a===void 0)continue;let i=await z(a,n);if("error"in i)throw new C(`Unsafe ${o}: ${i.error}`);r.endpoints.set(T(i.url),s)}}async function It(t,e,r,n,o){for(let s of Ht(t)){let a=await oe(s.url,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ie(a.status))throw new C("OAuth metadata redirects are not allowed");if(a.ok){await Bt(Ce(await se(a,o)),t,s.resourceIdentifier,e,r);break}}if(e.authorizationServers.size===0)throw new C("Protected-resource metadata could not be discovered");for(let s of e.authorizationServers){let a=!1;for(let i of $t(new URL(s))){let c=await oe(i,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ie(c.status))throw new C("OAuth metadata redirects are not allowed");if(c.ok){await qt(Ce(await se(c,o)),s,e,r),a=!0;break}}if(a)break}if(e.endpoints.size===0)throw new C("Authorization-server metadata could not be discovered");e.updatedAt=Date.now()}async function oe(t,e){return fetch(t,e)}function Zr(t){let e=new Headers;if(!t||typeof t!="object"||Array.isArray(t))return e;for(let[r,n]of Object.entries(t)){let o=r.toLowerCase();Wr.has(o)&&typeof n=="string"&&e.set(o,n)}return e}function en(t){let e={};return t.forEach((r,n)=>{Vr.has(n.toLowerCase())&&(e[n]=r)}),e}function tn(t,e){if(t==null)return;if(typeof t=="string"){if(!e.has("content-type"))try{JSON.parse(t),e.set("content-type","application/json")}catch{e.set("content-type","application/x-www-form-urlencoded")}return t}if((e.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof t=="object"&&!Array.isArray(t)){let n=new URLSearchParams;for(let[o,s]of Object.entries(t))n.append(o,String(s));return n.toString()}return e.has("content-type")||e.set("content-type","application/json"),JSON.stringify(t)}function zt(t,e){return`${t}\0${e}`}function rn(t){let{responseBody:e,binding:r,bindingKey:n,clients:o}=t,s=e.client_id,a=e.client_secret;if(typeof s!="string"||typeof a!="string")return e;let i=e.token_endpoint_auth_method,c=i==="client_secret_post"||i==="client_secret_basic"?i:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=e.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+Gr;for(on(o),o.set(zt(n,s),{clientSecret:a,authMethod:c,expiresAt:u});o.size>Xr;){let h=o.keys().next().value;if(!h)break;o.delete(h)}let p={...e};return delete p.client_secret,delete p.client_secret_expires_at,p.token_endpoint_auth_method="none",p}function nn(t){let{body:e,headers:r,bindingKey:n,clients:o}=t;if(!e||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return e;let s=new URLSearchParams(e),a=s.get("client_id");if(!a)return e;let i=zt(n,a),c=o.get(i);if(!c)return e;if(c.expiresAt<=Date.now())return o.delete(i),e;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=zr.from(`${Dt(a)}:${Dt(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",a),s.set("client_secret",c.clientSecret);return s.toString()}function Dt(t){return new URLSearchParams({value:t}).toString().slice(6)}function on(t){let e=Date.now();for(let[r,n]of t)n.expiresAt<=e&&t.delete(r)}async function sn(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw new H;return Ft(t.body,e)}async function se(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw await t.body?.cancel(),new H;return Ft(t.body,e)}async function Ft(t,e){if(!t)return"";let r=t.getReader(),n=[],o=0;for(;;){let{done:i,value:c}=await r.read();if(i)break;if(o+=c.byteLength,o>e)throw await r.cancel(),new H;n.push(c)}let s=new Uint8Array(o),a=0;for(let i of n)s.set(i,a),a+=i.byteLength;return new TextDecoder().decode(s)}function Ce(t){let e;try{e=JSON.parse(t)}catch{throw new C("OAuth metadata is not valid JSON")}if(!e||typeof e!="object"||Array.isArray(e))throw new C("OAuth metadata is not an object");return e}function kt(t,e){let r=t.get(e);return r&&Date.now()-r.updatedAt<=jt?r:(t.delete(e),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Nt(t){let e=Date.now();for(let[r,n]of t)e-n.updatedAt>jt&&t.delete(r);for(;t.size>Jr;){let r=t.keys().next().value;if(!r)break;t.delete(r)}}function T(t){let e=new URL(t);return e.hash="",(e.protocol==="https:"&&e.port==="443"||e.protocol==="http:"&&e.port==="80")&&(e.port=""),e.toString().replace(/\/$/,"")}function an(t,e,r){if(!t||!(e.get("content-type")??"").includes("json"))return t;try{let o=JSON.parse(t);return!o||typeof o!="object"||Array.isArray(o)?t:JSON.stringify({...o,redirect_uris:[r]})}catch{return t}}function Oe(t){let e=new URL(t);if(e.pathname!=="/"||e.search||e.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${t}`);return e.origin}function cn(t,e,r){try{let n=Oe(t);if(n===new URL(e.req.url).origin||r.has(n))return!0;let o=new URL(n),a=e.req.header("x-forwarded-host")?.split(",")[0]?.trim()||e.req.header("host");if(!a||o.host!==a)return!1;let i=e.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!i||`${i}:`===o.protocol}catch{return!1}}function ln(t){let e=new Headers;return t&&Wt(e,t),e.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),e.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),e.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:e})}function Wt(t,e){t.set("Access-Control-Allow-Origin",e),t.append("Vary","Origin")}async function Ut(t,e){return e?e(t):!0}function ie(t){return t>=300&&t<400}function Vt(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e.endsWith(".localhost")||e==="::1"||e.startsWith("127.")}function un(t){let e=t.toLowerCase();return e.endsWith(".local")||e.endsWith(".internal")||e.endsWith(".home.arpa")}function Kt(t){if(t.includes(":")){let s=t.toLowerCase();return s.startsWith("::ffff:")?Kt(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let e=t.split(".").map(Number);if(e.length!==4||e.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=e;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function Se(t,e,r){t&&console.log(e===void 0?`[OAuth BFF] ${r}`:`${e} [OAuth BFF] ${r}`)}function Ae(t,e,r,n){let o=e instanceof Error?e.message:"Unknown error";return r&&console.error(n===void 0?"[OAuth BFF]":`${n} [OAuth BFF]`,o),e instanceof H?t.json({error:"Upstream response too large"},502):e instanceof C?t.json({error:e.message},502):e instanceof DOMException&&e.name==="TimeoutError"?t.json({error:"OAuth upstream timed out"},504):t.json({error:"OAuth upstream request failed"},502)}var H=class extends Error{},C=class extends Error{};var dn=3;function pn(t,e){return t.includes("text/event-stream")&&!e}function Me(t,e={}){let r=e.path||"/mcp/proxy",n=e.enableLogging!==!1,o=e.logPrefix,s=e.rateLimiter??new D.default({points:120,duration:60}),a=async(i,c)=>{try{await s.consume(i.req)}catch(l){return W(i,l)}return c()};t.use(`${r}/*`,Ot({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&t.use(`${r}/*`,o===void 0?Ee():Ee((i,...c)=>console.log(o,i,...c))),t.use(`${r}/*`,a),t.all(`${r}/*`,async i=>{try{if(e.authenticate&&!await e.authenticate(i))return i.json({error:"Unauthorized"},401);let c=i.req.header("X-Target-URL");if(!c)return i.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Te(c,e.allowLoopback??!1))return i.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(e.validateRequest&&!await e.validateRequest(c,i))return i.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(c)}catch{return i.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let l=i.req.method,u={},p=i.req.header();for(let[v,g]of Object.entries(p)){let d=v.toLowerCase();!d.startsWith("x-proxy-")&&!d.startsWith("x-target-")&&!d.startsWith("x-mcp-")&&!d.startsWith("x-forwarded-")&&!d.startsWith("cf-")&&d!=="x-original-host"&&d!=="host"&&d!=="origin"&&d!=="referer"&&d!=="cookie"&&d!=="proxy-authorization"&&d!=="accept-encoding"&&d!=="cdn-loop"&&!d.startsWith("sec-fetch-")&&(u[v]=g)}u["Accept-Encoding"]="identity";let h=l!=="GET"&&l!=="HEAD"?new Uint8Array(await i.req.arrayBuffer()).slice():void 0,f=c,x=l,b=h;for(let v=0;;v+=1){let g=await fetch(f,{method:x,headers:u,body:b,redirect:"manual"}),d=g.headers.get("location");if(!(g.status>=300&&g.status<400&&d))return hn(g);if(v>=dn)return i.json({error:"Too many upstream redirects"},502);let m=new URL(d,f);if(!await Te(m.toString(),e.allowLoopback??!1)||e.validateRequest&&!await e.validateRequest(m.toString(),i))return i.json({error:"Redirect target is not allowed"},403);m.origin!==new URL(f).origin&&(ae(u,"authorization"),ae(u,"proxy-authorization")),(g.status===303||(g.status===301||g.status===302)&&x==="POST")&&(x="GET",b=void 0,ae(u,"content-type"),ae(u,"content-length")),f=m.toString()}}catch(c){let l=c instanceof Error?c.message:"Unknown error",u=i.req.header("X-Target-URL");return c instanceof Error&&(c.message.includes("ECONNREFUSED")||c.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${u||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",l,`
-Target URL:`,u||"unknown",`
-Error:`,c),i.json({error:"Proxy request failed",details:l,targetUrl:u||"unknown"},500)}})}function ae(t,e){for(let r of Object.keys(t))r.toLowerCase()===e&&delete t[r]}async function hn(t){let e={};if(t.headers.forEach((o,s)=>{let a=s.toLowerCase();a!=="content-encoding"&&a!=="transfer-encoding"&&a!=="content-length"&&a!=="set-cookie"&&(e[s]=o)}),pn(t.headers.get("content-type")||"",t.headers.get("content-length")))return e["x-accel-buffering"]="no",e["cache-control"]??="no-cache, no-transform",new Response(t.body,{status:t.status,statusText:t.statusText,headers:e});if([204,205,304].includes(t.status))return new Response(null,{status:t.status,statusText:t.statusText,headers:e});let n=await t.arrayBuffer();return e["Content-Length"]=String(n.byteLength),new Response(n,{status:t.status,statusText:t.statusText,headers:e})}function Ie(t,e,r=""){let n=i=>`${r}${i}`,o=e?.oauthProxyAllowLoopback??!1,s=e?.oauth!==!1,a=new D.default({points:120,duration:60});if(t.get(n("/inspector/health"),i=>i.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),Me(t,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:a,logPrefix:e?.logPrefix}),s&&Le(t,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,logPrefix:e?.logPrefix,allowedOrigins:e?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:a}),e?.autoConnectUrl!==void 0){let i=e.autoConnectUrl;t.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:i??null}))}}function mn(t,e){if(vn(t)){let o=t,s=e,a=Xt(s?.basePath);if(Qt(o)){Yt(o,s,a);return}let i=Jt(s,a),c=Gt(i);o.use(gn(c,i.routes.map(l=>l.path)));return}let r=t,n=Xt(r?.basePath);return Gt(Jt(r,n))}function Jt(t,e){let r=new ve;return Yt(r,t,e),r}function Yt(t,e,r){let n={oauthProxyAllowedOrigins:e?.oauthProxyAllowedOrigins??[],oauthProxyAllowLoopback:e?.oauthProxyAllowLoopback??!1,logPrefix:e?.logPrefix};e?.autoConnectUrl!==void 0?n.autoConnectUrl=e.autoConnectUrl:t.get(`${r}/inspector/config.json`,o=>{let s=new URL(o.req.url);return o.json({autoConnectUrl:`${s.origin}${r}`})}),Ie(t,n,r),Ct(t,{devMode:e?.devMode??!0,sandboxOrigin:e?.sandboxOrigin,inspectorMode:"embedded",rootRedirect:!1,basePath:r,proxyUrl:`${r}/inspector/api/proxy`,manufactChatUrl:e?.manufactChatUrl},r)}function Gt(t){return e=>Promise.resolve(t.fetch(e))}function gn(t,e){let r=new Set(e.filter(o=>!o.includes("*"))),n=e.filter(o=>o.endsWith("/*")).map(o=>o.slice(0,-1));return(o,s,a)=>{let i=new URL(o.originalUrl||o.url||"",yn(o));if(!r.has(i.pathname)&&!n.some(l=>i.pathname.startsWith(l))){a();return}let c=wn(o,i);t(c).then(l=>xn(s,l)).catch(a)}}function yn(t){let r=De(t.headers["x-forwarded-proto"])||t.protocol||"http",o=De(t.headers["x-forwarded-host"])||De(t.headers.host)||"localhost";return`${r}://${o}`}function De(t){return Array.isArray(t)?t[0]??"":(t??"").split(",")[0].trim()}function wn(t,e){let r={method:t.method,headers:t.headers};return t.method!=="GET"&&t.method!=="HEAD"&&(t.body!==void 0?r.body=bn(t.body):(r.body=fn.toWeb(t),r.duplex="half")),new globalThis.Request(e,r)}function bn(t){return typeof t=="string"||t instanceof ArrayBuffer||ArrayBuffer.isView(t)||t instanceof Blob||t instanceof FormData||t instanceof URLSearchParams||t instanceof ReadableStream?t:JSON.stringify(t)}async function xn(t,e){t.status(e.status),e.headers.forEach((o,s)=>{s!=="set-cookie"&&t.setHeader(s,o)});let r=e.headers.getSetCookie();if(r.length>0&&t.setHeader("set-cookie",r),!e.body){t.end();return}let n=e.body.getReader();for(;;){let{done:o,value:s}=await n.read();if(o)break;t.write(s)}t.end()}function vn(t){return!t||typeof t!="object"&&typeof t!="function"?!1:typeof t.use=="function"||Qt(t)}function Qt(t){return!!t&&typeof t=="object"&&typeof t.fetch=="function"&&typeof t.route=="function"}function Xt(t){if(t===void 0)return"/mcp";let e=t.trim(),r=[],n=!1;for(let s of e)s==="/"?(n||r.push(s),n=!0):(r.push(s),n=!1);for(;r.length>0&&r[r.length-1]==="/";)r.pop();let o=r.join("");return o===""||o==="/"?"":(o.startsWith("/")||(o=`/${o}`),o)}export{mn as mountInspector,Ie as registerInspectorProxyRoutes};
+</html>`}function Ct(t,e,r=""){let n=`${r}/inspector/assets`,o=encodeURIComponent(At),s={jsUrl:`${n}/inspector.js?v=${o}`,cssUrl:`${n}/inspector.css?v=${o}`},a=u=>`${r}${u}`,i={...e,basePath:e?.basePath??r,proxyUrl:e?.proxyUrl!==void 0?e.proxyUrl:a("/inspector/api/proxy"),disableTelemetry:e?.disableTelemetry??process.env.MCP_USE_ANONYMIZED_TELEMETRY==="false"},c=u=>{let d=new URL(u.req.url),h={...i,sandboxOrigin:i.sandboxOrigin??kr(d)??null};return u.html(Ur(h,r,s))};Pt(t,n),t.get(a("/inspector/oauth-popup-closed.html"),u=>u.html(Nr)),t.get(a("/inspector/sandbox"),u=>u.html(St(new URL(u.req.url).search))),t.get(a("/inspector"),c),t.get(`${a("/inspector")}/`,c);let l=a("/inspector/api/");t.get(a("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),t.post(a("/inspector/*"),u=>u.req.path.startsWith(l)?u.notFound():c(u)),r===""&&e?.rootRedirect!==!1&&t.get("/",u=>{let d=new URL(u.req.url);return u.redirect(`${a("/inspector")}${d.search}`)})}var Ot=t=>{let e={origin:"*",allowMethods:["GET","HEAD","PUT","POST","DELETE","PATCH","QUERY"],allowHeaders:[],exposeHeaders:[],...t},r=e.exposeHeaders?.length?e.exposeHeaders.join(","):void 0,n=e.allowHeaders?.length?e.allowHeaders.join(","):void 0,o=(a=>typeof a=="string"?a==="*"?()=>a:i=>a===i?i:null:typeof a=="function"?a:i=>a.includes(i)?i:null)(e.origin),s=(a=>{if(typeof a=="function")return async(i,c)=>(await a(i,c)).join(",");if(Array.isArray(a)){let i=a.join(",");return()=>i}else return()=>""})(e.allowMethods);return async function(i,c){function l(d,h){i.res.headers.set(d,h)}let u=await o(i.req.header("origin")||"",i);if(u&&l("Access-Control-Allow-Origin",u),e.credentials&&l("Access-Control-Allow-Credentials","true"),r&&l("Access-Control-Expose-Headers",r),i.req.method==="OPTIONS"){e.origin!=="*"&&i.res.headers.append("Vary","Origin"),e.maxAge!=null&&l("Access-Control-Max-Age",e.maxAge.toString());let d=await s(i.req.header("origin")||"",i);d&&l("Access-Control-Allow-Methods",d);let h=n;if(!h){let f=i.req.header("Access-Control-Request-Headers");f&&(h=f.split(",").map(x=>x.trim()).join(","))}return h&&(l("Access-Control-Allow-Headers",h),i.res.headers.append("Vary","Access-Control-Request-Headers")),i.res.headers.delete("Content-Length"),i.res.headers.delete("Content-Type"),new Response(null,{headers:i.res.headers,status:204,statusText:"No Content"})}await c(),e.origin!=="*"&&i.header("Vary","Origin",{append:!0})}};function jr(){let{process:t,Deno:e}=globalThis;return!(typeof e?.noColor=="boolean"?e.noColor:t!==void 0?"NO_COLOR"in t?.env:!1)}async function Lt(){let{navigator:t}=globalThis,e="cloudflare:workers";return!(t!==void 0&&t.userAgent==="Cloudflare-Workers"?await(async()=>{try{return"NO_COLOR"in((await import(e)).env??{})}catch{return!1}})():!jr())}var Hr=t=>{let[e,r]=[",","."];return t.map(o=>o.replace(/(\d)(?=(\d\d\d)+(?!\d))/g,"$1"+e)).join(r)},$r=t=>{let e=Date.now()-t;return Hr([e<1e3?e+"ms":Math.round(e/1e3)+"s"])},Br=async t=>{if(await Lt())switch(t/100|0){case 5:return`\x1B[31m${t}\x1B[0m`;case 4:return`\x1B[33m${t}\x1B[0m`;case 3:return`\x1B[36m${t}\x1B[0m`;case 2:return`\x1B[32m${t}\x1B[0m`}return`${t}`};async function Tt(t,e,r,n,o=0,s){let a=e==="<--"?`${e} ${r} ${n}`:`${e} ${r} ${n} ${await Br(o)} ${s}`;t(a)}var _e=(t=console.log)=>async function(r,n){let{method:o,url:s}=r.req,a=s.slice(s.indexOf("/",8));await Tt(t,"<--",o,a);let i=Date.now();await n(),await Tt(t,"-->",o,a,r.res.status,$r(i))};import{lookup as qr}from"dns/promises";import{Buffer as zr}from"buffer";import{isIP as Fr}from"net";var Wr=new Set(["accept","authorization","content-type","dpop"]),Vr=new Set(["cache-control","content-type","dpop-nonce","expires","pragma","retry-after","www-authenticate"]),Kr=[["registration_endpoint","registration"],["token_endpoint","token"],["revocation_endpoint","revocation"],["introspection_endpoint","introspection"]],jt=600*1e3,Jr=100,Gr=1440*60*1e3,Xr=500;function Le(t,e={}){let{basePath:r="/oauth",allowedOrigins:n=[],allowLoopback:o=!1,timeoutMs:s=1e4,maxRequestBodyBytes:a=64*1024,maxResponseBodyBytes:i=1024*1024,callbackPath:c="/oauth/callback",enableLogging:l=!0,logPrefix:u,authenticate:d,validateServerUrl:h,rateLimiter:f=new D.default({points:120,duration:60})}=e,x=new Set(n.map(Oe)),b=new Map,v=new Map,g=async(p,m)=>{try{await f.consume(p.req)}catch(y){return W(p,y)}return m()};t.use(`${r}/*`,async(p,m)=>{let y=p.req.header("Origin");if(y&&!cn(y,p,x))return p.json({error:"Origin not allowed"},403);if(p.req.method==="OPTIONS")return ln(y);await m(),y&&Wt(p.res.headers,y)}),t.use(`${r}/*`,g),t.get(`${r}/metadata`,async p=>{if(!await Ut(p,d))return p.json({error:"Unauthorized"},401);let m=await z(p.req.query("serverUrl"),o);if("error"in m)return p.json({error:m.error},400);let y=m.url;if(h&&!await h(y.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let P=await z(p.req.query("url"),o);if("error"in P)return p.json({error:P.error},400);let L=P.url,O=T(y),E=kt(b,O),_=Mt(y,L,E);if(!_&&E.authorizationServers.size===0)try{await It(y,E,o,s,i),b.set(O,E),_=Mt(y,L,E)}catch{}if(!_)return p.json({error:"Metadata target is not bound to this MCP server"},403);try{Se(l,u,`GET ${L}`);let S=await oe(L,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(s)});if(ie(S.status))return p.json({error:"OAuth metadata redirects are not allowed"},502);let w=await se(S,i);if(!S.ok)return p.body(w,S.status,{"Content-Type":S.headers.get("content-type")??"application/json"});let M=Ce(w);return _.type==="protected-resource"?await Bt(M,y,_.resourceIdentifier,E,o):await qt(M,_.issuer,E,o),E.updatedAt=Date.now(),b.set(O,E),Nt(b),p.body(w,200,{"Content-Type":S.headers.get("content-type")??"application/json"})}catch(S){return Ae(p,S,l,u)}}),t.post(`${r}/proxy`,async p=>{if(!await Ut(p,d))return p.json({error:"Unauthorized"},401);let m;try{m=JSON.parse(await sn(p.req.raw,a))}catch(w){return p.json({error:w instanceof H?"Request body too large":"Invalid JSON request body"},w instanceof H?413:400)}let y=await z(m.serverUrl,o);if("error"in y)return p.json({error:y.error},400);let P=y.url;if(h&&!await h(P.toString(),p))return p.json({error:"MCP server URL not allowed"},403);let L=await z(m.url,o);if("error"in L)return p.json({error:L.error},400);let O=L.url;if(m.method!==void 0&&m.method!=="POST")return p.json({error:"Only OAuth endpoint POST is allowed"},405);let E=T(P),_=kt(b,E);if(_.endpoints.size===0)try{await It(P,_,o,s,i),b.set(E,_),Nt(b)}catch(w){return Ae(p,w,l,u)}let S=_.endpoints.get(T(O));if(!S)return p.json({error:"OAuth endpoint is not bound to this MCP server"},403);try{let w=Zr(m.headers),M=tn(m.body,w);if(S==="registration"){let tr=Oe(p.req.header("Origin")??new URL(p.req.url).origin);M=an(M,w,new URL(c,tr).toString())}else M=nn({body:M,headers:w,bindingKey:E,clients:v});if(new TextEncoder().encode(M??"").byteLength>a)return p.json({error:"OAuth request body too large"},413);Se(l,u,`POST ${S} ${O}`);let $=await oe(O,{method:"POST",headers:w,body:M,redirect:"manual",signal:AbortSignal.timeout(s)});if(ie($.status))return p.json({error:"OAuth endpoint redirects are not allowed"},502);let ke=await se($,i),Zt=en($.headers),er=$.headers.get("content-type")??"",B=ke;if(er.includes("json"))try{B=JSON.parse(ke)}catch{}return S==="registration"&&$.ok&&B&&typeof B=="object"&&!Array.isArray(B)&&(B=rn({responseBody:B,binding:_,bindingKey:E,clients:v})),p.json({status:$.status,statusText:$.statusText,headers:Zt,body:B})}catch(w){return Ae(p,w,l,u)}}),Se(l,u,`Mounted at ${r}/metadata and ${r}/proxy`)}async function z(t,e){if(typeof t!="string"||!t)return{error:"Missing or invalid URL"};let r;try{r=new URL(t)}catch{return{error:"Invalid URL"}}if(r.username||r.password||r.hash)return{error:"URL credentials and fragments are not allowed"};let n=Vt(r.hostname);if(r.protocol!=="https:"&&!(e&&n&&r.protocol==="http:"))return{error:"HTTPS is required"};if(n)return e?{url:r}:{error:"Loopback URL not allowed"};if(un(r.hostname))return{error:"Local network URL not allowed"};try{let o=Fr(r.hostname)?[r.hostname]:(await qr(r.hostname,{all:!0,verbatim:!0})).map(({address:s})=>s);if(o.length===0||o.some(s=>!Kt(s)))return{error:"Private or non-routable URL not allowed"}}catch{return{error:"URL hostname could not be resolved"}}return{url:r}}async function Te(t,e=!1){return!("error"in await z(t,e))}function Mt(t,e,r){let n=T(e),o=Ht(t).find(s=>T(s.url)===n);if(o)return{type:"protected-resource",resourceIdentifier:o.resourceIdentifier};for(let s of r.authorizationServers)if($t(new URL(s)).some(a=>T(a)===n))return{type:"authorization-server",issuer:s}}function Ht(t){let e=t.pathname==="/"?"":t.pathname;return[{url:new URL(`/.well-known/oauth-protected-resource${e}`,t.origin),resourceIdentifier:t},{url:new URL("/.well-known/oauth-protected-resource",t.origin),resourceIdentifier:new URL(t.origin)}]}function $t(t){let e=t.pathname==="/"?"":t.pathname;return[new URL(`/.well-known/oauth-authorization-server${e}`,t.origin),new URL(`/.well-known/openid-configuration${e}`,t.origin),new URL(`${e||""}/.well-known/openid-configuration`,t.origin)]}async function Bt(t,e,r,n,o){let s=Yr(t.resource,o),a=s!==void 0&&T(s)===T(r),i=s!==void 0&&Qr(e,s);if(!a&&!i)throw new C("Protected-resource metadata does not match serverUrl");if(!Array.isArray(t.authorization_servers)||t.authorization_servers.length===0)throw new C("Protected-resource metadata has no authorization servers");let c=new Set;for(let l of t.authorization_servers){let u=await z(l,o);if("error"in u)throw new C(`Unsafe authorization server: ${u.error}`);c.add(T(u.url))}n.authorizationServers=c,n.endpoints.clear(),n.tokenEndpointAuthMethods.clear()}function Yr(t,e){if(!(typeof t!="string"||t.length===0))try{let r=new URL(t);return!(r.protocol==="https:"||e&&r.protocol==="http:"&&Vt(r.hostname))||r.username||r.password||r.hash?void 0:r}catch{return}}function Qr(t,e){if(t.origin!==e.origin||t.pathname.length<e.pathname.length)return!1;let r=t.pathname.endsWith("/")?t.pathname:`${t.pathname}/`,n=e.pathname.endsWith("/")?e.pathname:`${e.pathname}/`;return r.startsWith(n)}async function qt(t,e,r,n){if(typeof t.issuer!="string"||T(new URL(t.issuer))!==e)throw new C("Authorization-server metadata issuer mismatch");r.endpoints.clear(),r.tokenEndpointAuthMethods=new Set(Array.isArray(t.token_endpoint_auth_methods_supported)?t.token_endpoint_auth_methods_supported.filter(o=>typeof o=="string"):[]);for(let[o,s]of Kr){let a=t[o];if(a===void 0)continue;let i=await z(a,n);if("error"in i)throw new C(`Unsafe ${o}: ${i.error}`);r.endpoints.set(T(i.url),s)}}async function It(t,e,r,n,o){for(let s of Ht(t)){let a=await oe(s.url,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ie(a.status))throw new C("OAuth metadata redirects are not allowed");if(a.ok){await Bt(Ce(await se(a,o)),t,s.resourceIdentifier,e,r);break}}if(e.authorizationServers.size===0)throw new C("Protected-resource metadata could not be discovered");for(let s of e.authorizationServers){let a=!1;for(let i of $t(new URL(s))){let c=await oe(i,{method:"GET",headers:{Accept:"application/json"},redirect:"manual",signal:AbortSignal.timeout(n)});if(ie(c.status))throw new C("OAuth metadata redirects are not allowed");if(c.ok){await qt(Ce(await se(c,o)),s,e,r),a=!0;break}}if(a)break}if(e.endpoints.size===0)throw new C("Authorization-server metadata could not be discovered");e.updatedAt=Date.now()}async function oe(t,e){return fetch(t,e)}function Zr(t){let e=new Headers;if(!t||typeof t!="object"||Array.isArray(t))return e;for(let[r,n]of Object.entries(t)){let o=r.toLowerCase();Wr.has(o)&&typeof n=="string"&&e.set(o,n)}return e}function en(t){let e={};return t.forEach((r,n)=>{Vr.has(n.toLowerCase())&&(e[n]=r)}),e}function tn(t,e){if(t==null)return;if(typeof t=="string"){if(!e.has("content-type"))try{JSON.parse(t),e.set("content-type","application/json")}catch{e.set("content-type","application/x-www-form-urlencoded")}return t}if((e.get("content-type")??"").includes("application/x-www-form-urlencoded")&&typeof t=="object"&&!Array.isArray(t)){let n=new URLSearchParams;for(let[o,s]of Object.entries(t))n.append(o,String(s));return n.toString()}return e.has("content-type")||e.set("content-type","application/json"),JSON.stringify(t)}function zt(t,e){return`${t}\0${e}`}function rn(t){let{responseBody:e,binding:r,bindingKey:n,clients:o}=t,s=e.client_id,a=e.client_secret;if(typeof s!="string"||typeof a!="string")return e;let i=e.token_endpoint_auth_method,c=i==="client_secret_post"||i==="client_secret_basic"?i:r.tokenEndpointAuthMethods.has("client_secret_basic")?"client_secret_basic":"client_secret_post",l=e.client_secret_expires_at,u=l===0?Number.POSITIVE_INFINITY:typeof l=="number"&&l>0?l*1e3:Date.now()+Gr;for(on(o),o.set(zt(n,s),{clientSecret:a,authMethod:c,expiresAt:u});o.size>Xr;){let h=o.keys().next().value;if(!h)break;o.delete(h)}let d={...e};return delete d.client_secret,delete d.client_secret_expires_at,d.token_endpoint_auth_method="none",d}function nn(t){let{body:e,headers:r,bindingKey:n,clients:o}=t;if(!e||!(r.get("content-type")??"").includes("application/x-www-form-urlencoded"))return e;let s=new URLSearchParams(e),a=s.get("client_id");if(!a)return e;let i=zt(n,a),c=o.get(i);if(!c)return e;if(c.expiresAt<=Date.now())return o.delete(i),e;if(s.delete("client_secret"),c.authMethod==="client_secret_basic"){let l=zr.from(`${Dt(a)}:${Dt(c.clientSecret)}`,"utf8").toString("base64");r.set("authorization",`Basic ${l}`)}else r.delete("authorization"),s.set("client_id",a),s.set("client_secret",c.clientSecret);return s.toString()}function Dt(t){return new URLSearchParams({value:t}).toString().slice(6)}function on(t){let e=Date.now();for(let[r,n]of t)n.expiresAt<=e&&t.delete(r)}async function sn(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw new H;return Ft(t.body,e)}async function se(t,e){let r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw await t.body?.cancel(),new H;return Ft(t.body,e)}async function Ft(t,e){if(!t)return"";let r=t.getReader(),n=[],o=0;for(;;){let{done:i,value:c}=await r.read();if(i)break;if(o+=c.byteLength,o>e)throw await r.cancel(),new H;n.push(c)}let s=new Uint8Array(o),a=0;for(let i of n)s.set(i,a),a+=i.byteLength;return new TextDecoder().decode(s)}function Ce(t){let e;try{e=JSON.parse(t)}catch{throw new C("OAuth metadata is not valid JSON")}if(!e||typeof e!="object"||Array.isArray(e))throw new C("OAuth metadata is not an object");return e}function kt(t,e){let r=t.get(e);return r&&Date.now()-r.updatedAt<=jt?r:(t.delete(e),{authorizationServers:new Set,endpoints:new Map,tokenEndpointAuthMethods:new Set,updatedAt:Date.now()})}function Nt(t){let e=Date.now();for(let[r,n]of t)e-n.updatedAt>jt&&t.delete(r);for(;t.size>Jr;){let r=t.keys().next().value;if(!r)break;t.delete(r)}}function T(t){let e=new URL(t);return e.hash="",(e.protocol==="https:"&&e.port==="443"||e.protocol==="http:"&&e.port==="80")&&(e.port=""),e.toString().replace(/\/$/,"")}function an(t,e,r){if(!t||!(e.get("content-type")??"").includes("json"))return t;try{let o=JSON.parse(t);return!o||typeof o!="object"||Array.isArray(o)?t:JSON.stringify({...o,redirect_uris:[r]})}catch{return t}}function Oe(t){let e=new URL(t);if(e.pathname!=="/"||e.search||e.hash)throw new Error(`OAuth proxy allowed origin must be an origin: ${t}`);return e.origin}function cn(t,e,r){try{let n=Oe(t);if(n===new URL(e.req.url).origin||r.has(n))return!0;let o=new URL(n),a=e.req.header("x-forwarded-host")?.split(",")[0]?.trim()||e.req.header("host");if(!a||o.host!==a)return!1;let i=e.req.header("x-forwarded-proto")?.split(",")[0]?.trim();return!i||`${i}:`===o.protocol}catch{return!1}}function ln(t){let e=new Headers;return t&&Wt(e,t),e.set("Access-Control-Allow-Methods","GET, POST, OPTIONS"),e.set("Access-Control-Allow-Headers","Accept, Authorization, Content-Type"),e.set("Access-Control-Max-Age","600"),new Response(null,{status:204,headers:e})}function Wt(t,e){t.set("Access-Control-Allow-Origin",e),t.append("Vary","Origin")}async function Ut(t,e){return e?e(t):!0}function ie(t){return t>=300&&t<400}function Vt(t){let e=t.toLowerCase().replace(/^\[|\]$/g,"");return e==="localhost"||e.endsWith(".localhost")||e==="::1"||e.startsWith("127.")}function un(t){let e=t.toLowerCase();return e.endsWith(".local")||e.endsWith(".internal")||e.endsWith(".home.arpa")}function Kt(t){if(t.includes(":")){let s=t.toLowerCase();return s.startsWith("::ffff:")?Kt(s.slice(7)):!(s==="::"||s==="::1"||s.startsWith("fc")||s.startsWith("fd")||/^fe[89ab]/.test(s)||s.startsWith("ff")||s.startsWith("2001:db8:"))}let e=t.split(".").map(Number);if(e.length!==4||e.some(s=>!Number.isInteger(s)))return!1;let[r,n,o]=e;return!(r===0||r===10||r===127||r===100&&n>=64&&n<=127||r===169&&n===254||r===172&&n>=16&&n<=31||r===192&&n===0&&o===0||r===192&&n===0&&o===2||r===192&&n===168||r===198&&(n===18||n===19)||r===198&&n===51&&o===100||r===203&&n===0&&o===113||r>=224)}function Se(t,e,r){t&&console.log(e===void 0?`[OAuth BFF] ${r}`:`${e} [OAuth BFF] ${r}`)}function Ae(t,e,r,n){let o=e instanceof Error?e.message:"Unknown error";return r&&console.error(n===void 0?"[OAuth BFF]":`${n} [OAuth BFF]`,o),e instanceof H?t.json({error:"Upstream response too large"},502):e instanceof C?t.json({error:e.message},502):e instanceof DOMException&&e.name==="TimeoutError"?t.json({error:"OAuth upstream timed out"},504):t.json({error:"OAuth upstream request failed"},502)}var H=class extends Error{},C=class extends Error{};var dn=3;function pn(t,e){return t.includes("text/event-stream")&&!e}function Me(t,e={}){let r=e.path||"/mcp/proxy",n=e.enableLogging!==!1,o=e.logPrefix,s=e.rateLimiter??new D.default({points:120,duration:60}),a=async(i,c)=>{try{await s.consume(i.req)}catch(l){return W(i,l)}return c()};t.use(`${r}/*`,Ot({origin:"*",allowHeaders:["Authorization","Content-Type","Accept","X-Target-URL","X-MCP-Target","Mcp-Session-Id","mcp-session-id","mcp-protocol-version","X-Server-Id","X-Requested-With"],exposeHeaders:["*"]})),n&&t.use(`${r}/*`,o===void 0?_e():_e((i,...c)=>console.log(o,i,...c))),t.use(`${r}/*`,a),t.all(`${r}/*`,async i=>{try{if(e.authenticate&&!await e.authenticate(i))return i.json({error:"Unauthorized"},401);let c=i.req.header("X-Target-URL");if(!c)return i.json({error:"X-Target-URL header is required",usage:"Set X-Target-URL header to the MCP server URL you want to proxy to"},400);if(!await Te(c,e.allowLoopback??!1))return i.json({error:"Invalid target URL",details:"Target is not allowed by the proxy network policy"},403);if(e.validateRequest&&!await e.validateRequest(c,i))return i.json({error:"Invalid target URL",details:"The requested target URL is not allowed"},403);try{new URL(c)}catch{return i.json({error:"Invalid target URL format",details:"The X-Target-URL must be a valid HTTP/HTTPS URL"},400)}let l=i.req.method,u={},d=i.req.header();for(let[v,g]of Object.entries(d)){let p=v.toLowerCase();!p.startsWith("x-proxy-")&&!p.startsWith("x-target-")&&!p.startsWith("x-mcp-")&&!p.startsWith("x-forwarded-")&&!p.startsWith("cf-")&&p!=="x-original-host"&&p!=="host"&&p!=="origin"&&p!=="referer"&&p!=="cookie"&&p!=="proxy-authorization"&&p!=="accept-encoding"&&p!=="cdn-loop"&&!p.startsWith("sec-fetch-")&&(u[v]=g)}u["Accept-Encoding"]="identity";let h=l!=="GET"&&l!=="HEAD"?new Uint8Array(await i.req.arrayBuffer()).slice():void 0,f=c,x=l,b=h;for(let v=0;;v+=1){let g=await fetch(f,{method:x,headers:u,body:b,redirect:"manual",signal:i.req.raw.signal}),p=g.headers.get("location");if(!(g.status>=300&&g.status<400&&p))return await hn(g);if(v>=dn)return i.json({error:"Too many upstream redirects"},502);let m=new URL(p,f);if(!await Te(m.toString(),e.allowLoopback??!1)||e.validateRequest&&!await e.validateRequest(m.toString(),i))return i.json({error:"Redirect target is not allowed"},403);m.origin!==new URL(f).origin&&(ae(u,"authorization"),ae(u,"proxy-authorization")),(g.status===303||(g.status===301||g.status===302)&&x==="POST")&&(x="GET",b=void 0,ae(u,"content-type"),ae(u,"content-length")),f=m.toString()}}catch(c){let l=c instanceof Error?c.message:"Unknown error",{signal:u}=i.req.raw;if(u.aborted&&(c===u.reason||c instanceof Error&&c.name==="AbortError"))return new Response(null,{status:499});let d=i.req.header("X-Target-URL");return c instanceof Error&&(c.message.includes("ECONNREFUSED")||c.message.includes("fetch failed"))?console.warn(`[MCP Proxy] Connection refused to ${d||"unknown target"} - server may not be running`):console.error("[MCP Proxy] Request failed:",l,`
+Target URL:`,d||"unknown",`
+Error:`,c),i.json({error:"Proxy request failed",details:l,targetUrl:d||"unknown"},500)}})}function ae(t,e){for(let r of Object.keys(t))r.toLowerCase()===e&&delete t[r]}async function hn(t){let e={};if(t.headers.forEach((o,s)=>{let a=s.toLowerCase();a!=="content-encoding"&&a!=="transfer-encoding"&&a!=="content-length"&&a!=="set-cookie"&&(e[s]=o)}),pn(t.headers.get("content-type")||"",t.headers.get("content-length")))return e["x-accel-buffering"]="no",e["cache-control"]??="no-cache, no-transform",new Response(t.body,{status:t.status,statusText:t.statusText,headers:e});if([204,205,304].includes(t.status))return new Response(null,{status:t.status,statusText:t.statusText,headers:e});let n=await t.arrayBuffer();return e["Content-Length"]=String(n.byteLength),new Response(n,{status:t.status,statusText:t.statusText,headers:e})}function Ie(t,e,r=""){let n=i=>`${r}${i}`,o=e?.oauthProxyAllowLoopback??!1,s=e?.oauth!==!1,a=new D.default({points:120,duration:60});if(t.get(n("/inspector/health"),i=>i.json({status:"ok",protocol:"mcp-use-inspector-preview",version:1,capabilities:["view-preview"]})),Me(t,{path:n("/inspector/api/proxy"),allowLoopback:o,rateLimiter:a,logPrefix:e?.logPrefix}),s&&Le(t,{basePath:n("/inspector/api/oauth"),callbackPath:n("/inspector/oauth/callback"),enableLogging:!0,logPrefix:e?.logPrefix,allowedOrigins:e?.oauthProxyAllowedOrigins??[],allowLoopback:o,rateLimiter:a}),e?.autoConnectUrl!==void 0){let i=e.autoConnectUrl;t.get(n("/inspector/config.json"),c=>c.json({autoConnectUrl:i??null}))}}function mn(t,e){if(vn(t)){let o=t,s=e,a=Xt(s?.basePath);if(Qt(o)){Yt(o,s,a);return}let i=Jt(s,a),c=Gt(i);o.use(gn(c,i.routes.map(l=>l.path)));return}let r=t,n=Xt(r?.basePath);return Gt(Jt(r,n))}function Jt(t,e){let r=new ve;return Yt(r,t,e),r}function Yt(t,e,r){let n={oauthProxyAllowedOrigins:e?.oauthProxyAllowedOrigins??[],oauthProxyAllowLoopback:e?.oauthProxyAllowLoopback??!1,logPrefix:e?.logPrefix};e?.autoConnectUrl!==void 0?n.autoConnectUrl=e.autoConnectUrl:t.get(`${r}/inspector/config.json`,o=>{let s=new URL(o.req.url);return o.json({autoConnectUrl:`${s.origin}${r}`})}),Ie(t,n,r),Ct(t,{devMode:e?.devMode??!0,sandboxOrigin:e?.sandboxOrigin,inspectorMode:"embedded",rootRedirect:!1,basePath:r,proxyUrl:`${r}/inspector/api/proxy`,manufactChatUrl:e?.manufactChatUrl},r)}function Gt(t){return e=>Promise.resolve(t.fetch(e))}function gn(t,e){let r=new Set(e.filter(o=>!o.includes("*"))),n=e.filter(o=>o.endsWith("/*")).map(o=>o.slice(0,-1));return(o,s,a)=>{let i=new URL(o.originalUrl||o.url||"",yn(o));if(!r.has(i.pathname)&&!n.some(d=>i.pathname.startsWith(d))){a();return}let c=!1,l=new AbortController;s.on("close",()=>{c||l.abort()}),s.destroyed===!0&&l.abort();let u=wn(o,i,l.signal);t(u).then(d=>xn(s,d,l.signal)).catch(d=>{l.signal.aborted&&d instanceof Error&&d.name==="AbortError"||a(d)}).finally(()=>{c=!0})}}function yn(t){let r=De(t.headers["x-forwarded-proto"])||t.protocol||"http",o=De(t.headers["x-forwarded-host"])||De(t.headers.host)||"localhost";return`${r}://${o}`}function De(t){return Array.isArray(t)?t[0]??"":(t??"").split(",")[0].trim()}function wn(t,e,r){let n={method:t.method,headers:t.headers,signal:r};return t.method!=="GET"&&t.method!=="HEAD"&&(t.body!==void 0?n.body=bn(t.body):(n.body=fn.toWeb(t),n.duplex="half")),new globalThis.Request(e,n)}function bn(t){return typeof t=="string"||t instanceof ArrayBuffer||ArrayBuffer.isView(t)||t instanceof Blob||t instanceof FormData||t instanceof URLSearchParams||t instanceof ReadableStream?t:JSON.stringify(t)}async function xn(t,e,r){t.status(e.status),e.headers.forEach((a,i)=>{i!=="set-cookie"&&t.setHeader(i,a)});let n=e.headers.getSetCookie();if(n.length>0&&t.setHeader("set-cookie",n),!e.body){t.end();return}let o=e.body.getReader(),s=()=>{o.cancel().catch(()=>{})};r.aborted?s():r.addEventListener("abort",s,{once:!0});try{for(;!r.aborted;){let{done:a,value:i}=await o.read();if(a||r.aborted)break;t.write(i)}r.aborted||t.end()}finally{r.removeEventListener("abort",s)}}function vn(t){return!t||typeof t!="object"&&typeof t!="function"?!1:typeof t.use=="function"||Qt(t)}function Qt(t){return!!t&&typeof t=="object"&&typeof t.fetch=="function"&&typeof t.route=="function"}function Xt(t){if(t===void 0)return"/mcp";let e=t.trim(),r=[],n=!1;for(let s of e)s==="/"?(n||r.push(s),n=!0):(r.push(s),n=!1);for(;r.length>0&&r[r.length-1]==="/";)r.pop();let o=r.join("");return o===""||o==="/"?"":(o.startsWith("/")||(o=`/${o}`),o)}export{mn as mountInspector,Ie as registerInspectorProxyRoutes};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcp-use/inspector",
   "type": "module",
-  "version": "20.3.13",
+  "version": "20.3.14-canary.0",
   "description": "MCP Inspector - A tool for inspecting and debugging MCP servers",
   "author": "",
   "license": "MIT",
@@ -53,7 +53,7 @@
     "express": "^4.21.2 || ^5.0.0",
     "lucide-react": "^0.562.0",
     "markdown-to-jsx": "^9.7.4",
-    "mcp-use": "^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1",
+    "mcp-use": "^2.4.3 || ^2.4.4 || ^2.5.0 || ^2.5.1 || ^2.5.2 || ^2.6.0 || ^2.6.1 || ^2.7.0 || ^2.7.1 || ^2.7.2-canary.0",
     "motion": "^12.34.2",
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",