@modelcontextprotocol/inspector 2.4.0 → 2.5.0

package/clients/cli/build/index.js

@@ -390,6 +390,491 @@ async function deleteStoreFile(filePath) {
   }
 }
 
+// ../../core/json/nullableUnion.ts
+var RENDERABLE_TYPES = [
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "array",
+  "object"
+];
+function isRenderableType(type) {
+  return RENDERABLE_TYPES.includes(type);
+}
+function toBranch(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+function isStringEnum(value) {
+  return Array.isArray(value) && value.length > 0 && value.every((member) => typeof member === "string");
+}
+function nullExcludedBySiblings(schema) {
+  if (Array.isArray(schema.enum) && !schema.enum.includes(null)) {
+    return true;
+  }
+  return schema.const !== void 0 && schema.const !== null;
+}
+var ANNOTATION_KEYWORDS = /* @__PURE__ */ new Set([
+  "title",
+  "description",
+  "default",
+  "enumNames",
+  "examples",
+  "deprecated",
+  "readOnly",
+  "writeOnly",
+  "$comment",
+  "$schema",
+  "$id"
+]);
+function wrapperCarriesConstraints(schema) {
+  return Object.keys(schema).some(
+    (key) => key !== "anyOf" && !ANNOTATION_KEYWORDS.has(key)
+  );
+}
+function typeNamesNull(type) {
+  return Array.isArray(type) ? type.includes("null") : type === "null";
+}
+function hasOpaqueApplicator(schema) {
+  return schema.not !== void 0 || schema.allOf !== void 0 || schema.oneOf !== void 0 || // `$ref` points at a schema this module never resolves, and it applies
+  // *alongside* its siblings — `{ type: "string", $ref: "#/$defs/intOnly" }`
+  // can be unsatisfiable. The wrapper path already declines on it (it is not
+  // an annotation); this is the same rule for every other position.
+  schema.$ref !== void 0;
+}
+function hasUnevaluatedComposition(schema) {
+  return schema.anyOf !== void 0 || hasOpaqueApplicator(schema);
+}
+function stripNullEnumMembers(members, names) {
+  if (!Array.isArray(members)) {
+    return { kind: "unchanged" };
+  }
+  const kept = members.map((member, index) => ({ member, index })).filter((entry) => entry.member !== null);
+  if (kept.length === 0) {
+    return { kind: "unselectable" };
+  }
+  if (kept.length === members.length) {
+    return { kind: "unchanged" };
+  }
+  const wasParallel = Array.isArray(names) && names.length === members.length;
+  const aligned = wasParallel ? kept.map((entry) => names[entry.index]) : void 0;
+  return {
+    kind: "filtered",
+    members: kept.map((entry) => entry.member),
+    names: aligned
+  };
+}
+function collapsed(schema, branch, type) {
+  const merged = { ...schema, ...branch };
+  const strip = stripNullEnumMembers(
+    merged.enum,
+    merged.enumNames
+  );
+  if (strip.kind === "unselectable") {
+    return null;
+  }
+  return {
+    ...merged,
+    type,
+    anyOf: void 0,
+    // Read off the ORIGINAL schema, not the merge: a hoisted branch `enum` is
+    // not a sibling constraint, and treating it as one would mark the very
+    // shape #1928 is about as non-nullable. See `nullExcludedBySiblings`.
+    nullable: admitsNull(schema),
+    ...strip.kind === "filtered" ? { enum: strip.members, enumNames: strip.names } : {}
+  };
+}
+function typeAdmitsNull(type) {
+  return type === void 0 || typeNamesNull(type);
+}
+function admitsNull(schema) {
+  if (nullExcludedBySiblings(schema)) {
+    return false;
+  }
+  if (hasOpaqueApplicator(schema)) {
+    return false;
+  }
+  if (schema.const === null) {
+    if (schema.nullable !== true && !typeAdmitsNull(schema.type)) return false;
+    return schema.anyOf === void 0 || anyOfAdmitsNull(schema);
+  }
+  if (Array.isArray(schema.enum) && schema.enum.includes(null)) {
+    return (schema.nullable === true || typeAdmitsNull(schema.type)) && (schema.anyOf === void 0 || anyOfAdmitsNull(schema));
+  }
+  if (schema.nullable === true) {
+    return true;
+  }
+  if (schema.type !== void 0) {
+    if (schema.anyOf !== void 0) {
+      return false;
+    }
+    return typeNamesNull(schema.type);
+  }
+  return anyOfAdmitsNull(schema);
+}
+var ANNOTATION_ONLY_KEYWORDS = /* @__PURE__ */ new Set([
+  "title",
+  "description",
+  "examples",
+  "default",
+  "deprecated",
+  "readOnly",
+  "writeOnly",
+  "$comment",
+  // Core keywords that identify or declare rather than assert. `$ref` is
+  // deliberately absent: it applies whatever it points at, which is exactly an
+  // assertion this module cannot see.
+  "$defs",
+  "$id",
+  "$schema",
+  "$anchor",
+  "$dynamicAnchor",
+  "$vocabulary"
+]);
+function constrainsNothing(schema) {
+  return Object.keys(schema).every(
+    (keyword) => ANNOTATION_ONLY_KEYWORDS.has(keyword)
+  );
+}
+function anyOfAdmitsNull(schema) {
+  const branches = schema.anyOf;
+  if (!Array.isArray(branches)) return false;
+  return branches.some((entry) => {
+    if (typeof entry === "boolean") return entry;
+    const branch = toBranch(entry);
+    if (branch === null) return false;
+    const branchSchema = branch;
+    if (hasUnevaluatedComposition(branchSchema)) return false;
+    if (constrainsNothing(branchSchema)) return true;
+    return admitsNull(branchSchema);
+  });
+}
+function normalizeNullableUnion(schema) {
+  if (schema.anyOf?.length === 2) {
+    const branches = schema.anyOf.map(toBranch);
+    const nullBranch = branches.find((entry) => entry?.type === "null");
+    const branch = branches.find(
+      (entry) => entry !== null && entry.type !== "null"
+    );
+    if (nullBranch && branch && !wrapperCarriesConstraints(schema) && !hasUnevaluatedComposition(branch)) {
+      const type = branch.type ?? (isStringEnum(branch.enum) ? "string" : void 0);
+      if (isRenderableType(type)) {
+        const result = collapsed(schema, branch, type);
+        if (result !== null) {
+          return result;
+        }
+      }
+    }
+  }
+  if (Array.isArray(schema.type) && schema.type.length === 2 && schema.type.includes("null") && // This path keeps the schema's own keywords, but `collapsed` clears `anyOf`
+  // and the renderers ignore the other applicators — so a compound schema
+  // like `{ type: ["string", "null"], anyOf: [{ const: "a" }] }` would be
+  // widened into an unconstrained string field. Leave it for the JSON editor.
+  !hasUnevaluatedComposition(schema)) {
+    const type = schema.type.find((member) => member !== "null");
+    if (isRenderableType(type)) {
+      const result = collapsed(schema, void 0, type);
+      if (result !== null) {
+        return result;
+      }
+    }
+  }
+  return schema;
+}
+
+// ../../core/json/rootUnion.ts
+function membersOf(value) {
+  return Array.isArray(value) ? value : [];
+}
+function requiredOf(schema) {
+  const { required } = schema;
+  return Array.isArray(required) ? required.filter((name) => typeof name === "string") : [];
+}
+function toBranch2(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return null;
+  }
+  return value;
+}
+function admitsObject(schema) {
+  const { type } = schema;
+  if (type === void 0) return true;
+  return Array.isArray(type) ? type.includes("object") : type === "object";
+}
+function hasReadableProperties(schema) {
+  const { properties } = schema;
+  return typeof properties === "object" && properties !== null && !Array.isArray(properties);
+}
+function propertiesOf(schema) {
+  return hasReadableProperties(schema) ? schema.properties : {};
+}
+function isOfferable(branch, merged) {
+  if (branch.properties !== void 0 && !hasReadableProperties(branch)) {
+    return false;
+  }
+  if (!admitsObject(branch)) return false;
+  const properties = Object.values(propertiesOf(merged));
+  return properties.length > 0 && // Every value has to be something a renderer can read AND something a
+  // caller can satisfy. A `null` or an array is not a schema at all, and the
+  // web form dereferences one on the way to choosing a widget. JSON Schema's
+  // boolean form is legal, but only `true` is harmless — it constrains
+  // nothing and answers every keyword lookup with `undefined`, while `false`
+  // admits no value whatsoever, so a field declared with it can never be
+  // filled and a required one makes the whole branch unsatisfiable. Either
+  // way the branch is declined rather than offered as a callable shape.
+  properties.every(
+    (property) => property === true || typeof property === "object" && property !== null && !Array.isArray(property)
+  );
+}
+var ANNOTATION_KEYWORDS2 = /* @__PURE__ */ new Set([
+  "title",
+  "description",
+  "examples",
+  "deprecated",
+  "readOnly",
+  "writeOnly",
+  "$comment",
+  // An annotation too: a suggested initial value constrains nothing, so two
+  // declarations suggesting different ones still accept the same values.
+  "default"
+]);
+function canonicalJson(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map(canonicalJson).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== null) {
+    const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(
+      ([key, member]) => `${JSON.stringify(key)}:${canonicalJson(member)}`
+    );
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "undefined";
+}
+function sameJsonValue(a, b) {
+  return sameValue(a, b);
+}
+function sameValue(a, b) {
+  return a === b || canonicalJson(a) === canonicalJson(b);
+}
+function conflicts(baseProperty, branchProperty) {
+  const a = toBranch2(baseProperty);
+  const b = toBranch2(branchProperty);
+  if (a === null || b === null) {
+    return !sameValue(baseProperty, branchProperty);
+  }
+  const left = a;
+  const right = b;
+  if (Object.keys(right).some(
+    (keyword) => !ANNOTATION_KEYWORDS2.has(keyword) && keyword in left && !sameValue(left[keyword], right[keyword])
+  )) {
+    return true;
+  }
+  return !constSatisfiesSiblings({ ...left, ...right });
+}
+function jsonTypeOf(value) {
+  if (value === null) return "null";
+  if (Array.isArray(value)) return "array";
+  if (typeof value === "number") {
+    return Number.isInteger(value) ? "integer" : "number";
+  }
+  return typeof value;
+}
+var CONST_CHECKABLE = /* @__PURE__ */ new Set(["const", "type", "enum"]);
+function constSatisfiesSiblings(schema) {
+  if (!("const" in schema)) return true;
+  const value = schema.const;
+  const { type, enum: allowed } = schema;
+  if (Object.keys(schema).some(
+    (keyword) => !CONST_CHECKABLE.has(keyword) && !ANNOTATION_KEYWORDS2.has(keyword)
+  )) {
+    return false;
+  }
+  const actual = jsonTypeOf(value);
+  const admits = (name) => name === actual || name === "number" && actual === "integer";
+  if (typeof type === "string" && !admits(type)) return false;
+  if (Array.isArray(type) && !type.some(admits)) return false;
+  if (Array.isArray(allowed) && !allowed.some((member) => sameValue(member, value))) {
+    return false;
+  }
+  return true;
+}
+function mergeProperty(baseProperty, branchProperty) {
+  const a = toBranch2(baseProperty);
+  const b = toBranch2(branchProperty);
+  if (a === null || b === null) {
+    return branchProperty;
+  }
+  return { ...a, ...b };
+}
+var MERGEABLE_KEYWORDS = /* @__PURE__ */ new Set(["type", "properties", "required"]);
+function isFlattenable(member) {
+  const branch = toBranch2(member);
+  if (branch === null || !admitsObject(branch)) return false;
+  return Object.keys(branch).every(
+    (keyword) => MERGEABLE_KEYWORDS.has(keyword) || ANNOTATION_KEYWORDS2.has(keyword)
+  );
+}
+function conflictsWithBase(base, branch) {
+  const baseProperties = propertiesOf(base);
+  const branchProperties = propertiesOf(branch);
+  return Object.entries(branchProperties).some(
+    ([name, branchProperty]) => (
+      // `hasOwn`, not `in`: `properties` is a JSON record, so `constructor` and
+      // `toString` are legal argument names that `in` would find on
+      // `Object.prototype` and report as collisions the root never declared.
+      Object.hasOwn(baseProperties, name) && conflicts(baseProperties[name], branchProperty)
+    )
+  );
+}
+function hasDiscriminator(members, named, rootRequired) {
+  const first = propertiesOf(members[0] ?? {});
+  const candidates = named !== void 0 ? [named] : Object.keys(first);
+  return candidates.some((name) => {
+    const constants = members.map((member) => {
+      if (!rootRequired.includes(name) && !requiredOf(member).includes(name)) {
+        return void 0;
+      }
+      const property = toBranch2(propertiesOf(member)[name]);
+      return property?.const;
+    });
+    if (constants.some((value) => value === void 0)) return false;
+    const seen = new Set(constants.map(canonicalJson));
+    return seen.size === constants.length;
+  });
+}
+function restrictsAdditional(schema) {
+  const additional = schema.additionalProperties;
+  return additional === false || typeof additional === "object" && additional !== null && Object.keys(additional).some(
+    (keyword) => !ANNOTATION_KEYWORDS2.has(keyword)
+  );
+}
+function addsForbiddenNames(base, member) {
+  if (!restrictsAdditional(base)) return false;
+  const baseNames = propertiesOf(base);
+  return Object.keys(propertiesOf(member)).some(
+    (name) => !Object.hasOwn(baseNames, name)
+  );
+}
+function mergeBranch(base, branch) {
+  const baseProperties = propertiesOf(base);
+  const branchProperties = propertiesOf(branch);
+  const properties = Object.fromEntries([
+    ...Object.entries(baseProperties),
+    ...Object.entries(branchProperties).map(([name, branchProperty]) => [
+      name,
+      Object.hasOwn(baseProperties, name) ? mergeProperty(baseProperties[name], branchProperty) : branchProperty
+    ])
+  ]);
+  const baseRequired = requiredOf(base);
+  const required = [
+    ...baseRequired,
+    ...requiredOf(branch).filter((name) => !baseRequired.includes(name))
+  ];
+  return {
+    ...base,
+    ...Object.keys(properties).length > 0 ? { properties } : {},
+    ...required.length > 0 ? { required } : {}
+  };
+}
+function withoutComposition(schema) {
+  const { allOf: _allOf, anyOf: _anyOf, oneOf: _oneOf, ...rest } = schema;
+  return rest;
+}
+function branchLabel(branch, index, discriminatorProperty) {
+  if (typeof branch.title === "string" && branch.title.trim() !== "") {
+    return branch.title;
+  }
+  const properties = propertiesOf(branch);
+  const constOf = (name) => {
+    const property = toBranch2(properties[name]);
+    if (property === null || !("const" in property)) return void 0;
+    const value = property.const;
+    return value === null || typeof value !== "object" ? String(value) : void 0;
+  };
+  if (discriminatorProperty !== void 0) {
+    const value = constOf(discriminatorProperty);
+    if (value !== void 0) return value;
+  }
+  const constants = Object.keys(properties).map((name) => constOf(name)).filter((value) => value !== void 0);
+  if (constants.length === 1) return constants[0];
+  return `Option ${index + 1}`;
+}
+function resolveRootUnion(schema) {
+  const allOfMembers = membersOf(schema.allOf);
+  let merged = schema;
+  for (const member of allOfMembers) {
+    const branch = toBranch2(member);
+    if (branch === null || !isFlattenable(member) || conflictsWithBase(merged, branch) || addsForbiddenNames(merged, branch)) {
+      return { base: schema, branches: [] };
+    }
+    merged = mergeBranch(merged, branch);
+  }
+  const base = withoutComposition(merged);
+  if (schema.oneOf !== void 0 && schema.anyOf !== void 0) {
+    return { base, branches: [] };
+  }
+  const isExclusiveUnion = schema.oneOf !== void 0;
+  const members = membersOf(schema.oneOf ?? schema.anyOf);
+  const branches = members.map(toBranch2);
+  if (branches.length === 0 || branches.some(
+    (branch) => branch === null || !isOfferable(branch, mergeBranch(base, branch)) || // The same faithfulness test the `allOf` fold applies: a member
+    // carrying a constraint the merge does not copy — a nested `allOf`, a
+    // `not`, a `$ref` — would have it erased along with the union keyword,
+    // which can present an unsatisfiable branch as a callable one.
+    !isFlattenable(branch) || conflictsWithBase(base, branch)
+  )) {
+    return { base, branches: [] };
+  }
+  if (branches.some(
+    (branch) => addsForbiddenNames(base, branch)
+  )) {
+    return { base, branches: [] };
+  }
+  if (isExclusiveUnion && !hasDiscriminator(
+    branches,
+    schema.discriminator?.propertyName,
+    requiredOf(base)
+  )) {
+    return { base, branches: [] };
+  }
+  const discriminatorProperty = schema.discriminator?.propertyName;
+  return {
+    base,
+    branches: branches.filter((branch) => branch !== null).map((branch, index) => ({
+      // `base` is already composition-free and `mergeBranch` copies only
+      // `properties`/`required` off the branch, so the merge stays that way.
+      schema: mergeBranch(base, branch),
+      label: branchLabel(branch, index, discriminatorProperty),
+      declaredFields: Object.keys(propertiesOf(branch))
+    }))
+  };
+}
+function narrowBySuppliedNames(branches, candidates, suppliedNames) {
+  if (candidates.length === 1) return candidates[0];
+  if (candidates.length === 0 || suppliedNames.length === 0) return null;
+  const supplied = new Set(suppliedNames);
+  const satisfied = candidates.filter((index) => {
+    const branch = branches[index];
+    const required = requiredOf(branch.schema);
+    const own = required.filter((name) => branch.declaredFields.includes(name));
+    return own.length > 0 && own.every((name) => supplied.has(name));
+  });
+  if (satisfied.length === 1) return satisfied[0];
+  const exclusiveTo = /* @__PURE__ */ new Map();
+  for (const index of candidates) {
+    for (const name of branches[index].declaredFields) {
+      exclusiveTo.set(name, exclusiveTo.has(name) ? -1 : index);
+    }
+  }
+  const named = new Set(
+    suppliedNames.map((name) => exclusiveTo.get(name)).filter((index) => index !== void 0 && index >= 0)
+  );
+  return named.size === 1 ? [...named][0] : null;
+}
+
 // ../../core/json/jsonUtils.ts
 function isSerializableJson(value) {
   if (value === null) return true;
@@ -429,16 +914,90 @@ function convertParameterValue(value, schema) {
   }
   return value;
 }
+function coercionProperties(base, branches, params) {
+  if (branches.length === 0) {
+    return { ...base.properties };
+  }
+  const candidates = branches.map((branch, index) => ({ branch, index })).filter(
+    ({ branch }) => matchesConstants(branch.schema.properties ?? {}, params)
+  ).map(({ index }) => index);
+  const selected = narrowBySuppliedNames(
+    branches,
+    candidates,
+    Object.keys(params)
+  );
+  if (selected !== null) {
+    return { ...branches[selected].schema.properties };
+  }
+  const properties = Object.fromEntries(
+    Object.entries(base.properties ?? {})
+  );
+  const pool = candidates.length > 0 ? candidates.map((i) => branches[i]) : branches;
+  for (const name of new Set(pool.flatMap((b) => b.declaredFields))) {
+    const declarations = pool.filter((branch) => branch.declaredFields.includes(name)).map((branch) => branch.schema.properties?.[name]).filter((schema) => typeof schema === "object" && schema !== null).map((schema) => normalizeNullableUnion(schema));
+    const types = new Set(declarations.map((schema) => typeNameOf(schema)));
+    const pinnedOf = (schema) => typeof schema === "object" && schema !== null && "const" in schema ? schema.const : void 0;
+    const constsAgree = declarations.every(
+      (schema) => sameJsonValue(pinnedOf(schema), pinnedOf(declarations[0]))
+    );
+    if (types.size === 1 && constsAgree && declarations.length > 0) {
+      Object.defineProperty(properties, name, {
+        value: declarations[0],
+        writable: true,
+        enumerable: true,
+        configurable: true
+      });
+    } else {
+      delete properties[name];
+    }
+  }
+  return properties;
+}
+function typeNameOf(schema) {
+  if (typeof schema !== "object" || schema === null) return "";
+  const { type } = schema;
+  return Array.isArray(type) ? [...type].map(String).sort().join(",") : typeof type === "string" ? type : "";
+}
+function matchesConstants(properties, params) {
+  return Object.entries(properties).every(([name, schema]) => {
+    if (typeof schema !== "object" || schema === null) return true;
+    const constValue = schema.const;
+    if (constValue === void 0) return true;
+    if (!Object.hasOwn(params, name)) return true;
+    const supplied = params[name];
+    return supplied === void 0 || suppliedMatchesConst(supplied, constValue);
+  });
+}
+function suppliedMatchesConst(value, constValue) {
+  if (constValue === null || typeof constValue !== "object") {
+    return value === String(constValue);
+  }
+  try {
+    return sameJsonValue(JSON.parse(value), constValue);
+  } catch {
+    return false;
+  }
+}
 function convertToolParameters(tool, params) {
+  return convertParametersForSchema(tool.inputSchema, params);
+}
+function convertParametersForSchema(inputSchema, params) {
   const result = {};
-  const properties = tool.inputSchema?.properties || {};
+  const { base, branches } = resolveRootUnion(
+    inputSchema ?? {}
+  );
+  const properties = coercionProperties(base, branches, params);
   for (const [key, value] of Object.entries(params)) {
-    const paramSchema = properties[key];
-    if (paramSchema) {
-      result[key] = convertParameterValue(value, paramSchema);
-    } else {
-      result[key] = value;
-    }
+    const declared = properties[key];
+    const paramSchema = typeof declared === "object" && declared !== null ? normalizeNullableUnion(declared) : declared;
+    const pinned = paramSchema?.const;
+    const converted = pinned !== void 0 && suppliedMatchesConst(value, pinned) ? pinned : paramSchema ? convertParameterValue(value, paramSchema) : value;
+    Object.defineProperty(result, key, {
+      value: converted,
+      writable: true,
+      enumerable: true,
+      configurable: true
+    });
   }
   return result;
 }
@@ -675,6 +1234,9 @@ function storedFieldsToInspectorSettings(stored) {
   if (stored.oauth?.requestRefreshToken === false) {
     settings.oauthRequestRefreshToken = false;
   }
+  if (stored.oauth?.revokeOnClear === false) {
+    settings.oauthRevokeOnClear = false;
+  }
   if (stored.cwd) settings.cwd = stored.cwd;
   return settings;
 }
@@ -3460,6 +4022,25 @@ var OAuthStorageBase = class {
     this.memory.getState().setServerState(serverUrl, { discoveryState: void 0 });
     await this.persist();
   }
+  async takeRevocationSnapshot(serverUrl) {
+    await this.ensureLoaded();
+    const state = this.memory.getState().getServerState(serverUrl);
+    const snapshot = {
+      byIssuer: Object.fromEntries(
+        Object.entries(state.byIssuer ?? {}).map(([issuer, slot]) => [
+          issuer,
+          { tokens: slot?.tokens, clientInformation: slot?.clientInformation }
+        ])
+      ),
+      legacyTokens: state.tokens,
+      legacyClientInformation: state.clientInformation,
+      preregisteredClientInformation: state.preregisteredClientInformation,
+      serverMetadata: state.serverMetadata
+    };
+    this.memory.getState().clearServerState(serverUrl);
+    await this.persist();
+    return snapshot;
+  }
   async clear(serverUrl) {
     await this.ensureLoaded();
     this.memory.getState().clearServerState(serverUrl);
@@ -3650,6 +4231,288 @@ var NodeOAuthStorage = class extends OAuthStorageBase {
   }
 };
 
+// ../../core/auth/revocation.ts
+import { selectClientAuthMethod } from "@modelcontextprotocol/client";
+import {
+  OAuthClientInformationSchema as OAuthClientInformationSchema2,
+  OAuthTokensSchema as OAuthTokensSchema2
+} from "@modelcontextprotocol/core";
+var DEFAULT_REVOCATION_TIMEOUT_MS = 5e3;
+function selectRevocableToken(tokens) {
+  if (!tokens) return null;
+  if (tokens.refresh_token) {
+    return { token: tokens.refresh_token, tokenTypeHint: "refresh_token" };
+  }
+  if (tokens.access_token) {
+    return { token: tokens.access_token, tokenTypeHint: "access_token" };
+  }
+  return null;
+}
+function revocationAuthMethods(metadata) {
+  return metadata.revocation_endpoint_auth_methods_supported ?? [
+    "client_secret_basic"
+  ];
+}
+function buildRevocationRequest(params) {
+  const body = new URLSearchParams({
+    token: params.token,
+    token_type_hint: params.tokenTypeHint
+  });
+  const headers = {
+    "Content-Type": "application/x-www-form-urlencoded",
+    Accept: "application/json"
+  };
+  const client = params.clientInformation;
+  if (client) {
+    const method = selectClientAuthMethod(client, params.supportedAuthMethods);
+    if (method === "client_secret_basic" && client.client_secret) {
+      const credentials = `${encodeURIComponent(client.client_id)}:${encodeURIComponent(client.client_secret)}`;
+      headers.Authorization = `Basic ${base64Encode(credentials)}`;
+    } else if (method === "client_secret_post" && client.client_secret) {
+      body.set("client_id", client.client_id);
+      body.set("client_secret", client.client_secret);
+    } else {
+      body.set("client_id", client.client_id);
+    }
+  }
+  return {
+    url: params.endpoint,
+    init: { method: "POST", headers, body: body.toString() }
+  };
+}
+function base64Encode(value) {
+  if (typeof btoa === "function") return btoa(value);
+  return Buffer.from(value, "utf8").toString("base64");
+}
+async function revokeToken(params) {
+  const timeoutMs = params.timeoutMs ?? DEFAULT_REVOCATION_TIMEOUT_MS;
+  try {
+    const { url, init } = buildRevocationRequest(params);
+    const response = await withDeadline(
+      params.fetchFn(url, { ...init, signal: AbortSignal.timeout(timeoutMs) }),
+      timeoutMs
+    );
+    if (!response.ok) {
+      return {
+        status: "failed",
+        endpoint: url,
+        detail: `revocation endpoint responded ${response.status} ${response.statusText}`.trim()
+      };
+    }
+    return {
+      status: "revoked",
+      tokenTypeHint: params.tokenTypeHint,
+      endpoint: url
+    };
+  } catch (err) {
+    return {
+      // `params.endpoint`, not the built `url`: construction is inside the try
+      // now, so `url` may not exist on this path.
+      status: "failed",
+      endpoint: params.endpoint,
+      detail: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+async function withDeadline(promise, timeoutMs) {
+  let timer;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new Error(`revocation request timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+  });
+  try {
+    return await Promise.race([promise, deadline]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function emptyPlan(serverUrl, outcome, failures = []) {
+  return {
+    serverUrl,
+    grants: [],
+    failures,
+    supportedAuthMethods: [],
+    outcome: failures.length > 0 ? aggregateOutcomes([...failures, outcome]) : outcome
+  };
+}
+async function clearAndPlanRevocation(params) {
+  const { serverUrl, storage } = params;
+  let snapshot;
+  try {
+    snapshot = await storage.takeRevocationSnapshot(serverUrl);
+  } catch (err) {
+    throw err instanceof Error ? err : new Error(String(err));
+  }
+  if (params.enabled === false) {
+    return emptyPlan(serverUrl, { status: "skipped", reason: "disabled" });
+  }
+  try {
+    const { grants, failures } = await collectGrants(snapshot);
+    if (grants.length === 0) {
+      return emptyPlan(
+        serverUrl,
+        { status: "skipped", reason: "no_tokens" },
+        failures
+      );
+    }
+    const metadata = parseServerMetadata(snapshot.serverMetadata);
+    if (!metadata) {
+      return emptyPlan(
+        serverUrl,
+        { status: "skipped", reason: "no_metadata" },
+        failures
+      );
+    }
+    if (!metadata.revocation_endpoint) {
+      return emptyPlan(
+        serverUrl,
+        { status: "skipped", reason: "no_endpoint" },
+        failures
+      );
+    }
+    return {
+      serverUrl,
+      grants,
+      failures,
+      endpoint: metadata.revocation_endpoint,
+      supportedAuthMethods: revocationAuthMethods(metadata),
+      metadataIssuer: metadata.issuer
+    };
+  } catch (err) {
+    return emptyPlan(serverUrl, {
+      status: "failed",
+      detail: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+function parseServerMetadata(raw) {
+  if (raw === null || typeof raw !== "object") return void 0;
+  return raw;
+}
+async function executeOAuthRevocation(plan, params) {
+  const outcome = await runPlan(plan, params);
+  const { logger } = params;
+  if (outcome.status === "failed") {
+    logger?.warn(
+      {
+        serverUrl: plan.serverUrl,
+        endpoint: outcome.endpoint,
+        detail: outcome.detail
+      },
+      "Token revocation failed; local OAuth state was cleared anyway"
+    );
+  } else if (outcome.status === "skipped" && outcome.reason === "no_endpoint") {
+    logger?.debug(
+      { serverUrl: plan.serverUrl },
+      "Skipping token revocation: authorization server metadata has no revocation_endpoint"
+    );
+  }
+  return outcome;
+}
+async function collectGrants(snapshot) {
+  const grants = [];
+  const failures = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  let preregistered;
+  try {
+    preregistered = await parseClient(snapshot.preregisteredClientInformation);
+  } catch (err) {
+    failures.push({
+      status: "failed",
+      detail: `could not read the preconfigured client registration: ${err instanceof Error ? err.message : String(err)}`
+    });
+  }
+  const add2 = async (issuer, rawTokens, rawClient) => {
+    const revocable = selectRevocableToken(await parseTokens(rawTokens));
+    if (!revocable) return;
+    const key = `${issuer ?? "\0legacy"}\0${revocable.token}`;
+    if (seenKeys.has(key)) return;
+    seenKeys.add(key);
+    const bound = await parseClient(rawClient);
+    grants.push({
+      issuer,
+      ...revocable,
+      clientInformation: bound ?? preregistered
+    });
+  };
+  const addSafely = async (issuer, rawTokens, rawClient) => {
+    try {
+      await add2(issuer, rawTokens, rawClient);
+    } catch (err) {
+      const where = issuer === void 0 ? "the unkeyed slot" : `issuer ${issuer}`;
+      failures.push({
+        status: "failed",
+        detail: `could not read the stored grant for ${where}: ${err instanceof Error ? err.message : String(err)}`
+      });
+    }
+  };
+  for (const [issuer, slot] of Object.entries(snapshot.byIssuer)) {
+    await addSafely(issuer, slot?.tokens, slot?.clientInformation);
+  }
+  await addSafely(
+    void 0,
+    snapshot.legacyTokens,
+    snapshot.legacyClientInformation
+  );
+  return { grants, failures };
+}
+async function parseTokens(raw) {
+  return raw === void 0 || raw === null ? void 0 : await OAuthTokensSchema2.parseAsync(raw);
+}
+async function parseClient(raw) {
+  return raw === void 0 || raw === null ? void 0 : await OAuthClientInformationSchema2.parseAsync(raw);
+}
+function aggregateOutcomes(outcomes) {
+  return outcomes.find((o) => o.status === "failed") ?? outcomes.find((o) => o.status === "revoked") ?? outcomes[0] ?? { status: "skipped", reason: "no_tokens" };
+}
+async function runPlan(plan, params) {
+  if (plan.outcome) return plan.outcome;
+  const endpoint = plan.endpoint;
+  if (!endpoint) return { status: "skipped", reason: "no_endpoint" };
+  const outcomes = [...plan.failures];
+  const timeoutMs = params.timeoutMs ?? DEFAULT_REVOCATION_TIMEOUT_MS;
+  const deadlineAt = Date.now() + timeoutMs;
+  for (const grant of plan.grants) {
+    if (grant.issuer === void 0) {
+      outcomes.push({
+        status: "failed",
+        detail: "the stored grant is not bound to an authorization server (it predates issuer binding), so it could not be matched to this revocation endpoint and was cleared without revocation \u2014 re-authorize to make future clears revocable"
+      });
+      continue;
+    }
+    if (plan.metadataIssuer !== grant.issuer) {
+      outcomes.push({
+        status: "failed",
+        detail: plan.metadataIssuer === void 0 ? `the cached authorization-server metadata names no issuer, so the grant bound to ${grant.issuer} could not be matched to this revocation endpoint and was cleared without revocation` : `the cached authorization-server metadata is for ${plan.metadataIssuer}, so the grant bound to ${grant.issuer} was cleared without revocation`
+      });
+      continue;
+    }
+    const remainingMs = deadlineAt - Date.now();
+    if (remainingMs <= 0) {
+      outcomes.push({
+        status: "failed",
+        endpoint,
+        detail: `the ${timeoutMs}ms revocation budget was exhausted before this grant was attempted${grant.issuer === void 0 ? "" : ` (issuer ${grant.issuer})`}`
+      });
+      continue;
+    }
+    outcomes.push(
+      await revokeToken({
+        endpoint,
+        token: grant.token,
+        tokenTypeHint: grant.tokenTypeHint,
+        clientInformation: grant.clientInformation,
+        supportedAuthMethods: plan.supportedAuthMethods,
+        fetchFn: params.fetchFn,
+        timeoutMs: remainingMs
+      })
+    );
+  }
+  return aggregateOutcomes(outcomes);
+}
+
 // src/clear-stored-auth-for-relogin.ts
 function normalizeServerUrl(serverUrl) {
   try {
@@ -3658,16 +4521,56 @@ function normalizeServerUrl(serverUrl) {
     return serverUrl;
   }
 }
-async function clearStoredAuthForRelogin(serverUrl) {
-  if (!serverUrl?.trim()) return;
+async function clearStoredAuthForRelogin(serverUrl, options) {
+  if (!serverUrl?.trim()) return void 0;
   const raw = serverUrl.trim();
   const normalized = normalizeServerUrl(raw);
   const storage = new NodeOAuthStorage();
-  await storage.clear(raw);
-  if (normalized !== raw) {
-    await storage.clear(normalized);
+  const keys = normalized === raw ? [raw] : [normalized, raw];
+  const plans = [];
+  for (const key of keys) {
+    plans.push(
+      await clearAndPlanRevocation({
+        serverUrl: key,
+        storage,
+        enabled: options?.revoke !== false
+      })
+    );
   }
   resetNodeOAuthStorageCache();
+  return options?.revoke === false ? void 0 : sendPlans(plans, options?.budgetMs ?? DEFAULT_REVOCATION_TIMEOUT_MS);
+}
+async function sendPlans(plans, budgetMs) {
+  const fetchFn = createProxyFetch() ?? fetch;
+  const deadlineAt = Date.now() + budgetMs;
+  let reported;
+  let lastSkip;
+  for (const plan of plans) {
+    const remainingMs = deadlineAt - Date.now();
+    const needsNetwork = plan.outcome === void 0;
+    if (needsNetwork && remainingMs <= 0) {
+      const exhausted = {
+        status: "failed",
+        detail: `the ${budgetMs}ms revocation budget was exhausted before "${plan.serverUrl}" was attempted`
+      };
+      if (reported?.status !== "failed") reported = exhausted;
+      continue;
+    }
+    const outcome = await executeOAuthRevocation(plan, {
+      fetchFn,
+      timeoutMs: needsNetwork ? remainingMs : void 0
+    });
+    if (outcome.status === "skipped" && outcome.reason === "no_tokens") {
+      lastSkip = outcome;
+      continue;
+    }
+    if (outcome.status === "failed") {
+      if (reported?.status !== "failed") reported = outcome;
+    } else {
+      reported ??= outcome;
+    }
+  }
+  return reported ?? lastSkip;
 }
 
 // ../../core/mcp/inspectorClient.ts
@@ -3830,6 +4733,20 @@ function mcpParamHeadersForTool(tool, args) {
   return buildMcpParamHeaders(scan.declarations, args);
 }
 
+// ../../core/mcp/subscriptionAck.ts
+import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+var NEVER_ACKNOWLEDGED_SDK_MESSAGE = "closed the subscription gracefully before acknowledging";
+var NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE = "The server closed the subscription without acknowledging it. A subscriptions/listen request must first be answered with a notifications/subscriptions/acknowledged notification; a JSON-RPC result for the listen id means graceful closure. Not retrying \u2014 the server would answer the same way again.";
+function isNeverAcknowledgedSubscriptionClose(error) {
+  return SdkError.isInstance(error) && error.code === SdkErrorCode.ConnectionClosed && error.message.includes(NEVER_ACKNOWLEDGED_SDK_MESSAGE);
+}
+function subscriptionFailureMessage(error) {
+  if (isNeverAcknowledgedSubscriptionClose(error)) {
+    return NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE;
+  }
+  return error instanceof Error ? error.message : String(error);
+}
+
 // ../../core/mcp/messageTrackingTransport.ts
 var MessageTrackingTransport = class {
   baseTransport;
@@ -3921,6 +4838,29 @@ var MessageTrackingTransport = class {
   get sessionId() {
     return this.baseTransport.sessionId;
   }
+  /**
+   * Forward the base transport's per-request-stream capability (#2140).
+   *
+   * The SDK's `Protocol.request` reads this off the transport it was handed —
+   * which is always this wrapper — to decide how a cancelled request is
+   * signalled: abort that request's own stream (the 2026-07-28 signal for
+   * Streamable HTTP) or POST a `notifications/cancelled` (the stdio one).
+   *
+   * Not forwarding it made the wrapper *answer* the question, `undefined`, for
+   * every client. So the Cancel button POSTed a notification even on a modern
+   * Streamable HTTP connection, where a spec-compliant server acknowledges it
+   * `202` and drops it — the tool kept running and only a disconnect really
+   * cancelled anything. That hit the CLI and TUI as much as the web client:
+   * their real `StreamableHTTPClientTransport` advertises the flag correctly
+   * and this wrapper hid it.
+   *
+   * A base transport that says nothing stays `undefined` rather than becoming
+   * `false`, since the SDK's check is `=== true` either way and inventing a
+   * value here would misreport what the transport claimed.
+   */
+  get hasPerRequestStream() {
+    return this.baseTransport.hasPerRequestStream;
+  }
   // Implemented as a concrete method (rather than delegating the base
   // transport's optional `setProtocolVersion`) so the SDK Client always
   // invokes it after the initialize handshake — including for stdio, whose
@@ -4149,7 +5089,7 @@ function validateToolOutput(provider, tool, result) {
 
 // ../../core/mcp/listSalvage.ts
 import { z as z2 } from "zod/v4";
-import { SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
+import { SdkError as SdkError2, SdkErrorCode as SdkErrorCode2 } from "@modelcontextprotocol/client";
 import { ToolSchema } from "@modelcontextprotocol/core";
 var LIST_MAX_PAGES = 64;
 function listPaginationExceeded(method) {
@@ -4158,10 +5098,10 @@ function listPaginationExceeded(method) {
   );
 }
 function isClientDecodeRejection(err) {
-  return SdkError.isInstance(err) && (err.code === SdkErrorCode.InvalidResult || err.code === SdkErrorCode.UnsupportedResultType);
+  return SdkError2.isInstance(err) && (err.code === SdkErrorCode2.InvalidResult || err.code === SdkErrorCode2.UnsupportedResultType);
 }
 function isSalvageableRejection(err) {
-  return SdkError.isInstance(err) && err.code === SdkErrorCode.InvalidResult;
+  return SdkError2.isInstance(err) && err.code === SdkErrorCode2.InvalidResult;
 }
 function lenientListPageSchema(resultSchema, itemsKey) {
   return resultSchema.extend({ [itemsKey]: z2.array(z2.unknown()) });
@@ -4471,6 +5411,52 @@ var TypedEventGeneric = class extends CustomEvent {
   }
 };
 var TypedEventTarget = class extends EventTarget {
+  /**
+   * Per-event-type dispatch counter. Read through `getEventRevision` by
+   * `useStoreSnapshot` (core/react) to tell "nothing has happened on this
+   * event since I last looked" from "something has", without comparing the
+   * snapshot's contents (#1955).
+   */
+  eventRevisions = /* @__PURE__ */ new Map();
+  /**
+   * How many times an event of this type has been dispatched from this
+   * target. Monotonic per type, and per type only: an `errorChange` does not
+   * advance `toolsChange`, so a subscriber to one is not re-read because of
+   * the other.
+   *
+   * The counter — not the list's contents — is what a `useSyncExternalStore`
+   * snapshot is cached against. That distinction is load-bearing rather than
+   * an optimization: these stores hand out a defensive copy, so comparing
+   * contents is the only alternative, and a contents comparison cannot see an
+   * in-place mutation of an entry the list already holds. `MessageLogState`
+   * does exactly that when a response is folded into its request entry
+   * (filling in `response`/`duration`), and it dispatches — so the counter
+   * moves and the fold reaches the UI, where a shallow compare would report
+   * "unchanged" and never re-render it.
+   */
+  getEventRevision(type) {
+    return this.eventRevisions.get(type) ?? 0;
+  }
+  /**
+   * Overridden solely to advance the counter. It sits on `dispatchEvent`
+   * rather than on `dispatchTypedEvent` because that is the one funnel every
+   * dispatch passes through — the typed helper below delegates to it, and so
+   * does a hand-rolled `dispatchEvent(new CustomEvent(...))`, which the tests
+   * use extensively. A counter bumped only in the typed helper would be
+   * silently stale for those, i.e. exactly where nobody would look for it.
+   *
+   * Bumped BEFORE dispatching: the state mutation always precedes the
+   * dispatch, so by the time a listener runs the counter must already reflect
+   * it, or a snapshot read from inside that listener would return the cached
+   * pre-change value.
+   */
+  dispatchEvent(event) {
+    this.eventRevisions.set(
+      event.type,
+      (this.eventRevisions.get(event.type) ?? 0) + 1
+    );
+    return super.dispatchEvent(event);
+  }
   dispatchTypedEvent(type, ...args) {
     const detail = args[0] ?? void 0;
     this.dispatchEvent(new TypedEventGeneric(type, detail));
@@ -4859,6 +5845,115 @@ function withOAuthEndpointOverrides(fetchFn, getOverrides) {
   };
 }
 
+// ../../core/auth/oidcDiscoveryCompat.ts
+import {
+  OAuthMetadataSchema,
+  OpenIdProviderDiscoveryMetadataSchema
+} from "@modelcontextprotocol/core";
+var RFC8414_WELL_KNOWN = "/.well-known/oauth-authorization-server";
+var OIDC_WELL_KNOWN = "/.well-known/openid-configuration";
+var COMPAT_SOURCE_HEADER = "x-inspector-oauth-metadata-source";
+function oidcDiscoveryCandidates(rfc8414Url) {
+  let url;
+  try {
+    url = new URL(rfc8414Url);
+  } catch {
+    return [];
+  }
+  if (!url.pathname.startsWith(RFC8414_WELL_KNOWN)) return [];
+  const path5 = url.pathname.slice(RFC8414_WELL_KNOWN.length);
+  if (path5 !== "" && !path5.startsWith("/")) return [];
+  if (path5 === "") return [new URL(OIDC_WELL_KNOWN, url.origin).href];
+  return [
+    new URL(`${OIDC_WELL_KNOWN}${path5}`, url.origin).href,
+    new URL(`${path5}${OIDC_WELL_KNOWN}`, url.origin).href
+  ];
+}
+function continuesDiscovery(status) {
+  return status >= 400 && status < 500 || status === 502;
+}
+async function releaseBody(response) {
+  await response.body?.cancel().catch(() => {
+  });
+}
+function isRfc8414OnlyMetadata(value) {
+  if (!OAuthMetadataSchema.safeParse(value).success) return false;
+  return !OpenIdProviderDiscoveryMetadataSchema.safeParse(value).success;
+}
+function requestUrlOf2(input) {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return input.url;
+}
+function discoveryHeaders(input, init) {
+  if (init?.headers) return new Headers(init.headers);
+  if (typeof input !== "string" && !(input instanceof URL)) {
+    return new Headers(input.headers);
+  }
+  return new Headers();
+}
+function requestMethodOf(input, init) {
+  if (init?.method) return init.method.toUpperCase();
+  if (typeof input !== "string" && !(input instanceof URL)) {
+    return input.method.toUpperCase();
+  }
+  return "GET";
+}
+function withRfc8414OidcCompat(fetchFn) {
+  return async (input, init) => {
+    const response = await fetchFn(input, init);
+    if (response.ok) return response;
+    if (!continuesDiscovery(response.status)) return response;
+    if (requestMethodOf(input, init) !== "GET") return response;
+    const candidates = oidcDiscoveryCandidates(requestUrlOf2(input));
+    if (candidates.length === 0) return response;
+    const headers = discoveryHeaders(input, init);
+    for (const candidate of candidates) {
+      let probe;
+      try {
+        probe = await fetchFn(candidate, { headers });
+      } catch {
+        return response;
+      }
+      if (!probe.ok) {
+        await releaseBody(probe);
+        if (continuesDiscovery(probe.status)) continue;
+        return response;
+      }
+      let parsed;
+      let body;
+      try {
+        body = await probe.text();
+        parsed = JSON.parse(body);
+      } catch {
+        return response;
+      }
+      if (!isRfc8414OnlyMetadata(parsed)) {
+        return response;
+      }
+      const source = probe.url || candidate;
+      await releaseBody(response);
+      console.warn(
+        `[oauth] ${source} returned RFC 8414 OAuth 2.0 authorization server metadata, not an OpenID provider document. The MCP TypeScript SDK validates that path as OpenID Connect Discovery and would reject it (modelcontextprotocol/typescript-sdk#2733), so the Inspector is handing it to discovery as the RFC 8414 document it is.`
+      );
+      return new Response(body, {
+        status: 200,
+        statusText: "OK",
+        headers: {
+          "content-type": "application/json",
+          // The substituted response is what the fetch trackers above this
+          // wrapper record, so it says where its body actually came from
+          // rather than letting the Network tab imply the RFC 8414 path
+          // answered. Named on the response, not logged only, so it survives
+          // into the captured entry.
+          [COMPAT_SOURCE_HEADER]: source
+        }
+      });
+    }
+    return response;
+  };
+}
+
 // ../../core/logging/logger.ts
 var noop = () => {
 };
@@ -5277,7 +6372,7 @@ import {
   exchangeAuthorization,
   startAuthorization
 } from "@modelcontextprotocol/client";
-import { OAuthMetadataSchema } from "@modelcontextprotocol/core";
+import { OAuthMetadataSchema as OAuthMetadataSchema2 } from "@modelcontextprotocol/core";
 
 // ../../core/auth/ema/constants.ts
 var GRANT_TYPE_JWT_BEARER = "urn:ietf:params:oauth:grant-type:jwt-bearer";
@@ -5326,7 +6421,7 @@ function idpOAuthStorageKey(issuer) {
 }
 
 // ../../core/auth/ema/tokenEndpoint.ts
-import { selectClientAuthMethod } from "@modelcontextprotocol/client";
+import { selectClientAuthMethod as selectClientAuthMethod2 } from "@modelcontextprotocol/client";
 async function parseOAuthTokenErrorResponse(response, step) {
   let body;
   try {
@@ -5347,7 +6442,7 @@ async function parseOAuthTokenErrorResponse(response, step) {
 }
 function applyClientAuth(metadata, clientInformation, headers, body) {
   const supported = metadata?.token_endpoint_auth_methods_supported ?? [];
-  const method = selectClientAuthMethod(clientInformation, supported);
+  const method = selectClientAuthMethod2(clientInformation, supported);
   if (method === "client_secret_basic" && clientInformation.client_secret) {
     const credentials = btoa(
       `${clientInformation.client_id}:${clientInformation.client_secret}`
@@ -5401,7 +6496,7 @@ async function discoverIdpMetadata(issuer, fetchFn) {
       `Failed to discover OIDC metadata for IdP issuer ${issuer}`
     );
   }
-  return OAuthMetadataSchema.parse(metadata);
+  return OAuthMetadataSchema2.parse(metadata);
 }
 async function startIdpOidcAuthorization(params) {
   const issuer = normalizeIdpIssuer(params.idp.issuer);
@@ -5657,7 +6752,7 @@ async function discoverResourceAsMetadata(resourceAsUrl, fetchFn) {
 
 // ../../core/auth/ema/wire.ts
 import { discoverAndRequestJwtAuthGrant } from "@modelcontextprotocol/client";
-import { OAuthTokensSchema as OAuthTokensSchema2 } from "@modelcontextprotocol/core";
+import { OAuthTokensSchema as OAuthTokensSchema3 } from "@modelcontextprotocol/core";
 async function exchangeIdJag(params) {
   const issuer = normalizeIdpIssuer(params.idp.issuer);
   const resource = params.resource.trim();
@@ -5736,7 +6831,7 @@ async function redeemIdJagForAccessToken(params) {
       "EMA leg 3 (resource AS JWT bearer grant)"
     );
   }
-  return OAuthTokensSchema2.parse(await response.json());
+  return OAuthTokensSchema3.parse(await response.json());
 }
 
 // ../../core/auth/ema/emaFlow.ts
@@ -6465,14 +7560,41 @@ var OAuthManager = class {
       return void 0;
     }
   }
-  async clearOAuthTokens() {
+  /**
+   * Drop this server's local OAuth state, and revoke the grant at the
+   * authorization server (RFC 7009).
+   *
+   * The state is taken and deleted in one atomic step, and the requests are
+   * sent afterwards from what was taken. Both halves matter: the requests need
+   * state the clear destroys, and the clear must not wait on the network, or a
+   * fresh authorization completing during a five-second revocation would be
+   * deleted by a clear reasoning about the grant it replaced.
+   *
+   * Best-effort by construction: every failure is reported through the returned
+   * outcome and the clear has already happened regardless, because forgetting
+   * the tokens is what the caller actually asked for (#2144).
+   *
+   * `options.revoke === false` skips the request. That is not only an escape
+   * hatch for an authorization server that mishandles it — disconnecting while
+   * still holding live tokens is a case a user may want to reproduce
+   * deliberately, to watch how a server under test copes with it.
+   */
+  async clearOAuthTokens(options) {
     if (!this.oauthConfig?.storage) {
-      return;
+      return { status: "skipped", reason: "no_tokens" };
     }
     const serverUrl = this.getServerUrl();
-    await this.oauthConfig.storage.clear(serverUrl);
+    const plan = await clearAndPlanRevocation({
+      serverUrl,
+      storage: this.oauthConfig.storage,
+      enabled: options?.revoke
+    });
     this.oauthFlowState = null;
     this.pendingAuthorizationScope = void 0;
+    return executeOAuthRevocation(plan, {
+      fetchFn: this.params.effectiveAuthFetch,
+      logger: this.params.logger
+    });
   }
   async isOAuthAuthorized() {
     const tokens = await this.getOAuthTokens();
@@ -6799,10 +7921,11 @@ var OAuthManager = class {
         await this.params.onBeforeOAuthRedirect(parsedState.authId);
       }
     }
-    this.requireNavigation().navigateToAuthorization(authorizationUrl);
+    const navigation = this.requireNavigation();
     const provider = await this.createOAuthProvider();
     const clientInfo = await provider.clientInformation();
     await this.recordAuthorizationCodeFlowState(authorizationUrl, clientInfo);
+    navigation.navigateToAuthorization(authorizationUrl);
     this.params.dispatchOAuthAuthorizationRequired({ url: authorizationUrl });
   }
   requireNavigation() {
@@ -6959,6 +8082,24 @@ var RemoteClientTransport = class {
   sseResponseWaits = /* @__PURE__ */ new Map();
   options;
   config;
+  /**
+   * Whether the upstream connection gives each request its own response stream
+   * (#2140). The SDK's `Protocol.request` reads this: on a 2026-era connection
+   * a transport advertising it has its per-request stream **aborted** as the
+   * spec's cancellation signal, and no `notifications/cancelled` is sent; a
+   * transport that does not gets the stdio mechanism instead.
+   *
+   * The real upstream transport lives on the backend, so this transport has to
+   * answer for it. Streamable HTTP opens one POST — and one SSE response
+   * stream — per request, so it qualifies; stdio and SSE multiplex every
+   * request over one shared channel and must keep sending the notification.
+   *
+   * Advertising it is only half the fix: `requestSend` applies the SDK's
+   * `requestSignal` to the browser-to-backend fetch, and `/api/mcp/send`
+   * forwards that disconnect to the upstream `transport.send`, which is what
+   * actually closes the stream the server is watching.
+   */
+  hasPerRequestStream;
   /**
    * Intentionally returns undefined. The MCP Client checks transport.sessionId to detect
    * reconnects and skip initialize. Our _sessionId is the remote server's session ID, not
@@ -7003,6 +8144,7 @@ var RemoteClientTransport = class {
   constructor(options, config) {
     this.options = options;
     this.config = config;
+    this.hasPerRequestStream = config.type === "streamable-http";
   }
   setAuthRecovery(handlers) {
     this.options.authRecovery = handlers;
@@ -7367,7 +8509,8 @@ var RemoteClientTransport = class {
     const res = await this.fetchFn(`${this.baseUrl}/api/mcp/send`, {
       method: "POST",
       headers: this.headers,
-      body: JSON.stringify(body)
+      body: JSON.stringify(body),
+      ...options?.requestSignal && { signal: options.requestSignal }
     });
     if (!res.ok) {
       const text = await res.text();
@@ -7604,6 +8747,13 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   // pending re-listen timer.
   modernReconnectAttempts = 0;
   modernReconnectTimer;
+  // Set when the last `listen()` was rejected because the server answered it
+  // with a bare graceful-closure result instead of acknowledging (#2097). That
+  // condition is deterministic, so the reconnect machinery must not treat it as
+  // a drop to retry; the flag is what carries the distinction from the rejection
+  // site to the two failure handlers. Cleared by any user-initiated refresh (a
+  // subscribe/unsubscribe is a fresh attempt, and the server may have changed).
+  modernNeverAcknowledged = false;
   // Task ids the user explicitly cancelled. A cancel makes the in-flight
   // `callToolStream` reject with a generic -32603 error, which the stream's
   // error path would otherwise report as a *failed* task — flashing "failed"
@@ -7625,9 +8775,12 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   pendingRawWireRequests = /* @__PURE__ */ new Map();
   rawWireRequestCounter = 0;
   // Abort controller for the in-flight ordinary (non-task) tool call. Aborting
-  // it makes the SDK send a `notifications/cancelled` for that request (the MCP
-  // cancellation flow) and reject the pending call, which `callTool` surfaces as
-  // a `ToolCallCancelledError`. Undefined when no ordinary call is in flight.
+  // it hands the SDK the MCP cancellation flow for that request and rejects the
+  // pending call, which `callTool` surfaces as a `ToolCallCancelledError`. Which
+  // signal reaches the server is the transport's business, not ours: a
+  // per-request-stream transport on a 2026-era connection has that request's
+  // stream aborted, and everything else gets `notifications/cancelled` (#2140).
+  // Undefined when no ordinary call is in flight.
   // Task-augmented calls have a server-side task and are cancelled via
   // `cancelRequestorTask` instead, so they don't use this (#1458).
   activeToolCallAbortController;
@@ -7734,6 +8887,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.fetchFn ?? fetch,
       () => this.oauthManager?.getEndpointOverrides()
     );
+    this.fetchFn = withRfc8414OidcCompat(this.fetchFn);
     this.effectiveAuthFetch = this.buildEffectiveAuthFetch();
     this.sessionId = options.sessionId;
     if (options.oauth || options.environment.oauth) {
@@ -7753,6 +8907,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
           return Promise.resolve();
         },
         initialConfig: oauthConfig,
+        logger: this.logger,
         enterpriseManagedAuth: options.enterpriseManagedAuth,
         installEnterpriseManagedAuth: options.installEnterpriseManagedAuth,
         dispatchOAuthComplete: (detail) => this.dispatchTypedEvent("oauthComplete", detail),
@@ -8443,6 +9598,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     this.modernListenGeneration++;
     this.clearModernReconnectTimer();
     this.modernReconnectAttempts = 0;
+    this.modernNeverAcknowledged = false;
     this.modernSubscription = null;
     this.setModernStreamState(INACTIVE_SUBSCRIPTION_STREAM_STATE);
     this.dispatchSubscriptionsChange();
@@ -9229,10 +10385,13 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
   }
   /**
    * Cancel the in-flight ordinary (non-task) tool call started by
-   * {@link callTool}. Aborting its request makes the SDK send a
-   * `notifications/cancelled` to the server (the MCP cancellation flow) and
-   * reject the pending call, which `callTool` surfaces as a
-   * {@link ToolCallCancelledError}.
+   * {@link callTool}. Aborting its request runs the MCP cancellation flow and
+   * rejects the pending call, which `callTool` surfaces as a
+   * {@link ToolCallCancelledError}. The SDK chooses the wire signal from the
+   * transport: on a 2026-era Streamable HTTP connection it aborts that
+   * request's own SSE response stream — the spec's cancellation signal —
+   * rather than sending `notifications/cancelled`, which is the stdio
+   * mechanism and remains in use there (#2140).
    *
    * Task-augmented calls have a server-side task and are cancelled via
    * {@link cancelRequestorTask} instead — this is a no-op for them (and whenever
@@ -11448,6 +12607,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     if (!fromReconnect) {
       this.clearModernReconnectTimer();
       this.modernReconnectAttempts = 0;
+      this.modernNeverAcknowledged = false;
     }
     const generation = ++this.modernListenGeneration;
     const previous = this.modernSubscription;
@@ -11459,10 +12619,18 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.setModernStreamState(INACTIVE_SUBSCRIPTION_STREAM_STATE);
       return;
     }
-    const subscription = await this.client.listen(
-      this.buildSubscriptionFilter(),
-      this.getRequestOptions()
-    );
+    let subscription;
+    try {
+      subscription = await this.client.listen(
+        this.buildSubscriptionFilter(),
+        this.getRequestOptions()
+      );
+    } catch (error) {
+      if (generation === this.modernListenGeneration && isNeverAcknowledgedSubscriptionClose(error)) {
+        this.modernNeverAcknowledged = true;
+      }
+      throw error;
+    }
     if (generation !== this.modernListenGeneration) {
       await closeSubscriptionBestEffort(subscription);
       return;
@@ -11544,8 +12712,34 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.setModernStreamState(INACTIVE_SUBSCRIPTION_STREAM_STATE);
       return;
     }
+    if (this.modernNeverAcknowledged) {
+      this.endModernStreamNeverAcknowledged();
+      return;
+    }
     this.scheduleModernReconnect();
   }
+  /**
+   * Settle the stream on the never-acknowledged close (#2097): a status of its
+   * own so the UI can say what happened, no reconnect, and a log line carrying
+   * the same sentence the UI shows.
+   *
+   * The state is *not* `"ended"` — that badge covers the two expected closes (a
+   * server shutting an established stream down, and reconnection abandoned after
+   * repeated failures), and reading this case as either of them is exactly the
+   * silence #2063 reported.
+   */
+  endModernStreamNeverAcknowledged() {
+    this.clearModernReconnectTimer();
+    this.logger.warn(
+      { message: NEVER_ACKNOWLEDGED_SUBSCRIPTION_MESSAGE },
+      "subscriptions/listen closed without an acknowledgement"
+    );
+    this.setModernStreamState({
+      active: this.modernStreamActive(),
+      status: "never-acknowledged",
+      honoredUris: []
+    });
+  }
   /**
    * Schedule a reconnect re-listen after the current backoff delay (#1630).
    * `modernReconnectAttempts` reflects the number of *consecutive failed*
@@ -11579,6 +12773,10 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
    * stream ended (re-subscribing resets the run and tries again).
    */
   onModernReconnectFailed() {
+    if (this.modernNeverAcknowledged && !isTerminalStatus(this.status) && this.wantsModernStream()) {
+      this.endModernStreamNeverAcknowledged();
+      return;
+    }
     this.modernReconnectAttempts += 1;
     if (this.modernReconnectAttempts > MODERN_RECONNECT_MAX_ATTEMPTS || isTerminalStatus(this.status) || !this.wantsModernStream()) {
       this.setModernStreamState({
@@ -11635,7 +12833,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       this.dispatchSubscriptionsChange();
     } catch (error) {
       throw new Error(
-        `Failed to subscribe to resource: ${error instanceof Error ? error.message : String(error)}`,
+        `Failed to subscribe to resource: ${subscriptionFailureMessage(error)}`,
         { cause: error }
       );
     }
@@ -11680,7 +12878,7 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
       }
     } catch (error) {
       throw new Error(
-        `Failed to unsubscribe from resource: ${error instanceof Error ? error.message : String(error)}`,
+        `Failed to unsubscribe from resource: ${subscriptionFailureMessage(error)}`,
         { cause: error }
       );
     }
@@ -11951,10 +13149,23 @@ var InspectorClient = class _InspectorClient extends InspectorClientEventTarget
     return this.oauthManager.getOAuthTokens();
   }
   /**
-   * Clears OAuth tokens and client information
+   * Drop this server's stored OAuth state and revoke the grant at the
+   * authorization server (RFC 7009, #2144).
+   *
+   * The request is planned from the stored state, the state is cleared, and
+   * only then is the request sent — so the clear never waits on the network.
+   *
+   * The revocation is best-effort — an authorization server that advertises no
+   * `revocation_endpoint` is left behaving exactly as before, and a network
+   * error, a non-2xx or a timeout is reported in the returned outcome rather
+   * than thrown — so the local clear always completes. Pass
+   * `{ revoke: false }` to skip it.
    */
-  async clearOAuthTokens() {
-    await this.oauthManager?.clearOAuthTokens();
+  async clearOAuthTokens(options) {
+    return await this.oauthManager?.clearOAuthTokens(options) ?? {
+      status: "skipped",
+      reason: "no_tokens"
+    };
   }
   /**
    * Checks if client is currently OAuth authorized
@@ -14518,14 +15729,22 @@ var validLogLevels = Object.values(
   LoggingLevelSchema.enum
 );
 var CLI_CLIENT_NAME = "inspector-cli";
-async function callMethod(serverConfig, serverSettings, args, clientConfig, cliAuthOverrides, callbackUrlConfig, storedAuthOnly, relogin) {
+async function callMethod(serverConfig, serverSettings, args, clientConfig, cliAuthOverrides, callbackUrlConfig, storedAuthOnly, relogin, revoke) {
   if (relogin) {
     if (!("url" in serverConfig && serverConfig.url)) {
       throw new Error(
         "--relogin requires an HTTP/SSE server URL (no OAuth store entry for stdio)"
       );
     }
-    await clearStoredAuthForRelogin(serverConfig.url);
+    const revocation = await clearStoredAuthForRelogin(serverConfig.url, {
+      revoke: revoke && serverSettings?.oauthRevokeOnClear !== false
+    });
+    if (revocation?.status === "failed") {
+      process.stderr.write(
+        `Warning: could not revoke the OAuth grant at the authorization server (${revocation.detail}); it may still be valid there.
+`
+      );
+    }
   }
   const clientIdentity = {
     name: CLI_CLIENT_NAME,
@@ -14646,7 +15865,13 @@ function findStoredToken(servers, serverUrl) {
 }
 async function refreshStoredAuthToken(serverUrl, statePath, deps = {}) {
   const refresh = deps.refresh ?? refreshAuthorization;
-  const discover = deps.discover ?? discoverAuthorizationServerMetadata4;
+  const storedAuthFetch = withRfc8414OidcCompat(createProxyFetch() ?? fetch);
+  const discover = deps.discover ?? ((authorizationServerUrl, options) => discoverAuthorizationServerMetadata4(authorizationServerUrl, {
+    ...options,
+    // A caller-supplied fetch is left alone — it is theirs to compose. The
+    // walker below passes no options, so in practice this is ours.
+    fetchFn: options?.fetchFn ?? storedAuthFetch
+  }));
   const snapshot = await readOAuthSnapshot(statePath);
   const servers = snapshot.servers;
   const found = findStoredServerState(servers, serverUrl);
@@ -14684,7 +15909,8 @@ async function refreshStoredAuthToken(serverUrl, statePath, deps = {}) {
       metadata,
       clientInformation,
       refreshToken,
-      resource: new URL(serverUrl)
+      resource: new URL(serverUrl),
+      fetchFn: storedAuthFetch
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -14912,6 +16138,9 @@ async function parseArgs(argv) {
   ).option(
     "--relogin",
     "Delete stored OAuth for this server URL from the shared store before connect (HTTP/SSE URL keys only); interactive login runs only if the server requires auth. Rejected for stdio (no URL-keyed store entry)"
+  ).option(
+    "--no-revoke",
+    "Requires --relogin. Skips the RFC 7009 revocation request that would otherwise end the grant at the authorization server when the local state is deleted. Also skipped when the server entry sets oauth.revokeOnClear to false."
   ).option(
     "--wait-for-auth <sec>",
     "Poll the OAuth state file until a token for --server-url appears (or the timeout elapses), then proceed as if --use-stored-auth were set. Use after handing off to a human to complete OAuth in a browser.",
@@ -14953,6 +16182,9 @@ async function parseArgs(argv) {
       );
     }
   }
+  if (options.revoke === false && !options.relogin) {
+    throw new Error("--no-revoke requires --relogin (it has no other effect).");
+  }
   if (options.strict) {
     if (options.method !== "tools/list") {
       throw new Error("--strict requires --method tools/list.");
@@ -15138,7 +16370,10 @@ async function parseArgs(argv) {
     clientMetadataUrl: options.clientMetadataUrl,
     callbackUrl: options.callbackUrl,
     storedAuthOnly: options.storedAuthOnly === true,
-    relogin: options.relogin === true
+    relogin: options.relogin === true,
+    // Commander's `--no-revoke` defaults this to true; only an explicit
+    // `--no-revoke` makes it false.
+    revoke: options.revoke !== false
   };
 }
 async function runCli(argv) {
@@ -15154,7 +16389,8 @@ async function runCli(argv) {
     clientMetadataUrl,
     callbackUrl,
     storedAuthOnly,
-    relogin
+    relogin,
+    revoke
   } = parsed;
   const clientConfig = await loadRunnerClientConfig({ clientConfigPath });
   let callbackUrlConfig;
@@ -15178,7 +16414,8 @@ async function runCli(argv) {
     },
     callbackUrlConfig,
     storedAuthOnly === true,
-    relogin === true
+    relogin === true,
+    revoke !== false
   );
 }