@poe-platform/safe-js 0.1.802 → 0.1.804

package/dist/safe-js/chunks/{chunk-6H5VC5W5.js → chunk-CKOGIOB3.js}

@@ -1459,7 +1459,11 @@ var JSON_RPC_ERROR_CODES = Object.freeze({
 // packages/tiny-stdio-mcp-server/src/base64.ts
 function isBase64(value) {
   if (value.length % 4 !== 0) return false;
-  return Buffer.from(value, "base64").toString("base64") === value;
+  try {
+    return btoa(atob(value)) === value;
+  } catch {
+    return false;
+  }
 }
 
 // packages/tiny-stdio-mcp-server/src/uri.ts
@@ -3682,137 +3686,8 @@ function copyBoundedOAuthJson(value, message) {
   }
 }
 
-// packages/mcp-oauth/src/client/loopback-authorization.ts
-import http from "node:http";
-
-// packages/mcp-oauth/src/client/authorization-state.ts
-import crypto2 from "node:crypto";
-function createAuthorizationState(input) {
-  const payload = {
-    v: 1,
-    n: crypto2.randomBytes(16).toString("base64url"),
-    i: input.issuer,
-    r: input.requireIssuer
-  };
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
-}
-function parseAuthorizationState(value) {
-  if (value === null || value.length === 0) {
-    return null;
-  }
-  try {
-    const decoded = Buffer.from(value, "base64url").toString("utf8");
-    const parsed = JSON.parse(decoded);
-    if (!isObjectRecord(parsed)) {
-      return null;
-    }
-    const version = getOwnEntry(parsed, "v");
-    const nonce = getOwnEntry(parsed, "n");
-    const issuer = getOwnEntry(parsed, "i");
-    const requireIssuer = getOwnEntry(parsed, "r");
-    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
-      return null;
-    }
-    return {
-      issuer,
-      requireIssuer
-    };
-  } catch {
-    return null;
-  }
-}
-function isObjectRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getOwnEntry(record2, key2) {
-  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
-}
-
-// packages/mcp-oauth/src/client/authorization-error.ts
-var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
-var OAuthAuthorizationError = class extends Error {
-  constructor(error, errorDescription) {
-    super(`OAuth authorization failed: ${error} \u2014 ${errorDescription}`);
-    this.error = error;
-    this.errorDescription = errorDescription;
-    this.name = "OAuthAuthorizationError";
-    Object.defineProperty(this, authorizationErrorBrand, { value: true });
-  }
-  error;
-  errorDescription;
-  /** Recognize errors from separately bundled copies of this package. */
-  static is(value) {
-    return value instanceof Error && Object.getOwnPropertyDescriptor(value, authorizationErrorBrand)?.value === true;
-  }
-};
-
-// packages/mcp-oauth/src/client/loopback-authorization.ts
+// packages/mcp-oauth/src/client/redirect-target.ts
 var oauthCallbackParameters = ["code", "state", "iss", "error", "error_description", "error_uri"];
-function snapshotLoopbackAuthorizationOptions(options) {
-  return {
-    ...options,
-    openBrowser: options.openBrowser?.bind(options),
-    readLine: options.readLine?.bind(options),
-    waitForCallback: options.waitForCallback?.bind(options),
-    createServer: options.createServer?.bind(options),
-    callbackPath: options.callbackPath,
-    redirectUri: options.redirectUri,
-    signal: options.signal,
-    timeoutMs: options.timeoutMs,
-    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
-  };
-}
-async function createLoopbackAuthorizationSession(options = {}) {
-  options = snapshotLoopbackAuthorizationOptions(options);
-  options.signal?.throwIfAborted();
-  const timeoutMs = options.timeoutMs ?? 12e4;
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
-    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
-  if (options.waitForCallback !== void 0) return createHostedAuthorizationSession(options, timeoutMs);
-  const target = loopbackTarget(options);
-  const server = options.createServer ? options.createServer() : http.createServer();
-  const controller = new AbortController();
-  let closed = false;
-  let used = false;
-  const callerAbort = () => controller.abort(options.signal?.reason);
-  const teardown = () => {
-    if (closed) return;
-    closed = true;
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", callerAbort);
-    server.closeAllConnections?.();
-    server.close();
-  };
-  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-  timer.unref?.();
-  controller.signal.addEventListener("abort", teardown, { once: true });
-  options.signal?.addEventListener("abort", callerAbort, { once: true });
-  if (options.signal?.aborted) callerAbort();
-  let port;
-  try {
-    port = await startServer(server, target.port, target.host, controller.signal);
-  } catch (error) {
-    controller.abort(error);
-    throw error;
-  }
-  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
-  return {
-    redirectUri,
-    async waitForCode(authorizationUrl) {
-      controller.signal.throwIfAborted();
-      if (used) throw new Error("OAuth authorization session has already been used");
-      used = true;
-      try {
-        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
-      } finally {
-        clearTimeout(timer);
-      }
-    },
-    close() {
-      controller.abort(new Error("OAuth authorization session closed"));
-    }
-  };
-}
 function loopbackTarget(options) {
   if (options.redirectUri !== void 0) {
     let url;
@@ -3845,303 +3720,69 @@ function validateHostedOAuthRedirect(redirectUri, callbackPath) {
   if (url.protocol !== "https:" || url.username || url.password || url.href.includes("#") || url.port === "0" || oauthCallbackParameters.some((name) => url.searchParams.has(name)) || [...redirectUri].some((char) => char.codePointAt(0) <= 32) || callbackPath !== void 0 && callbackPath !== url.pathname)
     throw new Error("Invalid hosted OAuth redirect URI");
 }
-function createHostedAuthorizationSession(options, timeoutMs) {
-  validateAuthorizationRedirect(options);
-  const redirectUri = options.redirectUri, controller = new AbortController();
-  let used = false;
-  const aborted = () => controller.abort(options.signal?.reason);
-  const timer = setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-  timer.unref?.();
-  const cleanup = () => {
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", aborted);
-  };
-  controller.signal.addEventListener("abort", cleanup, { once: true });
-  options.signal?.addEventListener("abort", aborted, { once: true });
-  if (options.signal?.aborted) aborted();
-  return {
-    redirectUri,
-    async waitForCode(authorizationUrl) {
-      controller.signal.throwIfAborted();
-      if (used) throw new Error("OAuth authorization session has already been used");
-      used = true;
-      try {
-        const authorization = new URL(authorizationUrl);
-        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
-          throw new Error("OAuth authorization redirect mismatch");
-        const callback = await new Promise((resolve, reject) => {
-          const onAbort = () => reject(controller.signal.reason);
-          controller.signal.addEventListener("abort", onAbort, { once: true });
-          void Promise.resolve().then(() => {
-            controller.signal.throwIfAborted();
-            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
-          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
-        });
-        controller.signal.throwIfAborted();
-        const url = new URL(callback), base = new URL(redirectUri);
-        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32)) throw new Error("OAuth callback redirect mismatch");
-        const params = readAuthorizationCallbackParameters(url);
-        for (const name of oauthCallbackParameters) url.searchParams.delete(name);
-        if (url.searchParams.toString() !== base.searchParams.toString()) throw new Error("OAuth callback redirect mismatch");
-        const expected = readExpectedAuthorizationCallback(authorizationUrl);
-        if (expected.state === null) throw new Error("OAuth authorization missing state");
-        validateAuthorizationCallbackBinding(params, expected);
-        if (params.error !== null) throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
-        return validateAuthorizationCallbackParameters(params, expected);
-      } finally {
-        controller.abort(new Error("OAuth authorization session closed"));
-      }
-    },
-    close() {
-      controller.abort(new Error("OAuth authorization session closed"));
-    }
-  };
+
+// packages/mcp-oauth/src/client/token-auth-method.ts
+function normalizeOAuthTokenEndpointAuthMethod(value) {
+  if (value === void 0 || value === null) return void 0;
+  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
+    throw new Error("Unsupported OAuth token endpoint authentication method");
+  return value;
 }
-async function startServer(server, port, host, signal) {
-  signal.throwIfAborted();
-  return new Promise((resolve, reject) => {
-    const cleanup = () => {
-      server.off("error", handleError);
-      signal.removeEventListener("abort", aborted);
-    };
-    const handleError = (error) => {
-      cleanup();
-      reject(error);
-    };
-    const aborted = () => {
-      cleanup();
-      reject(signal.reason);
-    };
-    server.once("error", handleError);
-    signal.addEventListener("abort", aborted, { once: true });
-    try {
-      server.listen(port, host, () => {
-        cleanup();
-        if (signal.aborted) {
-          server.close();
-          reject(signal.reason);
-          return;
-        }
-        const address = server.address();
-        if (address === null || typeof address === "string") {
-          reject(new Error("OAuth listener has no TCP address"));
-          return;
-        }
-        resolve(address.port);
-      });
-    } catch (error) {
-      cleanup();
-      reject(error);
-    }
-  });
-}
-function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
-  signal.throwIfAborted();
-  const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const settle = (fn) => {
-      if (settled) return;
-      settled = true;
-      server.off("request", request);
-      signal.removeEventListener("abort", aborted);
-      fn();
-    };
-    const aborted = () => settle(() => reject(signal.reason));
-    const request = (req, res) => {
-      let url;
-      try {
-        url = new URL(req.url ?? "/", "http://127.0.0.1");
-      } catch {
-        res.writeHead(400);
-        res.end("Invalid callback URL");
-        return;
-      }
-      if (url.pathname !== callbackPath) {
-        res.writeHead(404);
-        res.end("Not found");
-        return;
-      }
-      try {
-        const callbackParameters = readAuthorizationCallbackParameters(url);
-        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-        if (callbackParameters.error !== null)
-          throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
-        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(buildSuccessPage(options.landingPage));
-        settle(() => resolve(code));
-      } catch (error) {
-        res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "X-Content-Type-Options": "nosniff" });
-        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
-        settle(() => reject(error));
-      }
-    };
-    server.on("request", request);
-    signal.addEventListener("abort", aborted, { once: true });
-    if (options.readLine !== void 0) {
-      void Promise.resolve().then(() => settled ? void 0 : options.readLine()).then((input) => {
-        if (settled) return;
-        const callbackParameters = extractCallbackParametersFromInput(input);
-        if (callbackParameters === null) throw new Error("OAuth callback missing authorization code");
-        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
-        if (callbackParameters.error !== null)
-          throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
-        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
-        settle(() => resolve(code));
-      }).catch((error) => settle(() => reject(error)));
-    }
-    if (options.openBrowser !== void 0) {
-      void Promise.resolve().then(() => settled ? void 0 : options.openBrowser(authorizationUrl)).catch((error) => settle(() => reject(error)));
-    }
-  });
-}
-function extractCallbackParametersFromInput(input) {
-  const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
-  if (trimmed.length === 0) {
-    return null;
-  }
-  let url;
-  try {
-    url = new URL(trimmed);
-  } catch {
-    return {
-      code: trimmed,
-      error: null,
-      errorDescription: null,
-      state: null,
-      iss: null
-    };
-  }
-  return readAuthorizationCallbackParameters(url);
-}
-function readAuthorizationCallbackParameters(url) {
-  for (const parameter of oauthCallbackParameters) {
-    if (url.searchParams.getAll(parameter).length > 1)
-      throw new Error(`OAuth callback parameter '${parameter}' must occur only once`);
-  }
-  return {
-    code: url.searchParams.get("code"),
-    error: url.searchParams.get("error"),
-    errorDescription: url.searchParams.get("error_description"),
-    state: url.searchParams.get("state"),
-    iss: url.searchParams.get("iss")
-  };
-}
-function readExpectedAuthorizationCallback(authorizationUrl) {
-  const url = new URL(authorizationUrl);
-  const state = url.searchParams.get("state");
-  const parsedState = parseAuthorizationState(state);
-  return {
-    state,
-    issuer: parsedState?.issuer ?? null,
-    requireIssuer: parsedState?.requireIssuer ?? false
-  };
-}
-function validateAuthorizationCallbackParameters(callback, expected) {
-  validateAuthorizationCallbackBinding(callback, expected);
-  if (callback.code === null || callback.code.length === 0) {
-    throw new Error("OAuth callback missing authorization code");
-  }
-  return callback.code;
-}
-function validateAuthorizationCallbackBinding(callback, expected) {
-  if (expected.state !== null) {
-    if (callback.state === null || callback.state.length === 0) {
-      throw new Error("OAuth callback missing state");
-    }
-    if (callback.state !== expected.state) {
-      throw new Error("OAuth callback state mismatch");
-    }
-  }
-  if (expected.requireIssuer) {
-    if (callback.iss === null || callback.iss.length === 0) {
-      throw new Error("OAuth callback missing issuer");
-    }
-  }
-  if (callback.iss !== null && callback.iss.length > 0 && expected.issuer !== null && callback.iss !== expected.issuer) {
-    throw new Error("OAuth callback issuer mismatch");
-  }
-}
-function escapeHtml(text) {
-  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
-}
-function buildSuccessPage(landingPage) {
-  const title = landingPage?.title ?? "Connected";
-  const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
-  return [
-    "<!DOCTYPE html>",
-    `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
-    '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
-    '<div style="text-align:center">',
-    `<h1>${escapeHtml(title)}</h1>`,
-    `<p style="color:#666">${escapeHtml(body)}</p>`,
-    "</div></body></html>"
-  ].join("");
-}
-
-// packages/mcp-oauth/src/client/token-auth-method.ts
-function normalizeOAuthTokenEndpointAuthMethod(value) {
-  if (value === void 0 || value === null) return void 0;
-  if (value !== "none" && value !== "client_secret_post" && value !== "client_secret_basic")
-    throw new Error("Unsupported OAuth token endpoint authentication method");
-  return value;
-}
-
-// packages/mcp-oauth/src/client/client-registration.ts
-function parseOAuthClientRegistration(value) {
-  const invalid = () => new Error("Invalid OAuth client registration metadata");
-  const result = copyBoundedOAuthJson(value, "Invalid OAuth client registration metadata");
-  if (typeof result !== "object" || result === null || Array.isArray(result)) throw invalid();
-  const record2 = result;
-  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
-    throw new Error("OAuth client registration response missing client_id");
-  for (const key2 of [
-    "client_id",
-    "client_secret",
-    "token_endpoint_auth_method",
-    "application_type",
-    "client_name",
-    "client_uri",
-    "logo_uri",
-    "scope",
-    "tos_uri",
-    "policy_uri",
-    "jwks_uri",
-    "software_id",
-    "software_version",
-    "software_statement",
-    "registration_access_token",
-    "registration_client_uri",
-    "issuer"
-  ]) {
-    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string") throw invalid();
-  }
-  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "") throw invalid();
-  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
-    const entry = record2[key2];
-    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string"))) throw invalid();
-  }
-  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
-    const entry = record2[key2];
-    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0)) throw invalid();
-  }
-  try {
-    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
-  } catch {
-    throw invalid();
-  }
-  return record2;
-}
-function normalizeStoredOAuthClient(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
-  const record2 = value;
-  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
-  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
-  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === "")) return null;
-  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
-  const requestedRedirectUri = Object.hasOwn(record2, "requestedRedirectUri") ? record2.requestedRedirectUri : void 0;
-  if (requestedRedirectUri !== void 0) {
+
+// packages/mcp-oauth/src/client/client-registration.ts
+function parseOAuthClientRegistration(value) {
+  const invalid = () => new Error("Invalid OAuth client registration metadata");
+  const result = copyBoundedOAuthJson(value, "Invalid OAuth client registration metadata");
+  if (typeof result !== "object" || result === null || Array.isArray(result)) throw invalid();
+  const record2 = result;
+  if (!Object.hasOwn(record2, "client_id") || typeof record2.client_id !== "string" || record2.client_id.trim() === "")
+    throw new Error("OAuth client registration response missing client_id");
+  for (const key2 of [
+    "client_id",
+    "client_secret",
+    "token_endpoint_auth_method",
+    "application_type",
+    "client_name",
+    "client_uri",
+    "logo_uri",
+    "scope",
+    "tos_uri",
+    "policy_uri",
+    "jwks_uri",
+    "software_id",
+    "software_version",
+    "software_statement",
+    "registration_access_token",
+    "registration_client_uri",
+    "issuer"
+  ]) {
+    if (Object.hasOwn(record2, key2) && record2[key2] !== null && typeof record2[key2] !== "string") throw invalid();
+  }
+  if (typeof record2.client_secret === "string" && record2.client_secret.trim() === "") throw invalid();
+  for (const key2 of ["redirect_uris", "grant_types", "response_types", "contacts"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (!Array.isArray(entry) || entry.some((item) => typeof item !== "string"))) throw invalid();
+  }
+  for (const key2 of ["client_id_issued_at", "client_secret_expires_at"]) {
+    const entry = record2[key2];
+    if (Object.hasOwn(record2, key2) && entry !== null && (typeof entry !== "number" || !Number.isSafeInteger(entry) || entry < 0)) throw invalid();
+  }
+  try {
+    normalizeOAuthScope(Object.hasOwn(record2, "scope") && record2.scope !== null ? record2.scope : void 0);
+  } catch {
+    throw invalid();
+  }
+  return record2;
+}
+function normalizeStoredOAuthClient(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  const record2 = value;
+  const clientId = Object.hasOwn(record2, "clientId") ? record2.clientId : void 0;
+  const clientSecret = Object.hasOwn(record2, "clientSecret") ? record2.clientSecret : void 0;
+  if (typeof clientId !== "string" || clientId.trim() === "" || clientSecret !== void 0 && (typeof clientSecret !== "string" || clientSecret.trim() === "")) return null;
+  const client = { clientId: clientId.trim(), ...clientSecret === void 0 ? {} : { clientSecret: clientSecret.trim() } };
+  const requestedRedirectUri = Object.hasOwn(record2, "requestedRedirectUri") ? record2.requestedRedirectUri : void 0;
+  if (requestedRedirectUri !== void 0) {
     try {
       if (typeof requestedRedirectUri !== "string") throw new Error("Invalid redirect identity");
       if (new URL(requestedRedirectUri).protocol === "https:")
@@ -4198,7 +3839,7 @@ function registrationMatchesRedirect(client, requestedUri, fresh = false) {
 }
 
 // packages/mcp-oauth/src/client/auth-store-session-store.ts
-import crypto3 from "node:crypto";
+import crypto2 from "node:crypto";
 import path4 from "node:path";
 
 // packages/auth-store/src/encrypted-file-store.ts
@@ -4217,8 +3858,8 @@ import { randomUUID } from "node:crypto";
 import path from "node:path";
 async function withSecretStoreFileLock(fs2, lockDirectory, operation, options = {}) {
   options = { ...options, signal: options.signal, timeoutMs: options.timeoutMs };
-  const timeoutMs = options.timeoutMs ?? 3e4;
-  if (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647)
+  const timeoutMs = options.timeoutMs ?? Infinity;
+  if (timeoutMs !== Infinity && (!Number.isFinite(timeoutMs) || timeoutMs < 0 || timeoutMs > 2147483647))
     throw new Error("Invalid secret-store transaction lock timeout");
   options.signal?.throwIfAborted();
   const deadline = performance.now() + timeoutMs;
@@ -4613,10 +4254,10 @@ function parseEncryptedDocument(raw) {
     if (!isRecord2(parsed)) {
       return null;
     }
-    const version = getOwnEntry2(parsed, "version");
-    const iv = getOwnEntry2(parsed, "iv");
-    const authTag = getOwnEntry2(parsed, "authTag");
-    const ciphertext = getOwnEntry2(parsed, "ciphertext");
+    const version = getOwnEntry(parsed, "version");
+    const iv = getOwnEntry(parsed, "iv");
+    const authTag = getOwnEntry(parsed, "authTag");
+    const ciphertext = getOwnEntry(parsed, "ciphertext");
     if (version !== ENCRYPTION_VERSION) {
       return null;
     }
@@ -4636,7 +4277,7 @@ function parseEncryptedDocument(raw) {
 function isRecord2(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
-function getOwnEntry2(record2, key2) {
+function getOwnEntry(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 function isNotFoundError(error) {
@@ -4808,14 +4449,14 @@ function createSecurityCliFailure(operation, result) {
   return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
 }
 function getCommandExitCode(result) {
-  const value = getOwnEntry3(result, "exitCode");
+  const value = getOwnEntry2(result, "exitCode");
   return typeof value === "number" && Number.isInteger(value) ? value : 1;
 }
 function getCommandOutput(result, key2) {
-  const value = getOwnEntry3(result, key2);
+  const value = getOwnEntry2(result, key2);
   return typeof value === "string" ? value : "";
 }
-function getOwnEntry3(record2, key2) {
+function getOwnEntry2(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 
@@ -4935,7 +4576,7 @@ function createAuthStoreClientStore(options, namespace) {
       } catch {
         throw new Error("Stored OAuth client must be valid JSON; reset the store explicitly to recover");
       }
-      if (isObjectRecord2(parsed) && typeof getOwnEntry4(parsed, "clientId") === "string")
+      if (isObjectRecord(parsed) && typeof getOwnEntry3(parsed, "clientId") === "string")
         return parsed;
       throw new Error("Stored OAuth client must be a JSON object with clientId");
     },
@@ -4956,7 +4597,7 @@ function snapshotPersistenceOptions(options) {
 }
 function createNamedSecretStore(key2, options, defaults, namespace) {
   options = snapshotOAuthPersistenceOptions(options);
-  const hash = crypto3.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
+  const hash = crypto2.createHash("sha256").update(namespace === void 0 ? key2 : JSON.stringify([namespace, key2])).digest("hex");
   const configuredFilePath = options.fileStore?.filePath;
   const parsedFilePath = configuredFilePath === void 0 ? null : path4.parse(configuredFilePath);
   const fileStore = {
@@ -4997,47 +4638,47 @@ function assertPersistenceNamespace(namespace) {
   if (namespace !== void 0 && (typeof namespace !== "string" || namespace.trim() === "" || Buffer.byteLength(namespace, "utf8") > 1024))
     throw new Error("OAuth persistence namespace must be a nonempty string within 1024 bytes");
 }
-function isObjectRecord2(value) {
+function isObjectRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function getOwnEntry4(record2, key2) {
+function getOwnEntry3(record2, key2) {
   return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
 }
 function getOwnString(record2, key2) {
-  const value = getOwnEntry4(record2, key2);
+  const value = getOwnEntry3(record2, key2);
   return typeof value === "string" ? value : void 0;
 }
 function isStoredOAuthSession(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry4(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry4(value, "discovery")) && (getOwnEntry4(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry4(value, "refreshState") === void 0 || getOwnEntry4(value, "refreshState") === "pending" && getOwnEntry4(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry4(value, "tokens"));
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && normalizeStoredOAuthClient(getOwnEntry3(value, "client")) !== null && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && (getOwnEntry3(value, "requestedScope") === void 0 || isNonBlankOwnString(value, "requestedScope")) && (getOwnEntry3(value, "refreshState") === void 0 || getOwnEntry3(value, "refreshState") === "pending" && getOwnEntry3(value, "tokens") === void 0) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
 }
 function isStoredOAuthDiscovery(value) {
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord(value)) {
     return false;
   }
-  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord2(getOwnEntry4(value, "resourceMetadata")) && isObjectRecord2(getOwnEntry4(value, "authorizationServerMetadata"));
+  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord(getOwnEntry3(value, "resourceMetadata")) && isObjectRecord(getOwnEntry3(value, "authorizationServerMetadata"));
 }
 function isStoredOAuthTokensOrMissing(value) {
   if (value === void 0) {
     return true;
   }
-  if (!isObjectRecord2(value)) {
+  if (!isObjectRecord(value)) {
     return false;
   }
   if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
     return false;
   }
-  const expiresAt = getOwnEntry4(value, "expiresAt");
+  const expiresAt = getOwnEntry3(value, "expiresAt");
   if (expiresAt !== null && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime()))) {
     return false;
   }
-  const refreshToken = getOwnEntry4(value, "refreshToken");
+  const refreshToken = getOwnEntry3(value, "refreshToken");
   if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
     return false;
   }
-  const scope = getOwnEntry4(value, "scope");
+  const scope = getOwnEntry3(value, "scope");
   return scope === void 0 || scope === "" || typeof scope === "string" && scope.trim().length > 0;
 }
 function isNonBlankOwnString(record2, key2) {
@@ -5101,8 +4742,8 @@ function createResourceBoundOAuthStores(options, namespace, identity) {
   async function replace(record2, options2) {
     options2 = { ...options2, signal: options2.signal, timeoutMs: options2.timeoutMs };
     options2.signal?.throwIfAborted();
-    const timeoutMs = options2.timeoutMs ?? 3e4;
-    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+    const timeoutMs = options2.timeoutMs ?? Infinity;
+    if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647))
       throw new Error("OAuth replacement timeoutMs must be a positive supported timer interval");
     if (store.withLock === void 0) throw new Error("OAuth resource identity backend must support transaction locks");
     await store.withLock(async () => {
@@ -5255,6 +4896,371 @@ async function fetchMcpResponse(fetchImplementation, input, init = {}) {
 // packages/mcp-oauth/src/client/default-oauth-client-provider.ts
 import { URL as URL2 } from "node:url";
 
+// packages/mcp-oauth/src/client/loopback-authorization.ts
+import http from "node:http";
+
+// packages/mcp-oauth/src/client/authorization-state.ts
+import crypto3 from "node:crypto";
+function createAuthorizationState(input) {
+  const payload = {
+    v: 1,
+    n: crypto3.randomBytes(16).toString("base64url"),
+    i: input.issuer,
+    r: input.requireIssuer
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function parseAuthorizationState(value) {
+  if (value === null || value.length === 0) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(value, "base64url").toString("utf8");
+    const parsed = JSON.parse(decoded);
+    if (!isObjectRecord2(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry4(parsed, "v");
+    const nonce = getOwnEntry4(parsed, "n");
+    const issuer = getOwnEntry4(parsed, "i");
+    const requireIssuer = getOwnEntry4(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
+      return null;
+    }
+    return {
+      issuer,
+      requireIssuer
+    };
+  } catch {
+    return null;
+  }
+}
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry4(record2, key2) {
+  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+}
+
+// packages/mcp-oauth/src/client/authorization-error.ts
+var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
+var OAuthAuthorizationError = class extends Error {
+  constructor(error, errorDescription) {
+    super(`OAuth authorization failed: ${error} \u2014 ${errorDescription}`);
+    this.error = error;
+    this.errorDescription = errorDescription;
+    this.name = "OAuthAuthorizationError";
+    Object.defineProperty(this, authorizationErrorBrand, { value: true });
+  }
+  error;
+  errorDescription;
+  /** Recognize errors from separately bundled copies of this package. */
+  static is(value) {
+    return value instanceof Error && Object.getOwnPropertyDescriptor(value, authorizationErrorBrand)?.value === true;
+  }
+};
+
+// packages/mcp-oauth/src/client/loopback-authorization.ts
+function snapshotLoopbackAuthorizationOptions(options) {
+  return {
+    ...options,
+    openBrowser: options.openBrowser?.bind(options),
+    readLine: options.readLine?.bind(options),
+    waitForCallback: options.waitForCallback?.bind(options),
+    createServer: options.createServer?.bind(options),
+    callbackPath: options.callbackPath,
+    redirectUri: options.redirectUri,
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
+  };
+}
+async function createLoopbackAuthorizationSession(options = {}) {
+  options = snapshotLoopbackAuthorizationOptions(options);
+  options.signal?.throwIfAborted();
+  const timeoutMs = options.timeoutMs ?? Infinity;
+  if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647))
+    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  if (options.waitForCallback !== void 0) return createHostedAuthorizationSession(options, timeoutMs);
+  const target = loopbackTarget(options);
+  const server = options.createServer ? options.createServer() : http.createServer();
+  const controller = new AbortController();
+  let closed = false;
+  let used = false;
+  const callerAbort = () => controller.abort(options.signal?.reason);
+  const teardown = () => {
+    if (closed) return;
+    closed = true;
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", callerAbort);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer?.unref?.();
+  controller.signal.addEventListener("abort", teardown, { once: true });
+  options.signal?.addEventListener("abort", callerAbort, { once: true });
+  if (options.signal?.aborted) callerAbort();
+  let port;
+  try {
+    port = await startServer(server, target.port, target.host, controller.signal);
+  } catch (error) {
+    controller.abort(error);
+    throw error;
+  }
+  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used) throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+  validateAuthorizationRedirect(options);
+  const redirectUri = options.redirectUri, controller = new AbortController();
+  let used = false;
+  const aborted = () => controller.abort(options.signal?.reason);
+  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer?.unref?.();
+  const cleanup = () => {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", aborted);
+  };
+  controller.signal.addEventListener("abort", cleanup, { once: true });
+  options.signal?.addEventListener("abort", aborted, { once: true });
+  if (options.signal?.aborted) aborted();
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used) throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        const authorization = new URL(authorizationUrl);
+        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+          throw new Error("OAuth authorization redirect mismatch");
+        const callback = await new Promise((resolve, reject) => {
+          const onAbort = () => reject(controller.signal.reason);
+          controller.signal.addEventListener("abort", onAbort, { once: true });
+          void Promise.resolve().then(() => {
+            controller.signal.throwIfAborted();
+            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+        });
+        controller.signal.throwIfAborted();
+        const url = new URL(callback), base = new URL(redirectUri);
+        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32)) throw new Error("OAuth callback redirect mismatch");
+        const params = readAuthorizationCallbackParameters(url);
+        for (const name of oauthCallbackParameters) url.searchParams.delete(name);
+        if (url.searchParams.toString() !== base.searchParams.toString()) throw new Error("OAuth callback redirect mismatch");
+        const expected = readExpectedAuthorizationCallback(authorizationUrl);
+        if (expected.state === null) throw new Error("OAuth authorization missing state");
+        validateAuthorizationCallbackBinding(params, expected);
+        if (params.error !== null) throw new OAuthAuthorizationError(params.error, params.errorDescription ?? params.error);
+        return validateAuthorizationCallbackParameters(params, expected);
+      } finally {
+        controller.abort(new Error("OAuth authorization session closed"));
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
+async function startServer(server, port, host, signal) {
+  signal.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      server.off("error", handleError);
+      signal.removeEventListener("abort", aborted);
+    };
+    const handleError = (error) => {
+      cleanup();
+      reject(error);
+    };
+    const aborted = () => {
+      cleanup();
+      reject(signal.reason);
+    };
+    server.once("error", handleError);
+    signal.addEventListener("abort", aborted, { once: true });
+    try {
+      server.listen(port, host, () => {
+        cleanup();
+        if (signal.aborted) {
+          server.close();
+          reject(signal.reason);
+          return;
+        }
+        const address = server.address();
+        if (address === null || typeof address === "string") {
+          reject(new Error("OAuth listener has no TCP address"));
+          return;
+        }
+        resolve(address.port);
+      });
+    } catch (error) {
+      cleanup();
+      reject(error);
+    }
+  });
+}
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath, signal) {
+  signal.throwIfAborted();
+  const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (settled) return;
+      settled = true;
+      server.off("request", request);
+      signal.removeEventListener("abort", aborted);
+      fn();
+    };
+    const aborted = () => settle(() => reject(signal.reason));
+    const request = (req, res) => {
+      let url;
+      try {
+        url = new URL(req.url ?? "/", "http://127.0.0.1");
+      } catch {
+        res.writeHead(400);
+        res.end("Invalid callback URL");
+        return;
+      }
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+      }
+      try {
+        const callbackParameters = readAuthorizationCallbackParameters(url);
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+        if (callbackParameters.error !== null)
+          throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(buildSuccessPage(options.landingPage));
+        settle(() => resolve(code));
+      } catch (error) {
+        res.writeHead(400, { "Content-Type": "text/plain; charset=utf-8", "X-Content-Type-Options": "nosniff" });
+        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
+        settle(() => reject(error));
+      }
+    };
+    server.on("request", request);
+    signal.addEventListener("abort", aborted, { once: true });
+    if (options.readLine !== void 0) {
+      void Promise.resolve().then(() => settled ? void 0 : options.readLine()).then((input) => {
+        if (settled) return;
+        const callbackParameters = extractCallbackParametersFromInput(input);
+        if (callbackParameters === null) throw new Error("OAuth callback missing authorization code");
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+        if (callbackParameters.error !== null)
+          throw new OAuthAuthorizationError(callbackParameters.error, callbackParameters.errorDescription ?? callbackParameters.error);
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        settle(() => resolve(code));
+      }).catch((error) => settle(() => reject(error)));
+    }
+    if (options.openBrowser !== void 0) {
+      void Promise.resolve().then(() => settled ? void 0 : options.openBrowser(authorizationUrl)).catch((error) => settle(() => reject(error)));
+    }
+  });
+}
+function extractCallbackParametersFromInput(input) {
+  const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
+  if (trimmed.length === 0) {
+    return null;
+  }
+  let url;
+  try {
+    url = new URL(trimmed);
+  } catch {
+    return {
+      code: trimmed,
+      error: null,
+      errorDescription: null,
+      state: null,
+      iss: null
+    };
+  }
+  return readAuthorizationCallbackParameters(url);
+}
+function readAuthorizationCallbackParameters(url) {
+  for (const parameter of oauthCallbackParameters) {
+    if (url.searchParams.getAll(parameter).length > 1)
+      throw new Error(`OAuth callback parameter '${parameter}' must occur only once`);
+  }
+  return {
+    code: url.searchParams.get("code"),
+    error: url.searchParams.get("error"),
+    errorDescription: url.searchParams.get("error_description"),
+    state: url.searchParams.get("state"),
+    iss: url.searchParams.get("iss")
+  };
+}
+function readExpectedAuthorizationCallback(authorizationUrl) {
+  const url = new URL(authorizationUrl);
+  const state = url.searchParams.get("state");
+  const parsedState = parseAuthorizationState(state);
+  return {
+    state,
+    issuer: parsedState?.issuer ?? null,
+    requireIssuer: parsedState?.requireIssuer ?? false
+  };
+}
+function validateAuthorizationCallbackParameters(callback, expected) {
+  validateAuthorizationCallbackBinding(callback, expected);
+  if (callback.code === null || callback.code.length === 0) {
+    throw new Error("OAuth callback missing authorization code");
+  }
+  return callback.code;
+}
+function validateAuthorizationCallbackBinding(callback, expected) {
+  if (expected.state !== null) {
+    if (callback.state === null || callback.state.length === 0) {
+      throw new Error("OAuth callback missing state");
+    }
+    if (callback.state !== expected.state) {
+      throw new Error("OAuth callback state mismatch");
+    }
+  }
+  if (expected.requireIssuer) {
+    if (callback.iss === null || callback.iss.length === 0) {
+      throw new Error("OAuth callback missing issuer");
+    }
+  }
+  if (callback.iss !== null && callback.iss.length > 0 && expected.issuer !== null && callback.iss !== expected.issuer) {
+    throw new Error("OAuth callback issuer mismatch");
+  }
+}
+function escapeHtml(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function buildSuccessPage(landingPage) {
+  const title = landingPage?.title ?? "Connected";
+  const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
+  return [
+    "<!DOCTYPE html>",
+    `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
+    '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+    '<div style="text-align:center">',
+    `<h1>${escapeHtml(title)}</h1>`,
+    `<p style="color:#666">${escapeHtml(body)}</p>`,
+    "</div></body></html>"
+  ].join("");
+}
+
 // packages/mcp-oauth/src/client/pkce.ts
 import crypto4 from "node:crypto";
 function generateCodeVerifier() {
@@ -5503,8 +5509,8 @@ function normalizeBearerTokenType(value) {
 // packages/mcp-oauth/src/client/session-transaction.ts
 var queues = /* @__PURE__ */ new WeakMap();
 async function withOAuthSessionTransaction(store, resource, operation, options = {}) {
-  const timeoutMs = options.timeoutMs ?? 3e4;
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647)
+  const timeoutMs = options.timeoutMs ?? Infinity;
+  if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647))
     throw new Error("sessionLockTimeoutMs must be an integer from 1 to 2147483647 milliseconds");
   options.signal?.throwIfAborted();
   const started = performance.now();
@@ -5527,7 +5533,7 @@ async function withOAuthSessionTransaction(store, resource, operation, options =
     });
     const abort = () => rejectWait(options.signal?.reason);
     try {
-      timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
+      if (timeoutMs !== Infinity) timer = setTimeout(() => rejectWait(new Error("Timed out waiting for OAuth session transaction lock")), timeoutMs);
       options.signal?.addEventListener("abort", abort, { once: true });
       if (options.signal?.aborted) abort();
       await waiting;
@@ -6418,15 +6424,15 @@ import {
 
 // packages/tiny-stdio-mcp-server/src/headers.ts
 function encodeHeaderValue(value) {
-  const bytes = Buffer.from(value, "utf8");
-  if (bytes.toString("utf8") !== value)
+  const bytes = new TextEncoder().encode(value);
+  if (new TextDecoder("utf-8", { ignoreBOM: true }).decode(bytes) !== value)
     throw new Error("MCP header value must contain valid Unicode");
   const sentinel = value.startsWith("=?base64?") && value.endsWith("?=");
   const unsafe = value.trim() !== value || [...value].some((character) => {
     const code = character.charCodeAt(0);
     return code !== 9 && (code < 32 || code > 126);
   });
-  return sentinel || unsafe ? `=?base64?${bytes.toString("base64")}?=` : value;
+  return sentinel || unsafe ? `=?base64?${btoa(Array.from(bytes, (byte) => String.fromCharCode(byte)).join(""))}?=` : value;
 }
 var schemaMaps = /* @__PURE__ */ new Set([
   "properties",
@@ -8154,7 +8160,7 @@ var HttpTransport = class {
     if (this.legacyProtocolVersion !== void 0) headers.set("MCP-Protocol-Version", this.legacyProtocolVersion);
     if (this.lastEventId !== void 0) {
       if (this.lastEventId === "") headers.delete("Last-Event-ID");
-      else headers.set("Last-Event-ID", Buffer.from(this.lastEventId, "utf8").toString("latin1"));
+      else headers.set("Last-Event-ID", Array.from(new TextEncoder().encode(this.lastEventId), (byte) => String.fromCharCode(byte)).join(""));
     }
     return this.authorizeRequestHeaders(headers, signal);
   }
@@ -8583,7 +8589,7 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
   let bytes = 0;
   const decoder = new TextDecoder("utf-8", { fatal: true });
   const append = (part) => {
-    bytes += Buffer.byteLength(part, "utf8");
+    bytes += new TextEncoder().encode(part).byteLength;
     if (bytes > maxLineBytes) throw new Error(`Stdio input line byte limit exceeded (${maxLineBytes} bytes)`);
     if (part.length > 0) parts.push(part);
   };
@@ -8644,7 +8650,7 @@ var SseParser = class {
         else if (index === this.buffer.length - 1) this.skipLf = true;
       }
       start = index + 1;
-      if (Buffer.byteLength(line, "utf8") > this.maxEventBytes)
+      if (new TextEncoder().encode(line).byteLength > this.maxEventBytes)
         throw new Error(`SSE event exceeds ${this.maxEventBytes} bytes`);
       this.consumeLine(line, messages);
       this.assertEventSize("");
@@ -8676,7 +8682,7 @@ var SseParser = class {
       return;
     }
     if (field === "data") {
-      this.dataBytes += Buffer.byteLength(value, "utf8") + (this.dataLines.length > 0 ? 1 : 0);
+      this.dataBytes += new TextEncoder().encode(value).byteLength + (this.dataLines.length > 0 ? 1 : 0);
       this.dataLines.push(value);
       return;
     }
@@ -8715,7 +8721,7 @@ var SseParser = class {
     this.dataBytes = 0;
   }
   assertEventSize(partialLine) {
-    if (this.dataBytes + Buffer.byteLength(this.eventType ?? "", "utf8") + Buffer.byteLength(this.eventId, "utf8") + Buffer.byteLength(partialLine, "utf8") > this.maxEventBytes)
+    if (this.dataBytes + new TextEncoder().encode(this.eventType ?? "").byteLength + new TextEncoder().encode(this.eventId).byteLength + new TextEncoder().encode(partialLine).byteLength > this.maxEventBytes)
       throw new Error(`SSE event exceeds ${this.maxEventBytes} bytes`);
   }
 };