@prefecthq/fastmcp-ts 1.7.3 → 1.8.1

package/dist/cli/index.cjs

@@ -1180,8 +1180,8 @@ var init_version = __esm({
       async run({ args }) {
         if (args.json) setJsonMode(true);
         const data = {
-          fastmcp: "1.7.3",
-          "mcp-sdk": "2.0.0",
+          fastmcp: "1.8.1",
+          "mcp-sdk": "2.3.1",
           node: process.version,
           platform: `${process.platform} ${process.arch}`
         };
@@ -8965,10 +8965,10 @@ var init_v4 = __esm({
   }
 });
 
-// node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs
+// node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs
 var LATEST_PROTOCOL_VERSION, SUPPORTED_PROTOCOL_VERSIONS, RELATED_TASK_META_KEY, PROTOCOL_VERSION_META_KEY, CLIENT_INFO_META_KEY, SERVER_INFO_META_KEY, CLIENT_CAPABILITIES_META_KEY, SUBSCRIPTION_ID_META_KEY, LOG_LEVEL_META_KEY, JSONRPC_VERSION, JSONValueSchema, JSONObjectSchema, JSONArraySchema, ProgressTokenSchema, CursorSchema, TaskMetadataSchema, RelatedTaskMetadataSchema, RequestMetaSchema, BaseRequestParamsSchema, TaskAugmentedRequestParamsSchema, RequestSchema, NotificationsParamsSchema, NotificationSchema, ResultMetaObjectSchema, ResultSchema, RequestIdSchema, JSONRPCRequestSchema, JSONRPCNotificationSchema, JSONRPCResultResponseSchema, JSONRPCErrorResponseSchema, JSONRPCMessageSchema, JSONRPCResponseSchema, EmptyResultSchema, CancelledNotificationParamsSchema, CancelledNotificationSchema, IconSchema, IconsSchema, BaseMetadataSchema, ImplementationSchema, FormElicitationCapabilitySchema, ElicitationCapabilitySchema, ClientTasksCapabilitySchema, ServerTasksCapabilitySchema, ClientCapabilitiesSchema, InitializeRequestParamsSchema, InitializeRequestSchema, ServerCapabilitiesSchema, InitializeResultSchema, InitializedNotificationSchema, DiscoverRequestSchema, DiscoverResultSchema, PingRequestSchema, ProgressSchema, ProgressNotificationParamsSchema, ProgressNotificationSchema, PaginatedRequestParamsSchema, PaginatedRequestSchema, PaginatedResultSchema, ResourceContentsSchema, TextResourceContentsSchema, Base64Schema, BlobResourceContentsSchema, RoleSchema, AnnotationsSchema, ResourceSchema, ResourceTemplateSchema, ListResourcesRequestSchema, ListResourcesResultSchema, ListResourceTemplatesRequestSchema, ListResourceTemplatesResultSchema, ResourceRequestParamsSchema, ReadResourceRequestParamsSchema, ReadResourceRequestSchema, ReadResourceResultSchema, ResourceListChangedNotificationSchema, SubscribeRequestParamsSchema, SubscribeRequestSchema, UnsubscribeRequestParamsSchema, UnsubscribeRequestSchema, SubscriptionFilterSchema, SubscriptionsListenRequestParamsSchema, SubscriptionsListenRequestSchema, SubscriptionsAcknowledgedNotificationParamsSchema, SubscriptionsAcknowledgedNotificationSchema, SubscriptionsListenResultMetaSchema, SubscriptionsListenResultSchema, ResourceUpdatedNotificationParamsSchema, ResourceUpdatedNotificationSchema, PromptArgumentSchema, PromptSchema, ListPromptsRequestSchema, ListPromptsResultSchema, GetPromptRequestParamsSchema, GetPromptRequestSchema, TextContentSchema, ImageContentSchema, AudioContentSchema, ToolUseContentSchema, EmbeddedResourceSchema, ResourceLinkSchema, ContentBlockSchema, PromptMessageSchema, GetPromptResultSchema, PromptListChangedNotificationSchema, ToolAnnotationsSchema, ToolExecutionSchema, ToolSchema, ListToolsRequestSchema, ListToolsResultSchema, CallToolResultSchema, CompatibilityCallToolResultSchema, CallToolRequestParamsSchema, CallToolRequestSchema, ToolListChangedNotificationSchema, ListChangedOptionsBaseSchema, LoggingLevelSchema, SetLevelRequestParamsSchema, SetLevelRequestSchema, LoggingMessageNotificationParamsSchema, LoggingMessageNotificationSchema, ModelHintSchema, ModelPreferencesSchema, ToolChoiceSchema, ToolResultContentSchema, SamplingContentSchema, SamplingMessageContentBlockSchema, SamplingMessageSchema, CreateMessageRequestParamsSchema, CreateMessageRequestSchema, CreateMessageResultSchema, CreateMessageResultWithToolsSchema, BooleanSchemaSchema, StringSchemaSchema, NumberSchemaSchema, UntitledSingleSelectEnumSchemaSchema, TitledSingleSelectEnumSchemaSchema, LegacyTitledEnumSchemaSchema, SingleSelectEnumSchemaSchema, UntitledMultiSelectEnumSchemaSchema, TitledMultiSelectEnumSchemaSchema, MultiSelectEnumSchemaSchema, EnumSchemaSchema, PrimitiveSchemaDefinitionSchema, ElicitRequestFormParamsSchema, ElicitRequestURLParamsSchema, ElicitRequestParamsSchema, ElicitRequestSchema, ElicitationCompleteNotificationParamsSchema, ElicitationCompleteNotificationSchema, ElicitResultSchema, ResourceTemplateReferenceSchema, PromptReferenceSchema, CompleteRequestParamsSchema, CompleteRequestSchema, CompleteResultSchema, RootSchema, ListRootsRequestSchema, ListRootsResultSchema, RootsListChangedNotificationSchema, TaskCreationParamsSchema, TaskStatusSchema, TaskSchema, CreateTaskResultSchema, TaskStatusNotificationParamsSchema, TaskStatusNotificationSchema, GetTaskRequestSchema, GetTaskResultSchema, GetTaskPayloadRequestSchema, GetTaskPayloadResultSchema, ListTasksRequestSchema, ListTasksResultSchema, CancelTaskRequestSchema, CancelTaskResultSchema, ClientRequestSchema, ClientNotificationSchema, ClientResultSchema, ServerRequestSchema, ServerNotificationSchema, ServerResultSchema, SafeUrlSchema, OAuthProtectedResourceMetadataSchema, OAuthMetadataSchema, OpenIdProviderMetadataSchema, OpenIdProviderDiscoveryMetadataSchema, OAuthTokensSchema, IdJagTokenExchangeResponseSchema, OAuthErrorResponseSchema, OptionalSafeUrlSchema, OAuthClientMetadataSchema, OAuthClientInformationSchema, OAuthClientInformationFullSchema, OAuthClientRegistrationErrorSchema, OAuthTokenRevocationRequestSchema;
-var init_auth_CUe6YdwF = __esm({
-  "node_modules/@modelcontextprotocol/core/dist/auth-CUe6YdwF.mjs"() {
+var init_auth_BNDyLTqp = __esm({
+  "node_modules/@modelcontextprotocol/core/dist/auth-BNDyLTqp.mjs"() {
     "use strict";
     init_v4();
     LATEST_PROTOCOL_VERSION = "2025-11-25";
@@ -9807,7 +9807,8 @@ var init_auth_CUe6YdwF = __esm({
       introspection_endpoint_auth_signing_alg_values_supported: array(string2()).optional(),
       code_challenge_methods_supported: array(string2()).optional(),
       client_id_metadata_document_supported: boolean2().optional(),
-      authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0)
+      authorization_response_iss_parameter_supported: boolean2().optional().catch(void 0),
+      dpop_signing_alg_values_supported: array(string2()).optional()
     });
     OpenIdProviderMetadataSchema = looseObject({
       issuer: string2(),
@@ -9858,7 +9859,8 @@ var init_auth_CUe6YdwF = __esm({
       token_type: string2(),
       expires_in: coerce_exports.number().optional(),
       scope: string2().optional(),
-      refresh_token: string2().optional()
+      refresh_token: string2().optional(),
+      issuer: string2().optional().catch(void 0)
     }).strip();
     IdJagTokenExchangeResponseSchema = object({
       issued_token_type: literal("urn:ietf:params:oauth:token-type:id-jag"),
@@ -9896,7 +9898,8 @@ var init_auth_CUe6YdwF = __esm({
       client_id: string2(),
       client_secret: string2().optional(),
       client_id_issued_at: number2().optional(),
-      client_secret_expires_at: number2().optional()
+      client_secret_expires_at: number2().optional(),
+      issuer: string2().optional().catch(void 0)
     }).strip();
     OAuthClientInformationFullSchema = OAuthClientMetadataSchema.merge(OAuthClientInformationSchema);
     OAuthClientRegistrationErrorSchema = object({
@@ -9914,11 +9917,11 @@ var init_auth_CUe6YdwF = __esm({
 var init_internal = __esm({
   "node_modules/@modelcontextprotocol/core/dist/internal.mjs"() {
     "use strict";
-    init_auth_CUe6YdwF();
+    init_auth_BNDyLTqp();
   }
 });
 
-// node_modules/@modelcontextprotocol/client/dist/src-D_zzAWoS.mjs
+// node_modules/@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs
 function stampErrorBrands(instance, ctor) {
   const brands = /* @__PURE__ */ new Set();
   let current = ctor;
@@ -9949,6 +9952,12 @@ function resourceUrlFromServerUrl(url2) {
   resourceURL.hash = "";
   return resourceURL;
 }
+function withoutIssuer(body) {
+  if (typeof body !== "object" || body === null || Array.isArray(body)) return body;
+  const copy = { ...body };
+  delete copy.issuer;
+  return copy;
+}
 function checkResourceAllowed({ requestedResource, configuredResource }) {
   const requested = typeof requestedResource === "string" ? new URL(requestedResource) : new URL(requestedResource.href);
   const configured = typeof configuredResource === "string" ? new URL(configuredResource) : new URL(configuredResource.href);
@@ -10980,7 +10989,7 @@ function getRequestSchema(method) {
 function getNotificationSchema(method) {
   return hasNotificationMethod2025(method) ? registryMaps().notificationSchemas[method] : void 0;
 }
-function isPlainObject$4(value) {
+function isPlainObject$5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function triState$1(schema, raw) {
@@ -10999,7 +11008,7 @@ function triState$1(schema, raw) {
   };
 }
 function toolNeedsLegacyWrap(t2) {
-  return isPlainObject$4(t2) && isPlainObject$4(t2["outputSchema"]) && isNonObjectJsonSchemaRoot(t2["outputSchema"]);
+  return isPlainObject$5(t2) && isPlainObject$5(t2["outputSchema"]) && isNonObjectJsonSchemaRoot(t2["outputSchema"]);
 }
 function toNeutralResult(value) {
   return value;
@@ -11873,7 +11882,8 @@ function build() {
     ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
     ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
     CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+    DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+    SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
   };
 }
 function buildSchemas2026() {
@@ -11915,7 +11925,7 @@ function fillCacheFields(method, result) {
   delete filled[RESULT_CACHE_HINT_FALLBACK];
   return filled;
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function stampServerInfoMeta(result, serverInfo) {
@@ -11925,7 +11935,7 @@ function stampServerInfoMeta(result, serverInfo) {
     ...result,
     _meta: { [SERVER_INFO_META_KEY]: serverInfo }
   };
-  if (!isPlainObject$3(meta3)) return result;
+  if (!isPlainObject$4(meta3)) return result;
   if (meta3[SERVER_INFO_META_KEY] !== void 0) return result;
   return {
     ...result,
@@ -11999,7 +12009,7 @@ function getResultSchema2026(method) {
 function getNotificationSchema2026(method) {
   return hasNotificationMethod2026(method) ? buildSchemas2026().notificationSchemas2026[method] : void 0;
 }
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function triState(schema, raw) {
@@ -12028,14 +12038,14 @@ function enforceDeletedFields(method, result) {
     return next;
   };
   const tools = result.tools;
-  if (method === "tools/list" && Array.isArray(tools) && tools.some((tool) => isPlainObject$2(tool) && "execution" in tool)) copy().tools = tools.map((tool) => {
-    if (!isPlainObject$2(tool) || !("execution" in tool)) return tool;
+  if (method === "tools/list" && Array.isArray(tools) && tools.some((tool) => isPlainObject$3(tool) && "execution" in tool)) copy().tools = tools.map((tool) => {
+    if (!isPlainObject$3(tool) || !("execution" in tool)) return tool;
     const rest = { ...tool };
     delete rest["execution"];
     return rest;
   });
   const capabilities = result.capabilities;
-  if (isPlainObject$2(capabilities) && "tasks" in capabilities) {
+  if (isPlainObject$3(capabilities) && "tasks" in capabilities) {
     const rest = { ...capabilities };
     delete rest["tasks"];
     copy().capabilities = rest;
@@ -12071,6 +12081,9 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
   return ALL_CODECS.some((codec2) => codec2.hasNotificationMethod(method));
 }
+function isExtensionReusedRequestMethod(method) {
+  return method === "tasks/get" || method === "tasks/cancel";
+}
 function scanXMcpHeaderDeclarations(inputSchema) {
   const declarations = [];
   const seenLower = /* @__PURE__ */ new Map();
@@ -12169,6 +12182,18 @@ function buildMcpParamHeaders(declarations, args) {
   }
   return out;
 }
+function mcpNameSource(method, params) {
+  const field = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
+  if (field === void 0) return;
+  const raw = isPlainObject$2(params) ? params[field] : void 0;
+  return {
+    field,
+    value: typeof raw === "string" ? raw : void 0
+  };
+}
+function isPlainObject$2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function parseSchema(schema, data) {
   return safeParse2(schema, data);
 }
@@ -12649,7 +12674,8 @@ function manualInputRequiredValue(decoded) {
   return {
     resultType: "input_required",
     inputRequests: decoded.inputRequests,
-    ...decoded.requestState !== void 0 && { requestState: decoded.requestState }
+    ...decoded.requestState !== void 0 && { requestState: decoded.requestState },
+    ...decoded._meta !== void 0 && { _meta: decoded._meta }
   };
 }
 function mediaTypeEssence(header) {
@@ -12687,9 +12713,61 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
     });
   };
 }
-var BRANDS, OAuthErrorCode, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, isInitializeRequest, isInitializedNotification, MCP_PARAM_HEADER_PREFIX, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, BASE64_SENTINEL_PREFIX, BASE64_SENTINEL_SUFFIX, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, DEFAULT_INPUT_REQUIRED_AUTO_FULFILL, DEFAULT_INPUT_REQUIRED_MAX_ROUNDS, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, InMemoryTransport;
-var init_src_D_zzAWoS = __esm({
-  "node_modules/@modelcontextprotocol/client/dist/src-D_zzAWoS.mjs"() {
+function isWithinOrigin(from, to) {
+  if (from.protocol === to.protocol && from.host === to.host) return true;
+  return from.protocol === "http:" && to.protocol === "https:" && from.hostname === to.hostname && !from.port && !to.port;
+}
+function redirectTarget(url2, response) {
+  const location = REDIRECT_STATUSES.has(response.status) ? response.headers?.get("location") : void 0;
+  if (!location) return void 0;
+  try {
+    return new URL(location, url2);
+  } catch {
+    return;
+  }
+}
+function fetchLeavingRedirects(baseFetch) {
+  const copy = (url2, init) => baseFetch(url2, init);
+  leftToFetch.add(copy);
+  return copy;
+}
+function fetchWithinOrigin(baseFetch) {
+  if (leftToFetch.has(baseFetch)) return baseFetch;
+  return async (url2, init) => {
+    if (init?.redirect === "error" || init?.redirect === "manual") return baseFetch(url2, init);
+    const method = (init?.method ?? "GET").toUpperCase();
+    let current = url2;
+    for (let followed = 0; ; followed++) {
+      const response = await baseFetch(current, {
+        ...init,
+        redirect: "manual"
+      });
+      const target = redirectTarget(current, response);
+      if (!target || followed === MAX_REDIRECTS) return response;
+      const from = new URL(current);
+      const keepsMethod = method === "GET" || response.status === 307 || response.status === 308;
+      const keepsUserinfo = !(target.username || target.password) || target.username === from.username && target.password === from.password;
+      if (!keepsMethod || !keepsUserinfo || !isWithinOrigin(from, target)) return response;
+      await response.text?.().catch(() => {
+      });
+      current = target;
+    }
+  };
+}
+function unfollowedRedirect(url2, response) {
+  if (response.type === "opaqueredirect") return "Redirect not followed: this runtime does not expose where it points";
+  const target = redirectTarget(response.url || url2, response);
+  if (!target) return void 0;
+  target.username = target.password = target.search = target.hash = "";
+  if (target.protocol === "http:" && new URL(response.url || url2).protocol === "https:") {
+    target.protocol = "https:";
+    return `Redirect from https to plain http not followed; try ${target.href} as the endpoint`;
+  }
+  return `Redirect to ${target.href} not followed; use that URL as the endpoint if it is the intended server`;
+}
+var BRANDS, OAuthErrorCode, OAuthError, SdkErrorCode, SdkError, SdkHttpError, FIRST_MODERN_PROTOCOL_VERSION, SUPPORTED_MODERN_PROTOCOL_VERSIONS, TOOL_RESULT_FOREIGN_FAMILY_KEYS, memo$1, REF_REWRITE_DATA_POSITION_KEYS, REF_REWRITE_NAME_MAP_KEYS, requestMethodKeys$1, notificationMethodKeys$1, resultMethodKeys, maps$1, rev2025RequestMethods, rev2025NotificationMethods, NOT_IN_ERA$1, rev2025Codec, memo, CACHEABLE_RESULT_METHODS, RESULT_CACHE_HINT_FALLBACK, ProtocolErrorCode, ProtocolError, ResourceNotFoundError, UrlElicitationRequiredError, UnsupportedProtocolVersionError, MissingRequiredClientCapabilityError, DEFAULT_CACHE_TTL_MS, DEFAULT_CACHE_SCOPE, EXTENDED_RESULT_TYPE_METHODS, INPUT_REQUEST_METHODS_2026, maps, requestMethodKeys, notificationMethodKeys, rev2026RequestMethods, rev2026NotificationMethods, NOT_IN_ERA, REQUIRED_ENVELOPE_KEYS, rev2026Codec, wireResultSchemasMemo, MODERN_WIRE_REVISION, ALL_CODECS, schemas_exports3, isJSONRPCRequest, isJSONRPCNotification, isJSONRPCResultResponse, isJSONRPCErrorResponse, isInputRequiredResult, isInitializeRequest, isInitializedNotification, MCP_PARAM_HEADER_PREFIX, X_MCP_HEADER_KEY, RFC9110_TOKEN, PERMITTED_X_MCP_HEADER_TYPES, NON_REACHABLE_SUBSCHEMA_KEYWORDS, OBJECT_VALUED_SUBSCHEMA_KEYWORDS, BASE64_SENTINEL_PREFIX, BASE64_SENTINEL_SUFFIX, HEADER_MISMATCH_ERROR_CODE, INBOUND_VALIDATION_LADDER, LADDER_ERROR_HTTP_STATUS, MCP_NAME_HEADER_SOURCE, warnedZodFallback, JSON_SCHEMA_CONVERSION_TARGET, DATETIME_FRACTION_DIGITS, ANNOTATION_ONLY_JSON_SCHEMA_KEYWORDS, ROOT_KEYS, PROPERTY_KEYS_BY_TYPE, SUPPORTED_STRING_FORMATS, inputRequired, DEFAULT_INPUT_REQUIRED_AUTO_FULFILL, DEFAULT_INPUT_REQUIRED_MAX_ROUNDS, REQUEST_STATE_ONLY_LEG_PACING_MS, SPEC_SCHEMA_KEYS, authSchemas, _specTypeSchemas, _isSpecType, specTypeSchemas, isSpecType, DEFAULT_REQUEST_TIMEOUT_MSEC, RESERVED_ENVELOPE_META_KEYS, RETRY_PARAMS_KEYS, NO_REQUEST_STATE, writeNegotiatedProtocolVersion, Protocol, require_content_type, import_content_type, STDIO_DEFAULT_MAX_BUFFER_SIZE, ReadBuffer, REDIRECT_STATUSES, MAX_REDIRECTS, leftToFetch, InMemoryTransport;
+var init_src_WCy6ifGf = __esm({
+  "node_modules/@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs"() {
     "use strict";
     init_chunk_Br0eD_fh();
     init_dialects_BOhdv1Fc();
@@ -12715,6 +12793,8 @@ var init_src_D_zzAWoS = __esm({
       OAuthErrorCode$1["InvalidRedirectUri"] = "invalid_redirect_uri";
       OAuthErrorCode$1["InsufficientScope"] = "insufficient_scope";
       OAuthErrorCode$1["InvalidTarget"] = "invalid_target";
+      OAuthErrorCode$1["InvalidDpopProof"] = "invalid_dpop_proof";
+      OAuthErrorCode$1["UseDpopNonce"] = "use_dpop_nonce";
       return OAuthErrorCode$1;
     })({});
     OAuthError = class OAuthError2 extends Error {
@@ -12804,8 +12884,18 @@ var init_src_D_zzAWoS = __esm({
         if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
         return brandedHasInstance(this, value);
       }
-      constructor(code, message, data) {
-        super(message);
+      /**
+      * @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+      * @param message - Human-readable description.
+      * @param data - Optional structured payload (for example the HTTP status carried by
+      * {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+      * promoted to `Error.cause`.
+      * @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+      * failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+      * loggers and error trackers walk.
+      */
+      constructor(code, message, data, options) {
+        super(message, options);
         this.code = code;
         this.data = data;
         this.name = "SdkError";
@@ -12816,8 +12906,11 @@ var init_src_D_zzAWoS = __esm({
       static {
         Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
       }
-      constructor(code, message, data) {
-        super(code, message, data);
+      /**
+      * @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+      */
+      constructor(code, message, data, options) {
+        super(code, message, data, options);
         this.name = "SdkHttpError";
       }
       get status() {
@@ -12936,7 +13029,7 @@ var init_src_D_zzAWoS = __esm({
         };
       },
       decodeResult(_method, raw) {
-        if (isPlainObject$4(raw) && "resultType" in raw) {
+        if (isPlainObject$5(raw) && "resultType" in raw) {
           const stripped = { ...raw };
           delete stripped["resultType"];
           return {
@@ -13177,7 +13270,7 @@ var init_src_D_zzAWoS = __esm({
       projectCallToolResult: (result) => appendTextFallbackForNonObject(result),
       inputRequestSchema: getInputRequestSchema2026,
       decodeResult(method, raw) {
-        if (!isPlainObject$2(raw)) return {
+        if (!isPlainObject$3(raw)) return {
           kind: "invalid",
           error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: not an object`, { method })
         };
@@ -13198,8 +13291,10 @@ var init_src_D_zzAWoS = __esm({
         };
         if (rawResultType === "input_required") {
           const rawInputRequests = raw["inputRequests"];
-          const inputRequests = isPlainObject$2(rawInputRequests) ? rawInputRequests : {};
+          const inputRequests = isPlainObject$3(rawInputRequests) ? rawInputRequests : {};
           const requestState = raw["requestState"];
+          const metaParse = raw["_meta"] === void 0 ? void 0 : buildSchemas2026().ResultMetaSchema.safeParse(raw["_meta"]);
+          const meta3 = metaParse?.success ? metaParse.data : void 0;
           if (Object.keys(inputRequests).length === 0 && typeof requestState !== "string") return {
             kind: "invalid",
             error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`, {
@@ -13210,7 +13305,8 @@ var init_src_D_zzAWoS = __esm({
           return {
             kind: "input_required",
             inputRequests,
-            ...typeof requestState === "string" && { requestState }
+            ...typeof requestState === "string" && { requestState },
+            ...meta3 !== void 0 && { _meta: meta3 }
           };
         }
         if (rawResultType !== "complete") return {
@@ -13520,7 +13616,7 @@ var init_src_D_zzAWoS = __esm({
         evaluatedAt: "pre-dispatch",
         codes: [HEADER_MISMATCH_ERROR_CODE],
         conformance: ["http-header-validation"],
-        rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
+        rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half \u2014 including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."
       },
       {
         rung: "client-capabilities",
@@ -13547,6 +13643,14 @@ var init_src_D_zzAWoS = __esm({
       [ProtocolErrorCode.MissingRequiredClientCapability]: 400,
       [HEADER_MISMATCH_ERROR_CODE]: 400
     };
+    MCP_NAME_HEADER_SOURCE = {
+      "tools/call": "name",
+      "prompts/get": "name",
+      "resources/read": "uri",
+      "tasks/get": "taskId",
+      "tasks/update": "taskId",
+      "tasks/cancel": "taskId"
+    };
     warnedZodFallback = false;
     JSON_SCHEMA_CONVERSION_TARGET = "draft-2020-12";
     DATETIME_FRACTION_DIGITS = /\\\.\\d\{(\d+)\}/;
@@ -13802,6 +13906,8 @@ var init_src_D_zzAWoS = __esm({
       _transport;
       _requestMessageId = 0;
       _requestHandlers = /* @__PURE__ */ new Map();
+      /** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+      _customSchemaRequestMethods = /* @__PURE__ */ new Set();
       _requestHandlerAbortControllers = /* @__PURE__ */ new Map();
       _notificationHandlers = /* @__PURE__ */ new Map();
       _responseHandlers = /* @__PURE__ */ new Map();
@@ -13938,7 +14044,7 @@ var init_src_D_zzAWoS = __esm({
         return this._requestHandlers.get(method);
       }
       async _oncancel(notification) {
-        if (!notification.params.requestId) return;
+        if (notification.params.requestId === void 0) return;
         this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
       }
       _setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -14085,7 +14191,7 @@ var init_src_D_zzAWoS = __esm({
             return;
           }
         }
-        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method)) {
+        if (isSpecRequestMethod(request.method) && !codec2.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
           sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
           return;
         }
@@ -14218,8 +14324,11 @@ var init_src_D_zzAWoS = __esm({
       }
       request(request, schemaOrOptions, maybeOptions) {
         const codec2 = this._resolveOutboundCodec(request.method);
+        if (isStandardSchema(schemaOrOptions)) {
+          if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec2, request.method);
+          return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
+        }
         this._assertOutboundRequestInEra(codec2, request.method);
-        if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec2, request, schemaOrOptions, maybeOptions);
         const validate2 = codecResultValidator(codec2, request.method);
         if (validate2 === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
         return this._requestWithSchemaViaCodec(codec2, request, validate2, schemaOrOptions);
@@ -14337,19 +14446,20 @@ var init_src_D_zzAWoS = __esm({
           const cancel = (reason) => {
             if (responseReceived) return;
             this._progressHandlers.delete(messageId);
-            if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-              jsonrpc: "2.0",
-              method: "notifications/cancelled",
-              params: {
-                requestId: messageId,
-                reason: String(reason)
-              }
-            }), {
-              relatedRequestId,
-              resumptionToken,
-              onresumptiontoken
-            }).catch((error2) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error2}`)));
-            else requestAbort.abort();
+            if (requestAbort === void 0) {
+              if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+                jsonrpc: "2.0",
+                method: "notifications/cancelled",
+                params: {
+                  requestId: messageId,
+                  reason: String(reason)
+                }
+              }), {
+                relatedRequestId,
+                resumptionToken,
+                onresumptiontoken
+              }).catch((error2) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error2}`)));
+            } else requestAbort.abort();
             reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
           };
           this._responseHandlers.set(messageId, (response) => {
@@ -14411,7 +14521,7 @@ var init_src_D_zzAWoS = __esm({
       * Emits a notification, which is a one-way message that does not expect a response.
       */
       async notification(notification, options) {
-        return this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
+        return await this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
       }
       /**
       * The notification funnel proper, keyed by the resolved era codec —
@@ -14429,7 +14539,7 @@ var init_src_D_zzAWoS = __esm({
           jsonrpc: "2.0",
           ...notification
         });
-        if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+        if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
           if (this._pendingDebouncedNotifications.has(notification.method)) return;
           this._pendingDebouncedNotifications.add(notification.method);
           Promise.resolve().then(() => {
@@ -14462,6 +14572,8 @@ var init_src_D_zzAWoS = __esm({
           return maybeHandler(parsed.data, ctx);
         };
         else throw new TypeError("setRequestHandler: handler is required");
+        if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+        else this._customSchemaRequestMethods.add(method);
         this._requestHandlers.set(method, this._wrapHandler(method, stored));
       }
       /**
@@ -14491,6 +14603,7 @@ var init_src_D_zzAWoS = __esm({
       */
       removeRequestHandler(method) {
         this._requestHandlers.delete(method);
+        this._customSchemaRequestMethods.delete(method);
       }
       /**
       * Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -14604,6 +14717,15 @@ var init_src_D_zzAWoS = __esm({
         this._buffer = void 0;
       }
     };
+    REDIRECT_STATUSES = /* @__PURE__ */ new Set([
+      301,
+      302,
+      303,
+      307,
+      308
+    ]);
+    MAX_REDIRECTS = 5;
+    leftToFetch = /* @__PURE__ */ new WeakSet();
     InMemoryTransport = class InMemoryTransport2 {
       _otherTransport;
       _messageQueue = [];
@@ -22216,10 +22338,13 @@ var init_stream = __esm({
 
 // node_modules/@modelcontextprotocol/client/dist/index.mjs
 function discardIfIssuerMismatch(stored, issuer, opts) {
-  if (stored === void 0) return void 0;
-  if (stored.issuer === void 0) {
+  if (!stored) return void 0;
+  if (typeof stored.issuer !== "string") {
     if (opts?.canPersistStamp !== false) console.warn("[mcp-sdk] SEP-2352: stored OAuth credential has no 'issuer' stamp (pre-upgrade storage or provider not round-tripping the value). SEP-2352 isolation is inactive for this read; ensure your provider round-trips the issuer field.");
-    return stored;
+    return stored.issuer === void 0 ? stored : {
+      ...stored,
+      issuer: void 0
+    };
   }
   return issuersMatch(stored.issuer, issuer) ? stored : void 0;
 }
@@ -22346,7 +22471,7 @@ function applyPublicAuth(clientId, params) {
   params.set("client_id", clientId);
 }
 function isLoopbackHost(hostname3) {
-  return hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "[::1]" || hostname3 === "::1";
+  return hostname3 === "localhost" || hostname3.endsWith(".localhost") || hostname3 === "127.0.0.1" || hostname3 === "[::1]" || hostname3 === "::1";
 }
 function assertSecureTokenEndpoint(tokenEndpoint) {
   const url2 = new URL(String(tokenEndpoint));
@@ -22385,16 +22510,22 @@ async function parseErrorResponse(input) {
     return new OAuthError(OAuthErrorCode.ServerError, errorMessage);
   }
 }
+function warnCredentialInvalidation(provider, error2, invalidated) {
+  const action = provider.invalidateCredentials === void 0 ? `retrying authorization without discarding the stored ${invalidated} (provider implements no invalidateCredentials())` : `invalidating the stored ${invalidated} and retrying authorization`;
+  console.warn(`[mcp-sdk] OAuth ${JSON.stringify(error2.code)} \u2014 ${action}. Cause: ${JSON.stringify(error2.message)}`);
+}
 async function auth(provider, options) {
   try {
     return await authInternal(provider, options);
   } catch (error2) {
     if (error2 instanceof OAuthError) {
       if (error2.code === OAuthErrorCode.InvalidClient || error2.code === OAuthErrorCode.UnauthorizedClient) {
+        warnCredentialInvalidation(provider, error2, "client credentials and tokens");
         await provider.invalidateCredentials?.("client");
         await provider.invalidateCredentials?.("tokens");
         return await authInternal(provider, options);
-      } else if (error2.code === OAuthErrorCode.InvalidGrant) {
+      } else if (error2.code === OAuthErrorCode.InvalidGrant || error2.code === OAuthErrorCode.InvalidDpopProof) {
+        warnCredentialInvalidation(provider, error2, "tokens");
         await provider.invalidateCredentials?.("tokens");
         return await authInternal(provider, options);
       }
@@ -22462,8 +22593,9 @@ async function authInternal(provider, { serverUrl, authorizationCode, iss, scope
     } else if (!issuersMatch(recordedIssuer, issuer)) throw new AuthorizationServerMismatchError(recordedIssuer, issuer);
   }
   if (freshDiscoveryState) await provider.saveDiscoveryState?.(freshDiscoveryState);
-  const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
-  if (resource) await provider.saveResourceUrl?.(String(resource));
+  const selectedResource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+  const resource = selectedResource && resourceMetadata && !provider.validateResourceURL ? resourceMetadata.resource : selectedResource;
+  if (resource) await provider.saveResourceUrl?.(resourceIndicatorToString(resource));
   const resolvedScope = determineScope({
     requestedScope: scope,
     resourceMetadata,
@@ -22534,24 +22666,30 @@ async function authInternal(provider, { serverUrl, authorizationCode, iss, scope
     };
     await provider.saveTokens(tokens, infoCtx);
   }
-  if (tokens?.refresh_token && !forceReauthorization) try {
-    const newTokens = await refreshAuthorization(authorizationServerUrl, {
-      metadata,
-      clientInformation,
-      refreshToken: tokens.refresh_token,
-      resource,
-      addClientAuthentication: provider.addClientAuthentication,
-      fetchFn
-    });
-    await provider.saveTokens({
-      ...newTokens,
-      issuer
-    }, infoCtx);
-    return "AUTHORIZED";
-  } catch (error2) {
-    if (error2 instanceof InsecureTokenEndpointError) throw error2;
-    if (!(error2 instanceof OAuthError) || error2.code === OAuthErrorCode.ServerError) {
-    } else throw error2;
+  if (tokens?.refresh_token && !forceReauthorization) {
+    let newTokens;
+    try {
+      newTokens = await refreshAuthorization(authorizationServerUrl, {
+        metadata,
+        clientInformation,
+        refreshToken: tokens.refresh_token,
+        resource,
+        addClientAuthentication: provider.addClientAuthentication,
+        dpop: await provider.dpop?.(),
+        fetchFn
+      });
+    } catch (error2) {
+      if (error2 instanceof InsecureTokenEndpointError) throw error2;
+      if (!(error2 instanceof OAuthError) || error2.code === OAuthErrorCode.ServerError) console.warn(`[mcp-sdk] Could not refresh OAuth tokens; falling back to a new authorization request. Cause: ${JSON.stringify(error2 instanceof Error ? error2.message : String(error2))}`);
+      else throw error2;
+    }
+    if (newTokens) {
+      await provider.saveTokens({
+        ...newTokens,
+        issuer
+      }, infoCtx);
+      return "AUTHORIZED";
+    }
   }
   const state = provider.state ? await provider.state() : void 0;
   const { authorizationUrl, codeVerifier } = await startAuthorization(authorizationServerUrl, {
@@ -22592,7 +22730,7 @@ function extractWWWAuthenticateParams(res) {
   const authenticateHeader = res.headers.get("WWW-Authenticate");
   if (!authenticateHeader) return {};
   const [type, scheme] = authenticateHeader.split(" ");
-  if (type?.toLowerCase() !== "bearer" || !scheme) return {};
+  if (!type || !RECOGNIZED_CHALLENGE_SCHEMES.has(type.toLowerCase()) || !scheme) return {};
   const resourceMetadataMatch = extractFieldFromWwwAuth(res, "resource_metadata") || void 0;
   let resourceMetadataUrl;
   if (resourceMetadataMatch) try {
@@ -22638,12 +22776,13 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
   return OAuthProtectedResourceMetadataSchema.parse(await response.json());
 }
 async function fetchWithCorsRetry(url2, headers, fetchFn = fetch) {
+  const withinOrigin = fetchWithinOrigin(fetchFn);
   try {
-    return await fetchFn(url2, { headers });
+    return await withinOrigin(url2, { headers });
   } catch (error2) {
     if (!(error2 instanceof TypeError) || !CORS_IS_POSSIBLE) throw error2;
     if (headers) try {
-      return await fetchFn(url2, {});
+      return await withinOrigin(url2, {});
     } catch (retryError) {
       if (!(retryError instanceof TypeError)) throw retryError;
       return;
@@ -22661,7 +22800,7 @@ async function tryMetadataDiscovery(url2, protocolVersion, fetchFn = fetch) {
 function shouldAttemptFallback(response, pathname) {
   if (!response) return true;
   if (pathname === "/") return false;
-  return response.status >= 400 && response.status < 500 || response.status === 502;
+  return !response.ok && response.status < 500 || response.status === 502;
 }
 async function discoverMetadataWithFallback(serverUrl, wellKnownType, fetchFn, opts) {
   const issuer = new URL(serverUrl);
@@ -22718,7 +22857,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
     if (!response.ok) {
       await response.text?.().catch(() => {
       });
-      if (response.status >= 400 && response.status < 500 || response.status === 502) continue;
+      if (response.status < 500 || response.status === 502) continue;
       throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
     }
     const parsed = type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
@@ -22749,6 +22888,9 @@ async function discoverOAuthServerInfo(serverUrl, opts) {
     resourceMetadata
   };
 }
+function resourceIndicatorToString(resource) {
+  return typeof resource === "string" ? resource : resource.href;
+}
 async function startAuthorization(authorizationServerUrl, { metadata, clientInformation, redirectUrl, scope, state, resource }) {
   let authorizationUrl;
   if (metadata) {
@@ -22767,7 +22909,7 @@ async function startAuthorization(authorizationServerUrl, { metadata, clientInfo
   if (state) authorizationUrl.searchParams.set("state", state);
   if (scope) authorizationUrl.searchParams.set("scope", scope);
   if (scope?.split(" ").includes("offline_access")) authorizationUrl.searchParams.append("prompt", "consent");
-  if (resource) authorizationUrl.searchParams.set("resource", resource.href);
+  if (resource) authorizationUrl.searchParams.set("resource", resourceIndicatorToString(resource));
   return {
     authorizationUrl,
     codeVerifier
@@ -22781,30 +22923,46 @@ function prepareAuthorizationCodeRequest(authorizationCode, codeVerifier, redire
     redirect_uri: String(redirectUri)
   });
 }
-async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, fetchFn }) {
+async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequestParams, clientInformation, addClientAuthentication, resource, dpop, fetchFn }) {
   const tokenUrl = assertSecureTokenEndpoint(metadata?.token_endpoint ?? new URL("/token", authorizationServerUrl));
   const headers = new Headers({
     "Content-Type": "application/x-www-form-urlencoded",
     Accept: "application/json"
   });
-  if (resource) tokenRequestParams.set("resource", resource.href);
-  if (addClientAuthentication) await addClientAuthentication(headers, tokenRequestParams, tokenUrl, metadata);
-  else if (clientInformation) applyClientAuthentication(selectClientAuthMethod(clientInformation, metadata?.token_endpoint_auth_methods_supported ?? []), clientInformation, headers, tokenRequestParams);
-  const response = await (fetchFn ?? fetch)(tokenUrl, {
-    method: "POST",
-    headers,
-    body: tokenRequestParams
-  });
+  if (resource) tokenRequestParams.set("resource", resourceIndicatorToString(resource));
+  if (!addClientAuthentication && clientInformation) applyClientAuthentication(selectClientAuthMethod(clientInformation, metadata?.token_endpoint_auth_methods_supported ?? []), clientInformation, headers, tokenRequestParams);
+  const requestOnce = async () => {
+    const requestHeaders = new Headers(headers);
+    if (addClientAuthentication) await addClientAuthentication(requestHeaders, tokenRequestParams, tokenUrl, metadata);
+    if (dpop) requestHeaders.set("DPoP", await dpop.buildProof({
+      htm: "POST",
+      htu: tokenUrl
+    }));
+    return fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
+      method: "POST",
+      headers: requestHeaders,
+      body: tokenRequestParams
+    });
+  };
+  let response = await requestOnce();
+  if (dpop && response.status === 400) {
+    if ((await response.clone().json().catch(() => {
+    }))?.error === OAuthErrorCode.UseDpopNonce) {
+      dpop.observeNonce(response, tokenUrl);
+      response = await requestOnce();
+    }
+  }
+  dpop?.observeNonce(response, tokenUrl);
   if (!response.ok) throw await parseErrorResponse(response);
   const json2 = await response.json();
   try {
-    return OAuthTokensSchema.parse(json2);
+    return OAuthTokensSchema.parse(withoutIssuer(json2));
   } catch (parseError) {
     if (typeof json2 === "object" && json2 !== null && "error" in json2) throw await parseErrorResponse(JSON.stringify(json2));
     throw parseError;
   }
 }
-async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, fetchFn }) {
+async function refreshAuthorization(authorizationServerUrl, { metadata, clientInformation, refreshToken, resource, addClientAuthentication, dpop, fetchFn }) {
   return {
     refresh_token: refreshToken,
     ...await executeTokenRequest(authorizationServerUrl, {
@@ -22816,6 +22974,7 @@ async function refreshAuthorization(authorizationServerUrl, { metadata, clientIn
       clientInformation,
       addClientAuthentication,
       resource,
+      dpop,
       fetchFn
     })
   };
@@ -22826,6 +22985,14 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     expectedIssuer: metadata?.issuer,
     issParameterSupported: isIssParameterSupported(metadata)
   });
+  const issuer = metadata?.issuer ?? String(authorizationServerUrl);
+  const readClientInformation = async () => {
+    const rawClientInfo = await provider.clientInformation({ issuer });
+    const checked = discardIfIssuerMismatch(rawClientInfo, issuer, { canPersistStamp: false });
+    if (rawClientInfo && checked === void 0) throw new AuthorizationServerMismatchError(String(rawClientInfo.issuer), issuer);
+    return checked;
+  };
+  let clientInformation = await readClientInformation();
   const effectiveScope = scope ?? provider.clientMetadata.scope;
   let tokenRequestParams;
   if (provider.prepareTokenRequest) tokenRequestParams = await provider.prepareTokenRequest(effectiveScope);
@@ -22834,13 +23001,14 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
     if (!provider.redirectUrl) throw new Error("redirectUrl is required for authorization_code flow");
     tokenRequestParams = prepareAuthorizationCodeRequest(authorizationCode, await provider.codeVerifier(), provider.redirectUrl);
   }
-  const clientInformation = await provider.clientInformation({ issuer: metadata?.issuer ?? String(authorizationServerUrl) });
+  clientInformation ??= await readClientInformation();
   return executeTokenRequest(authorizationServerUrl, {
     metadata,
     tokenRequestParams,
-    clientInformation: clientInformation ?? void 0,
+    clientInformation,
     addClientAuthentication: provider.addClientAuthentication,
     resource,
+    dpop: await provider.dpop?.(),
     fetchFn
   });
 }
@@ -22854,7 +23022,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     ...clientMetadata,
     ...scope === void 0 ? {} : { scope }
   };
-  const response = await (fetchFn ?? fetch)(registrationUrl, {
+  const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify(submittedMetadata)
@@ -22864,7 +23032,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
     body: await response.text(),
     submittedMetadata
   });
-  return OAuthClientInformationFullSchema.parse(await response.json());
+  return OAuthClientInformationFullSchema.parse(withoutIssuer(await response.json()));
 }
 function keyOf(key) {
   return `${key.method}\0${JSON.stringify([key.partition ?? "", key.params ?? ""])}`;
@@ -22905,6 +23073,11 @@ function classifyProbeOutcome(outcome, context) {
       return classifyHttpError(outcome, context);
     case "network-error":
       return classifyNetworkError(outcome.error, context);
+    case "unusable-reply":
+      return {
+        kind: "error",
+        error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: the server answered with an unusable reply (${describeError(outcome.error)})`, { cause: outcome.error }, { cause: outcome.error })
+      };
     case "auth-required":
       return {
         kind: "error",
@@ -22996,7 +23169,7 @@ function classifyNetworkError(error2, context) {
   if (context.environment === "browser" && isOpaqueFetchTypeError(error2)) return { kind: "legacy" };
   return {
     kind: "error",
-    error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error2)}`, { cause: error2 })
+    error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error2)}`, { cause: error2 }, { cause: error2 })
   };
 }
 function isOpaqueFetchTypeError(error2) {
@@ -23079,6 +23252,10 @@ function buildProbeRequest(id, protocolVersion, clientInfo, capabilities) {
     }) }
   };
 }
+function isUnusableReplyError(error2) {
+  if (error2 instanceof SdkError && error2.code === SdkErrorCode.ClientHttpUnexpectedContent) return true;
+  return error2 instanceof Error && error2.name === "SyntaxError";
+}
 function normalizeReply(reply, timeoutMs) {
   switch (reply.kind) {
     case "response":
@@ -23104,6 +23281,10 @@ function normalizeReply(reply, timeoutMs) {
           statusText: error2.data.statusText
         };
       }
+      if (isUnusableReplyError(error2)) return {
+        kind: "unusable-reply",
+        error: error2
+      };
       return {
         kind: "network-error",
         error: error2
@@ -23268,6 +23449,14 @@ function validatePrior(prior) {
   }
   throw new SdkError(SdkErrorCode.EraNegotiationFailed, "connect({ prior }): unrecognized prior \u2014 expected { kind: 'modern', discover } or { kind: 'legacy' }");
 }
+function hasDpopChallenge(wwwAuthenticate) {
+  return /(?:^|,)\s*dpop(?:\s|$|,)/i.test(wwwAuthenticate);
+}
+function isDpopNonceChallenge(response) {
+  if (response.status !== 401) return false;
+  const wwwAuthenticate = response.headers.get("www-authenticate") ?? "";
+  return hasDpopChallenge(wwwAuthenticate) && /use_dpop_nonce/i.test(wwwAuthenticate);
+}
 function anySignal(a2, b) {
   if (typeof AbortSignal.any === "function") return AbortSignal.any([a2, b]);
   const controller = new AbortController();
@@ -23289,11 +23478,11 @@ function anySignal(a2, b) {
   b.addEventListener("abort", onB, { once: true });
   return controller.signal;
 }
-var OAuthClientFlowError, IssuerMismatchError, RegistrationRejectedError, InsecureTokenEndpointError, AuthorizationServerMismatchError, InsufficientScopeError, UnauthorizedError, AUTHORIZATION_CODE_RESPONSE_TYPE, AUTHORIZATION_CODE_CHALLENGE_METHOD, CAP_EXEMPT_METHODS, InMemoryResponseCacheStore, MAX_CACHE_TTL_MS, ClientResponseCache, AUTH_SEAM, UNSUPPORTED_PROTOCOL_VERSION, NOT_PROBE_RECOGNIZED, DEFAULT_VERSION_NEGOTIATION_MODE, ProbeWindow, pendingSpentCloseGuards, LIST_CHANGED_EVICTIONS, DEFAULT_LIST_MAX_PAGES, Client, SseError, SSEClientTransport, DEFAULT_MAX_STEP_UP_RETRIES, DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS, RESERVED_REQUEST_HEADER_NAMES, StreamableHTTPClientTransport;
+var OAuthClientFlowError, IssuerMismatchError, RegistrationRejectedError, InsecureTokenEndpointError, AuthorizationServerMismatchError, InsufficientScopeError, UnauthorizedError, AUTHORIZATION_CODE_RESPONSE_TYPE, AUTHORIZATION_CODE_CHALLENGE_METHOD, RECOGNIZED_CHALLENGE_SCHEMES, CAP_EXEMPT_METHODS, InMemoryResponseCacheStore, MAX_CACHE_TTL_MS, ClientResponseCache, AUTH_SEAM, UNSUPPORTED_PROTOCOL_VERSION, NOT_PROBE_RECOGNIZED, DEFAULT_VERSION_NEGOTIATION_MODE, ProbeWindow, pendingSpentCloseGuards, LIST_CHANGED_EVICTIONS, DEFAULT_LIST_MAX_PAGES, Client, withDpop, withDpopFromProvider, SseError, SSEClientTransport, DEFAULT_MAX_STEP_UP_RETRIES, DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS, RESERVED_REQUEST_HEADER_NAMES, StreamableHTTPClientTransport;
 var init_dist4 = __esm({
   "node_modules/@modelcontextprotocol/client/dist/index.mjs"() {
     "use strict";
-    init_src_D_zzAWoS();
+    init_src_WCy6ifGf();
     init_shimsNode();
     init_index_node();
     init_dist3();
@@ -23365,7 +23554,7 @@ var init_dist4 = __esm({
       /** The token endpoint URL that was rejected. */
       tokenEndpoint;
       constructor(tokenEndpoint) {
-        super(`Refusing to send credentials to non-https token endpoint '${tokenEndpoint}'. OAuth token requests MUST use TLS (localhost / 127.0.0.1 / ::1 are exempt).`);
+        super(`Refusing to send credentials to non-https token endpoint '${tokenEndpoint}'. OAuth token requests MUST use TLS (localhost / *.localhost / 127.0.0.1 / ::1 are exempt).`);
         this.tokenEndpoint = tokenEndpoint;
       }
     };
@@ -23374,7 +23563,7 @@ var init_dist4 = __esm({
         Object.defineProperty(this, "mcpBrand", { value: "mcp.AuthorizationServerMismatchError" });
       }
       constructor(recordedIssuer, currentIssuer) {
-        super(`Authorization server changed between redirect and callback (redirected to ${JSON.stringify(recordedIssuer)}, callback resolved ${JSON.stringify(currentIssuer)}); refusing to send authorization_code/code_verifier to a different token endpoint`);
+        super(`Authorization server mismatch: credentials are bound to ${JSON.stringify(recordedIssuer)} but this call resolved ${JSON.stringify(currentIssuer)}; refusing to present them to a different authorization server`);
         this.recordedIssuer = recordedIssuer;
         this.currentIssuer = currentIssuer;
       }
@@ -23424,6 +23613,7 @@ var init_dist4 = __esm({
     };
     AUTHORIZATION_CODE_RESPONSE_TYPE = "code";
     AUTHORIZATION_CODE_CHALLENGE_METHOD = "S256";
+    RECOGNIZED_CHALLENGE_SCHEMES = /* @__PURE__ */ new Set(["bearer", "dpop"]);
     CAP_EXEMPT_METHODS = /* @__PURE__ */ new Set([
       "tools/list",
       "prompts/list",
@@ -24640,7 +24830,7 @@ var init_dist4 = __esm({
         }, options);
         const hit = await this._serveFromCache("prompts/list", void 0, options);
         if (hit !== void 0) return hit;
-        return this._listAllPages("prompts/list", params, options, (acc, page) => acc.prompts.push(...page.prompts));
+        return this._listAllPages("prompts/list", params, options, (r2) => r2.prompts);
       }
       /**
       * Lists available resources.
@@ -24679,7 +24869,7 @@ var init_dist4 = __esm({
         }, options);
         const hit = await this._serveFromCache("resources/list", void 0, options);
         if (hit !== void 0) return hit;
-        return this._listAllPages("resources/list", params, options, (acc, page) => acc.resources.push(...page.resources));
+        return this._listAllPages("resources/list", params, options, (r2) => r2.resources);
       }
       /**
       * Lists available resource URI templates for dynamic resources.
@@ -24704,7 +24894,7 @@ var init_dist4 = __esm({
         }, options);
         const hit = await this._serveFromCache("resources/templates/list", void 0, options);
         if (hit !== void 0) return hit;
-        return this._listAllPages("resources/templates/list", params, options, (acc, page) => acc.resourceTemplates.push(...page.resourceTemplates));
+        return this._listAllPages("resources/templates/list", params, options, (r2) => r2.resourceTemplates);
       }
       /**
       * Walk every page of a paginated list verb, aggregate, and write ONE
@@ -24712,8 +24902,7 @@ var init_dist4 = __esm({
       * methods' no-`cursor` auto-aggregate path. Page 1's result object is
       * mutated in place (its items array is extended; `nextCursor` is
       * cleared); page-1 metadata (`ttlMs`, `cacheScope`, `_meta`) is preserved.
-      * A `nextCursor` that repeats stops the walk (defence against a
-      * non-converging server, mcp.d's `drainList` guard);
+      * A page with the same items and `nextCursor` as the previous page ends the walk;
       * {@linkcode ClientOptions.listMaxPages} is a hard cap — hitting it
       * throws, so a partial aggregate is never cached. The
       * captured-generation guard skips the write when a `list_changed` landed
@@ -24728,7 +24917,7 @@ var init_dist4 = __esm({
       * trace context) supplied to the public `list*()` reaches every wire
       * request the walk issues.
       */
-      async _listAllPages(method, baseParams, options, append, finalize2) {
+      async _listAllPages(method, baseParams, options, items, finalize2) {
         const bypass = options?.cacheMode === "bypass";
         const generation = this._cache.captureGeneration(method);
         const acc = await this.request({
@@ -24736,14 +24925,13 @@ var init_dist4 = __esm({
           ...baseParams && { params: { ...baseParams } }
         }, options);
         let cursor3 = acc.nextCursor;
-        const seen = /* @__PURE__ */ new Set();
+        let previous = acc;
         let pages = 1;
-        while (cursor3 !== void 0 && !seen.has(cursor3)) {
+        while (cursor3 !== void 0) {
           if (this._listMaxPages !== 0 && pages >= this._listMaxPages) throw new SdkError(SdkErrorCode.ListPaginationExceeded, `${method}: exceeded listMaxPages (${this._listMaxPages}); server pagination did not terminate`, {
             method,
             listMaxPages: this._listMaxPages
           });
-          seen.add(cursor3);
           const page = await this.request({
             method,
             params: {
@@ -24751,7 +24939,9 @@ var init_dist4 = __esm({
               cursor: cursor3
             }
           }, options);
-          append(acc, page);
+          if (page.nextCursor === cursor3 && JSON.stringify(items(page)) === JSON.stringify(items(previous))) break;
+          items(acc).push(...items(page));
+          previous = page;
           cursor3 = page.nextCursor;
           pages++;
         }
@@ -25015,19 +25205,22 @@ var init_dist4 = __esm({
             notifications: filter
           }
         };
+        const routeSendFailure = (error2) => {
+          settle({
+            cause: "remote",
+            error: error2 instanceof Error ? error2 : new Error(String(error2))
+          });
+        };
         try {
-          await this.transport.send(jsonrpcRequest, {
+          this.transport.send(jsonrpcRequest, {
             requestSignal: requestAbort.signal,
             onRequestStreamEnd: () => settle({
               cause: "remote",
               error: /* @__PURE__ */ new Error("subscriptions/listen: stream ended")
             })
-          });
+          }).catch(routeSendFailure);
         } catch (error2) {
-          settle({
-            cause: "remote",
-            error: error2 instanceof Error ? error2 : new Error(String(error2))
-          });
+          routeSendFailure(error2);
         }
         return {
           honoredFilter: await opening,
@@ -25279,7 +25472,7 @@ var init_dist4 = __esm({
         }
         const hit = await this._serveFromCache("tools/list", void 0, options);
         if (hit !== void 0) return hit;
-        return this._listAllPages("tools/list", params, options, (acc, page) => acc.tools.push(...page.tools), (acc) => this._excludeInvalidXMcpHeaderTools(acc));
+        return this._listAllPages("tools/list", params, options, (r2) => r2.tools, (acc) => this._excludeInvalidXMcpHeaderTools(acc));
       }
       /**
       * SEP-2243 (protocol revision 2026-07-28): a Streamable HTTP client MUST
@@ -25350,6 +25543,55 @@ var init_dist4 = __esm({
         return this.notification({ method: "notifications/roots/list_changed" });
       }
     };
+    withDpop = (session, getToken) => (next) => {
+      const resolveSession = typeof session === "function" ? session : () => session;
+      return async (input, init) => {
+        const method = (init?.method ?? "GET").toUpperCase();
+        const url2 = new URL(input.toString());
+        const activeSession = await resolveSession();
+        if (!activeSession) return next(input, init);
+        const makeRequest = async () => {
+          const accessToken = await getToken();
+          if (!accessToken) return next(input, init);
+          const headers = new Headers(init?.headers);
+          const proof = await activeSession.buildProof({
+            htm: method,
+            htu: url2,
+            accessToken
+          });
+          headers.set("Authorization", `DPoP ${accessToken}`);
+          headers.set("DPoP", proof);
+          return next(input, {
+            ...init,
+            headers
+          });
+        };
+        let response = await makeRequest();
+        if (isDpopNonceChallenge(response) && response.headers.has("dpop-nonce")) {
+          activeSession.observeNonce(response, url2);
+          await response.text?.().catch(() => {
+          });
+          response = await makeRequest();
+        }
+        activeSession.observeNonce(response, url2);
+        return response;
+      };
+    };
+    withDpopFromProvider = (provider) => withDpop(async () => {
+      try {
+        return await provider.dpop?.();
+      } catch (error2) {
+        throw markAuthSeamEscape(error2);
+      }
+    }, async () => {
+      let tokens;
+      try {
+        tokens = await provider.tokens();
+      } catch (error2) {
+        throw markAuthSeamEscape(error2);
+      }
+      return tokens?.token_type?.toLowerCase() === "dpop" ? tokens.access_token : void 0;
+    });
     SseError = class extends Error {
       static {
         Object.defineProperty(this, "mcpBrand", { value: "mcp.SseError" });
@@ -25391,6 +25633,8 @@ var init_dist4 = __esm({
       _skipIssuerMetadataValidation;
       _fetch;
       _fetchWithInit;
+      _redirectPolicy;
+      _dpop;
       _protocolVersion;
       onclose;
       onerror;
@@ -25402,32 +25646,46 @@ var init_dist4 = __esm({
         this._eventSourceInit = opts?.eventSourceInit;
         this._requestInit = opts?.requestInit;
         this._skipIssuerMetadataValidation = opts?.skipIssuerMetadataValidation;
+        this._fetch = opts?.fetch;
         if (isOAuthClientProvider(opts?.authProvider)) {
           this._oauthProvider = opts.authProvider;
           this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
+          if (opts.authProvider.dpop) {
+            this._dpop = withDpopFromProvider(opts.authProvider);
+            this._fetch = this._dpop(opts.fetch ?? fetch);
+          }
         } else this._authProvider = opts?.authProvider;
-        this._fetch = opts?.fetch;
+        this._redirectPolicy = opts?.redirectPolicy;
         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+        if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
       }
       _last401Response;
+      _connectAuthRetried = false;
+      /** `baseFetch` with redirects handled as `redirectPolicy` says. */
+      _redirects(baseFetch) {
+        return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+      }
+      /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+      _unfollowedRedirect(url2, response) {
+        const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url2, response);
+        return text && `${text} (redirectPolicy: 'same-origin')`;
+      }
       async _commonHeaders() {
-        const headers = {};
+        const headers = new Headers(this._requestInit?.headers || void 0);
         let token;
         try {
           token = await this._authProvider?.token();
         } catch (error2) {
           throw markAuthSeamEscape(error2);
         }
-        if (token) headers["Authorization"] = `Bearer ${token}`;
-        if (this._protocolVersion) headers["mcp-protocol-version"] = this._protocolVersion;
-        const extraHeaders = normalizeHeaders(this._requestInit?.headers);
-        return new Headers({
-          ...headers,
-          ...extraHeaders
-        });
+        if (token) headers.set("Authorization", `Bearer ${token}`);
+        if (this._protocolVersion) headers.set("mcp-protocol-version", this._protocolVersion);
+        return headers;
       }
       _startOrAuth() {
-        const fetchImpl = this?._eventSourceInit?.fetch ?? this._fetch ?? fetch;
+        const eventSourceFetch = this._eventSourceInit?.fetch;
+        const fetchImpl = this._redirects(eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch);
+        let redirect;
         return new Promise((resolve5, reject) => {
           this._eventSource = new EventSource(this._url.href, {
             ...this._eventSourceInit,
@@ -25438,6 +25696,7 @@ var init_dist4 = __esm({
                 ...init,
                 headers
               });
+              redirect = this._unfollowedRedirect(url2, response);
               if (response.status === 401) {
                 this._last401Response = response;
                 if (response.headers.has("www-authenticate")) {
@@ -25452,31 +25711,41 @@ var init_dist4 = __esm({
           this._abortController = new AbortController();
           this._eventSource.onerror = (event) => {
             if (event.code === 401 && this._authProvider) {
-              if (this._authProvider.onUnauthorized && this._last401Response) {
+              if (this._authProvider.onUnauthorized && this._last401Response && !this._connectAuthRetried) {
                 const response = this._last401Response;
                 this._last401Response = void 0;
+                this._connectAuthRetried = true;
                 this._eventSource?.close();
                 this._authProvider.onUnauthorized({
                   response,
                   serverUrl: this._url,
                   fetchFn: this._fetchWithInit
                 }).then(() => this._startOrAuth().then(resolve5, reject), (error$2) => {
+                  this._connectAuthRetried = false;
                   markAuthSeamEscape(error$2);
                   this.onerror?.(error$2);
                   reject(error$2);
                 });
                 return;
               }
-              const error$1 = markAuthSeamEscape(new UnauthorizedError());
+              const retried = this._connectAuthRetried;
+              this._connectAuthRetried = false;
+              const error$1 = markAuthSeamEscape(retried ? new SdkHttpError(SdkErrorCode.ClientHttpAuthentication, "Server returned 401 after re-authentication", {
+                status: 401,
+                statusText: this._last401Response?.statusText ?? ""
+              }) : new UnauthorizedError());
+              this._last401Response = void 0;
               reject(error$1);
               this.onerror?.(error$1);
               return;
             }
-            const error2 = new SseError(event.code, event.message, event);
+            this._connectAuthRetried = false;
+            const error2 = new SseError(event.code, redirect ?? event.message, event);
             reject(error2);
             this.onerror?.(error2);
           };
           this._eventSource.onopen = () => {
+            this._connectAuthRetried = false;
           };
           this._eventSource.addEventListener("endpoint", (event) => {
             const messageEvent = event;
@@ -25544,7 +25813,7 @@ var init_dist4 = __esm({
             body: JSON.stringify(message),
             signal: this._abortController?.signal
           };
-          const response = await (this._fetch ?? fetch)(this._endpoint, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._endpoint, init);
           if (!response.ok) {
             if (response.status === 401 && this._authProvider) {
               if (response.headers.has("www-authenticate")) {
@@ -25575,7 +25844,7 @@ var init_dist4 = __esm({
               throw markAuthSeamEscape(new UnauthorizedError());
             }
             const text = await response.text?.().catch(() => null);
-            throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${text}`);
+            throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${this._unfollowedRedirect(this._endpoint, response) ?? text}`);
           }
           await response.text?.().catch(() => {
           });
@@ -25597,6 +25866,7 @@ var init_dist4 = __esm({
     };
     RESERVED_REQUEST_HEADER_NAMES = /* @__PURE__ */ new Set([
       "authorization",
+      "dpop",
       "content-type",
       "mcp-protocol-version",
       "mcp-method",
@@ -25614,6 +25884,7 @@ var init_dist4 = __esm({
       _skipIssuerMetadataValidation;
       _fetch;
       _fetchWithInit;
+      _redirectPolicy;
       _sessionId;
       _reconnectionOptions;
       _protocolVersion;
@@ -25638,12 +25909,15 @@ var init_dist4 = __esm({
         this._scope = void 0;
         this._requestInit = opts?.requestInit;
         this._skipIssuerMetadataValidation = opts?.skipIssuerMetadataValidation;
+        this._fetch = opts?.fetch;
         if (isOAuthClientProvider(opts?.authProvider)) {
           this._oauthProvider = opts.authProvider;
           this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
+          if (opts.authProvider.dpop) this._fetch = withDpopFromProvider(opts.authProvider)(opts.fetch ?? fetch);
         } else this._authProvider = opts?.authProvider;
-        this._fetch = opts?.fetch;
+        this._redirectPolicy = opts?.redirectPolicy;
         this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+        if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
         this._sessionId = opts?.sessionId;
         this._protocolVersion = opts?.protocolVersion;
         this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
@@ -25695,22 +25969,27 @@ var init_dist4 = __esm({
           skipIssuerMetadataValidation: this._skipIssuerMetadataValidation
         });
       }
+      /** `baseFetch` with redirects handled as `redirectPolicy` says. */
+      _redirects(baseFetch) {
+        return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+      }
+      /** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+      _unfollowedRedirect(url2, response) {
+        const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url2, response);
+        return text && `${text} (redirectPolicy: 'same-origin')`;
+      }
       async _commonHeaders() {
-        const headers = {};
+        const headers = new Headers(this._requestInit?.headers || void 0);
         let token;
         try {
           token = await this._authProvider?.token();
         } catch (error2) {
           throw markAuthSeamEscape(error2);
         }
-        if (token) headers["Authorization"] = `Bearer ${token}`;
-        if (this._sessionId) headers["mcp-session-id"] = this._sessionId;
-        if (this._protocolVersion) headers["mcp-protocol-version"] = this._protocolVersion;
-        const extraHeaders = normalizeHeaders(this._requestInit?.headers);
-        return new Headers({
-          ...headers,
-          ...extraHeaders
-        });
+        if (token) headers.set("Authorization", `Bearer ${token}`);
+        if (this._sessionId) headers.set("mcp-session-id", this._sessionId);
+        if (this._protocolVersion) headers.set("mcp-protocol-version", this._protocolVersion);
+        return headers;
       }
       /**
       * Body-derived per-request headers: when an outgoing request carries a
@@ -25726,9 +26005,8 @@ var init_dist4 = __esm({
         if (typeof envelopeVersion !== "string") return;
         headers.set("mcp-protocol-version", envelopeVersion);
         headers.set("mcp-method", message.method);
-        const params = message.params;
-        const nameHeader = message.method === "resources/read" ? typeof params?.uri === "string" ? params.uri : void 0 : typeof params?.name === "string" ? params.name : void 0;
-        if (nameHeader !== void 0) headers.set("mcp-name", encodeMcpParamValue(nameHeader));
+        const source = mcpNameSource(message.method, message.params);
+        if (source?.value !== void 0) headers.set("mcp-name", encodeMcpParamValue(source.value));
       }
       /**
       * `true` when the outbound message is a single request carrying a
@@ -25751,7 +26029,7 @@ var init_dist4 = __esm({
           if (resumptionToken) headers.set("last-event-id", resumptionToken);
           const transportSignal = this._abortController?.signal;
           const signal = requestSignal !== void 0 && transportSignal !== void 0 ? anySignal(transportSignal, requestSignal) : requestSignal ?? transportSignal;
-          const response = await (this._fetch ?? fetch)(this._url, {
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, {
             ...this._requestInit,
             method: "GET",
             headers,
@@ -25806,7 +26084,8 @@ var init_dist4 = __esm({
               options.onRequestStreamEnd?.();
               return;
             }
-            throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${response.statusText}`, {
+            const reason = this._unfollowedRedirect(this._url, response) ?? response.statusText;
+            throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${reason}`, {
               status: response.status,
               statusText: response.statusText
             });
@@ -25995,7 +26274,7 @@ var init_dist4 = __esm({
             body: JSON.stringify(message),
             signal
           };
-          const response = await (this._fetch ?? fetch)(this._url, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
           if (isHandshake && response.ok) this._sessionId = response.headers.get("mcp-session-id") || void 0;
           if (!response.ok) {
             if (response.status === 401 && this._authProvider) {
@@ -26049,7 +26328,8 @@ var init_dist4 = __esm({
               }
             } catch {
             }
-            throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${text}`, {
+            const reason = this._unfollowedRedirect(this._url, response) ?? text;
+            throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${reason}`, {
               status: response.status,
               statusText: response.statusText,
               text
@@ -26109,10 +26389,10 @@ var init_dist4 = __esm({
             headers,
             signal: this._abortController?.signal
           };
-          const response = await (this._fetch ?? fetch)(this._url, init);
+          const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
           await response.text?.().catch(() => {
           });
-          if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${response.statusText}`, {
+          if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${this._unfollowedRedirect(this._url, response) ?? response.statusText}`, {
             status: response.status,
             statusText: response.statusText
           });
@@ -29421,7 +29701,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@prefecthq/fastmcp-ts",
-      version: "1.7.3",
+      version: "1.8.1",
       description: "\u{1F3CE}\uFE0F  The official FastMCP TypeScript library - build MCP servers and clients, fast \u{1F3CE}\uFE0F",
       type: "module",
       exports: {
@@ -29549,11 +29829,11 @@ var init_package = __esm({
       },
       dependencies: {
         "@clack/prompts": "^1.2.0",
-        "@modelcontextprotocol/client": "^2.0.0",
+        "@modelcontextprotocol/client": "^2.3.1",
         "@modelcontextprotocol/core": "^2.0.0",
         "@modelcontextprotocol/node": "^2.0.0",
-        "@modelcontextprotocol/server": "^2.0.0",
-        "@modelcontextprotocol/server-legacy": "^2.0.0",
+        "@modelcontextprotocol/server": "^2.3.1",
+        "@modelcontextprotocol/server-legacy": "^2.3.1",
         "@standard-schema/spec": "^1.1.0",
         "@types/express": "^5.0.6",
         chalk: "^5.6.2",
@@ -30120,23 +30400,29 @@ var import_node_process4, import_node_stream2, import_cross_spawn, DEFAULT_INHER
 var init_stdio = __esm({
   "node_modules/@modelcontextprotocol/client/dist/stdio.mjs"() {
     "use strict";
-    init_src_D_zzAWoS();
+    init_src_WCy6ifGf();
     import_node_process4 = __toESM(require("process"), 1);
     import_node_stream2 = require("stream");
     import_cross_spawn = __toESM(require_cross_spawn(), 1);
     DEFAULT_INHERITED_ENV_VARS = import_node_process4.default.platform === "win32" ? [
       "APPDATA",
+      "COMSPEC",
       "HOMEDRIVE",
       "HOMEPATH",
       "LOCALAPPDATA",
       "PATH",
+      "PATHEXT",
       "PROCESSOR_ARCHITECTURE",
+      "PROGRAMDATA",
+      "PROGRAMFILES",
+      "PROGRAMFILES(X86)",
+      "PROGRAMW6432",
       "SYSTEMDRIVE",
       "SYSTEMROOT",
       "TEMP",
       "USERNAME",
       "USERPROFILE",
-      "PROGRAMFILES"
+      "WINDIR"
     ] : [
       "HOME",
       "LOGNAME",
@@ -33813,8 +34099,8 @@ var init_inspect = __esm({
               // only case Python's inspect supports); over --url/--command the
               // generation is unknowable from the wire.
               generation: mode.kind === "inprocess" ? 2 : null,
-              fastmcpVersion: "1.7.3",
-              mcpVersion: "2.0.0",
+              fastmcpVersion: "1.8.1",
+              mcpVersion: "2.3.1",
               tools: tools2,
               prompts: prompts2,
               resources: resources2,
@@ -47342,7 +47628,7 @@ init_format();
 var main = defineCommand({
   meta: {
     name: "fastmcp",
-    version: "1.7.3",
+    version: "1.8.1",
     description: "FastMCP CLI \u2014 build, run, and manage MCP servers"
   },
   args: {
@@ -47367,7 +47653,7 @@ var main = defineCommand({
 runMain(main);
 /*! Bundled license information:
 
-@modelcontextprotocol/client/dist/src-D_zzAWoS.mjs:
+@modelcontextprotocol/client/dist/src-WCy6ifGf.mjs:
   (*!
   * content-type
   * Copyright(c) 2015 Douglas Christopher Wilson