@theoremjs/agents 0.0.0-stage → 0.3.0

package/esm/src/kernel/tools/remote.js

@@ -0,0 +1,998 @@
+import { errorKind } from '../../guardrails/error.js';
+import { lexiconText } from '../../guardrails/lexicon.js';
+import { fetchGuarded } from '../../guardrails/network.js';
+import { refreshOAuthToken, tokenAudienceCovers } from '../auth/oauth.js';
+import { mapStrings } from '../engine/tree.js';
+import { guardToolTarget, messageOf, networkBlocked, networkBlockedEvent, requestChecks, startToolExecution, toolEvent, toolNetworkPolicy, } from './events.js';
+import { createMcpSessionCache, isMcpSessionId, mcpSessionKey, } from './mcp-sessions.js';
+import { checkPermission } from './permission.js';
+import { assertFixedEndpointOrigin } from './schema.js';
+import { runPreToolPipeline } from './stage-run.js';
+function authHeaderPair(authConfig, value, defaults) {
+    const headerName = authConfig.headerName ?? defaults.headerName;
+    const headerPrefix = authConfig.headerPrefix ?? defaults.headerPrefix;
+    return { [headerName]: `${headerPrefix}${value}` };
+}
+function buildAuthGate(toolName, authConfig, message, extras) {
+    return {
+        kind: 'auth',
+        tool: toolName,
+        authChallenge: {
+            slot: authConfig.slot,
+            authType: authConfig.type,
+            service: authConfig.service,
+            message,
+            issuer: extras?.issuer ?? authConfig.preResolved?.issuer,
+            resource: extras?.resource ?? authConfig.preResolved?.resource,
+            requiredScopes: authConfig.scopes,
+        },
+    };
+}
+function unauthenticatedResult(toolName, authConfig, message, policy, extras) {
+    if (policy === 'gate') {
+        // The caller emits the gate through emitGateSettlement, so `pre_tool` runs first.
+        const gate = buildAuthGate(toolName, authConfig, message, extras);
+        return { headers: {}, unauthenticated: true, gate };
+    }
+    return { headers: {}, unauthenticated: true, modelMessage: message };
+}
+function resolveStaticCredential(credential, authConfig) {
+    if (credential.type === 'bearer') {
+        return {
+            headers: authHeaderPair(authConfig, credential.token, {
+                headerName: 'Authorization',
+                headerPrefix: 'Bearer ',
+            }),
+            secret: credential.token,
+        };
+    }
+    if (credential.type === 'api_key') {
+        const headerName = credential.headerName ?? authConfig.headerName ?? 'Authorization';
+        const headerPrefix = credential.headerPrefix ?? authConfig.headerPrefix ?? '';
+        return {
+            headers: { [headerName]: `${headerPrefix}${credential.key}` },
+            secret: credential.key,
+        };
+    }
+    return undefined;
+}
+/**
+ * Refreshes in flight, by grant. Calls that find the same expired token share
+ * one refresh: with rotating refresh tokens a second request would present a
+ * spent token, which a server may treat as theft and revoke the whole grant.
+ */
+const refreshesInFlight = new Map();
+function refreshOnce(credential, refreshToken, transport, clientSecret) {
+    const grant = `${credential.tokenEndpoint}\n${refreshToken}`;
+    const inFlight = refreshesInFlight.get(grant);
+    if (inFlight)
+        return inFlight;
+    const refresh = refreshOAuthToken({
+        refreshToken,
+        tokenEndpoint: credential.tokenEndpoint,
+        clientId: credential.clientId,
+        resource: credential.resource,
+        scope: credential.scope,
+        issuer: credential.issuer,
+        ...(clientSecret === undefined ? {} : { clientSecret }),
+        ...transport,
+    }).then((result) => result.credential);
+    refreshesInFlight.set(grant, refresh);
+    const settle = () => refreshesInFlight.delete(grant);
+    refresh.then(settle, settle);
+    return refresh;
+}
+async function* resolveOAuth2Credential(toolName, authConfig, credential, source, ctx, base, policy) {
+    const slot = authConfig.slot;
+    const bound = { issuer: credential.issuer, resource: credential.resource };
+    // A token goes only to the resource it was issued for; one that names none
+    // has nowhere it may go, so the user signs in again.
+    if (typeof credential.resource !== 'string' || credential.resource.length === 0) {
+        const message = `OAuth credential for '${toolName}' (slot: '${slot}') does not name the resource it was issued for.`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        return unauthenticatedResult(toolName, authConfig, message, policy, bound);
+    }
+    let active = credential;
+    const isExpired = credential.expiresAt !== undefined && credential.expiresAt <= Date.now() + 30000;
+    if (isExpired && credential.refreshToken) {
+        try {
+            active = await refreshOnce(credential, credential.refreshToken, { network: toolNetworkPolicy(ctx), resolveHost: ctx.resolveHost }, await source.clientSecret?.(credential.clientId));
+        }
+        catch (err) {
+            // The server's own words are untrusted text: they go to the host as
+            // `errorInternal`, never to the model or the client.
+            yield {
+                ...toolEvent(base, {
+                    phase: 'progress',
+                    data: { kind: 'auth_token_refresh_failed', slot },
+                }),
+                errorInternal: messageOf(err),
+            };
+            const message = `Failed to refresh OAuth token for '${toolName}' (slot: '${slot}').`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+            return unauthenticatedResult(toolName, authConfig, message, policy, bound);
+        }
+        // The host persists the refreshed credential before the call goes on; the
+        // event only names the slot, so no token rides the stream.
+        await source.set(slot, active);
+        yield toolEvent(base, {
+            phase: 'progress',
+            data: { kind: 'auth_token_refreshed', slot },
+        });
+    }
+    else if (isExpired) {
+        const message = `OAuth token expired for '${toolName}' (slot: '${slot}') and no refresh token is available.`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        return unauthenticatedResult(toolName, authConfig, message, policy, bound);
+    }
+    return {
+        headers: authHeaderPair(authConfig, active.accessToken, {
+            headerName: 'Authorization',
+            headerPrefix: 'Bearer ',
+        }),
+        secret: active.accessToken,
+        audience: credential.resource,
+    };
+}
+export async function* resolveToolAuth(toolName, authConfig, ctx, base) {
+    if (!authConfig) {
+        return { headers: {} };
+    }
+    const source = ctx.credentials;
+    const credential = source ? await source.get(authConfig.slot) : undefined;
+    const policy = authConfig.onUnauthenticated ?? 'gate';
+    if (!source || !credential) {
+        const message = `Authentication required for '${toolName}' (auth slot: '${authConfig.slot}').`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        return unauthenticatedResult(toolName, authConfig, message, policy);
+    }
+    const staticResolved = resolveStaticCredential(credential, authConfig);
+    if (staticResolved) {
+        return staticResolved;
+    }
+    if (credential.type === 'oauth2') {
+        return yield* resolveOAuth2Credential(toolName, authConfig, credential, source, ctx, base, policy);
+    }
+    return { headers: {} };
+}
+/**
+ * One path parameter, encoded. `encodeURIComponent` leaves `.` and `..` as they
+ * are and a URL resolves them, walking the endpoint's path; they are refused.
+ */
+function pathSegment(param, value) {
+    if (value === '.' || value === '..') {
+        throw new Error(`Path parameter "${param}" cannot be "${value}"`); // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    return encodeURIComponent(value);
+}
+export function buildHttpToolTarget(endpoint, method, input, mapping) {
+    assertFixedEndpointOrigin(endpoint);
+    let urlStr = endpoint;
+    const pathParams = mapping?.pathParams ?? [];
+    for (const param of pathParams) {
+        const val = input[param];
+        if (val !== undefined) {
+            urlStr = urlStr.replaceAll(`{${param}}`, pathSegment(param, String(val)));
+        }
+    }
+    const unreplacedMatch = urlStr.match(/\{([a-zA-Z0-9_-]+)\}/);
+    if (unreplacedMatch) {
+        throw new Error(`Missing required path parameter "${unreplacedMatch[1]}" for endpoint "${endpoint}"`);
+    }
+    const targetUrl = new URL(urlStr);
+    const queryParams = mapping?.queryParams ?? [];
+    for (const param of queryParams) {
+        const val = input[param];
+        if (val !== undefined) {
+            targetUrl.searchParams.set(param, String(val));
+        }
+    }
+    if (method === 'GET') {
+        return { url: targetUrl.toString() };
+    }
+    if (mapping?.bodyParam) {
+        return { url: targetUrl.toString(), body: JSON.stringify(input[mapping.bodyParam]) };
+    }
+    const bodyObj = {};
+    const excluded = new Set([...pathParams, ...queryParams]);
+    for (const [k, v] of Object.entries(input)) {
+        if (!excluded.has(k)) {
+            bodyObj[k] = v;
+        }
+    }
+    return { url: targetUrl.toString(), body: JSON.stringify(bodyObj) };
+}
+function parseHttpResponseData(contentType, text, status) {
+    if (contentType.includes('application/json') && text.trim().length > 0) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return text;
+        }
+    }
+    if (text.trim().length === 0 && status === 204) {
+        return null;
+    }
+    return text;
+}
+export function parseToolOutput(schema, responseData) {
+    let checked = schema.safeParse(responseData);
+    if (!checked.success && typeof responseData === 'string' && responseData.trim().length > 0) {
+        try {
+            const jsonParsed = JSON.parse(responseData);
+            const retryChecked = schema.safeParse(jsonParsed);
+            if (retryChecked.success) {
+                checked = retryChecked;
+            }
+        }
+        catch {
+            // Not JSON: the schema's first result stands.
+        }
+    }
+    return checked;
+}
+/** Not repeated as `data`, which `composeToolText` would append a second time. */
+export function modelResultFromOutput(data) {
+    return { finding: typeof data === 'string' ? data : JSON.stringify(data) };
+}
+/** The result with the media a tool returned beside its value, when it returned any. */
+export function withMedia(result, parts) {
+    return parts?.length ? { ...result, parts } : result;
+}
+function failureOutcome(failure, callNotStarted) {
+    return { kind: 'failed', failure, callNotStarted };
+}
+async function* runRemotePreBodyStages(args) {
+    const pre = yield* runPreToolPipeline(args);
+    if (pre.ok)
+        return pre;
+    if (pre.kind === 'aborted') {
+        return { kind: 'aborted', aborted: pre.aborted };
+    }
+    if (pre.kind === 'gated') {
+        return { kind: 'gated', gate: pre.gate };
+    }
+    return { ...failureOutcome(pre.failure, true), ...(pre.denied ? { denied: true } : {}) };
+}
+async function* remoteParseAndPermit(tool, rawInput, ctx, base) {
+    const started = yield* startToolExecution(tool, rawInput, ctx, base);
+    if (!started.ok) {
+        return {
+            ok: false,
+            outcome: failureOutcome({
+                code: 'invalid_input',
+                kind: 'bad_response',
+                message: lexiconText('tool.input_invalid', {}, ctx.profile.lexicon),
+            }, true),
+        };
+    }
+    const permissionGate = checkPermission(tool.name, tool.permission, ctx.sessionPermissions, ctx.resume);
+    if (permissionGate) {
+        return { ok: false, outcome: { kind: 'gated', gate: permissionGate } };
+    }
+    return { ok: true, input: started.data };
+}
+export function outcomeFromUnauth(authRes) {
+    if (!authRes.unauthenticated)
+        return undefined;
+    if (authRes.gate)
+        return { kind: 'gated', gate: authRes.gate };
+    if (authRes.modelMessage) {
+        return {
+            kind: 'ok',
+            modelResult: { finding: authRes.modelMessage },
+            outputRaw: { unauthenticated: true, message: authRes.modelMessage },
+        };
+    }
+    return failureOutcome({ code: 'not_authorized', kind: 'auth', message: 'Tool authentication required' }, // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    true);
+}
+export function credentialRefusal(response) {
+    return response.status === 401 || response.status === 403
+        ? { status: response.status, challenge: response.headers.get('www-authenticate') }
+        : undefined;
+}
+/** RFC 6750 §3: the characters a scope token may hold. */
+const SCOPE_TOKEN = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+/** A `Bearer` challenge's `error` and well-formed `scope` tokens (RFC 6750 §3). */
+function bearerChallenge(header) {
+    const param = (name) => header?.match(new RegExp(`(?:^|[\\s,])${name}="([^"]*)"`, 'i'))?.[1];
+    const scopes = (param('scope') ?? '').split(' ').filter((scope) => SCOPE_TOKEN.test(scope));
+    const error = param('error');
+    return error === undefined ? { scopes } : { error, scopes };
+}
+/** A refusal that asks for a sign-in: 401, or 403 `insufficient_scope`. Any other 403 is the call's own failure. */
+export function refusalAsksForSignIn(refusal) {
+    return (refusal.status === 401 || bearerChallenge(refusal.challenge).error === 'insufficient_scope');
+}
+/**
+ * The service refused the credential it was sent. A 401 says it no longer works:
+ * the person signs in again. A 403 `insufficient_scope` asks for more access: a
+ * sign-in can grant scopes the tool declares, and nothing else, so a request
+ * outside them fails with `sign_in.out_of_scope` and the trace records what was
+ * asked against what is declared. Any other refusal is the call's failure.
+ */
+export function* refusedCredentialOutcome(tool, refusal, authHeaders, ctx, base) {
+    const auth = tool.auth;
+    if (!auth || !refusal || Object.keys(authHeaders).length === 0)
+        return undefined;
+    const policy = auth.onUnauthenticated ?? 'gate';
+    if (refusal.status === 401) {
+        const message = `The credential for '${tool.name}' (slot: '${auth.slot}') was refused.`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        return outcomeFromUnauth(unauthenticatedResult(tool.name, auth, message, policy));
+    }
+    const challenge = bearerChallenge(refusal.challenge);
+    if (challenge.error !== 'insufficient_scope')
+        return undefined;
+    const declared = auth.scopes ?? [];
+    const requested = challenge.scopes;
+    if (requested.length > 0 && requested.every((scope) => declared.includes(scope))) {
+        const message = `'${tool.name}' needs scopes its credential (slot: '${auth.slot}') does not carry.`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        return outcomeFromUnauth(unauthenticatedResult(tool.name, auth, message, policy));
+    }
+    const refused = {
+        kind: 'auth_scope_refused',
+        slot: auth.slot,
+        requested,
+        declared,
+    };
+    yield toolEvent(base, { phase: 'progress', data: refused });
+    return failureOutcome({
+        code: 'out_of_scope',
+        kind: 'auth',
+        message: lexiconText('sign_in.out_of_scope', { service: auth.service }, ctx.profile.lexicon),
+    }, false);
+}
+async function* remoteAuthAndPreBody(args) {
+    const authRes = yield* resolveToolAuth(args.tool.name, args.tool.auth, args.ctx, args.base);
+    const unauth = outcomeFromUnauth(authRes);
+    if (unauth)
+        return unauth;
+    const preBody = yield* runRemotePreBodyStages({
+        tool: args.tool,
+        input: args.input,
+        ctx: args.ctx,
+        base: args.base,
+        stages: args.stages,
+    });
+    if (!('ok' in preBody))
+        return preBody;
+    return {
+        ok: true,
+        input: preBody.input,
+        authHeaders: authRes.headers ?? {},
+        ...(authRes.secret ? { secret: authRes.secret } : {}),
+        ...(authRes.audience ? { audience: authRes.audience } : {}),
+    };
+}
+function* thrownOutcome(err, checks) {
+    if (errorKind(err) === 'blocked') {
+        const blocked = networkBlockedEvent();
+        checks.record(blocked);
+        return failureOutcome(yield* networkBlocked(err, blocked), false);
+    }
+    return failureOutcome({ code: 'network_error', kind: 'network', message: messageOf(err) }, false);
+}
+const OMIT_CREDENTIAL = '[omitted - credential]';
+/** The most of a tool's response body the kernel reads; past it the call fails instead of exhausting the host's memory. */
+export const MAX_TOOL_RESPONSE_BYTES = 4 * 1024 * 1024;
+/** The most of an error or unparseable body quoted back in a failure message. */
+const MAX_QUOTED_BODY_CHARS = 2000;
+/** A body, read up to `maxBytes`; `undefined` when it runs past, with the rest left unread. */
+async function readCappedText(response, maxBytes = MAX_TOOL_RESPONSE_BYTES) {
+    const declared = Number(response.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        await response.body?.cancel().catch(() => { });
+        return undefined;
+    }
+    if (!response.body)
+        return await response.text();
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let bytes = 0;
+    let text = '';
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        bytes += value.byteLength;
+        if (bytes > maxBytes) {
+            await reader.cancel().catch(() => { });
+            return undefined;
+        }
+        text += decoder.decode(value, { stream: true });
+    }
+    return text + decoder.decode();
+}
+/** A body quoted in a failure message, cut short when long. */
+function quotedBody(text) {
+    return text.length > MAX_QUOTED_BODY_CHARS ? `${text.slice(0, MAX_QUOTED_BODY_CHARS)}…` : text;
+}
+/** The failure for a body past MAX_TOOL_RESPONSE_BYTES. */
+function tooLargeFailure(host) {
+    return {
+        code: 'response_too_large',
+        kind: 'bad_response',
+        message: `Response from ${host} is larger than ${MAX_TOOL_RESPONSE_BYTES} bytes`, // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    };
+}
+/** The text with the credential replaced. */
+function omitSecretText(text, secret) {
+    return text.replaceAll(secret, OMIT_CREDENTIAL);
+}
+/** Every string in `value` with the credential replaced. */
+export function omitSecret(value, secret) {
+    return mapStrings(value, (text) => omitSecretText(text, secret));
+}
+/** A failure's message and details with the credential replaced. */
+export function failureWithoutSecret(failure, secret) {
+    return {
+        ...failure,
+        message: omitSecretText(failure.message, secret),
+        ...(failure.details === undefined ? {} : { details: omitSecret(failure.details, secret) }),
+    };
+}
+/** An echo endpoint or debug page can repeat the credential; it must never reach the model, trace or client. */
+function withoutSecret(outcome, secret) {
+    if (!secret)
+        return outcome;
+    if (outcome.kind === 'ok') {
+        const outputRaw = omitSecret(outcome.outputRaw, secret);
+        return {
+            kind: 'ok',
+            outputRaw,
+            modelResult: withMedia(modelResultFromOutput(outputRaw), outcome.modelResult.parts),
+        };
+    }
+    if (outcome.kind === 'failed') {
+        return { ...outcome, failure: failureWithoutSecret(outcome.failure, secret) };
+    }
+    return outcome;
+}
+/** Why an OAuth token issued for `audience` may not go to `url` (RFC 8707), or `undefined` when it may. */
+export function audienceMismatch(audience, url) {
+    if (!audience || tokenAudienceCovers(audience, url))
+        return undefined;
+    return `The OAuth token for "${audience}" cannot be sent to "${url.origin}${url.pathname}"`; // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+}
+/** An OAuth token goes only to the resource it was issued for (RFC 8707); any other target gets no request. */
+async function* sendWithCredential(prepared, url, send) {
+    const mismatch = audienceMismatch(prepared.audience, url);
+    if (mismatch) {
+        return failureOutcome({ code: 'credential_audience_mismatch', kind: 'config', message: mismatch }, true);
+    }
+    return withoutSecret(yield* send(), prepared.secret);
+}
+/** Order: schema → permission → auth → preTool/host stages → body. */
+export async function* executeHttpTool(tool, rawInput, ctx, base, stages) {
+    const parsed = yield* remoteParseAndPermit(tool, rawInput, ctx, base);
+    if (!parsed.ok)
+        return parsed.outcome;
+    let input = parsed.input;
+    const prepared = yield* remoteAuthAndPreBody({ tool, input, ctx, base, stages });
+    if (!('ok' in prepared))
+        return prepared;
+    input = prepared.input;
+    let target;
+    try {
+        target = buildHttpToolTarget(tool.endpoint, tool.method, input, tool.mapping);
+    }
+    catch (err) {
+        const failure = {
+            code: 'invalid_input',
+            kind: 'bad_response',
+            message: messageOf(err),
+        };
+        return failureOutcome(failure, true);
+    }
+    const guarded = yield* guardToolTarget(target.url, ctx, stages?.span);
+    if (!guarded.ok)
+        return failureOutcome(guarded.failure, true);
+    return yield* sendWithCredential(prepared, guarded.url, () => sendHttpRequest(tool, guarded.url, target.body, prepared.authHeaders, ctx, base, stages?.span));
+}
+async function* sendHttpRequest(tool, targetUrl, body, authHeaders, ctx, base, span) {
+    const checks = requestChecks(span);
+    const headers = { Accept: 'application/json' };
+    if (tool.method !== 'GET') {
+        headers['Content-Type'] = 'application/json';
+    }
+    try {
+        const response = await fetchGuarded(targetUrl.href, { method: tool.method, headers, body, signal: ctx.signal }, {
+            policy: toolNetworkPolicy(ctx),
+            followRedirects: true,
+            originBoundHeaders: { ...tool.headers, ...authHeaders },
+            resolveHost: ctx.resolveHost,
+            onCheck: checks.onCheck,
+        });
+        const text = await readCappedText(response);
+        if (text === undefined)
+            return failureOutcome(tooLargeFailure(targetUrl.hostname), false);
+        if (!response.ok) {
+            const refused = yield* refusedCredentialOutcome(tool, credentialRefusal(response), authHeaders, ctx, base);
+            if (refused)
+                return refused;
+            const failure = {
+                code: `http_${response.status}`,
+                kind: kindOfToolHttpStatus(response.status),
+                message: `HTTP ${response.status} from ${targetUrl.hostname}: ${quotedBody(text)}`,
+            };
+            return failureOutcome(failure, false);
+        }
+        const responseData = parseHttpResponseData(response.headers.get('content-type') ?? '', text, response.status);
+        const checked = parseToolOutput(tool.output, responseData);
+        if (!checked.success) {
+            const failure = {
+                code: 'invalid_output',
+                kind: 'bad_response',
+                message: 'HTTP response did not match tool output schema', // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+                details: checked.error.flatten(),
+            };
+            return failureOutcome(failure, false);
+        }
+        return {
+            kind: 'ok',
+            modelResult: modelResultFromOutput(checked.data),
+            outputRaw: checked.data,
+        };
+    }
+    catch (err) {
+        return yield* thrownOutcome(err, checks);
+    }
+    finally {
+        checks.record();
+    }
+}
+/** Preferred first. */
+export const MCP_PROTOCOL_VERSIONS = [
+    '2026-07-28',
+    '2025-11-25',
+    '2025-06-18',
+    '2025-03-26',
+];
+/** Accepts a JSON body or an SSE (`data:`) stream. */
+export function parseMcpRpcResponse(text) {
+    const trimmed = text.trim();
+    if (trimmed.startsWith('{')) {
+        return JSON.parse(trimmed);
+    }
+    const messages = [];
+    for (const line of text.split('\n')) {
+        if (!line.startsWith('data: '))
+            continue;
+        const payload = line.slice(6).trim();
+        if (!payload || payload === '[DONE]')
+            continue;
+        try {
+            messages.push(JSON.parse(payload));
+        }
+        catch {
+            // Pings and other non-JSON payloads.
+        }
+    }
+    for (let i = messages.length - 1; i >= 0; i--) {
+        const msg = messages[i];
+        if (msg.result !== undefined && msg.method === undefined)
+            return msg;
+    }
+    const last = messages.at(-1);
+    if (!last) {
+        throw new Error(`MCP server returned non-JSON response: ${text}`); // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    }
+    return last;
+}
+export function isUnsupportedMcpProtocolError(error) {
+    if (!error)
+        return false;
+    const message = error.message.toLowerCase();
+    return (message.includes('unsupported protocol version') || // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        message.includes('inconsistent mcp protocol version') // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    );
+}
+function unsupportedProtocolFromHttpBody(text) {
+    try {
+        const rpcResponse = parseMcpRpcResponse(text);
+        if (rpcResponse.error && isUnsupportedMcpProtocolError(rpcResponse.error)) {
+            return rpcResponse.error;
+        }
+    }
+    catch {
+        // A non-JSON error page falls through to the raw-text check.
+    }
+    // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    if (text.toLowerCase().includes('unsupported protocol version')) {
+        return { code: -32600, message: text };
+    }
+    return undefined;
+}
+async function fetchMcpProtocolAttempt(transport, rpcId, mcpToolName, input, protocolVersion) {
+    const jsonRpcPayload = {
+        jsonrpc: '2.0',
+        id: rpcId,
+        method: 'tools/call',
+        params: {
+            name: mcpToolName,
+            arguments: input,
+            // Stateless servers read the client's capabilities from each call, not from an initialize.
+            _meta: {
+                'io.modelcontextprotocol/protocolVersion': protocolVersion,
+                'io.modelcontextprotocol/clientCapabilities': {},
+            },
+        },
+    };
+    const response = await fetchGuarded(transport.url, {
+        method: 'POST',
+        headers: {
+            ...transport.headers,
+            'MCP-Protocol-Version': protocolVersion,
+            'Mcp-Method': jsonRpcPayload.method,
+            'Mcp-Name': mcpToolName,
+        },
+        body: JSON.stringify(jsonRpcPayload),
+        signal: transport.signal,
+    }, {
+        policy: transport.policy,
+        followRedirects: true,
+        originBoundHeaders: transport.originBoundHeaders,
+        resolveHost: transport.resolveHost,
+        onCheck: transport.onCheck,
+    });
+    const text = await readCappedText(response);
+    if (text === undefined) {
+        return { kind: 'failure', failure: tooLargeFailure(new URL(transport.url).hostname) };
+    }
+    if (!response.ok) {
+        const sessionSent = SESSION_HEADER in transport.originBoundHeaders;
+        if (sessionSent && response.status === 404)
+            return { kind: 'session_expired' };
+        if (!sessionSent && response.status === 400 && /mcp-session-id/i.test(text)) {
+            return { kind: 'session_required' };
+        }
+        const acceptRejected = response.status === 406 &&
+            text.toLowerCase().includes('accept') &&
+            protocolVersion !== MCP_PROTOCOL_VERSIONS.at(-1);
+        if (acceptRejected)
+            return { kind: 'retry' };
+        const protocolError = unsupportedProtocolFromHttpBody(text);
+        if (protocolError)
+            return { kind: 'protocol_retry', error: protocolError };
+        const refusal = credentialRefusal(response);
+        return {
+            kind: 'failure',
+            ...(refusal ? { refusal } : {}),
+            failure: {
+                code: `mcp_http_${response.status}`,
+                kind: kindOfToolHttpStatus(response.status),
+                message: `MCP server error HTTP ${response.status}: ${quotedBody(text)}`, // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+            },
+        };
+    }
+    try {
+        const rpcResponse = parseMcpRpcResponse(text);
+        if (rpcResponse.error && isUnsupportedMcpProtocolError(rpcResponse.error)) {
+            return { kind: 'protocol_retry', error: rpcResponse.error };
+        }
+        return { kind: 'rpc', response: rpcResponse };
+    }
+    catch {
+        return {
+            kind: 'failure',
+            failure: {
+                code: 'invalid_response',
+                kind: 'bad_response',
+                message: `MCP server returned non-JSON response: ${quotedBody(text)}`, // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+            },
+        };
+    }
+}
+async function negotiateMcpRpc(transport, rpcId, mcpToolName, input) {
+    let lastProtocolError;
+    for (const protocolVersion of MCP_PROTOCOL_VERSIONS) {
+        const outcome = await fetchMcpProtocolAttempt(transport, rpcId, mcpToolName, input, protocolVersion);
+        if (outcome.kind === 'retry' || outcome.kind === 'protocol_retry') {
+            if (outcome.kind === 'protocol_retry')
+                lastProtocolError = outcome.error;
+            continue;
+        }
+        if (outcome.kind === 'failure') {
+            return { failure: outcome.failure, ...(outcome.refusal ? { refusal: outcome.refusal } : {}) };
+        }
+        if (outcome.kind !== 'rpc')
+            return { sessionRequired: true };
+        return { rpc: outcome.response };
+    }
+    return { lastProtocolError };
+}
+const SESSION_HEADER = 'Mcp-Session-Id';
+/** The newest revision that has sessions; 2026-07-28 is stateless. */
+const SESSION_PROTOCOL_VERSION = '2025-11-25';
+class McpSessionFailure extends Error {
+    failure;
+    constructor(failure) {
+        super(failure.message);
+        this.failure = failure;
+    }
+}
+function sessionFailure(code, message) {
+    return new McpSessionFailure({ code, kind: 'failed', message });
+}
+/**
+ * Opens a session: initialize, then the initialized notification. Only the session ID and version
+ * are read back; the server's `instructions` would be a prompt-injection channel. Redirects are not
+ * followed, so a session can only come from the configured server.
+ */
+async function openMcpSession(transport) {
+    const post = (body, headers, originBound = {}) => fetchGuarded(transport.url, {
+        method: 'POST',
+        headers: { ...transport.headers, ...headers },
+        body: JSON.stringify(body),
+        signal: transport.signal,
+    }, {
+        policy: transport.policy,
+        followRedirects: false,
+        originBoundHeaders: { ...transport.originBoundHeaders, ...originBound },
+        resolveHost: transport.resolveHost,
+        onCheck: transport.onCheck,
+    });
+    const response = await post({
+        jsonrpc: '2.0',
+        id: 'initialize',
+        method: 'initialize',
+        params: {
+            protocolVersion: SESSION_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'theorem', version: '1' },
+        },
+    }, { 'Mcp-Method': 'initialize' });
+    const text = await readCappedText(response);
+    if (text === undefined) {
+        throw new McpSessionFailure(tooLargeFailure(new URL(transport.url).hostname));
+    }
+    if (!response.ok) {
+        throw sessionFailure(`mcp_session_http_${response.status}`, `MCP server refused to open a session: HTTP ${response.status}: ${quotedBody(text)}`);
+    }
+    const id = response.headers.get(SESSION_HEADER);
+    if (!isMcpSessionId(id)) {
+        throw sessionFailure('mcp_session_invalid', 'MCP server required a session but sent no usable session ID');
+    }
+    let version;
+    try {
+        version = parseMcpRpcResponse(text).result?.protocolVersion;
+    }
+    catch {
+        version = undefined;
+    }
+    if (!MCP_PROTOCOL_VERSIONS.some((known) => known === version)) {
+        throw sessionFailure('mcp_protocol_error', 'MCP server opened a session on a protocol version Theorem does not speak');
+    }
+    const protocolVersion = String(version);
+    const initialized = await post({ jsonrpc: '2.0', method: 'notifications/initialized' }, { 'MCP-Protocol-Version': protocolVersion, 'Mcp-Method': 'notifications/initialized' }, { [SESSION_HEADER]: id });
+    await initialized.body?.cancel().catch(() => { });
+    return { id, protocolVersion };
+}
+/** The call in a session: an expired one is reopened once, so a server can't loop us. */
+async function negotiateInSession(transport, rpcId, mcpToolName, input, sessions) {
+    let session = sessions.cached;
+    for (let attempt = 0; attempt < 2; attempt++) {
+        if (!session) {
+            try {
+                session = await sessions.cache.open(sessions.key, () => openMcpSession(transport));
+            }
+            catch (err) {
+                if (err instanceof McpSessionFailure)
+                    return { failure: err.failure };
+                throw err;
+            }
+        }
+        const outcome = await fetchMcpProtocolAttempt({
+            ...transport,
+            originBoundHeaders: { ...transport.originBoundHeaders, [SESSION_HEADER]: session.id },
+        }, rpcId, mcpToolName, input, session.protocolVersion);
+        if (outcome.kind === 'session_expired') {
+            sessions.cache.drop(sessions.key, session.id);
+            session = undefined;
+            continue;
+        }
+        if (outcome.kind === 'rpc')
+            return { rpc: outcome.response };
+        if (outcome.kind === 'failure') {
+            // A server can echo the session ID in its error; it goes no further than the server.
+            const failure = {
+                ...outcome.failure,
+                message: outcome.failure.message.replaceAll(session.id, '[session]'),
+            };
+            return { failure, ...(outcome.refusal ? { refusal: outcome.refusal } : {}) };
+        }
+        return {
+            lastProtocolError: outcome.kind === 'protocol_retry' ? outcome.error : undefined,
+        };
+    }
+    return {
+        failure: {
+            code: 'mcp_session_expired',
+            kind: 'failed',
+            message: 'MCP server ended the session again right after it was reopened', // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        },
+    };
+}
+function kindOfToolHttpStatus(status) {
+    return status === 401 || status === 403 ? 'auth' : 'failed';
+}
+/** A content block as text: its text, an embedded resource's text, or a linked resource's URI. */
+function mcpContentText(block) {
+    if (block.type === 'text')
+        return block.text;
+    const resource = block.resource;
+    if (block.type === 'resource' && typeof resource?.text === 'string')
+        return resource.text;
+    if (block.type === 'resource_link' && typeof block.uri === 'string')
+        return block.uri;
+    return undefined;
+}
+/** An image or audio block as media; the spec gives both as base64 `data` and a `mimeType`. */
+function mcpMedia(block) {
+    if (block.type !== 'image' && block.type !== 'audio')
+        return undefined;
+    const { data, mimeType } = block;
+    if (typeof data !== 'string' || !data || typeof mimeType !== 'string' || !mimeType.trim()) {
+        return undefined;
+    }
+    return { type: block.type, mimeType, data };
+}
+/**
+ * A tool result's value, read the way the spec layers it: the structured
+ * content when the server sends one and it fits the tool's declared output,
+ * else the text blocks. Images and audio come back as media, not flattened
+ * away.
+ */
+function extractMcpOutput(tool, result) {
+    const content = Array.isArray(result?.content) ? result.content : undefined;
+    const media = content?.flatMap((block) => mcpMedia(block) ?? []);
+    const withParts = media?.length ? { parts: media } : {};
+    let warning;
+    if (result?.structuredContent !== undefined) {
+        const structured = tool.output.safeParse(result.structuredContent);
+        if (structured.success)
+            return { checked: structured, ...withParts };
+        warning = structuredMismatch(structured.error.issues);
+    }
+    const text = content
+        ? content.flatMap((block) => mcpContentText(block) ?? []).join('\n')
+        : result;
+    return {
+        checked: parseToolOutput(tool.output, text),
+        ...withParts,
+        ...(warning ? { warning } : {}),
+    };
+}
+/** Otherwise the text fallback hides why the tool's declared fields never arrive. */
+function structuredMismatch(issues) {
+    const shown = issues
+        .slice(0, 3)
+        .map((issue) => `${issue.path.map(String).join('.') || '(root)'}: ${issue.message}`);
+    const more = issues.length > 3 ? ` (+${String(issues.length - 3)} more)` : '';
+    return {
+        code: 'mcp_structured_mismatch',
+        severity: 'warning',
+        message: `structuredContent does not match the output schema, so the text content was used. ${shown.join('; ')}${more}`, // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+    };
+}
+function mcpResultFailure(rpcResponse) {
+    if (rpcResponse.error) {
+        return {
+            code: `mcp_rpc_error_${rpcResponse.error.code}`,
+            kind: 'failed',
+            message: rpcResponse.error.message,
+            details: rpcResponse.error.data,
+        };
+    }
+    const result = rpcResponse.result;
+    if (result?.isError) {
+        return {
+            code: 'mcp_tool_execution_failed',
+            kind: 'failed',
+            message: result.content?.map((c) => c.text ?? '').join('\n') ?? 'MCP Tool execution error', // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+        };
+    }
+    return undefined;
+}
+function interpretMcpRpc(tool, negotiated) {
+    if (negotiated.failure) {
+        return { ok: false, failure: negotiated.failure };
+    }
+    const rpcResponse = negotiated.rpc;
+    if (!rpcResponse) {
+        return {
+            ok: false,
+            failure: {
+                code: 'mcp_protocol_error',
+                kind: 'failed',
+                message: negotiated.lastProtocolError?.message ?? 'MCP protocol negotiation failed', // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+                details: negotiated.lastProtocolError?.data,
+            },
+        };
+    }
+    const resultFailure = mcpResultFailure(rpcResponse);
+    if (resultFailure) {
+        return { ok: false, failure: resultFailure };
+    }
+    const { checked, parts, warning } = extractMcpOutput(tool, rpcResponse.result);
+    const withWarning = warning ? { warning } : {};
+    if (!checked.success) {
+        return {
+            ok: false,
+            failure: {
+                code: 'invalid_output',
+                kind: 'bad_response',
+                message: 'MCP output schema validation failed', // lexicon-exempt: developer contract / internal diagnostic — not end-user or model copy (P2)
+                details: checked.error.flatten(),
+            },
+            ...withWarning,
+        };
+    }
+    return { ok: true, data: checked.data, ...(parts ? { parts } : {}), ...withWarning };
+}
+/** Streamable HTTP, spec revision 2026-07-28. Order: schema → permission → auth → preTool/host stages → body. */
+export async function* executeMcpTool(tool, rawInput, ctx, base, stages, 
+/** The scope's sessions; without them a session lasts one call. */
+sessions = createMcpSessionCache()) {
+    const permitted = yield* remoteParseAndPermit(tool, rawInput, ctx, base);
+    if (!permitted.ok)
+        return permitted.outcome;
+    const guarded = yield* guardToolTarget(tool.serverUrl, ctx, stages?.span);
+    if (!guarded.ok)
+        return failureOutcome(guarded.failure, true);
+    const prepared = yield* remoteAuthAndPreBody({ tool, input: permitted.input, ctx, base, stages });
+    if (!('ok' in prepared))
+        return prepared;
+    return yield* sendWithCredential(prepared, guarded.url, () => sendMcpRequest(tool, guarded.url, prepared.input, prepared.authHeaders, ctx, base, stages?.span, sessions));
+}
+async function* sendMcpRequest(tool, url, input, authHeaders, ctx, base, span, sessions) {
+    const checks = requestChecks(span);
+    try {
+        const transport = {
+            url: url.href,
+            headers: {
+                'Content-Type': 'application/json',
+                Accept: 'application/json, text/event-stream',
+            },
+            originBoundHeaders: { ...tool.headers, ...authHeaders },
+            policy: toolNetworkPolicy(ctx),
+            resolveHost: ctx.resolveHost,
+            signal: ctx.signal,
+            onCheck: checks.onCheck,
+        };
+        const key = await mcpSessionKey(url.href, transport.originBoundHeaders);
+        const cached = sessions.get(key);
+        const first = cached
+            ? await negotiateInSession(transport, base.callId, tool.mcpToolName, input, {
+                cache: sessions,
+                key,
+                cached,
+            })
+            : await negotiateMcpRpc(transport, base.callId, tool.mcpToolName, input);
+        const negotiated = first.sessionRequired
+            ? await negotiateInSession(transport, base.callId, tool.mcpToolName, input, {
+                cache: sessions,
+                key,
+            })
+            : first;
+        const refused = yield* refusedCredentialOutcome(tool, negotiated.refusal, authHeaders, ctx, base);
+        if (refused)
+            return refused;
+        const interpreted = interpretMcpRpc(tool, negotiated);
+        if (interpreted.warning) {
+            yield toolEvent(base, { phase: 'warning', warning: interpreted.warning });
+        }
+        if (!interpreted.ok) {
+            return failureOutcome(interpreted.failure, false);
+        }
+        return {
+            kind: 'ok',
+            modelResult: withMedia(modelResultFromOutput(interpreted.data), interpreted.parts),
+            outputRaw: interpreted.data,
+        };
+    }
+    catch (err) {
+        return yield* thrownOutcome(err, checks);
+    }
+    finally {
+        checks.record();
+    }
+}