@trops/dash-core 0.1.567 → 0.1.569

package/dist/electron/index.js

@@ -22761,10 +22761,9 @@ function date$1(params) {
 	 */
 	exports.TaskCreationParamsSchema = z.looseObject({
 	    /**
-	     * Time in milliseconds to keep task results available after completion.
-	     * If null, the task has unlimited lifetime until manually cleaned up.
+	     * Requested duration in milliseconds to retain task from creation.
 	     */
-	    ttl: z.union([z.number(), z.null()]).optional(),
+	    ttl: z.number().optional(),
 	    /**
 	     * Time in milliseconds to wait between task status requests.
 	     */
@@ -23192,7 +23191,11 @@ function date$1(params) {
 	    /**
 	     * Present if the client supports task creation.
 	     */
-	    tasks: exports.ClientTasksCapabilitySchema.optional()
+	    tasks: exports.ClientTasksCapabilitySchema.optional(),
+	    /**
+	     * Extensions that the client supports. Keys are extension identifiers (vendor-prefix/extension-name).
+	     */
+	    extensions: z.record(z.string(), AssertObjectSchema).optional()
 	});
 	exports.InitializeRequestParamsSchema = BaseRequestParamsSchema.extend({
 	    /**
@@ -23267,7 +23270,11 @@ function date$1(params) {
 	    /**
 	     * Present if the server supports task creation.
 	     */
-	    tasks: exports.ServerTasksCapabilitySchema.optional()
+	    tasks: exports.ServerTasksCapabilitySchema.optional(),
+	    /**
+	     * Extensions that the server supports. Keys are extension identifiers (vendor-prefix/extension-name).
+	     */
+	    extensions: z.record(z.string(), AssertObjectSchema).optional()
 	});
 	/**
 	 * After receiving an initialize request from the client, the server sends this response.
@@ -23542,6 +23549,12 @@ function date$1(params) {
 	     * The MIME type of this resource, if known.
 	     */
 	    mimeType: z.optional(z.string()),
+	    /**
+	     * The size of the raw resource content, in bytes (i.e., before base64 encoding or any tokenization), if known.
+	     *
+	     * This can be used by Hosts to display file sizes and estimate context window usage.
+	     */
+	    size: z.optional(z.number()),
 	    /**
 	     * Optional annotations for the client.
 	     */
@@ -25332,17 +25345,21 @@ const AUTHORIZATION_CODE_CHALLENGE_METHOD = 'S256';
  */
 function selectClientAuthMethod(clientInformation, supportedMethods) {
     const hasClientSecret = clientInformation.client_secret !== undefined;
-    // If server doesn't specify supported methods, use RFC 6749 defaults
-    if (supportedMethods.length === 0) {
-        return hasClientSecret ? 'client_secret_post' : 'none';
-    }
-    // Prefer the method returned by the server during client registration if valid and supported
+    // Prefer the method returned by the server during client registration, if valid.
+    // When server metadata is present we also require the method to be listed as supported;
+    // when supportedMethods is empty (metadata omitted the field) the DCR hint stands alone.
     if ('token_endpoint_auth_method' in clientInformation &&
         clientInformation.token_endpoint_auth_method &&
         isClientAuthMethod(clientInformation.token_endpoint_auth_method) &&
-        supportedMethods.includes(clientInformation.token_endpoint_auth_method)) {
+        (supportedMethods.length === 0 || supportedMethods.includes(clientInformation.token_endpoint_auth_method))) {
         return clientInformation.token_endpoint_auth_method;
     }
+    // If server metadata omits token_endpoint_auth_methods_supported, RFC 8414 §2 says the
+    // default is client_secret_basic. RFC 6749 §2.3.1 also requires servers to support HTTP
+    // Basic authentication for clients with a secret, making it the safest default.
+    if (supportedMethods.length === 0) {
+        return hasClientSecret ? 'client_secret_basic' : 'none';
+    }
     // Try methods in priority order (most secure first)
     if (hasClientSecret && supportedMethods.includes('client_secret_basic')) {
         return 'client_secret_basic';
@@ -25516,6 +25533,12 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         });
     }
     const resource = await selectResourceURL(serverUrl, provider, resourceMetadata);
+    // Apply scope selection strategy (SEP-835):
+    // 1. WWW-Authenticate scope (passed via `scope` param)
+    // 2. PRM scopes_supported
+    // 3. Client metadata scope (user-configured fallback)
+    // The resolved scope is used consistently for both DCR and the authorization request.
+    const resolvedScope = scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope;
     // Handle client registration if needed
     let clientInformation = await Promise.resolve(provider.clientInformation());
     if (!clientInformation) {
@@ -25543,6 +25566,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
             const fullInformation = await registerClient(authorizationServerUrl, {
                 metadata,
                 clientMetadata: provider.clientMetadata,
+                scope: resolvedScope,
                 fetchFn
             });
             await provider.saveClientInformation(fullInformation);
@@ -25594,7 +25618,7 @@ async function authInternal(provider, { serverUrl, authorizationCode, scope, res
         clientInformation,
         state,
         redirectUrl: provider.redirectUrl,
-        scope: scope || resourceMetadata?.scopes_supported?.join(' ') || provider.clientMetadata.scope,
+        scope: resolvedScope,
         resource
     });
     await provider.saveCodeVerifier(codeVerifier);
@@ -26175,8 +26199,12 @@ async function fetchToken(provider, authorizationServerUrl, { metadata, resource
 }
 /**
  * Performs OAuth 2.0 Dynamic Client Registration according to RFC 7591.
+ *
+ * If `scope` is provided, it overrides `clientMetadata.scope` in the registration
+ * request body. This allows callers to apply the Scope Selection Strategy (SEP-835)
+ * consistently across both DCR and the subsequent authorization request.
  */
-async function registerClient(authorizationServerUrl, { metadata, clientMetadata, fetchFn }) {
+async function registerClient(authorizationServerUrl, { metadata, clientMetadata, scope, fetchFn }) {
     let registrationUrl;
     if (metadata) {
         if (!metadata.registration_endpoint) {
@@ -26192,7 +26220,10 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
         headers: {
             'Content-Type': 'application/json'
         },
-        body: JSON.stringify(clientMetadata)
+        body: JSON.stringify({
+            ...clientMetadata,
+            ...(scope !== undefined ? { scope } : {})
+        })
     });
     if (!response.ok) {
         throw await parseErrorResponse(response);
@@ -26210,6 +26241,7 @@ class ParseError extends Error {
     super(message), this.name = "ParseError", this.type = options.type, this.field = options.field, this.value = options.value, this.line = options.line;
   }
 }
+const LF = 10, CR = 13, SPACE = 32;
 function noop(_arg) {
 }
 function createParser(callbacks) {
@@ -26217,39 +26249,109 @@ function createParser(callbacks) {
     throw new TypeError(
       "`callbacks` must be an object, got a function instead. Did you mean `{onEvent: fn}`?"
     );
-  const { onEvent = noop, onError = noop, onRetry = noop, onComment } = callbacks;
-  let incompleteLine = "", isFirstChunk = !0, id, data = "", eventType = "";
-  function feed(newChunk) {
-    const chunk = isFirstChunk ? newChunk.replace(/^\xEF\xBB\xBF/, "") : newChunk, [complete, incomplete] = splitLines(`${incompleteLine}${chunk}`);
-    for (const line of complete)
-      parseLine(line);
-    incompleteLine = incomplete, isFirstChunk = !1;
-  }
-  function parseLine(line) {
-    if (line === "") {
+  const { onEvent = noop, onError = noop, onRetry = noop, onComment } = callbacks, pendingFragments = [];
+  let isFirstChunk = !0, id, data = "", dataLines = 0, eventType;
+  function feed(chunk) {
+    if (isFirstChunk && (isFirstChunk = !1, chunk.charCodeAt(0) === 239 && chunk.charCodeAt(1) === 187 && chunk.charCodeAt(2) === 191 && (chunk = chunk.slice(3))), pendingFragments.length === 0) {
+      const trailing2 = processLines(chunk);
+      trailing2 !== "" && pendingFragments.push(trailing2);
+      return;
+    }
+    if (chunk.indexOf(`
+`) === -1 && chunk.indexOf("\r") === -1) {
+      pendingFragments.push(chunk);
+      return;
+    }
+    pendingFragments.push(chunk);
+    const input = pendingFragments.join("");
+    pendingFragments.length = 0;
+    const trailing = processLines(input);
+    trailing !== "" && pendingFragments.push(trailing);
+  }
+  function processLines(chunk) {
+    let searchIndex = 0;
+    if (chunk.indexOf("\r") === -1) {
+      let lfIndex = chunk.indexOf(`
+`, searchIndex);
+      for (; lfIndex !== -1; ) {
+        if (searchIndex === lfIndex) {
+          dataLines > 0 && onEvent({ id, event: eventType, data }), id = void 0, data = "", dataLines = 0, eventType = void 0, searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+          continue;
+        }
+        const firstCharCode = chunk.charCodeAt(searchIndex);
+        if (isDataPrefix(chunk, searchIndex, firstCharCode)) {
+          const valueStart = chunk.charCodeAt(searchIndex + 5) === SPACE ? searchIndex + 6 : searchIndex + 5, value = chunk.slice(valueStart, lfIndex);
+          if (dataLines === 0 && chunk.charCodeAt(lfIndex + 1) === LF) {
+            onEvent({ id, event: eventType, data: value }), id = void 0, data = "", eventType = void 0, searchIndex = lfIndex + 2, lfIndex = chunk.indexOf(`
+`, searchIndex);
+            continue;
+          }
+          data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
+        } else isEventPrefix(chunk, searchIndex, firstCharCode) ? eventType = chunk.slice(
+          chunk.charCodeAt(searchIndex + 6) === SPACE ? searchIndex + 7 : searchIndex + 6,
+          lfIndex
+        ) || void 0 : parseLine(chunk, searchIndex, lfIndex);
+        searchIndex = lfIndex + 1, lfIndex = chunk.indexOf(`
+`, searchIndex);
+      }
+      return chunk.slice(searchIndex);
+    }
+    for (; searchIndex < chunk.length; ) {
+      const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
+`, searchIndex);
+      let lineEnd = -1;
+      if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = crIndex < lfIndex ? crIndex : lfIndex : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1)
+        break;
+      parseLine(chunk, searchIndex, lineEnd), searchIndex = lineEnd + 1, chunk.charCodeAt(searchIndex - 1) === CR && chunk.charCodeAt(searchIndex) === LF && searchIndex++;
+    }
+    return chunk.slice(searchIndex);
+  }
+  function parseLine(chunk, start, end) {
+    if (start === end) {
       dispatchEvent();
       return;
     }
-    if (line.startsWith(":")) {
-      onComment && onComment(line.slice(line.startsWith(": ") ? 2 : 1));
+    const firstCharCode = chunk.charCodeAt(start);
+    if (isDataPrefix(chunk, start, firstCharCode)) {
+      const valueStart = chunk.charCodeAt(start + 5) === SPACE ? start + 6 : start + 5, value2 = chunk.slice(valueStart, end);
+      data = dataLines === 0 ? value2 : `${data}
+${value2}`, dataLines++;
       return;
     }
-    const fieldSeparatorIndex = line.indexOf(":");
-    if (fieldSeparatorIndex !== -1) {
-      const field = line.slice(0, fieldSeparatorIndex), offset = line[fieldSeparatorIndex + 1] === " " ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
-      processField(field, value, line);
+    if (isEventPrefix(chunk, start, firstCharCode)) {
+      eventType = chunk.slice(chunk.charCodeAt(start + 6) === SPACE ? start + 7 : start + 6, end) || void 0;
       return;
     }
-    processField(line, "", line);
+    if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
+      const value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
+      id = value2.includes("\0") ? void 0 : value2;
+      return;
+    }
+    if (firstCharCode === 58) {
+      if (onComment) {
+        const line2 = chunk.slice(start, end);
+        onComment(line2.slice(chunk.charCodeAt(start + 1) === SPACE ? 2 : 1));
+      }
+      return;
+    }
+    const line = chunk.slice(start, end), fieldSeparatorIndex = line.indexOf(":");
+    if (fieldSeparatorIndex === -1) {
+      processField(line, "", line);
+      return;
+    }
+    const field = line.slice(0, fieldSeparatorIndex), offset = line.charCodeAt(fieldSeparatorIndex + 1) === SPACE ? 2 : 1, value = line.slice(fieldSeparatorIndex + offset);
+    processField(field, value, line);
   }
   function processField(field, value, line) {
     switch (field) {
       case "event":
-        eventType = value;
+        eventType = value || void 0;
         break;
       case "data":
-        data = `${data}${value}
-`;
+        data = dataLines === 0 ? value : `${data}
+${value}`, dataLines++;
         break;
       case "id":
         id = value.includes("\0") ? void 0 : value;
@@ -26274,37 +26376,26 @@ function createParser(callbacks) {
     }
   }
   function dispatchEvent() {
-    data.length > 0 && onEvent({
+    dataLines > 0 && onEvent({
       id,
-      event: eventType || void 0,
-      // If the data buffer's last character is a U+000A LINE FEED (LF) character,
-      // then remove the last character from the data buffer.
-      data: data.endsWith(`
-`) ? data.slice(0, -1) : data
-    }), id = void 0, data = "", eventType = "";
+      event: eventType,
+      data
+    }), id = void 0, data = "", dataLines = 0, eventType = void 0;
   }
   function reset(options = {}) {
-    incompleteLine && options.consume && parseLine(incompleteLine), isFirstChunk = !0, id = void 0, data = "", eventType = "", incompleteLine = "";
+    if (options.consume && pendingFragments.length > 0) {
+      const incompleteLine = pendingFragments.join("");
+      parseLine(incompleteLine, 0, incompleteLine.length);
+    }
+    isFirstChunk = !0, id = void 0, data = "", dataLines = 0, eventType = void 0, pendingFragments.length = 0;
   }
   return { feed, reset };
 }
-function splitLines(chunk) {
-  const lines = [];
-  let incompleteLine = "", searchIndex = 0;
-  for (; searchIndex < chunk.length; ) {
-    const crIndex = chunk.indexOf("\r", searchIndex), lfIndex = chunk.indexOf(`
-`, searchIndex);
-    let lineEnd = -1;
-    if (crIndex !== -1 && lfIndex !== -1 ? lineEnd = Math.min(crIndex, lfIndex) : crIndex !== -1 ? crIndex === chunk.length - 1 ? lineEnd = -1 : lineEnd = crIndex : lfIndex !== -1 && (lineEnd = lfIndex), lineEnd === -1) {
-      incompleteLine = chunk.slice(searchIndex);
-      break;
-    } else {
-      const line = chunk.slice(searchIndex, lineEnd);
-      lines.push(line), searchIndex = lineEnd + 1, chunk[searchIndex - 1] === "\r" && chunk[searchIndex] === `
-` && searchIndex++;
-    }
-  }
-  return [lines, incompleteLine];
+function isDataPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 100 && chunk.charCodeAt(i + 1) === 97 && chunk.charCodeAt(i + 2) === 116 && chunk.charCodeAt(i + 3) === 97 && chunk.charCodeAt(i + 4) === 58;
+}
+function isEventPrefix(chunk, i, firstCharCode) {
+  return firstCharCode === 101 && chunk.charCodeAt(i + 1) === 118 && chunk.charCodeAt(i + 2) === 101 && chunk.charCodeAt(i + 3) === 110 && chunk.charCodeAt(i + 4) === 116 && chunk.charCodeAt(i + 5) === 58;
 }
 dist$2.ParseError = ParseError;
 dist$2.createParser = createParser;
@@ -36579,6 +36670,10 @@ function parseWithCompat(schema, data) {
 	        this._progressHandlers.clear();
 	        this._taskProgressTokens.clear();
 	        this._pendingDebouncedNotifications.clear();
+	        for (const info of this._timeoutInfo.values()) {
+	            clearTimeout(info.timeoutId);
+	        }
+	        this._timeoutInfo.clear();
 	        // Abort all in-flight request handlers so they stop sending messages
 	        for (const controller of this._requestHandlerAbortControllers.values()) {
 	            controller.abort();
@@ -36738,7 +36833,11 @@ function parseWithCompat(schema, data) {
 	        })
 	            .catch(error => this._onerror(new Error(`Failed to send response: ${error}`)))
 	            .finally(() => {
-	            this._requestHandlerAbortControllers.delete(request.id);
+	            // Only delete if the stored controller is still ours; after close()+connect(),
+	            // a new connection may have reused the same request ID with a different controller.
+	            if (this._requestHandlerAbortControllers.get(request.id) === abortController) {
+	                this._requestHandlerAbortControllers.delete(request.id);
+	            }
 	        });
 	    }
 	    _onprogress(notification) {
@@ -40686,6 +40785,15 @@ const isUUID$1 = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[
 /** @type {(value: string) => boolean} */
 const isIPv4$1 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
 
+/** @type {(value: string) => boolean} */
+const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+
+/** @type {(value: string) => boolean} */
+const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+
+/** @type {(value: string) => boolean} */
+const isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+
 /**
  * @param {Array<string>} input
  * @returns {string}
@@ -40944,31 +41052,126 @@ function removeDotSegments$1 (path) {
 }
 
 /**
- * @param {import('../types/index').URIComponent} component
- * @param {boolean} esc
- * @returns {import('../types/index').URIComponent}
+ * Re-escape RFC 3986 gen-delims that must not appear literally in the host.
+ * After the URI regex parses, these characters cannot be literal in the host
+ * field, so any that appear after decoding came from percent-encoding and
+ * must be restored to prevent authority structure changes.
+ *
+ * @param {string} host
+ * @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+ * @returns {string}
  */
-function normalizeComponentEncoding$1 (component, esc) {
-  const func = esc !== true ? escape : unescape;
-  if (component.scheme !== undefined) {
-    component.scheme = func(component.scheme);
-  }
-  if (component.userinfo !== undefined) {
-    component.userinfo = func(component.userinfo);
-  }
-  if (component.host !== undefined) {
-    component.host = func(component.host);
+const HOST_DELIMS = { '@': '%40', '/': '%2F', '?': '%3F', '#': '%23', ':': '%3A' };
+const HOST_DELIM_RE = /[@/?#:]/g;
+const HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+
+function reescapeHostDelimiters$1 (host, isIP) {
+  const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+  re.lastIndex = 0;
+  return host.replace(re, (ch) => HOST_DELIMS[ch])
+}
+
+/**
+ * Normalizes percent escapes and optionally decodes only unreserved ASCII bytes.
+ * Reserved delimiters such as `%2F` and `%2E` stay escaped.
+ *
+ * @param {string} input
+ * @param {boolean} [decodeUnreserved=false]
+ * @returns {string}
+ */
+function normalizePercentEncoding$1 (input, decodeUnreserved = false) {
+  if (input.indexOf('%') === -1) {
+    return input
   }
-  if (component.path !== undefined) {
-    component.path = func(component.path);
+
+  let output = '';
+
+  for (let i = 0; i < input.length; i++) {
+    if (input[i] === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3);
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase();
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+
+        if (decodeUnreserved && isUnreserved(decoded)) {
+          output += decoded;
+        } else {
+          output += '%' + normalizedHex;
+        }
+
+        i += 2;
+        continue
+      }
+    }
+
+    output += input[i];
   }
-  if (component.query !== undefined) {
-    component.query = func(component.query);
+
+  return output
+}
+
+/**
+ * Normalizes path data without turning reserved escapes into live path syntax.
+ * Valid escapes are uppercased, raw unsafe characters are escaped, and only
+ * unreserved bytes that are not `.` are decoded.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function normalizePathEncoding$1 (input) {
+  let output = '';
+
+  for (let i = 0; i < input.length; i++) {
+    if (input[i] === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3);
+      if (isHexPair(hex)) {
+        const normalizedHex = hex.toUpperCase();
+        const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+
+        if (decoded !== '.' && isUnreserved(decoded)) {
+          output += decoded;
+        } else {
+          output += '%' + normalizedHex;
+        }
+
+        i += 2;
+        continue
+      }
+    }
+
+    if (isPathCharacter(input[i])) {
+      output += input[i];
+    } else {
+      output += escape(input[i]);
+    }
   }
-  if (component.fragment !== undefined) {
-    component.fragment = func(component.fragment);
+
+  return output
+}
+
+/**
+ * Escapes a component while preserving existing valid percent escapes.
+ *
+ * @param {string} input
+ * @returns {string}
+ */
+function escapePreservingEscapes$1 (input) {
+  let output = '';
+
+  for (let i = 0; i < input.length; i++) {
+    if (input[i] === '%' && i + 2 < input.length) {
+      const hex = input.slice(i + 1, i + 3);
+      if (isHexPair(hex)) {
+        output += '%' + hex.toUpperCase();
+        i += 2;
+        continue
+      }
+    }
+
+    output += escape(input[i]);
   }
-  return component
+
+  return output
 }
 
 /**
@@ -40990,7 +41193,7 @@ function recomposeAuthority$1 (component) {
       if (ipV6res.isIPV6 === true) {
         host = `[${ipV6res.escapedHost}]`;
       } else {
-        host = component.host;
+        host = reescapeHostDelimiters$1(host, false);
       }
     }
     uriTokens.push(host);
@@ -41006,7 +41209,10 @@ function recomposeAuthority$1 (component) {
 var utils = {
   nonSimpleDomain: nonSimpleDomain$1,
   recomposeAuthority: recomposeAuthority$1,
-  normalizeComponentEncoding: normalizeComponentEncoding$1,
+  reescapeHostDelimiters: reescapeHostDelimiters$1,
+  normalizePercentEncoding: normalizePercentEncoding$1,
+  normalizePathEncoding: normalizePathEncoding$1,
+  escapePreservingEscapes: escapePreservingEscapes$1,
   removeDotSegments: removeDotSegments$1,
   isIPv4: isIPv4$1,
   isUUID: isUUID$1,
@@ -41280,7 +41486,7 @@ var schemes = {
   getSchemeHandler: getSchemeHandler$1,
 };
 
-const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = utils;
+const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = utils;
 const { SCHEMES, getSchemeHandler } = schemes;
 
 /**
@@ -41291,7 +41497,7 @@ const { SCHEMES, getSchemeHandler } = schemes;
  */
 function normalize (uri, options) {
   if (typeof uri === 'string') {
-    uri = /** @type {T} */ (serialize(parse(uri, options), options));
+    uri = /** @type {T} */ (normalizeString(uri, options));
   } else if (typeof uri === 'object') {
     uri = /** @type {T} */ (parse(serialize(uri, options), options));
   }
@@ -41386,21 +41592,10 @@ function resolveComponent (base, relative, options, skipNormalization) {
  * @returns {boolean}
  */
 function equal$2 (uriA, uriB, options) {
-  if (typeof uriA === 'string') {
-    uriA = unescape(uriA);
-    uriA = serialize(normalizeComponentEncoding(parse(uriA, options), true), { ...options, skipEscape: true });
-  } else if (typeof uriA === 'object') {
-    uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-  }
-
-  if (typeof uriB === 'string') {
-    uriB = unescape(uriB);
-    uriB = serialize(normalizeComponentEncoding(parse(uriB, options), true), { ...options, skipEscape: true });
-  } else if (typeof uriB === 'object') {
-    uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-  }
+  const normalizedA = normalizeComparableURI(uriA, options);
+  const normalizedB = normalizeComparableURI(uriB, options);
 
-  return uriA.toLowerCase() === uriB.toLowerCase()
+  return normalizedA !== undefined && normalizedB !== undefined && normalizedA.toLowerCase() === normalizedB.toLowerCase()
 }
 
 /**
@@ -41436,13 +41631,13 @@ function serialize (cmpts, opts) {
 
   if (component.path !== undefined) {
     if (!options.skipEscape) {
-      component.path = escape(component.path);
+      component.path = escapePreservingEscapes(component.path);
 
       if (component.scheme !== undefined) {
         component.path = component.path.split('%3A').join(':');
       }
     } else {
-      component.path = unescape(component.path);
+      component.path = normalizePercentEncoding(component.path);
     }
   }
 
@@ -41493,12 +41688,29 @@ function serialize (cmpts, opts) {
 
 const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
 
+/**
+ * @param {import('./types/index').URIComponent} parsed
+ * @param {RegExpMatchArray} matches
+ * @returns {string|undefined}
+ */
+function getParseError (parsed, matches) {
+  if (matches[2] !== undefined && parsed.path && parsed.path[0] !== '/') {
+    return 'URI path must start with "/" when authority is present.'
+  }
+
+  if (typeof parsed.port === 'number' && (parsed.port < 0 || parsed.port > 65535)) {
+    return 'URI port is malformed.'
+  }
+
+  return undefined
+}
+
 /**
  * @param {string} uri
  * @param {import('./types/index').Options} [opts]
- * @returns
+ * @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean }}
  */
-function parse (uri, opts) {
+function parseWithStatus (uri, opts) {
   const options = Object.assign({}, opts);
   /** @type {import('./types/index').URIComponent} */
   const parsed = {
@@ -41511,6 +41723,8 @@ function parse (uri, opts) {
     fragment: undefined
   };
 
+  let malformedAuthorityOrPort = false;
+
   let isIP = false;
   if (options.reference === 'suffix') {
     if (options.scheme) {
@@ -41536,6 +41750,13 @@ function parse (uri, opts) {
     if (isNaN(parsed.port)) {
       parsed.port = matches[5];
     }
+
+    const parseError = getParseError(parsed, matches);
+    if (parseError !== undefined) {
+      parsed.error = parsed.error || parseError;
+      malformedAuthorityOrPort = true;
+    }
+
     if (parsed.host) {
       const ipv4result = isIPv4(parsed.host);
       if (ipv4result === false) {
@@ -41584,14 +41805,18 @@ function parse (uri, opts) {
           parsed.scheme = unescape(parsed.scheme);
         }
         if (parsed.host !== undefined) {
-          parsed.host = unescape(parsed.host);
+          parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
         }
       }
       if (parsed.path) {
-        parsed.path = escape(unescape(parsed.path));
+        parsed.path = normalizePathEncoding(parsed.path);
       }
       if (parsed.fragment) {
-        parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+        try {
+          parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+        } catch {
+          parsed.error = parsed.error || 'URI malformed';
+        }
       }
     }
 
@@ -41602,7 +41827,54 @@ function parse (uri, opts) {
   } else {
     parsed.error = parsed.error || 'URI can not be parsed.';
   }
-  return parsed
+  return { parsed, malformedAuthorityOrPort }
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns
+ */
+function parse (uri, opts) {
+  return parseWithStatus(uri, opts).parsed
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {string}
+ */
+function normalizeString (uri, opts) {
+  return normalizeStringWithStatus(uri, opts).normalized
+}
+
+/**
+ * @param {string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {{ normalized: string, malformedAuthorityOrPort: boolean }}
+ */
+function normalizeStringWithStatus (uri, opts) {
+  const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+  return {
+    normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+    malformedAuthorityOrPort
+  }
+}
+
+/**
+ * @param {import ('./types/index').URIComponent|string} uri
+ * @param {import('./types/index').Options} [opts]
+ * @returns {string|undefined}
+ */
+function normalizeComparableURI (uri, opts) {
+  if (typeof uri === 'string') {
+    const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+    return malformedAuthorityOrPort ? undefined : normalized
+  }
+
+  if (typeof uri === 'object') {
+    return serialize(uri, opts)
+  }
 }
 
 const fastUri = {
@@ -41722,7 +41994,7 @@ uri$1.default = uri;
 	    constructor(opts = {}) {
 	        this.schemas = {};
 	        this.refs = {};
-	        this.formats = {};
+	        this.formats = Object.create(null);
 	        this._compilations = new Set();
 	        this._loading = {};
 	        this._cache = new Map();
@@ -46552,9 +46824,10 @@ let McpServer$1 = class McpServer {
                 }
             }
             else if (typeof firstArg === 'object' && firstArg !== null) {
-                // Not a ZodRawShapeCompat, so must be annotations in this position
-                // Case: tool(name, annotations, cb)
-                // Or: tool(name, description, annotations, cb)
+                // ToolAnnotations values are primitives. Nested objects indicate a misplaced schema
+                if (Object.values(firstArg).some(v => typeof v === 'object' && v !== null)) {
+                    throw new Error(`Tool ${name} expected a Zod schema or ToolAnnotations, but received an unrecognized object`);
+                }
                 annotations = rest.shift();
             }
         }
@@ -46726,7 +46999,7 @@ function isZodRawShapeCompat(obj) {
 }
 /**
  * Converts a provided Zod schema to a Zod object if it is a ZodRawShapeCompat,
- * otherwise returns the schema as is.
+ * otherwise returns the schema as is. Throws if the value is not a valid Zod schema.
  */
 function getZodSchemaObject(schema) {
     if (!schema) {
@@ -46735,6 +47008,9 @@ function getZodSchemaObject(schema) {
     if (isZodRawShapeCompat(schema)) {
         return (0, zod_compat_js_1.objectFromShape)(schema);
     }
+    if (!isZodSchemaInstance(schema)) {
+        throw new Error('inputSchema must be a Zod schema or raw shape, received an unrecognized object');
+    }
     return schema;
 }
 function promptArgumentsFromSchema(schema) {