@vitalsend/mcp 0.0.0-stage → 0.2.0

package/dist/vitalsend-mcp.js

@@ -0,0 +1,1515 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+// src/index.js
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+
+// src/server.js
+import { McpServer } from "@modelcontextprotocol/server";
+import { z } from "zod";
+
+// src/send.js
+import { openAsBlob } from "node:fs";
+import { basename } from "node:path";
+import { randomBytes as randomBytes4 } from "node:crypto";
+
+// src/crypto.js
+import { randomInt } from "node:crypto";
+
+// vendor/crypto/encrypt.js
+import sodium3 from "libsodium-wrappers-sumo";
+
+// vendor/crypto/format.js
+import sodium from "libsodium-wrappers-sumo";
+var enc = new TextEncoder();
+var dec = new TextDecoder();
+var HEADER_MAGIC = "E2EEFILE";
+var HEADER_VERSION = 3;
+var HEADER_MAC_BYTES = 32;
+var PASSWORD_MIN_LENGTH = 10;
+var MAX_HEADER_BYTES = 128 * 1024;
+var MAX_METADATA_BYTES = 32 * 1024;
+var MAX_CHUNK_SIZE = 64 * 1024 * 1024;
+var DEFAULT_CHUNK_SIZE = 32 * 1024 * 1024;
+var KDF_CONTEXT_CHUNK = "vitalsend:chunk:v3";
+var KDF_CONTEXT_META = "vitalsend:meta:v3";
+var KDF_CONTEXT_HEADER = "vitalsend:header:v3";
+function u8concat(...chunks) {
+  const len = chunks.reduce((a, c) => a + c.length, 0);
+  const out = new Uint8Array(len);
+  let off = 0;
+  for (const c of chunks) {
+    out.set(c, off);
+    off += c.length;
+  }
+  return out;
+}
+function u32be(n) {
+  const b = new Uint8Array(4);
+  b[0] = n >>> 24 & 255;
+  b[1] = n >>> 16 & 255;
+  b[2] = n >>> 8 & 255;
+  b[3] = n & 255;
+  return b;
+}
+function u64be(n) {
+  const out = new Uint8Array(8);
+  const dv = new DataView(out.buffer);
+  dv.setBigUint64(0, BigInt(n), false);
+  return out;
+}
+function readU32be(u8, off) {
+  return (u8[off] << 24 | u8[off + 1] << 16 | u8[off + 2] << 8 | u8[off + 3]) >>> 0;
+}
+function readU64be(u8, off) {
+  const dv = new DataView(u8.buffer, u8.byteOffset + off, 8);
+  return Number(dv.getBigUint64(0, false));
+}
+function ensureAvailable(u8, off, needed, label) {
+  if (off + needed > u8.length) {
+    throw new Error(`Truncated header while reading ${label}.`);
+  }
+}
+function deriveSubkey(rootKey, context) {
+  return sodium.crypto_generichash(32, context, rootKey);
+}
+function parseHeaderV3(headerBytes) {
+  if (headerBytes.length > MAX_HEADER_BYTES) throw new Error("Header too large.");
+  let off = 0;
+  ensureAvailable(headerBytes, off, 8, "magic");
+  const magic = dec.decode(headerBytes.slice(off, off + 8));
+  off += 8;
+  if (magic !== HEADER_MAGIC) throw new Error("Bad magic");
+  ensureAvailable(headerBytes, off, 1, "version");
+  const ver = headerBytes[off++];
+  if (ver !== HEADER_VERSION) throw new Error("Unsupported version");
+  ensureAvailable(headerBytes, off, 4, "chunk size");
+  const chunkSize = readU32be(headerBytes, off);
+  off += 4;
+  if (chunkSize < 1 || chunkSize > MAX_CHUNK_SIZE) throw new Error("Invalid chunk size");
+  ensureAvailable(headerBytes, off, 1, "flags");
+  const flags = headerBytes[off++];
+  const hasPwhash = (flags & 1) !== 0;
+  ensureAvailable(headerBytes, off, 8, "total chunks");
+  const totalChunks = readU64be(headerBytes, off);
+  off += 8;
+  if (totalChunks < 1) throw new Error("Invalid total chunks");
+  ensureAvailable(headerBytes, off, 16, "file nonce");
+  const fileNonce = headerBytes.slice(off, off + 16);
+  off += 16;
+  ensureAvailable(headerBytes, off, 4, "pwhash length");
+  const pwhashLen = readU32be(headerBytes, off);
+  off += 4;
+  ensureAvailable(headerBytes, off, pwhashLen, "pwhash block");
+  const pwhashBlock = headerBytes.slice(off, off + pwhashLen);
+  off += pwhashLen;
+  ensureAvailable(headerBytes, off, sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES, "metadata nonce");
+  const metaNonce = headerBytes.slice(off, off + sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  off += sodium.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES;
+  ensureAvailable(headerBytes, off, 4, "metadata length");
+  const metaLen = readU32be(headerBytes, off);
+  off += 4;
+  if (metaLen < sodium.crypto_aead_xchacha20poly1305_ietf_ABYTES || metaLen > MAX_METADATA_BYTES) {
+    throw new Error("Invalid metadata length");
+  }
+  ensureAvailable(headerBytes, off, metaLen, "metadata cipher");
+  const metaCipher = headerBytes.slice(off, off + metaLen);
+  off += metaLen;
+  ensureAvailable(headerBytes, off, HEADER_MAC_BYTES, "header MAC");
+  const headerMac = headerBytes.slice(off, off + HEADER_MAC_BYTES);
+  off += HEADER_MAC_BYTES;
+  if (off !== headerBytes.length) throw new Error("Unexpected header size");
+  return {
+    chunkSize,
+    totalChunks,
+    hasPwhash,
+    fileNonce,
+    pwhashLen,
+    pwhashBlock,
+    metaNonce,
+    metaCipher,
+    headerMac,
+    headerBody: headerBytes.slice(0, headerBytes.length - HEADER_MAC_BYTES)
+  };
+}
+function chunkNonce(fileNonce, index) {
+  return u8concat(fileNonce, u64be(index));
+}
+function sealChunk(chunkKey, fileNonce, index, plain) {
+  return sodium.crypto_aead_xchacha20poly1305_ietf_encrypt(
+    plain,
+    u64be(index),
+    null,
+    chunkNonce(fileNonce, index),
+    chunkKey
+  );
+}
+function buildHeader({ chunkSize, hasPassword, totalChunks, fileNonce, pwhashBlock, metaNonce, metaCipher, headerMacKey }) {
+  const headerBody = u8concat(
+    enc.encode(HEADER_MAGIC),
+    new Uint8Array([HEADER_VERSION]),
+    u32be(chunkSize),
+    new Uint8Array([hasPassword ? 1 : 0]),
+    u64be(totalChunks),
+    fileNonce,
+    u32be(pwhashBlock.length),
+    pwhashBlock,
+    metaNonce,
+    u32be(metaCipher.length),
+    metaCipher
+  );
+  const headerMac = sodium.crypto_generichash(HEADER_MAC_BYTES, headerBody, headerMacKey);
+  return u8concat(headerBody, headerMac);
+}
+function verifyHeaderMac(parsed, headerMacKey) {
+  const expected = sodium.crypto_generichash(HEADER_MAC_BYTES, parsed.headerBody, headerMacKey);
+  return sodium.memcmp(parsed.headerMac, expected);
+}
+
+// vendor/crypto/kdf.js
+import sodium2 from "libsodium-wrappers-sumo";
+var PASSWORD_VERIFIER_CONTEXT = "vitalsend:password-verifier:v1";
+function normalizePassword(password) {
+  if (password == null) return null;
+  return String(password).trim().toUpperCase();
+}
+function assertPassword(password) {
+  if (typeof password !== "string" || password.length < PASSWORD_MIN_LENGTH) {
+    throw new Error(`Password must be at least ${PASSWORD_MIN_LENGTH} characters.`);
+  }
+}
+function buildPasswordHashBlock(password, linkKeyBytes) {
+  if (password == null) {
+    return { pwhashBlock: new Uint8Array(0), rootKey: linkKeyBytes };
+  }
+  const normalized = normalizePassword(password);
+  assertPassword(normalized);
+  const salt = sodium2.randombytes_buf(sodium2.crypto_pwhash_SALTBYTES);
+  const ops = sodium2.crypto_pwhash_OPSLIMIT_MODERATE;
+  const mem = sodium2.crypto_pwhash_MEMLIMIT_MODERATE;
+  const passwordKey = sodium2.crypto_pwhash(32, normalized, salt, ops, mem, sodium2.crypto_pwhash_ALG_DEFAULT);
+  const rootKey = sodium2.crypto_generichash(32, linkKeyBytes, passwordKey);
+  sodium2.memzero(passwordKey);
+  return { pwhashBlock: u8concat(salt, u64be(ops), u64be(mem)), rootKey };
+}
+function deriveRootKey(linkKeyBytes, password, pwhashBlock) {
+  if (!pwhashBlock || pwhashBlock.length === 0) {
+    return linkKeyBytes;
+  }
+  if (password == null) throw new Error("Password required to decrypt");
+  const normalized = normalizePassword(password);
+  assertPassword(normalized);
+  if (pwhashBlock.length !== sodium2.crypto_pwhash_SALTBYTES + 16) {
+    throw new Error("Invalid pwhash block");
+  }
+  const salt = pwhashBlock.slice(0, sodium2.crypto_pwhash_SALTBYTES);
+  const ops = readU64be(pwhashBlock, sodium2.crypto_pwhash_SALTBYTES);
+  const mem = readU64be(pwhashBlock, sodium2.crypto_pwhash_SALTBYTES + 8);
+  if (ops < 1 || ops > sodium2.crypto_pwhash_OPSLIMIT_MODERATE || mem < 1 || mem > sodium2.crypto_pwhash_MEMLIMIT_MODERATE) {
+    throw new Error("Invalid password parameters");
+  }
+  const passwordKey = sodium2.crypto_pwhash(32, normalized, salt, ops, mem, sodium2.crypto_pwhash_ALG_DEFAULT);
+  const rootKey = sodium2.crypto_generichash(32, linkKeyBytes, passwordKey);
+  sodium2.memzero(passwordKey);
+  return rootKey;
+}
+async function derivePasswordVerifier(linkKeyBytes, password) {
+  await sodium2.ready;
+  const normalized = normalizePassword(password);
+  assertPassword(normalized);
+  const salt = sodium2.crypto_generichash(sodium2.crypto_pwhash_SALTBYTES, PASSWORD_VERIFIER_CONTEXT, linkKeyBytes);
+  const verifier = sodium2.crypto_pwhash(
+    32,
+    normalized,
+    salt,
+    sodium2.crypto_pwhash_OPSLIMIT_MODERATE,
+    sodium2.crypto_pwhash_MEMLIMIT_MODERATE,
+    sodium2.crypto_pwhash_ALG_DEFAULT
+  );
+  const encoded = sodium2.to_base64(verifier, sodium2.base64_variants.URLSAFE_NO_PADDING);
+  sodium2.memzero(verifier);
+  return encoded;
+}
+
+// vendor/crypto/encrypt.js
+var enc2 = new TextEncoder();
+var dec2 = new TextDecoder();
+var nowMs = () => typeof performance !== "undefined" && performance.now ? performance.now() : Date.now();
+function normalizeResumeOffset(resumeFromBytes, headerLength, chunkStride) {
+  const offset = Number(resumeFromBytes || 0);
+  if (!Number.isFinite(offset) || offset <= 0) {
+    return { resumeChunkIndex: 0, shouldUploadHeader: true };
+  }
+  if (offset < headerLength) {
+    return { resumeChunkIndex: 0, shouldUploadHeader: true };
+  }
+  const remaining = offset - headerLength;
+  const alignedRemaining = Math.floor(remaining / chunkStride) * chunkStride;
+  const resumeChunkIndex = Math.floor(alignedRemaining / chunkStride);
+  return {
+    resumeChunkIndex,
+    shouldUploadHeader: resumeChunkIndex === 0
+  };
+}
+function verifyResumeMetadata(parsed, metaKey, file) {
+  const metaPlain = sodium3.crypto_aead_xchacha20poly1305_ietf_decrypt(
+    null,
+    parsed.metaCipher,
+    parsed.fileNonce,
+    parsed.metaNonce,
+    metaKey
+  );
+  const meta = JSON.parse(dec2.decode(metaPlain));
+  if (Number(meta?.size || 0) !== Number(file.size || 0)) {
+    throw new Error("Resume data mismatch.");
+  }
+  if (meta?.name && file.name && meta.name !== file.name) {
+    throw new Error("Resume data mismatch.");
+  }
+  const metaMtime = meta?.lastModified ?? null;
+  const fileMtime = file?.lastModified ?? null;
+  if (metaMtime !== null && fileMtime !== null && Number(metaMtime) !== Number(fileMtime)) {
+    throw new Error("Resume data mismatch.");
+  }
+}
+function buildEncryptionState({ file, linkKeyBytes, password, chunkSize, totalChunks, resumeHeaderBytes }) {
+  if (resumeHeaderBytes) {
+    const headerBytes2 = resumeHeaderBytes instanceof Uint8Array ? resumeHeaderBytes : new Uint8Array(resumeHeaderBytes || []);
+    let parsed;
+    try {
+      parsed = parseHeaderV3(headerBytes2);
+    } catch {
+      throw new Error("Resume data mismatch.");
+    }
+    if (parsed.chunkSize !== chunkSize || parsed.totalChunks !== totalChunks) {
+      throw new Error("Resume data mismatch.");
+    }
+    const hasPassword = parsed.hasPwhash;
+    if (hasPassword !== (password != null)) {
+      throw new Error("Resume data mismatch.");
+    }
+    let rootKey2;
+    try {
+      rootKey2 = deriveRootKey(linkKeyBytes, password, parsed.pwhashBlock);
+    } catch {
+      throw new Error("Resume data mismatch.");
+    }
+    const chunkKey2 = deriveSubkey(rootKey2, KDF_CONTEXT_CHUNK);
+    const metaKey2 = deriveSubkey(rootKey2, KDF_CONTEXT_META);
+    const headerMacKey2 = deriveSubkey(rootKey2, KDF_CONTEXT_HEADER);
+    if (!verifyHeaderMac(parsed, headerMacKey2)) {
+      throw new Error("Resume data mismatch.");
+    }
+    verifyResumeMetadata(parsed, metaKey2, file);
+    return { headerBytes: headerBytes2, fileNonce: parsed.fileNonce, rootKey: rootKey2, chunkKey: chunkKey2, metaKey: metaKey2, headerMacKey: headerMacKey2 };
+  }
+  const { pwhashBlock, rootKey } = buildPasswordHashBlock(password, linkKeyBytes);
+  const chunkKey = deriveSubkey(rootKey, KDF_CONTEXT_CHUNK);
+  const metaKey = deriveSubkey(rootKey, KDF_CONTEXT_META);
+  const headerMacKey = deriveSubkey(rootKey, KDF_CONTEXT_HEADER);
+  const meta = {
+    name: file.name,
+    size: file.size,
+    type: file.type || "application/octet-stream",
+    lastModified: file.lastModified ?? null
+  };
+  const metaBytes = enc2.encode(JSON.stringify(meta));
+  if (metaBytes.length + sodium3.crypto_aead_xchacha20poly1305_ietf_ABYTES > MAX_METADATA_BYTES) {
+    throw new Error("Metadata too large.");
+  }
+  const metaNonce = sodium3.randombytes_buf(sodium3.crypto_aead_xchacha20poly1305_ietf_NPUBBYTES);
+  const fileNonce = sodium3.randombytes_buf(16);
+  const metaCipher = sodium3.crypto_aead_xchacha20poly1305_ietf_encrypt(
+    metaBytes,
+    fileNonce,
+    null,
+    metaNonce,
+    metaKey
+  );
+  const headerBytes = buildHeader({
+    chunkSize,
+    hasPassword: password != null,
+    totalChunks,
+    fileNonce,
+    pwhashBlock,
+    metaNonce,
+    metaCipher,
+    headerMacKey
+  });
+  return { headerBytes, fileNonce, rootKey, chunkKey, metaKey, headerMacKey };
+}
+async function encryptAndUpload({
+  file,
+  // File
+  uploadPart,
+  // async (partIndex:number, bytes:Uint8Array) => void
+  uploadHeader,
+  // async (bytes:Uint8Array) => void
+  linkKey = null,
+  // Uint8Array(32) or null to generate (shared in URL fragment)
+  outOfBandFileKey = null,
+  // legacy alias for linkKey
+  password = null,
+  // optional string (second factor)
+  chunkSize = DEFAULT_CHUNK_SIZE,
+  padToChunkBoundary = false,
+  // optional tail padding (disabled by default)
+  onProgress = null,
+  // optional (percent:number) => void
+  resumeFromBytes = 0,
+  // optional ciphertext offset to resume from
+  resumeHeaderBytes = null,
+  // encrypted header from original upload when resuming
+  onHeader = null,
+  // optional (bytes:Uint8Array) => void
+  debug = false
+}) {
+  await sodium3.ready;
+  if (!Number.isInteger(chunkSize) || chunkSize < 1 || chunkSize > MAX_CHUNK_SIZE) {
+    throw new Error("Invalid chunk size.");
+  }
+  const totalBytes = Number(file.size || 0);
+  const totalChunks = totalBytes === 0 ? 1 : Math.ceil(totalBytes / chunkSize);
+  const providedKey = linkKey ?? outOfBandFileKey;
+  const linkKeyBytes = providedKey ? new Uint8Array(providedKey) : sodium3.randombytes_buf(
+    sodium3.crypto_secretstream_xchacha20poly1305_KEYBYTES
+  );
+  const shareKey = new Uint8Array(linkKeyBytes);
+  const {
+    headerBytes,
+    fileNonce,
+    rootKey,
+    chunkKey,
+    metaKey,
+    headerMacKey
+  } = buildEncryptionState({ file, linkKeyBytes, password, chunkSize, totalChunks, resumeHeaderBytes });
+  if (typeof onHeader === "function") {
+    onHeader(headerBytes);
+  }
+  const cipherOverhead = sodium3.crypto_aead_xchacha20poly1305_ietf_ABYTES;
+  const chunkStride = chunkSize + cipherOverhead;
+  const { resumeChunkIndex, shouldUploadHeader } = normalizeResumeOffset(
+    resumeFromBytes,
+    headerBytes.length,
+    chunkStride
+  );
+  if (shouldUploadHeader) {
+    await uploadHeader(headerBytes, 0);
+  }
+  const reader = file.stream().getReader();
+  let buf = new Uint8Array(0);
+  let part = 0;
+  let processedBytes = Math.min(totalBytes, resumeChunkIndex * chunkSize);
+  const reportProgress = () => {
+    if (typeof onProgress !== "function") return;
+    if (!totalBytes) {
+      onProgress(100);
+      return;
+    }
+    const percent = Math.min(100, Math.floor(processedBytes / totalBytes * 100));
+    onProgress(percent);
+  };
+  const encryptChunk = async (plain, index) => sealChunk(chunkKey, fileNonce, index, plain);
+  const partOffset = (index) => headerBytes.length + index * chunkStride;
+  const pipelineStats = debug ? { chunks: 0, encryptMs: 0, uploadMs: 0 } : null;
+  while (true) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    const chunk = new Uint8Array(value);
+    buf = buf.length ? u8concat(buf, chunk) : chunk;
+    while (buf.length >= chunkSize) {
+      const plain = buf.slice(0, chunkSize);
+      buf = buf.slice(chunkSize);
+      const encryptStart = debug ? nowMs() : 0;
+      const ct = await encryptChunk(plain, part);
+      const encryptMs = debug ? nowMs() - encryptStart : 0;
+      if (part >= resumeChunkIndex) {
+        const uploadStart = debug ? nowMs() : 0;
+        await uploadPart(part, ct, partOffset(part));
+        const uploadMs = debug ? nowMs() - uploadStart : 0;
+        if (pipelineStats) {
+          pipelineStats.chunks += 1;
+          pipelineStats.encryptMs += encryptMs;
+          pipelineStats.uploadMs += uploadMs;
+          console.info("[vitalsend] upload chunk", part, "encryptMs", Math.round(encryptMs), "uploadMs", Math.round(uploadMs));
+        }
+      }
+      part += 1;
+      processedBytes += plain.length;
+      reportProgress();
+    }
+  }
+  if (totalBytes === 0) {
+    const encryptStart = debug ? nowMs() : 0;
+    const ct = await encryptChunk(new Uint8Array(0), part);
+    const encryptMs = debug ? nowMs() - encryptStart : 0;
+    if (part >= resumeChunkIndex) {
+      const uploadStart = debug ? nowMs() : 0;
+      await uploadPart(part, ct, partOffset(part));
+      const uploadMs = debug ? nowMs() - uploadStart : 0;
+      if (pipelineStats) {
+        pipelineStats.chunks += 1;
+        pipelineStats.encryptMs += encryptMs;
+        pipelineStats.uploadMs += uploadMs;
+        console.info("[vitalsend] upload chunk", part, "encryptMs", Math.round(encryptMs), "uploadMs", Math.round(uploadMs));
+      }
+    }
+    part += 1;
+    reportProgress();
+  } else if (buf.length > 0) {
+    let finalPlain = buf;
+    if (padToChunkBoundary && finalPlain.length < chunkSize) {
+      const padLen = chunkSize - finalPlain.length;
+      const pad = new Uint8Array(padLen);
+      pad.fill(padLen);
+      finalPlain = u8concat(finalPlain, pad);
+    }
+    const encryptStart = debug ? nowMs() : 0;
+    const ct = await encryptChunk(finalPlain, part);
+    const encryptMs = debug ? nowMs() - encryptStart : 0;
+    if (part >= resumeChunkIndex) {
+      const uploadStart = debug ? nowMs() : 0;
+      await uploadPart(part, ct, partOffset(part));
+      const uploadMs = debug ? nowMs() - uploadStart : 0;
+      if (pipelineStats) {
+        pipelineStats.chunks += 1;
+        pipelineStats.encryptMs += encryptMs;
+        pipelineStats.uploadMs += uploadMs;
+        console.info("[vitalsend] upload chunk", part, "encryptMs", Math.round(encryptMs), "uploadMs", Math.round(uploadMs));
+      }
+    }
+    part += 1;
+    processedBytes += buf.length;
+    reportProgress();
+  }
+  if (pipelineStats && pipelineStats.chunks > 0) {
+    console.info(
+      "[vitalsend] upload pipeline totals",
+      "chunks",
+      pipelineStats.chunks,
+      "encryptMs",
+      Math.round(pipelineStats.encryptMs),
+      "uploadMs",
+      Math.round(pipelineStats.uploadMs)
+    );
+  }
+  sodium3.memzero(chunkKey);
+  sodium3.memzero(metaKey);
+  sodium3.memzero(headerMacKey);
+  sodium3.memzero(rootKey);
+  sodium3.memzero(linkKeyBytes);
+  return shareKey;
+}
+
+// vendor/crypto/decrypt.js
+import sodium4 from "libsodium-wrappers-sumo";
+var dec3 = new TextDecoder();
+
+// vendor/crypto/link-key.js
+function toBase64(bytes) {
+  if (typeof Buffer !== "undefined") {
+    return Buffer.from(bytes).toString("base64");
+  }
+  let binary = "";
+  for (const byte of bytes) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+}
+function toBase64Url(value) {
+  return value.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function encodeLinkKey(bytes) {
+  if (!(bytes instanceof Uint8Array) || bytes.length !== 32) {
+    throw new Error("Link key must be 32 bytes.");
+  }
+  return toBase64Url(toBase64(bytes));
+}
+function buildShareLink(baseLink, encodedKey, requiresPassword) {
+  if (!baseLink) return "";
+  if (!encodedKey) return baseLink;
+  const base = String(baseLink).split("#")[0];
+  const params = new URLSearchParams();
+  params.set("k", encodedKey);
+  if (requiresPassword) params.set("p", "1");
+  return `${base}#${params.toString()}`;
+}
+
+// src/crypto.js
+var PASSWORD_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+var PASSWORD_LENGTH = 10;
+function generatePassword() {
+  let out = "";
+  for (let i = 0; i < PASSWORD_LENGTH; i += 1) {
+    out += PASSWORD_ALPHABET[randomInt(PASSWORD_ALPHABET.length)];
+  }
+  return out;
+}
+
+// src/paths.js
+import { realpath, stat } from "node:fs/promises";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+var PathNotAllowed = class extends Error {
+  constructor() {
+    super("That file is outside the folders this tool may read, or is not a file.");
+    this.name = "PathNotAllowed";
+  }
+};
+var RootRequired = class extends Error {
+  constructor() {
+    super("This app does not tell the tool which folder you work in. Set VITALSEND_ROOT to that folder in the tool's MCP configuration.");
+    this.name = "RootRequired";
+  }
+};
+var inside = (child, parent) => {
+  const rel = relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute(rel) && rel.split(sep)[0] !== "..";
+};
+async function realOrNull(p) {
+  try {
+    return await realpath(p);
+  } catch (_err) {
+    return null;
+  }
+}
+async function resolveAllowedFile(path, { roots, cwd, envRoot = "", home = homedir() }) {
+  let rootDirs;
+  if (roots && roots.length) {
+    rootDirs = roots.map((r) => String(r).startsWith("file:") ? fileURLToPath(r) : String(r));
+  } else if (envRoot) {
+    rootDirs = [envRoot];
+  } else {
+    const start = resolve(cwd);
+    if (start === resolve("/") || start === resolve(home)) throw new RootRequired();
+    rootDirs = [start];
+  }
+  const realRoots = (await Promise.all(rootDirs.map(realOrNull))).filter(Boolean);
+  const base = realRoots[0] || cwd;
+  const real = await realOrNull(resolve(base, String(path || "")));
+  if (!real || !realRoots.some((root) => inside(real, root))) throw new PathNotAllowed();
+  const info = await stat(real).catch(() => null);
+  if (!info?.isFile()) throw new PathNotAllowed();
+  return real;
+}
+
+// src/api.js
+var CLIENT_ID = "vitalsend-mcp";
+var API_KEY_GRANT = "urn:vitalsend:params:oauth:grant-type:api-key";
+var FLOW = "/api/v1/managedsend";
+var STEP_TOKEN_SKEW_MS = 3e4;
+var PART_ATTEMPTS = 3;
+var DEFAULT_CHUNK_SIZE2 = 8 * 1024 * 1024;
+var MESSAGES = {
+  credits_insufficient: "Not enough credits.",
+  recipient_not_allowed: "This API key may not send to that recipient.",
+  invalid_grant: "The VitalSend login is no longer valid.",
+  unauthorized: "VitalSend refused the request.",
+  network: "VitalSend could not be reached.",
+  server: "VitalSend could not complete the request."
+};
+var ApiError = class extends Error {
+  constructor(code, status = 0) {
+    super(MESSAGES[code] || MESSAGES.server);
+    this.name = "ApiError";
+    this.code = code;
+    this.status = status;
+  }
+};
+async function send(fetchImpl, url, init) {
+  try {
+    return await fetchImpl(url, { ...init, redirect: "error" });
+  } catch (_err) {
+    throw new ApiError("network");
+  }
+}
+async function readJSON(res) {
+  try {
+    return await res.json();
+  } catch (_err) {
+    return {};
+  }
+}
+async function failure(res) {
+  const data = await readJSON(res);
+  if (data?.code === "credits_insufficient" || data?.code === "recipient_not_allowed") {
+    return new ApiError(data.code, res.status);
+  }
+  if (data?.error === "invalid_grant") return new ApiError("invalid_grant", res.status);
+  if (res.status === 401 || res.status === 403) return new ApiError("unauthorized", res.status);
+  return new ApiError("server", res.status);
+}
+function createTokenClient({ baseUrl: baseUrl2, fetchImpl = fetch }) {
+  const token = async (form) => {
+    const res = await send(fetchImpl, `${baseUrl2}/api/v1/oauth/token`, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams(form).toString()
+    });
+    if (!res.ok) throw await failure(res);
+    const data = await readJSON(res);
+    return {
+      accessToken: data.access_token || "",
+      expiresIn: Number(data.expires_in || 0),
+      refreshToken: data.refresh_token || ""
+    };
+  };
+  return {
+    exchangeCode: ({ code, verifier, redirectUri }) => token({
+      grant_type: "authorization_code",
+      code,
+      code_verifier: verifier,
+      redirect_uri: redirectUri,
+      client_id: CLIENT_ID
+    }),
+    refresh: (refreshToken) => token({ grant_type: "refresh_token", refresh_token: refreshToken }),
+    exchangeAPIKey: (apiKey) => token({ grant_type: API_KEY_GRANT, api_key: apiKey })
+  };
+}
+function jwtExpiresAt(token) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1], "base64url").toString());
+    return Number(payload.exp || 0) * 1e3;
+  } catch (_err) {
+    return 0;
+  }
+}
+function createSendSession({ baseUrl: baseUrl2, accessToken, fetchImpl = fetch }) {
+  const cookies = /* @__PURE__ */ new Map([["vitalsend_jwt", accessToken]]);
+  let stepToken = "";
+  let fileId = "";
+  let uploadId = "";
+  const cookieHeader = () => [...cookies].map(([k, v]) => `${k}=${v}`).join("; ");
+  const keepCookies = (res) => {
+    for (const line of res.headers.getSetCookie?.() || []) {
+      const [pair] = line.split(";");
+      const eq = pair.indexOf("=");
+      if (eq > 0) cookies.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
+    }
+  };
+  const request = async (path, { body, headers = {}, raw = false } = {}) => {
+    const res = await send(fetchImpl, `${baseUrl2}${FLOW}${path}`, {
+      method: "POST",
+      headers: {
+        Cookie: cookieHeader(),
+        ...stepToken ? { Authorization: `Bearer ${stepToken}` } : {},
+        ...raw ? {} : { "Content-Type": "application/json" },
+        ...headers
+      },
+      body: raw ? body : JSON.stringify(body ?? {})
+    });
+    keepCookies(res);
+    return res;
+  };
+  const refreshStep = async () => {
+    const res = await request("/prepare/refresh", { body: { file_id: fileId } });
+    if (!res.ok) throw await failure(res);
+    const data = await readJSON(res);
+    if (data.step_token) stepToken = data.step_token;
+  };
+  const call = async (path, body) => {
+    if (fileId && stepToken && jwtExpiresAt(stepToken) - Date.now() < STEP_TOKEN_SKEW_MS && jwtExpiresAt(stepToken) > 0) {
+      await refreshStep();
+    }
+    let res = await request(path, { body });
+    if (res.status === 401 && fileId) {
+      await refreshStep();
+      res = await request(path, { body });
+    }
+    if (!res.ok) throw await failure(res);
+    const data = await readJSON(res);
+    if (data.step_token) stepToken = data.step_token;
+    return data;
+  };
+  const postPart = async (bytes, offset, chunkIndex) => {
+    for (let attempt = 0; attempt < PART_ATTEMPTS; attempt += 1) {
+      const res = await request("/prepare/part", {
+        raw: true,
+        body: bytes,
+        headers: {
+          "Content-Type": "application/octet-stream",
+          "X-Vitalsend-Upload-Id": uploadId,
+          "X-Vitalsend-Upload-Offset": String(offset),
+          ...Number.isInteger(chunkIndex) ? { "X-Vitalsend-Chunk-Index": String(chunkIndex) } : {}
+        }
+      });
+      if (res.ok) return;
+      if (res.status === 401) {
+        await refreshStep();
+        continue;
+      }
+      if (res.status === 429 && attempt < PART_ATTEMPTS - 1) {
+        await new Promise((resolve2) => setTimeout(resolve2, 1e3));
+        continue;
+      }
+      throw await failure(res);
+    }
+    throw new ApiError("server");
+  };
+  return {
+    async init() {
+      stepToken = "";
+      await call("/init");
+    },
+    // The recipient lets a connection's allowlist refuse before anything is spent.
+    async quote({ sizeBytes, password, recipient = "" }) {
+      const data = await call("/quote", { file_size_bytes: sizeBytes, extra_password_enabled: !!password, recipient_email: recipient });
+      return { creditsNeeded: Number(data.credits_needed || 0) };
+    },
+    async reserve({ name, type, sizeBytes, passwordVerifier }) {
+      const data = await call("/reserve", {
+        filename: name,
+        file_type: type || "",
+        file_size_bytes: sizeBytes,
+        extra_password: passwordVerifier || ""
+      });
+      fileId = data.file_id || "";
+      return { expiresAt: data.expires_at || "", creditsNeeded: Number(data.credits_needed || 0) };
+    },
+    async upload({ blob, linkKey, password, chunkSize = DEFAULT_CHUNK_SIZE2, onProgress }) {
+      const started = await call("/prepare/start", { file_id: fileId, restart: false });
+      uploadId = started.upload_id || fileId;
+      let offset = 0;
+      await encryptAndUpload({
+        file: blob,
+        linkKey,
+        password: password || null,
+        chunkSize,
+        onProgress,
+        uploadHeader: async (bytes) => {
+          await postPart(bytes, offset);
+          offset += bytes.length;
+        },
+        uploadPart: async (index, bytes) => {
+          await postPart(bytes, offset, index);
+          offset += bytes.length;
+        }
+      });
+    },
+    async complete({ name, type, sizeBytes }) {
+      await call("/prepare/complete", {
+        upload_id: uploadId || fileId,
+        file_id: fileId,
+        original_filename: name,
+        file_type: type || "",
+        file_size_bytes: sizeBytes
+      });
+    },
+    async link() {
+      const data = await call("/link", { file_id: fileId, payment_id: "" });
+      return data.link || "";
+    },
+    async sendEmail({ recipient, link }) {
+      await call("/send-email", { file_id: fileId, recipient_email: recipient, link });
+    }
+  };
+}
+
+// src/credentials.js
+import { mkdir, readFile, writeFile, rename, rm, chmod, open, stat as stat2 } from "node:fs/promises";
+import { homedir as homedir2 } from "node:os";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+var FILE = "mcp-credentials.json";
+var EXPIRY_SKEW_MS = 3e4;
+var LOCK = "mcp-credentials.lock";
+var LOCK_STALE_MS = 3e4;
+var LOCK_WAIT_MS = 15e3;
+var LoginRequired = class extends Error {
+  constructor() {
+    super("Sign in to VitalSend to send files.");
+    this.name = "LoginRequired";
+  }
+};
+function defaultCredentialsDir(env = process.env, platform = process.platform) {
+  if (platform === "win32" && env.APPDATA) return join(env.APPDATA, "vitalsend");
+  return join(env.XDG_CONFIG_HOME || join(homedir2(), ".config"), "vitalsend");
+}
+function expiresAt(accessToken, expiresIn, now) {
+  try {
+    const payload = JSON.parse(Buffer.from(accessToken.split(".")[1], "base64url").toString());
+    if (payload.exp) return payload.exp * 1e3;
+  } catch (_err) {
+  }
+  return now() + Number(expiresIn || 0) * 1e3;
+}
+function createCredentials({ dir = defaultCredentialsDir(), env = process.env, tokens: tokens2, now = Date.now }) {
+  const file = join(dir, FILE);
+  let cached = null;
+  const load = async () => {
+    try {
+      const data = JSON.parse(await readFile(file, "utf8"));
+      return typeof data?.refreshToken === "string" && data.refreshToken ? data : null;
+    } catch (_err) {
+      return null;
+    }
+  };
+  const withLock = async (fn) => {
+    await mkdir(dir, { recursive: true, mode: 448 });
+    const lock = join(dir, LOCK);
+    const started = now();
+    for (; ; ) {
+      try {
+        const handle = await open(lock, "wx", 384);
+        await handle.close();
+        break;
+      } catch (err) {
+        if (err.code !== "EEXIST") throw err;
+        const info = await stat2(lock).catch(() => null);
+        if (info && Date.now() - info.mtimeMs > LOCK_STALE_MS) await rm(lock, { force: true });
+        else if (now() - started > LOCK_WAIT_MS) throw err;
+        else await new Promise((resolve2) => setTimeout(resolve2, 25));
+      }
+    }
+    try {
+      return await fn();
+    } finally {
+      await rm(lock, { force: true });
+    }
+  };
+  const fresh = () => cached && cached.expiresAt - now() > EXPIRY_SKEW_MS;
+  const remember = (t) => {
+    cached = { accessToken: t.accessToken, expiresAt: expiresAt(t.accessToken, t.expiresIn, now) };
+    return t.accessToken;
+  };
+  const self = {
+    async mode() {
+      if (env.VITALSEND_API_KEY) return "api_key";
+      return await load() ? "oauth" : "none";
+    },
+    // Written to a private temp file and renamed into place, so a reader
+    // never sees half a file.
+    async save({ refreshToken }) {
+      await mkdir(dir, { recursive: true, mode: 448 });
+      await chmod(dir, 448);
+      const tmp = join(dir, `.${FILE}.${randomBytes(6).toString("hex")}`);
+      await writeFile(tmp, JSON.stringify({ refreshToken }), { mode: 384 });
+      await rename(tmp, file);
+    },
+    async clear() {
+      cached = null;
+      await rm(file, { force: true });
+    },
+    async accessToken() {
+      if (fresh()) return cached.accessToken;
+      if (env.VITALSEND_API_KEY) {
+        return remember(await tokens2.exchangeAPIKey(env.VITALSEND_API_KEY));
+      }
+      return withLock(async () => {
+        if (fresh()) return cached.accessToken;
+        const stored = await load();
+        if (!stored) throw new LoginRequired();
+        let next;
+        try {
+          next = await tokens2.refresh(stored.refreshToken);
+        } catch (err) {
+          if (err?.code === "invalid_grant") {
+            await self.clear();
+            throw new LoginRequired();
+          }
+          throw err;
+        }
+        await self.save({ refreshToken: next.refreshToken });
+        return remember(next);
+      });
+    },
+    // After a login: keep the refresh token, use the access token.
+    async adopt(loginTokens) {
+      await self.save({ refreshToken: loginTokens.refreshToken });
+      return remember(loginTokens);
+    }
+  };
+  return self;
+}
+
+// src/login.js
+import { createServer } from "node:http";
+import { randomBytes as randomBytes2, createHash } from "node:crypto";
+var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
+var LoginDeclined = class extends Error {
+  constructor() {
+    super("The VitalSend login was declined.");
+    this.name = "LoginDeclined";
+  }
+};
+var LoginTimeout = class extends Error {
+  constructor() {
+    super("The VitalSend login was not completed in time.");
+    this.name = "LoginTimeout";
+  }
+};
+var PAGE = (text) => `<!doctype html><meta charset="utf-8"><title>VitalSend</title><p style="font-family:system-ui;margin:3rem">${text}</p>`;
+async function startLogin({ baseUrl: baseUrl2, tokens: tokens2, connectionName, timeoutMs = DEFAULT_TIMEOUT_MS }) {
+  const verifier = randomBytes2(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const state = randomBytes2(24).toString("base64url");
+  let settle;
+  const done = new Promise((resolve2, reject) => {
+    settle = { resolve: resolve2, reject };
+  });
+  done.catch(() => {
+  });
+  let finished = false;
+  const server2 = createServer();
+  const finish = (fn) => {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);
+    server2.close();
+    server2.closeAllConnections?.();
+    fn();
+  };
+  server2.on("request", async (req, res) => {
+    const url2 = new URL(req.url, "http://127.0.0.1");
+    if (finished || url2.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    if (url2.searchParams.get("state") !== state) {
+      res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }).end(PAGE("This sign-in link is not valid."));
+      return;
+    }
+    if (url2.searchParams.get("error")) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(PAGE("Not connected. You can close this tab."));
+      finish(() => settle.reject(new LoginDeclined()));
+      return;
+    }
+    try {
+      const result = await tokens2.exchangeCode({ code: url2.searchParams.get("code") || "", verifier, redirectUri });
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(PAGE("Connected. You can go back to your app."));
+      finish(() => settle.resolve(result));
+    } catch (err) {
+      res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", Connection: "close" }).end(PAGE("Sign-in failed. Try again from your app."));
+      finish(() => settle.reject(err));
+    }
+  });
+  await new Promise((resolve2) => server2.listen(0, "127.0.0.1", resolve2));
+  const redirectUri = `http://127.0.0.1:${server2.address().port}/callback`;
+  const timer = setTimeout(() => finish(() => settle.reject(new LoginTimeout())), timeoutMs);
+  const url = new URL("/oauth/authorize/", baseUrl2);
+  url.search = new URLSearchParams({
+    client_id: CLIENT_ID,
+    redirect_uri: redirectUri,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state,
+    connection_name: connectionName || "AI app"
+  }).toString();
+  return {
+    url: url.toString(),
+    done,
+    cancel: () => finish(() => settle.reject(new LoginDeclined()))
+  };
+}
+
+// src/delivery-page.js
+import { createServer as createServer2 } from "node:http";
+import { randomBytes as randomBytes3, createHash as createHash2 } from "node:crypto";
+
+// vendor/vitalsend-share.js
+var SHARE_ROUTES = ["sms", "whatsapp", "telegram", "email"];
+function shareText(item, value) {
+  if (item === "password") return `The password for the file I sent you: ${value}`;
+  return `A file for you. It can be downloaded once: ${value}`;
+}
+function shareUrl(route, text) {
+  const enc3 = encodeURIComponent(text);
+  switch (route) {
+    case "sms":
+      return `sms:?&body=${enc3}`;
+    case "whatsapp":
+      return `https://wa.me/?text=${enc3}`;
+    case "telegram":
+      return `https://t.me/share/url?url=&text=${enc3}`;
+    case "email":
+      return `mailto:?body=${enc3}`;
+    default:
+      return "";
+  }
+}
+
+// src/delivery-page.js
+var STYLE = `body{font-family:system-ui,sans-serif;max-width:36rem;margin:3rem auto;padding:0 1rem;line-height:1.5}
+.card{border:1px solid #ccc;border-radius:1rem;padding:1.5rem}code{display:block;font-size:1.4rem;letter-spacing:.15em;margin:1rem 0;word-break:break-all}
+.row{display:flex;flex-wrap:wrap;gap:.5rem;margin:.75rem 0}a,button{padding:.5rem .9rem;border-radius:.5rem;border:1px solid #888;background:none;color:inherit;text-decoration:none;font:inherit;cursor:pointer}
+.dim{opacity:.4}.primary{background:#111;color:#fff}[hidden]{display:none}`;
+var SCRIPT = `(() => {
+const base = location.pathname;
+const $ = (id) => document.getElementById(id);
+const post = (action) => fetch(base + '/action', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ action }) });
+const labels = { sms: 'SMS', whatsapp: 'WhatsApp', telegram: 'Telegram', email: 'Email' };
+// Rebuilt only when what it shows changes: a button replaced by the next poll
+// loses a click that is under way.
+function shares(el, item, s) {
+  const key = JSON.stringify([s[item], s.dimmed[item]]);
+  if (el.dataset.key === key) return;
+  el.dataset.key = key;
+  el.textContent = '';
+  const copy = document.createElement('button');
+  copy.textContent = 'Copy';
+  copy.onclick = () => navigator.clipboard?.writeText(item === 'password' ? s.password.value : s.link.value).then(() => {
+    copy.textContent = '\u2713 Done';
+    setTimeout(() => { copy.textContent = 'Copy'; }, 2000);
+  }, () => {});
+  el.append(copy);
+  if (navigator.share) {
+    const b = document.createElement('button');
+    b.textContent = 'Share';
+    b.onclick = () => navigator.share({ text: s[item].text }).then(() => post('shared:' + item + ':sheet')).catch(() => {});
+    el.append(b);
+  }
+  for (const [route, url] of Object.entries(s[item].routes)) {
+    const a = document.createElement('a');
+    a.href = url; a.target = '_blank'; a.rel = 'noopener noreferrer';
+    a.textContent = labels[route] || route;
+    if ((s.dimmed[item] || []).includes(route)) a.className = 'dim';
+    a.onclick = () => post('shared:' + item + ':' + route);
+    el.append(a);
+  }
+}
+async function tick() {
+  let s;
+  try { s = await (await fetch(base + '/state')).json(); } catch (_e) { return; }
+  for (const v of ['confirm', 'password', 'link', 'closed']) $(v).hidden = s.view !== v;
+  if (s.view === 'confirm') {
+    $('c-name').textContent = s.confirm.name;
+    $('c-size').textContent = s.confirm.size;
+    $('c-to').textContent = s.confirm.recipient || 'you share the link yourself';
+    $('c-credits').textContent = String(s.confirm.credits);
+  }
+  // A secret is only in the page while its view is on screen.
+  if (s.view !== 'password') { $('p-value').textContent = ''; $('p-share').textContent = ''; delete $('p-share').dataset.key; }
+  if (s.view !== 'link') { $('l-value').textContent = ''; $('l-share').textContent = ''; delete $('l-share').dataset.key; }
+  if (s.view === 'password') { $('p-value').textContent = s.password.value; shares($('p-share'), 'password', s); }
+  if (s.view === 'link') {
+    $('l-value').textContent = s.link.value;
+    $('l-mailed').hidden = !s.link.emailedTo;
+    $('l-mailed-to').textContent = s.link.emailedTo || '';
+    shares($('l-share'), 'link', s);
+  }
+}
+$('send').onclick = () => post('send');
+$('cancel').onclick = () => post('cancel');
+$('saved').onclick = () => post('saved');
+$('done').onclick = () => post('done');
+tick();
+setInterval(tick, 1000);
+})();`;
+var BODY = `<h1>VitalSend</h1>
+<div class="card" id="confirm" hidden><p>Send <strong id="c-name"></strong> (<span id="c-size"></span>) to <strong id="c-to"></strong>?</p>
+<p>It costs <span id="c-credits"></span> credit(s).</p><div class="row"><button class="primary" id="send">Send</button><button id="cancel">Cancel</button></div></div>
+<div class="card" id="password" hidden><p>The password for this file. The recipient needs it to open the file. Send it another way than the link.</p>
+<code id="p-value"></code><div class="row" id="p-share"></div><div class="row"><button class="primary" id="saved">I have saved the password</button></div></div>
+<div class="card" id="link" hidden><p id="l-mailed" hidden>The link was emailed to <strong id="l-mailed-to"></strong>.</p>
+<p>The link. It can be downloaded once.</p><code id="l-value" style="font-size:.9rem;letter-spacing:0"></code><div class="row" id="l-share"></div>
+<div class="row"><button class="primary" id="done">Done</button></div></div>
+<div class="card" id="closed" hidden><p>You can close this tab.</p></div>`;
+var sha256 = (text) => `'sha256-${createHash2("sha256").update(text).digest("base64")}'`;
+var CSP = [
+  "default-src 'none'",
+  `script-src ${sha256(SCRIPT)}`,
+  `style-src ${sha256(STYLE)}`,
+  "connect-src 'self'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'"
+].join("; ");
+var HTML = `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>VitalSend</title><style>${STYLE}</style><body>${BODY}<script>${SCRIPT}</script></body></html>`;
+function formatSize(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 ** 2) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 ** 3) return `${(bytes / 1024 ** 2).toFixed(1)} MB`;
+  return `${(bytes / 1024 ** 3).toFixed(2)} GB`;
+}
+var BrowserUnavailable = class extends Error {
+  constructor() {
+    super("No browser could be opened on this computer.");
+    this.name = "BrowserUnavailable";
+  }
+};
+var COOKIE = "vs_page";
+var SECRET_VIEWS = /* @__PURE__ */ new Set(["confirm", "password"]);
+var routesFor = (item, value) => Object.fromEntries(SHARE_ROUTES.map((r) => [r, shareUrl(r, shareText(item, value))]));
+async function openDeliveryPage({ openBrowser: openBrowser2, timeoutMs = 5 * 60 * 1e3, linkTimeoutMs = 30 * 60 * 1e3 }) {
+  const path = `/${randomBytes3(32).toString("base64url")}`;
+  const pageSecret = randomBytes3(32).toString("base64url");
+  const used = { link: /* @__PURE__ */ new Set(), password: /* @__PURE__ */ new Set() };
+  let view = "idle";
+  let data = {};
+  let pageServed = false;
+  let browserOpened = false;
+  let pending = null;
+  const server2 = createServer2();
+  await new Promise((resolve2) => server2.listen(0, "127.0.0.1", resolve2));
+  const origin = `http://127.0.0.1:${server2.address().port}`;
+  const host = origin.slice("http://".length);
+  const dimmed = () => ({
+    password: [...used.link].filter((r) => r !== "sheet"),
+    link: [...used.password].filter((r) => r !== "sheet")
+  });
+  const snapshot = () => ({ view, ...data, dimmed: dimmed() });
+  const settle = (result) => {
+    if (!pending) return;
+    const { resolve: resolve2, timer } = pending;
+    pending = null;
+    clearTimeout(timer);
+    resolve2(result);
+  };
+  const openOnce = async () => {
+    if (browserOpened) return;
+    browserOpened = true;
+    try {
+      await openBrowser2(`${origin}${path}`);
+    } catch (_err) {
+      throw new BrowserUnavailable();
+    }
+  };
+  const show = async (nextView, nextData, accepts) => {
+    settle("superseded");
+    await openOnce();
+    view = nextView;
+    data = nextData;
+    const wait = nextView === "link" ? linkTimeoutMs : timeoutMs;
+    return new Promise((resolve2) => {
+      pending = { accepts: new Set(accepts), resolve: resolve2, timer: setTimeout(() => settle("timeout"), wait) };
+    });
+  };
+  const hasCookie = (req) => (req.headers.cookie || "").split(";").some((c) => c.trim() === `${COOKIE}=${pageSecret}`);
+  server2.on("request", async (req, res) => {
+    const url = new URL(req.url, origin);
+    const empty = (status) => res.writeHead(status, { "Cache-Control": "no-store" }).end();
+    if (req.headers.host !== host || !url.pathname.startsWith(path)) return empty(404);
+    const rest = url.pathname.slice(path.length);
+    if (rest === "" && req.method === "GET") {
+      if (pageServed) {
+        if (SECRET_VIEWS.has(view)) settle("cancel");
+        return empty(404);
+      }
+      pageServed = true;
+      res.writeHead(200, {
+        "Content-Type": "text/html; charset=utf-8",
+        "Content-Security-Policy": CSP,
+        "Cache-Control": "no-store",
+        "Referrer-Policy": "no-referrer",
+        "X-Content-Type-Options": "nosniff",
+        "Set-Cookie": `${COOKIE}=${pageSecret}; HttpOnly; SameSite=Strict; Path=${path}`
+      });
+      return res.end(HTML);
+    }
+    if (!hasCookie(req)) return empty(404);
+    if (rest === "/state" && req.method === "GET") {
+      res.writeHead(200, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+      return res.end(JSON.stringify(snapshot()));
+    }
+    if (rest === "/action" && req.method === "POST") {
+      if (req.headers.origin && req.headers.origin !== origin) return empty(403);
+      let body = "";
+      for await (const chunk of req) {
+        body += chunk;
+        if (body.length > 1024) return empty(413);
+      }
+      let action = "";
+      try {
+        action = String(JSON.parse(body).action || "");
+      } catch (_err) {
+        return empty(400);
+      }
+      const shared = /^shared:(link|password):(sheet|sms|whatsapp|telegram|email)$/.exec(action);
+      if (shared) used[shared[1]].add(shared[2]);
+      else if (pending?.accepts.has(action)) settle(action);
+      return empty(204);
+    }
+    return empty(404);
+  });
+  return {
+    open: openOnce,
+    confirm({ recipient, name, sizeBytes, credits }) {
+      return show("confirm", { confirm: { recipient: recipient || "", name, size: formatSize(sizeBytes), credits } }, ["send", "cancel"]);
+    },
+    showPassword(password) {
+      return show("password", { password: { value: password, text: shareText("password", password), routes: routesFor("password", password) } }, ["saved"]);
+    },
+    showLink({ link, emailedTo }) {
+      if (emailedTo) used.link.add("email");
+      return show("link", { link: { value: link, text: shareText("link", link), routes: routesFor("link", link), emailedTo: emailedTo || "" } }, ["done"]);
+    },
+    close() {
+      settle("closed");
+      view = "closed";
+      data = {};
+      setTimeout(() => {
+        server2.close();
+        server2.closeAllConnections?.();
+      }, 3e3).unref();
+    }
+  };
+}
+
+// src/send.js
+var EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var fail = (text) => ({ isError: true, text: `Not sent. ${text}` });
+function formatSize2(bytes) {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 ** 2) return `${(bytes / 1024).toFixed(1)} KB`;
+  if (bytes < 1024 ** 3) return `${(bytes / 1024 ** 2).toFixed(1)} MB`;
+  return `${(bytes / 1024 ** 3).toFixed(2)} GB`;
+}
+function formatExpiry(iso) {
+  const d = new Date(iso);
+  return Number.isNaN(d.getTime()) ? "" : `${d.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function explain(err) {
+  if (err instanceof PathNotAllowed || err instanceof RootRequired) return fail(err.message);
+  if (err instanceof BrowserUnavailable) return fail("No browser could be opened on this computer, so nothing was sent. Use an API key with recipient_email instead.");
+  if (err instanceof LoginDeclined || err instanceof LoginTimeout) return fail("The VitalSend login was not completed.");
+  if (err instanceof LoginRequired) return fail("Sign in to VitalSend first.");
+  if (err instanceof ApiError) {
+    if (err.code === "credits_insufficient") return fail("Not enough credits. Top up at https://vitalsend.eu/me/.");
+    return fail(err.message);
+  }
+  return fail("Something went wrong.");
+}
+async function sendFile(input, deps) {
+  const { credentials: credentials2, newSession, openPage, startLogin: startLogin2, io, clientName, cwd } = deps;
+  let page = null;
+  let pageHandedOff = false;
+  const getPage = async () => page ||= await openPage();
+  try {
+    const mode = await credentials2.mode();
+    const recipient = String(input.recipient_email || "").trim();
+    const withPassword = input.password ?? mode !== "api_key";
+    if (mode === "api_key" && withPassword) return fail("An API key cannot send with a password; sign in through the browser instead, or set password to false.");
+    if (mode === "api_key" && !recipient) return fail("With an API key the link is emailed, so recipient_email is required.");
+    if (recipient && !EMAIL.test(recipient)) return fail("recipient_email is not a valid email address.");
+    const path = await resolveAllowedFile(input.path, { roots: await io.roots(), cwd, envRoot: deps.envRoot || "" });
+    const blob = await openAsBlob(path);
+    const name = basename(path);
+    const sizeBytes = blob.size;
+    let accessToken;
+    try {
+      accessToken = await credentials2.accessToken();
+    } catch (err) {
+      if (!(err instanceof LoginRequired)) throw err;
+      const login2 = await startLogin2({ connectionName: clientName });
+      await io.openLogin(login2.url, login2);
+      accessToken = await credentials2.adopt(await login2.done);
+    }
+    const session = newSession(accessToken);
+    await session.init();
+    const { creditsNeeded } = await session.quote({ sizeBytes, password: withPassword, recipient });
+    const password = withPassword ? generatePassword() : null;
+    const inDialogs = mode !== "api_key" && !!io.canShowSecrets;
+    if (mode !== "api_key") {
+      const details = { recipient, name, sizeBytes, size: formatSize2(sizeBytes), credits: creditsNeeded, password: inDialogs ? password : null };
+      let decision = await io.confirm(details);
+      if (decision === "unavailable") decision = await (await getPage()).confirm(details);
+      if (decision !== "send") return fail("The send was cancelled.");
+    }
+    if (mode !== "api_key" && !inDialogs) {
+      await (await getPage()).open();
+      if (password) {
+        const shown = await (await getPage()).showPassword(password);
+        if (shown !== "saved") return fail("The password was not confirmed in the browser, so nothing was sent and no credits were used.");
+      }
+    }
+    const linkKey = new Uint8Array(randomBytes4(32));
+    const reserved = await session.reserve({
+      name,
+      type: blob.type || "",
+      sizeBytes,
+      passwordVerifier: password ? await derivePasswordVerifier(linkKey, password) : ""
+    });
+    await session.upload({ blob, linkKey, password });
+    await session.complete({ name, type: blob.type || "", sizeBytes });
+    const link = buildShareLink(await session.link(), encodeLinkKey(linkKey), !!password);
+    let emailed = false;
+    if (recipient) {
+      try {
+        await session.sendEmail({ recipient, link });
+        emailed = true;
+      } catch (err) {
+        if (mode === "api_key") {
+          return fail(`The file was uploaded and ${creditsNeeded} credit${creditsNeeded === 1 ? " was" : "s were"} used, but VitalSend could not email the link, and it cannot be shown here. ${explain(err).text.replace(/^Not sent\. /, "")}`);
+        }
+      }
+    }
+    let linkShown = emailed || mode === "api_key";
+    if (!linkShown && inDialogs) linkShown = await io.showLink(link, { password: !!password }).catch(() => "cancel") === "accept";
+    if (mode !== "api_key" && (!inDialogs || !linkShown)) {
+      const p = await getPage();
+      pageHandedOff = true;
+      p.showLink({ link, emailedTo: emailed ? recipient : "" }).catch(() => {
+      }).finally(() => p.close());
+    }
+    const lines = [`Sent ${name} (${formatSize2(sizeBytes)}).`];
+    if (emailed) {
+      lines.push(`VitalSend emailed the download link to ${recipient}.`);
+    } else {
+      if (recipient) lines.push(`VitalSend could not email the link to ${recipient}.`);
+      lines.push(linkShown ? "The download link was shown to the user to share; it was not given to you." : "The download link is waiting in the user's browser to be shared; it was not given to you.");
+    }
+    const expiry = formatExpiry(reserved.expiresAt);
+    if (expiry) lines.push(`It can be downloaded once, until ${expiry}.`);
+    if (password) lines.push("A password was set and shown to the user" + (inDialogs ? "" : " in the browser") + ". The recipient needs it; the user should send it another way than the link.");
+    lines.push(`Cost: ${creditsNeeded} credit${creditsNeeded === 1 ? "" : "s"}.`);
+    return { isError: false, text: lines.join(" ") };
+  } catch (err) {
+    if (err?.inputRequired) throw err;
+    return explain(err);
+  } finally {
+    if (page && !pageHandedOff) page.close();
+  }
+}
+
+// src/io.js
+import { inputRequired } from "@modelcontextprotocol/server";
+var NeedInput = class extends Error {
+  constructor(value) {
+    super("input required");
+    this.inputRequired = true;
+    this.value = value;
+  }
+};
+var LOGIN_MESSAGE = "Sign in to VitalSend to send this file. The page opens on vitalsend.eu.";
+function createIo({ server: server2, ctx, openBrowser: openBrowser2 }) {
+  const era2026 = !!ctx?.mcpReq?.envelope;
+  const caps = server2.server.getClientCapabilities?.() || {};
+  const answers = ctx?.mcpReq?.inputResponses || {};
+  const elicitation = caps.elicitation;
+  const canForm = !!elicitation && (Object.keys(elicitation).length === 0 || !!elicitation.form);
+  const canUrl = !!elicitation?.url;
+  const canShowSecrets = canForm && !era2026;
+  const ask = (key, request) => {
+    throw new NeedInput(inputRequired({ inputRequests: { [key]: request } }));
+  };
+  return {
+    async roots() {
+      if (!caps.roots) return null;
+      if (!era2026) return (await server2.server.listRoots()).roots.map((r) => r.uri);
+      if (answers.roots?.roots) return answers.roots.roots.map((r) => r.uri);
+      return ask("roots", inputRequired.listRoots());
+    },
+    // login: { done, cancel } from startLogin. On 2025-era connections the
+    // client may hold its dialog open until told the login is complete, so the
+    // dialog is not awaited: completing the login closes it, declining it
+    // cancels the login.
+    async openLogin(url, login2) {
+      if (!canUrl) return openBrowser2(url);
+      if (!era2026) {
+        const elicitationId = `login-${Date.now()}`;
+        ctx.mcpReq.elicitInput({ mode: "url", url, message: LOGIN_MESSAGE, elicitationId }).then((res) => {
+          if (res?.action !== "accept") login2?.cancel();
+        }, () => login2?.cancel());
+        login2?.done.then(() => server2.server.createElicitationCompletionNotifier(elicitationId)(), () => {
+        }).catch(() => {
+        });
+        return void 0;
+      }
+      if (answers.login) return void 0;
+      return ask("login", inputRequired.elicitUrl({ url, message: LOGIN_MESSAGE }));
+    },
+    canShowSecrets,
+    async confirm({ recipient, name, sizeBytes, size, credits, password }) {
+      if (!canForm) return "unavailable";
+      const cost = `${credits} credit${credits === 1 ? "" : "s"}`;
+      let message = `Send ${name} (${size || `${sizeBytes} bytes`}) ${recipient ? `to ${recipient}` : "and share the link yourself"} for ${cost}?`;
+      if (password && canShowSecrets) {
+        const to = recipient || "the recipient";
+        message += `
+
+    Password:   ${password}
+
+Copy the password now and send it to ${to} yourself, by text message for example. ` + (recipient ? "Not by email: the link arrives by email, and the two must travel separately." : "Not together with the link.") + " The password is shown only here.";
+      }
+      const request = { mode: "form", message, requestedSchema: { type: "object", properties: {} } };
+      if (!era2026) {
+        const res = await ctx.mcpReq.elicitInput(request);
+        return res?.action === "accept" ? "send" : "cancel";
+      }
+      if (answers.confirm) return answers.confirm.action === "accept" ? "send" : "cancel";
+      return ask("confirm", inputRequired.elicit({ message, requestedSchema: request.requestedSchema }));
+    },
+    async showLink(link, { password = false } = {}) {
+      if (!canShowSecrets) return "unavailable";
+      const res = await ctx.mcpReq.elicitInput({
+        mode: "form",
+        requestedSchema: { type: "object", properties: {} },
+        message: `Uploaded. Copy the link and send it to the recipient; it can be downloaded once:
+
+    ${link}` + (password ? "\n\nSend the password another way than the link." : "")
+      });
+      return res?.action || "cancel";
+    }
+  };
+}
+
+// src/server.js
+var VERSION = "0.2.0";
+var DESCRIPTION = `Send a file end-to-end encrypted through VitalSend. The file is encrypted on this computer; the recipient can download it once. With recipient_email, VitalSend emails the download link; without it, the link is shown to the user to share. You never see the link, its key or the password. By default a password is set and shown to the user, who sends it to the recipient another way. Each send is confirmed by the user first.`;
+function buildServer({ sendFileDeps, openBrowser: openBrowser2 }) {
+  const server2 = new McpServer({ name: "vitalsend", version: VERSION });
+  server2.registerTool("send_file", {
+    description: DESCRIPTION,
+    inputSchema: {
+      path: z.string().describe("Path of the file to send, inside the folders this client shares."),
+      recipient_email: z.string().optional().describe("Email the download link to this address. Leave out to let the user share the link."),
+      password: z.boolean().optional().describe("Protect the file with a password shown to the user. Default: yes when signed in through the browser.")
+    }
+  }, async (args, ctx) => {
+    const io = createIo({ server: server2, ctx, openBrowser: openBrowser2 });
+    try {
+      const out = await sendFile(args, { ...sendFileDeps(server2), io });
+      return { content: [{ type: "text", text: out.text }], isError: out.isError };
+    } catch (err) {
+      if (err?.inputRequired) return err.value;
+      return { content: [{ type: "text", text: "Not sent. Something went wrong." }], isError: true };
+    }
+  });
+  return server2;
+}
+
+// src/browser.js
+import { spawn } from "node:child_process";
+async function openBrowser(url, platform = process.platform) {
+  const [cmd, args] = platform === "darwin" ? ["open", [url]] : platform === "win32" ? ["rundll32", ["url.dll,FileProtocolHandler", url]] : ["xdg-open", [url]];
+  await new Promise((resolve2, reject) => {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve2();
+    });
+  });
+}
+
+// src/index.js
+var baseUrl = (process.env.VITALSEND_BASE_URL || "https://vitalsend.eu").replace(/\/+$/, "");
+var tokens = createTokenClient({ baseUrl });
+var credentials = createCredentials({ tokens });
+var activeLogin = null;
+async function login({ connectionName }) {
+  if (activeLogin && !activeLogin.settled) return activeLogin;
+  const started = await startLogin({ baseUrl, tokens, connectionName });
+  activeLogin = started;
+  started.done.then(() => {
+  }, () => {
+  }).finally(() => {
+    started.settled = true;
+  });
+  return started;
+}
+var server = buildServer({
+  openBrowser,
+  sendFileDeps: (srv) => ({
+    credentials,
+    newSession: (accessToken) => createSendSession({ baseUrl, accessToken }),
+    openPage: () => openDeliveryPage({ openBrowser }),
+    startLogin: login,
+    clientName: srv.server.getClientVersion?.()?.name || "AI app",
+    cwd: process.cwd(),
+    envRoot: process.env.VITALSEND_ROOT || ""
+  })
+});
+await server.connect(new StdioServerTransport());