@weavecode/weave 0.1.2 → 0.1.3

package/node_modules/@modelcontextprotocol/sdk/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Anthropic, PBC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/@modelcontextprotocol/sdk/README.md

@@ -0,0 +1,178 @@
+# MCP TypeScript SDK [![NPM Version](https://img.shields.io/npm/v/%40modelcontextprotocol%2Fsdk)](https://www.npmjs.com/package/@modelcontextprotocol/sdk) [![MIT licensed](https://img.shields.io/npm/l/%40modelcontextprotocol%2Fsdk)](https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.x/LICENSE)
+
+> **This is v1.x of the MCP TypeScript SDK, the maintenance line.** It implements the MCP spec up to 2025-11-25. Support for the [2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28) is not planned for v1.x: it is in v2, the current stable release, which
+> ships as separate packages, [`@modelcontextprotocol/server`](https://www.npmjs.com/package/@modelcontextprotocol/server) and [`@modelcontextprotocol/client`](https://www.npmjs.com/package/@modelcontextprotocol/client). See the
+> [v2 documentation](https://ts.sdk.modelcontextprotocol.io/v2/) and the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2).
+>
+> **Staying on v1.x?** It continues to receive bug fixes and security updates for at least six months after the v2 release (2026-07-27). The v1 documentation is at <https://ts.sdk.modelcontextprotocol.io/>.
+
+<details>
+<summary>Table of Contents</summary>
+
+- [Overview](#overview)
+- [Installation](#installation)
+- [Quick Start](#quick-start)
+- [Core Concepts](#core-concepts)
+- [Examples](#examples)
+- [Documentation](#documentation)
+- [Contributing](#contributing)
+- [License](#license)
+
+</details>
+
+## Overview
+
+The Model Context Protocol allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction. This TypeScript SDK implements
+[the 2025-11-25 MCP specification](https://modelcontextprotocol.io/specification/2025-11-25), making it easy to:
+
+- Create MCP servers that expose resources, prompts and tools
+- Build MCP clients that can connect to any MCP server
+- Use standard transports like stdio and Streamable HTTP
+
+## Installation
+
+```bash
+npm install @modelcontextprotocol/sdk zod
+```
+
+This SDK has a **required peer dependency** on `zod` for schema validation. The SDK internally imports from `zod/v4`, but maintains backwards compatibility with projects using Zod v3.25 or later. You can use either API in your code by importing from `zod/v3` or `zod/v4`:
+
+## Quick Start
+
+To see the SDK in action end-to-end, start from the runnable examples in `src/examples`:
+
+1. **Install dependencies** (from the SDK repo root):
+
+    ```bash
+    npm install
+    ```
+
+2. **Run the example Streamable HTTP server**:
+
+    ```bash
+    npx tsx src/examples/server/simpleStreamableHttp.ts
+    ```
+
+3. **Run the interactive client in another terminal**:
+
+    ```bash
+    npx tsx src/examples/client/simpleStreamableHttp.ts
+    ```
+
+This pair of examples demonstrates tools, resources, prompts, sampling, elicitation, tasks and logging. For a guided walkthrough and variations (stateless servers, JSON-only responses, SSE compatibility, OAuth, etc.), see [docs/server.md](docs/server.md) and
+[docs/client.md](docs/client.md).
+
+## Core Concepts
+
+### Servers and transports
+
+An MCP server is typically created with `McpServer` and connected to a transport such as Streamable HTTP or stdio. The SDK supports:
+
+- **Streamable HTTP** for remote servers (recommended).
+- **HTTP + SSE** for backwards compatibility only.
+- **stdio** for local, process-spawned integrations.
+
+Runnable server examples live under `src/examples/server` and are documented in [docs/server.md](docs/server.md).
+
+### Tools, resources, prompts
+
+- **Tools** let LLMs ask your server to take actions (computation, side effects, network calls).
+- **Resources** expose read-only data that clients can surface to users or models.
+- **Prompts** are reusable templates that help users talk to models in a consistent way.
+
+The detailed APIs, including `ResourceTemplate`, completions, and display-name metadata, are covered in [docs/server.md](docs/server.md#tools-resources-and-prompts), with runnable implementations in [`simpleStreamableHttp.ts`](src/examples/server/simpleStreamableHttp.ts).
+
+### Capabilities: sampling, elicitation, and tasks
+
+The SDK includes higher-level capabilities for richer workflows:
+
+- **Sampling**: server-side tools can ask connected clients to run LLM completions.
+- **Form elicitation**: tools can request non-sensitive input via structured forms.
+- **URL elicitation**: servers can ask users to complete secure flows in a browser (e.g., API key entry, payments, OAuth).
+- **Tasks (experimental)**: long-running tool calls can be turned into tasks that you poll or resume later.
+
+Conceptual overviews and links to runnable examples are in:
+
+- [docs/capabilities.md](docs/capabilities.md)
+
+Key example servers include:
+
+- [`toolWithSampleServer.ts`](src/examples/server/toolWithSampleServer.ts)
+- [`elicitationFormExample.ts`](src/examples/server/elicitationFormExample.ts)
+- [`elicitationUrlExample.ts`](src/examples/server/elicitationUrlExample.ts)
+
+### Clients
+
+The high-level `Client` class connects to MCP servers over different transports and exposes helpers like `listTools`, `callTool`, `listResources`, `readResource`, `listPrompts`, and `getPrompt`.
+
+Runnable clients live under `src/examples/client` and are described in [docs/client.md](docs/client.md), including:
+
+- Interactive Streamable HTTP client ([`simpleStreamableHttp.ts`](src/examples/client/simpleStreamableHttp.ts))
+- Streamable HTTP client with SSE fallback ([`streamableHttpWithSseFallbackClient.ts`](src/examples/client/streamableHttpWithSseFallbackClient.ts))
+- OAuth-enabled clients and polling/parallel examples
+
+### Node.js Web Crypto (globalThis.crypto) compatibility
+
+Some parts of the SDK (for example, JWT-based client authentication in `auth-extensions.ts` via `jose`) rely on the Web Crypto API exposed as `globalThis.crypto`.
+
+See [docs/faq.md](docs/faq.md) for details on supported Node.js versions and how to polyfill `globalThis.crypto` when running on older Node.js runtimes.
+
+## Examples
+
+The SDK ships runnable examples under `src/examples`. Use these tables to find the scenario you care about and jump straight to the corresponding code and docs.
+
+### Server examples
+
+| Scenario                                            | Description                                                                                       | Example file(s)                                                                                          | Related docs                                                             |
+| --------------------------------------------------- | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ |
+| Streamable HTTP server (stateful)                   | Feature-rich server with tools, resources, prompts, logging, tasks, sampling, and optional OAuth. | [`simpleStreamableHttp.ts`](src/examples/server/simpleStreamableHttp.ts)                                 | [`server.md`](docs/server.md), [`capabilities.md`](docs/capabilities.md) |
+| Streamable HTTP server (stateless)                  | No session tracking; good for simple API-style servers.                                           | [`simpleStatelessStreamableHttp.ts`](src/examples/server/simpleStatelessStreamableHttp.ts)               | [`server.md`](docs/server.md)                                            |
+| JSON response mode (no SSE)                         | Streamable HTTP with JSON responses only and limited notifications.                               | [`jsonResponseStreamableHttp.ts`](src/examples/server/jsonResponseStreamableHttp.ts)                     | [`server.md`](docs/server.md)                                            |
+| Server notifications over Streamable HTTP           | Demonstrates server-initiated notifications using SSE with Streamable HTTP.                       | [`standaloneSseWithGetStreamableHttp.ts`](src/examples/server/standaloneSseWithGetStreamableHttp.ts)     | [`server.md`](docs/server.md)                                            |
+| Deprecated HTTP+SSE server                          | Legacy HTTP+SSE transport for backwards-compatibility testing.                                    | [`simpleSseServer.ts`](src/examples/server/simpleSseServer.ts)                                           | [`server.md`](docs/server.md)                                            |
+| Backwards-compatible server (Streamable HTTP + SSE) | Single server that supports both Streamable HTTP and legacy SSE clients.                          | [`sseAndStreamableHttpCompatibleServer.ts`](src/examples/server/sseAndStreamableHttpCompatibleServer.ts) | [`server.md`](docs/server.md)                                            |
+| Form elicitation server                             | Uses form elicitation to collect non-sensitive user input.                                        | [`elicitationFormExample.ts`](src/examples/server/elicitationFormExample.ts)                             | [`capabilities.md`](docs/capabilities.md#elicitation)                    |
+| URL elicitation server                              | Demonstrates URL-mode elicitation in an OAuth-protected server.                                   | [`elicitationUrlExample.ts`](src/examples/server/elicitationUrlExample.ts)                               | [`capabilities.md`](docs/capabilities.md#elicitation)                    |
+| Sampling and tasks server                           | Combines tools, logging, sampling, and experimental task-based execution.                         | [`toolWithSampleServer.ts`](src/examples/server/toolWithSampleServer.ts)                                 | [`capabilities.md`](docs/capabilities.md)                                |
+| OAuth demo authorization server                     | In-memory OAuth provider used with the example servers.                                           | [`demoInMemoryOAuthProvider.ts`](src/examples/server/demoInMemoryOAuthProvider.ts)                       | [`server.md`](docs/server.md)                                            |
+
+### Client examples
+
+| Scenario                                            | Description                                                                        | Example file(s)                                                                                                                                                                                                                        | Related docs                                                 |
+| --------------------------------------------------- | ---------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
+| Interactive Streamable HTTP client                  | CLI client that exercises tools, resources, prompts, elicitation, and tasks.       | [`simpleStreamableHttp.ts`](src/examples/client/simpleStreamableHttp.ts)                                                                                                                                                               | [`client.md`](docs/client.md)                                |
+| Backwards-compatible client (Streamable HTTP → SSE) | Tries Streamable HTTP first, then falls back to SSE on 4xx responses.              | [`streamableHttpWithSseFallbackClient.ts`](src/examples/client/streamableHttpWithSseFallbackClient.ts)                                                                                                                                 | [`client.md`](docs/client.md), [`server.md`](docs/server.md) |
+| SSE polling client                                  | Polls a legacy SSE server and demonstrates notification handling.                  | [`ssePollingClient.ts`](src/examples/client/ssePollingClient.ts)                                                                                                                                                                       | [`client.md`](docs/client.md)                                |
+| Parallel tool calls client                          | Shows how to run multiple tool calls in parallel.                                  | [`parallelToolCallsClient.ts`](src/examples/client/parallelToolCallsClient.ts)                                                                                                                                                         | [`client.md`](docs/client.md)                                |
+| Multiple clients in parallel                        | Demonstrates connecting multiple clients concurrently to the same server.          | [`multipleClientsParallel.ts`](src/examples/client/multipleClientsParallel.ts)                                                                                                                                                         | [`client.md`](docs/client.md)                                |
+| OAuth clients                                       | Examples of client_credentials (basic and private_key_jwt) and reusable providers. | [`simpleOAuthClient.ts`](src/examples/client/simpleOAuthClient.ts), [`simpleOAuthClientProvider.ts`](src/examples/client/simpleOAuthClientProvider.ts), [`simpleClientCredentials.ts`](src/examples/client/simpleClientCredentials.ts) | [`client.md`](docs/client.md)                                |
+| URL elicitation client                              | Works with the URL elicitation server to drive secure browser flows.               | [`elicitationUrlExample.ts`](src/examples/client/elicitationUrlExample.ts)                                                                                                                                                             | [`capabilities.md`](docs/capabilities.md#elicitation)        |
+
+Shared utilities:
+
+- In-memory event store for resumability: [`inMemoryEventStore.ts`](src/examples/shared/inMemoryEventStore.ts) (see [`server.md`](docs/server.md)).
+
+For more details on how to run these examples (including recommended commands and deployment diagrams), see `src/examples/README.md`.
+
+## Documentation
+
+- Local SDK docs:
+    - [docs/server.md](docs/server.md) – building and running MCP servers, transports, tools/resources/prompts, CORS, DNS rebinding, and multi-node deployment.
+    - [docs/client.md](docs/client.md) – using the high-level client, transports, backwards compatibility, and OAuth helpers.
+    - [docs/capabilities.md](docs/capabilities.md) – sampling, elicitation (form and URL), and experimental task-based execution.
+    - [docs/protocol.md](docs/protocol.md) – protocol features: ping, progress, cancellation, pagination, capability negotiation, and JSON Schema.
+    - [docs/faq.md](docs/faq.md) – environment and troubleshooting FAQs (including Node.js Web Crypto support).
+- External references:
+    - [V1 API reference](https://modelcontextprotocol.github.io/typescript-sdk/)
+    - [V2 API reference](https://modelcontextprotocol.github.io/typescript-sdk/v2/)
+    - [Model Context Protocol documentation](https://modelcontextprotocol.io)
+    - [MCP Specification](https://spec.modelcontextprotocol.io)
+    - [Example Servers](https://github.com/modelcontextprotocol/servers)
+
+## Contributing
+
+Issues and pull requests are welcome on GitHub at <https://github.com/modelcontextprotocol/typescript-sdk>.
+
+## License
+
+This project is licensed under the MIT License—see the [LICENSE](LICENSE) file for details.

package/node_modules/@modelcontextprotocol/sdk/dist/cjs/client/auth-extensions.d.ts

@@ -0,0 +1,231 @@
+/**
+ * OAuth provider extensions for specialized authentication flows.
+ *
+ * This module provides ready-to-use OAuthClientProvider implementations
+ * for common machine-to-machine authentication scenarios.
+ */
+import { OAuthClientInformation, OAuthClientMetadata, OAuthTokens } from '../shared/auth.js';
+import { AddClientAuthentication, OAuthClientProvider } from './auth.js';
+/**
+ * Helper to produce a private_key_jwt client authentication function.
+ *
+ * Usage:
+ *   const addClientAuth = createPrivateKeyJwtAuth({ issuer, subject, privateKey, alg, audience? });
+ *   // pass addClientAuth as provider.addClientAuthentication implementation
+ */
+export declare function createPrivateKeyJwtAuth(options: {
+    issuer: string;
+    subject: string;
+    privateKey: string | Uint8Array | Record<string, unknown>;
+    alg: string;
+    audience?: string | URL;
+    lifetimeSeconds?: number;
+    claims?: Record<string, unknown>;
+}): AddClientAuthentication;
+/**
+ * Options for creating a ClientCredentialsProvider.
+ */
+export interface ClientCredentialsProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * The client_secret for client_secret_basic authentication.
+     */
+    clientSecret: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+    /**
+     * Space-separated scopes values requested by the client.
+     */
+    scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
+}
+/**
+ * OAuth provider for client_credentials grant with client_secret_basic authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a client_id and client_secret.
+ *
+ * @example
+ * const provider = new ClientCredentialsProvider({
+ *   clientId: 'my-client',
+ *   clientSecret: 'my-secret',
+ *   expectedIssuer: 'https://auth.example.com'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+export declare class ClientCredentialsProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    constructor(options: ClientCredentialsProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
+    constructor(options: ClientCredentialsProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+/**
+ * Options for creating a PrivateKeyJwtProvider.
+ */
+export interface PrivateKeyJwtProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * The private key for signing JWT assertions.
+     * Can be a PEM string, Uint8Array, or JWK object.
+     */
+    privateKey: string | Uint8Array | Record<string, unknown>;
+    /**
+     * The algorithm to use for signing (e.g., 'RS256', 'ES256').
+     */
+    algorithm: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+    /**
+     * Optional JWT lifetime in seconds (default: 300).
+     */
+    jwtLifetimeSeconds?: number;
+    /**
+     * Space-separated scopes values requested by the client.
+     */
+    scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
+}
+/**
+ * OAuth provider for client_credentials grant with private_key_jwt authentication.
+ *
+ * This provider is designed for machine-to-machine authentication where
+ * the client authenticates using a signed JWT assertion (RFC 7523 Section 2.2).
+ *
+ * @example
+ * const provider = new PrivateKeyJwtProvider({
+ *   clientId: 'my-client',
+ *   privateKey: pemEncodedPrivateKey,
+ *   algorithm: 'RS256',
+ *   expectedIssuer: 'https://auth.example.com'
+ * });
+ *
+ * const transport = new StreamableHTTPClientTransport(serverUrl, {
+ *   authProvider: provider
+ * });
+ */
+export declare class PrivateKeyJwtProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    addClientAuthentication: AddClientAuthentication;
+    constructor(options: PrivateKeyJwtProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
+    constructor(options: PrivateKeyJwtProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+/**
+ * Options for creating a StaticPrivateKeyJwtProvider.
+ */
+export interface StaticPrivateKeyJwtProviderOptions {
+    /**
+     * The client_id for this OAuth client.
+     */
+    clientId: string;
+    /**
+     * A pre-built JWT client assertion to use for authentication.
+     *
+     * This token should already contain the appropriate claims
+     * (iss, sub, aud, exp, etc.) and be signed by the client's key.
+     */
+    jwtBearerAssertion: string;
+    /**
+     * Optional client name for metadata.
+     */
+    clientName?: string;
+    /**
+     * Space-separated scopes values requested by the client.
+     */
+    scope?: string;
+    /**
+     * The issuer URL of the authorization server these credentials were registered with.
+     * When set, `auth()` only presents them to that authorization server and throws if the
+     * MCP server advertises a different URL (one trailing slash aside).
+     *
+     * Omitting it is deprecated: the credentials then go to whichever authorization server
+     * the MCP server advertises first.
+     */
+    expectedIssuer?: string;
+}
+/**
+ * OAuth provider for client_credentials grant with a static private_key_jwt assertion.
+ *
+ * This provider mirrors {@link PrivateKeyJwtProvider} but instead of constructing and
+ * signing a JWT on each request, it accepts a pre-built JWT assertion string and
+ * uses it directly for authentication.
+ */
+export declare class StaticPrivateKeyJwtProvider implements OAuthClientProvider {
+    private _tokens?;
+    private _clientInfo;
+    private _clientMetadata;
+    addClientAuthentication: AddClientAuthentication;
+    constructor(options: StaticPrivateKeyJwtProviderOptions & {
+        expectedIssuer: string;
+    });
+    /** @deprecated Pass `expectedIssuer` so the credentials are only sent to that authorization server. */
+    constructor(options: StaticPrivateKeyJwtProviderOptions);
+    get redirectUrl(): undefined;
+    get clientMetadata(): OAuthClientMetadata;
+    clientInformation(): OAuthClientInformation;
+    saveClientInformation(info: OAuthClientInformation): void;
+    tokens(): OAuthTokens | undefined;
+    saveTokens(tokens: OAuthTokens): void;
+    redirectToAuthorization(): void;
+    saveCodeVerifier(): void;
+    codeVerifier(): string;
+    prepareTokenRequest(scope?: string): URLSearchParams;
+}
+//# sourceMappingURL=auth-extensions.d.ts.map