@wrongstack/mcp 0.285.0 → 0.286.0

package/dist/index.js

@@ -1,3 +1,742 @@
+// src/authorization.ts
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import * as dns from "node:dns/promises";
+import * as http from "node:http";
+import * as https from "node:https";
+import * as net from "node:net";
+import { isPrivateIPv4, isPrivateIPv6 } from "@wrongstack/core/utils";
+function canonicalMcpResource(rawUrl) {
+  let url;
+  try {
+    url = new URL(rawUrl);
+  } catch {
+    throw new Error("MCP authorization resource must be an absolute URL");
+  }
+  if (url.protocol !== "https:" && !isLoopbackHttp(url)) {
+    throw new Error("MCP authorization resource must use HTTPS (except loopback development)");
+  }
+  if (url.username || url.password || url.hash) {
+    throw new Error("MCP authorization resource must not contain credentials or a fragment");
+  }
+  if (url.pathname === "/" && !url.search) return url.origin;
+  return url.toString();
+}
+function authorizationHeaderForToken(token, expectedResource, now = Date.now()) {
+  if (canonicalMcpResource(token.resource) !== expectedResource) {
+    throw new Error("MCP access token resource does not match the target server");
+  }
+  if (token.expiresAt !== void 0 && token.expiresAt <= now) {
+    throw new Error("MCP access token is expired");
+  }
+  const tokenType = token.tokenType ?? "Bearer";
+  if (tokenType.toLowerCase() !== "bearer") {
+    throw new Error(`Unsupported MCP OAuth token type "${tokenType}"`);
+  }
+  if (!token.accessToken || token.accessToken.length > 16384 || /[\r\n]/.test(token.accessToken)) {
+    throw new Error("MCP access token is empty, oversized, or contains invalid characters");
+  }
+  return `Bearer ${token.accessToken}`;
+}
+function parseMcpBearerChallenge(header, resource) {
+  const challenge = {
+    status: 401,
+    resource,
+    scopes: [],
+    rawScheme: "Bearer"
+  };
+  if (!header) return challenge;
+  const bearer = /(?:^|,)\s*Bearer(?:\s+|$)/i.exec(header);
+  if (!bearer) return challenge;
+  const parameters = header.slice((bearer.index ?? 0) + bearer[0].length);
+  const resourceMetadata = challengeParameter(parameters, "resource_metadata");
+  if (resourceMetadata) {
+    const metadataUrl = validateMetadataUrl(resourceMetadata);
+    if (metadataUrl) challenge.resourceMetadataUrl = metadataUrl;
+  }
+  const scope = challengeParameter(parameters, "scope");
+  if (scope) {
+    challenge.scopes = [...new Set(scope.split(/\s+/).filter(Boolean))].slice(0, 64);
+  }
+  return challenge;
+}
+function protectedResourceMetadataUrls(resource) {
+  const url = new URL(canonicalMcpResource(resource));
+  const suffix = url.pathname === "/" ? "" : url.pathname;
+  const candidates = [
+    new URL(`/.well-known/oauth-protected-resource${suffix}`, url.origin).toString(),
+    new URL("/.well-known/oauth-protected-resource", url.origin).toString()
+  ];
+  return [...new Set(candidates)];
+}
+function authorizationServerMetadataUrls(issuer) {
+  const url = secureOAuthUrl(issuer, "authorization server issuer");
+  const suffix = url.pathname === "/" ? "" : url.pathname;
+  const candidates = [
+    new URL(`/.well-known/oauth-authorization-server${suffix}`, url.origin).toString(),
+    new URL(`/.well-known/openid-configuration${suffix}`, url.origin).toString()
+  ];
+  if (suffix) {
+    candidates.push(
+      new URL(
+        `${suffix.replace(/\/$/, "")}/.well-known/openid-configuration`,
+        url.origin
+      ).toString()
+    );
+  }
+  return candidates;
+}
+function parseProtectedResourceMetadata(value, expectedResource) {
+  const metadata = record(value, "protected resource metadata");
+  const resource = canonicalMcpResource(requiredString(metadata["resource"], "resource"));
+  if (resource !== canonicalMcpResource(expectedResource)) {
+    throw new Error("MCP protected resource metadata resource does not match the target server");
+  }
+  const authorizationServers = boundedStringArray(
+    metadata["authorization_servers"],
+    "authorization_servers",
+    8
+  ).map((issuer) => secureOAuthUrl(issuer, "authorization server issuer").toString());
+  if (authorizationServers.length === 0) {
+    throw new Error("MCP protected resource metadata must declare an authorization server");
+  }
+  return {
+    resource,
+    authorizationServers,
+    scopesSupported: optionalStringArray(metadata["scopes_supported"], "scopes_supported", 128)
+  };
+}
+function parseAuthorizationServerMetadata(value, expectedIssuer) {
+  const metadata = record(value, "authorization server metadata");
+  const issuer = secureOAuthUrl(requiredString(metadata["issuer"], "issuer"), "issuer").toString();
+  if (issuer !== secureOAuthUrl(expectedIssuer, "expected issuer").toString()) {
+    throw new Error("MCP authorization metadata issuer mismatch");
+  }
+  const methods = boundedStringArray(
+    metadata["code_challenge_methods_supported"],
+    "code_challenge_methods_supported",
+    16
+  );
+  if (!methods.includes("S256")) {
+    throw new Error("MCP authorization server does not advertise required PKCE S256 support");
+  }
+  const registration = optionalString(metadata["registration_endpoint"], "registration_endpoint");
+  return {
+    issuer,
+    authorizationEndpoint: secureOAuthUrl(
+      requiredString(metadata["authorization_endpoint"], "authorization_endpoint"),
+      "authorization endpoint"
+    ).toString(),
+    tokenEndpoint: secureOAuthUrl(
+      requiredString(metadata["token_endpoint"], "token_endpoint"),
+      "token endpoint"
+    ).toString(),
+    registrationEndpoint: registration ? secureOAuthUrl(registration, "registration endpoint").toString() : void 0,
+    scopesSupported: optionalStringArray(metadata["scopes_supported"], "scopes_supported", 128)
+  };
+}
+function validateMcpAuthorizationServerMetadata(value) {
+  const metadata = record(value, "stored authorization server metadata");
+  const registration = optionalString(metadata["registrationEndpoint"], "registrationEndpoint");
+  return {
+    issuer: secureOAuthUrl(requiredString(metadata["issuer"], "issuer"), "issuer").toString(),
+    authorizationEndpoint: secureOAuthUrl(
+      requiredString(metadata["authorizationEndpoint"], "authorizationEndpoint"),
+      "authorization endpoint"
+    ).toString(),
+    tokenEndpoint: secureOAuthUrl(
+      requiredString(metadata["tokenEndpoint"], "tokenEndpoint"),
+      "token endpoint"
+    ).toString(),
+    registrationEndpoint: registration ? secureOAuthUrl(registration, "registration endpoint").toString() : void 0,
+    scopesSupported: optionalStringArray(metadata["scopesSupported"], "scopesSupported", 128)
+  };
+}
+async function discoverMcpAuthorization(resource, options = {}) {
+  const canonicalResource = canonicalMcpResource(resource);
+  const resourceUrl = new URL(canonicalResource);
+  const allowedLoopbackHostname = isLoopbackHttp(resourceUrl) ? unbracket(resourceUrl.hostname).toLowerCase() : void 0;
+  const fetchJson = options.fetchJson ?? ((url, signal) => requestPinnedJson(url, {
+    signal,
+    timeoutMs: options.timeoutMs,
+    maxResponseBytes: options.maxResponseBytes,
+    lookup: options.lookup,
+    allowedLoopbackHostname
+  }));
+  const challenge = parseMcpBearerChallenge(options.challengeHeader ?? null, canonicalResource);
+  const resourceCandidates = challenge.resourceMetadataUrl ? [challenge.resourceMetadataUrl] : protectedResourceMetadataUrls(canonicalResource);
+  const resourceDiscovery = await discoverFirst(
+    resourceCandidates,
+    fetchJson,
+    options.signal,
+    (value) => parseProtectedResourceMetadata(value, canonicalResource),
+    "protected resource metadata"
+  );
+  const issuer = resourceDiscovery.value.authorizationServers[0];
+  const authorizationDiscovery = await discoverFirst(
+    authorizationServerMetadataUrls(issuer),
+    fetchJson,
+    options.signal,
+    (value) => parseAuthorizationServerMetadata(value, issuer),
+    "authorization server metadata"
+  );
+  return {
+    resourceMetadataUrl: resourceDiscovery.url,
+    authorizationServerMetadataUrl: authorizationDiscovery.url,
+    protectedResource: resourceDiscovery.value,
+    authorizationServer: authorizationDiscovery.value
+  };
+}
+function createMcpAuthorizationRequest(options) {
+  const resource = canonicalMcpResource(options.resource);
+  const clientId = boundedCredential(options.clientId, "client id");
+  const redirectUri = validateRedirectUri(options.redirectUri);
+  const scopes = validateScopes(options.scopes ?? []);
+  const codeVerifier = base64Url(randomBytes(32));
+  const codeChallenge = base64Url(createHash("sha256").update(codeVerifier).digest());
+  const state = base64Url(randomBytes(32));
+  const authorizationUrl = secureOAuthUrl(
+    options.authorizationServer.authorizationEndpoint,
+    "authorization endpoint"
+  );
+  authorizationUrl.searchParams.set("response_type", "code");
+  authorizationUrl.searchParams.set("client_id", clientId);
+  authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+  authorizationUrl.searchParams.set("state", state);
+  authorizationUrl.searchParams.set("code_challenge", codeChallenge);
+  authorizationUrl.searchParams.set("code_challenge_method", "S256");
+  authorizationUrl.searchParams.set("resource", resource);
+  if (scopes.length > 0) authorizationUrl.searchParams.set("scope", scopes.join(" "));
+  return {
+    authorizationUrl: authorizationUrl.toString(),
+    state,
+    codeVerifier,
+    redirectUri,
+    clientId,
+    resource
+  };
+}
+function parseMcpAuthorizationCallback(callbackUrl, session) {
+  let callback;
+  try {
+    callback = new URL(callbackUrl);
+  } catch {
+    throw new Error("MCP OAuth callback must be an absolute URL");
+  }
+  const expected = new URL(validateRedirectUri(session.redirectUri));
+  if (callback.protocol !== expected.protocol || callback.hostname !== expected.hostname || callback.port !== expected.port || callback.pathname !== expected.pathname) {
+    throw new Error("MCP OAuth callback redirect URI does not match the authorization session");
+  }
+  const returnedState = callback.searchParams.get("state") ?? "";
+  if (!constantTimeEqual(returnedState, session.state)) {
+    throw new Error("MCP OAuth callback state mismatch");
+  }
+  const oauthError = callback.searchParams.get("error");
+  if (oauthError)
+    throw new Error(`MCP OAuth authorization failed: ${boundedErrorCode(oauthError)}`);
+  return boundedCredential(callback.searchParams.get("code") ?? "", "authorization code");
+}
+async function exchangeMcpAuthorizationCode(options) {
+  const resource = canonicalMcpResource(options.resource);
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: boundedCredential(options.code, "authorization code"),
+    client_id: boundedCredential(options.clientId, "client id"),
+    redirect_uri: validateRedirectUri(options.redirectUri),
+    code_verifier: validateCodeVerifier(options.codeVerifier),
+    resource
+  }).toString();
+  const response = await requestPinnedJson(options.authorizationServer.tokenEndpoint, {
+    method: "POST",
+    body,
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+    maxResponseBytes: options.maxResponseBytes,
+    lookup: options.lookup,
+    allowedLoopbackHostname: loopbackHostnameForResource(resource)
+  });
+  if (response === void 0) throw new Error("MCP OAuth token endpoint returned no response");
+  return parseTokenResponse(response, resource);
+}
+async function refreshMcpAccessToken(options) {
+  const resource = canonicalMcpResource(options.resource);
+  const previousRefreshToken = boundedCredential(options.refreshToken, "refresh token");
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: previousRefreshToken,
+    client_id: boundedCredential(options.clientId, "client id"),
+    resource
+  }).toString();
+  const response = await requestPinnedJson(options.authorizationServer.tokenEndpoint, {
+    method: "POST",
+    body,
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+    maxResponseBytes: options.maxResponseBytes,
+    lookup: options.lookup,
+    allowedLoopbackHostname: loopbackHostnameForResource(resource)
+  });
+  if (response === void 0) throw new Error("MCP OAuth token endpoint returned no response");
+  const parsed = parseTokenResponse(response, resource);
+  return { ...parsed, refreshToken: parsed.refreshToken ?? previousRefreshToken };
+}
+function challengeParameter(parameters, name) {
+  const pattern = new RegExp(
+    `(?:^|,)\\s*${name}\\s*=\\s*(?:"((?:\\\\.|[^"\\\\])*)"|([^,\\s]+))`,
+    "i"
+  );
+  const match = pattern.exec(parameters);
+  const value = match?.[1] ?? match?.[2];
+  return value?.replace(/\\(["\\])/g, "$1");
+}
+function validateMetadataUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.username || url.password || url.hash) return void 0;
+    if (url.protocol !== "https:" && !isLoopbackHttp(url)) return void 0;
+    return url.toString();
+  } catch {
+    return void 0;
+  }
+}
+function record(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`MCP ${label} must be an object`);
+  }
+  return value;
+}
+function requiredString(value, field) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 4096) {
+    throw new Error(`MCP authorization field "${field}" must be a bounded non-empty string`);
+  }
+  return value;
+}
+function optionalString(value, field) {
+  return value === void 0 ? void 0 : requiredString(value, field);
+}
+function boundedStringArray(value, field, maxItems) {
+  if (!Array.isArray(value) || value.length > maxItems) {
+    throw new Error(`MCP authorization field "${field}" must be an array of at most ${maxItems}`);
+  }
+  return [...new Set(value.map((entry) => requiredString(entry, field)))];
+}
+function optionalStringArray(value, field, maxItems) {
+  return value === void 0 ? [] : boundedStringArray(value, field, maxItems);
+}
+function secureOAuthUrl(value, label) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error(`MCP ${label} must be an absolute URL`);
+  }
+  if (url.protocol !== "https:" && !isLoopbackHttp(url)) {
+    throw new Error(`MCP ${label} must use HTTPS (except loopback development)`);
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error(`MCP ${label} must not contain credentials, query, or fragment components`);
+  }
+  if (url.pathname === "/") return new URL(url.origin);
+  return url;
+}
+async function discoverFirst(candidates, fetchJson, signal, parse, label) {
+  const failures = [];
+  for (const candidate of candidates) {
+    signal?.throwIfAborted();
+    try {
+      const value = await fetchJson(candidate, signal);
+      if (value === void 0) {
+        failures.push(`${candidate}: not found`);
+        continue;
+      }
+      return { url: candidate, value: parse(value) };
+    } catch (error) {
+      signal?.throwIfAborted();
+      failures.push(`${candidate}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+  }
+  throw new Error(`MCP ${label} discovery failed (${failures.join("; ")})`);
+}
+async function requestPinnedJson(rawUrl, options) {
+  const url = secureOAuthUrl(rawUrl, "discovery URL");
+  const target = await resolvePinnedAddress(url, options);
+  const timeoutMs = options.timeoutMs ?? 1e4;
+  const maxBytes = options.maxResponseBytes ?? 64 * 1024;
+  options.signal?.throwIfAborted();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      options.signal?.removeEventListener("abort", onAbort);
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onAbort = () => {
+      request3.destroy(options.signal?.reason instanceof Error ? options.signal.reason : void 0);
+    };
+    const headers = {
+      accept: "application/json",
+      host: url.host,
+      ...options.headers
+    };
+    if (options.body !== void 0) {
+      headers["content-length"] = Buffer.byteLength(options.body);
+    }
+    const requestOptions = {
+      host: target.address,
+      family: target.family,
+      port: Number(url.port || (url.protocol === "https:" ? 443 : 80)),
+      method: options.method ?? "GET",
+      path: `${url.pathname}${url.search}`,
+      headers,
+      ...url.protocol === "https:" && net.isIP(unbracket(url.hostname)) === 0 ? { servername: unbracket(url.hostname) } : {}
+    };
+    const requestFn = url.protocol === "https:" ? https.request : http.request;
+    const request3 = requestFn(requestOptions, (response) => {
+      const status = response.statusCode ?? 0;
+      if (status === 404 || status === 410) {
+        response.resume();
+        finish(void 0, void 0);
+        return;
+      }
+      if (status >= 300 && status < 400) {
+        response.resume();
+        finish(new Error("MCP OAuth discovery redirects are not allowed"));
+        return;
+      }
+      if (status < 200 || status >= 300) {
+        response.resume();
+        finish(new Error(`MCP OAuth discovery HTTP ${status}`));
+        return;
+      }
+      const contentType = response.headers["content-type"] ?? "";
+      if (!/^(?:application\/json|[^;]+\+json)(?:;|$)/i.test(contentType)) {
+        response.resume();
+        finish(new Error("MCP OAuth discovery response must be JSON"));
+        return;
+      }
+      const declaredLength = Number(response.headers["content-length"] ?? 0);
+      if (Number.isFinite(declaredLength) && declaredLength > maxBytes) {
+        response.destroy();
+        finish(new Error(`MCP OAuth discovery response exceeds ${maxBytes} bytes`));
+        return;
+      }
+      const chunks = [];
+      let size = 0;
+      response.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > maxBytes) {
+          response.destroy();
+          finish(new Error(`MCP OAuth discovery response exceeds ${maxBytes} bytes`));
+          return;
+        }
+        chunks.push(chunk);
+      });
+      response.once("end", () => {
+        try {
+          finish(void 0, JSON.parse(Buffer.concat(chunks).toString("utf8")));
+        } catch {
+          finish(new Error("MCP OAuth discovery response is not valid JSON"));
+        }
+      });
+      response.once("error", (error) => finish(error));
+    });
+    request3.setTimeout(timeoutMs, () => {
+      request3.destroy(new Error(`MCP OAuth discovery timed out after ${timeoutMs}ms`));
+    });
+    request3.once("error", (error) => finish(error));
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+    request3.end(options.body);
+  });
+}
+async function resolvePinnedAddress(url, options) {
+  const hostname = unbracket(url.hostname).toLowerCase();
+  const literalFamily = net.isIP(hostname);
+  if (literalFamily === 4 || literalFamily === 6) {
+    assertDiscoveryAddressAllowed(
+      hostname,
+      literalFamily,
+      hostname,
+      options.allowedLoopbackHostname
+    );
+    return { address: hostname, family: literalFamily };
+  }
+  const lookup2 = options.lookup ?? ((host) => dns.lookup(host, { all: true }));
+  const records = await lookup2(hostname);
+  if (records.length === 0)
+    throw new Error(`MCP OAuth discovery DNS returned no addresses for ${hostname}`);
+  for (const record3 of records) {
+    if (record3.family !== 4 && record3.family !== 6) {
+      throw new Error("MCP OAuth discovery DNS returned an unsupported address family");
+    }
+    assertDiscoveryAddressAllowed(
+      record3.address,
+      record3.family,
+      hostname,
+      options.allowedLoopbackHostname
+    );
+  }
+  const selected = records[0];
+  return { address: selected.address, family: selected.family };
+}
+function assertDiscoveryAddressAllowed(address, family, hostname, allowedLoopbackHostname) {
+  const isPrivate = family === 4 ? isPrivateIPv4(address) : isPrivateIPv6(address);
+  if (!isPrivate) return;
+  const loopback = family === 4 ? address.startsWith("127.") : address === "::1";
+  if (loopback && hostname === allowedLoopbackHostname) return;
+  throw new Error(`MCP OAuth discovery blocked private address ${address}`);
+}
+function unbracket(hostname) {
+  return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+}
+function validateRedirectUri(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("MCP OAuth redirect URI must be an absolute URL");
+  }
+  if (url.protocol !== "https:" && !isLoopbackHttp(url)) {
+    throw new Error("MCP OAuth redirect URI must use HTTPS or loopback HTTP");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("MCP OAuth redirect URI must not contain credentials, query, or fragment");
+  }
+  return url.toString();
+}
+function validateScopes(scopes) {
+  if (scopes.length > 128) throw new Error("MCP OAuth scope list exceeds 128 entries");
+  const normalized = scopes.map((scope) => {
+    if (!scope || scope.length > 256 || /\s/.test(scope)) {
+      throw new Error("MCP OAuth scopes must be bounded non-empty tokens");
+    }
+    return scope;
+  });
+  return [...new Set(normalized)];
+}
+function validateCodeVerifier(value) {
+  if (value.length < 43 || value.length > 128 || !/^[A-Za-z0-9._~-]+$/.test(value)) {
+    throw new Error("MCP OAuth PKCE code verifier is invalid");
+  }
+  return value;
+}
+function boundedCredential(value, label) {
+  if (!value || value.length > 16384 || /[\r\n]/.test(value)) {
+    throw new Error(`MCP OAuth ${label} is empty, oversized, or invalid`);
+  }
+  return value;
+}
+function boundedErrorCode(value) {
+  return /^[A-Za-z0-9._-]{1,128}$/.test(value) ? value : "invalid_error";
+}
+function base64Url(value) {
+  return Buffer.from(value).toString("base64url");
+}
+function constantTimeEqual(left, right) {
+  const leftHash = createHash("sha256").update(left).digest();
+  const rightHash = createHash("sha256").update(right).digest();
+  return timingSafeEqual(leftHash, rightHash);
+}
+function parseTokenResponse(value, resource) {
+  const response = record(value, "token response");
+  const accessToken = boundedCredential(
+    requiredString(response["access_token"], "access_token"),
+    "access token"
+  );
+  const tokenType = optionalString(response["token_type"], "token_type") ?? "Bearer";
+  if (tokenType.toLowerCase() !== "bearer") {
+    throw new Error(`Unsupported MCP OAuth token type "${tokenType}"`);
+  }
+  const expiresIn = response["expires_in"];
+  let expiresAt;
+  if (expiresIn !== void 0) {
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || expiresIn <= 0 || expiresIn > 31536e3) {
+      throw new Error("MCP OAuth expires_in must be between 1 second and 1 year");
+    }
+    expiresAt = Date.now() + Math.floor(expiresIn * 1e3);
+  }
+  const refresh = optionalString(response["refresh_token"], "refresh_token");
+  const scope = optionalString(response["scope"], "scope");
+  const token = {
+    accessToken,
+    tokenType: "Bearer",
+    resource,
+    scopes: scope ? validateScopes(scope.split(/\s+/).filter(Boolean)) : [],
+    ...expiresAt !== void 0 ? { expiresAt } : {},
+    ...refresh ? { refreshToken: boundedCredential(refresh, "refresh token") } : {}
+  };
+  authorizationHeaderForToken(token, resource);
+  return token;
+}
+function loopbackHostnameForResource(resource) {
+  const url = new URL(resource);
+  return isLoopbackHttp(url) ? unbracket(url.hostname).toLowerCase() : void 0;
+}
+function isLoopbackHttp(url) {
+  if (url.protocol !== "http:") return false;
+  return url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]" || url.hostname === "::1";
+}
+
+// src/authorization-manager.ts
+var DEFAULT_PENDING_TTL_MS = 10 * 6e4;
+var MAX_PENDING_AUTHORIZATIONS = 32;
+var MCPAuthorizationManager = class {
+  constructor(options) {
+    this.options = options;
+    this.pendingTtlMs = options.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    if (!Number.isFinite(this.pendingTtlMs) || this.pendingTtlMs <= 0) {
+      throw new Error("MCP authorization pending TTL must be a positive finite number");
+    }
+    this.discover = options.discover ?? discoverMcpAuthorization;
+    this.exchange = options.exchange ?? exchangeMcpAuthorizationCode;
+    this.now = options.now ?? Date.now;
+  }
+  options;
+  pending = /* @__PURE__ */ new Map();
+  pendingTtlMs;
+  discover;
+  exchange;
+  now;
+  async begin(input) {
+    const resource = canonicalMcpResource(input.resource);
+    const key = authorizationKey(input.serverName, resource);
+    this.pruneExpired();
+    if (!this.pending.has(key) && this.pending.size >= MAX_PENDING_AUTHORIZATIONS) {
+      throw new Error("Too many pending MCP authorization sessions");
+    }
+    const discovery = await this.discover(resource, {
+      challengeHeader: input.challengeHeader,
+      signal: input.signal
+    });
+    const challengeScopes = parseMcpBearerChallenge(input.challengeHeader ?? null, resource).scopes;
+    const scopes = input.scopes ? [...input.scopes] : challengeScopes;
+    const session = createMcpAuthorizationRequest({
+      authorizationServer: discovery.authorizationServer,
+      clientId: input.clientId,
+      redirectUri: input.redirectUri,
+      resource,
+      scopes
+    });
+    const normalizedScopes = new URL(session.authorizationUrl).searchParams.get("scope")?.split(" ").filter(Boolean) ?? [];
+    const expiresAt = this.now() + this.pendingTtlMs;
+    this.pending.set(key, { session, discovery, scopes: normalizedScopes, expiresAt });
+    return {
+      serverName: boundedServerName(input.serverName),
+      resource,
+      authorizationUrl: session.authorizationUrl,
+      redirectUri: session.redirectUri,
+      scopes: [...normalizedScopes],
+      expiresAt
+    };
+  }
+  async complete(input) {
+    const serverName = boundedServerName(input.serverName);
+    const resource = canonicalMcpResource(input.resource);
+    const key = authorizationKey(serverName, resource);
+    this.pruneExpired();
+    const pending = this.pending.get(key);
+    if (!pending) {
+      throw new Error("No live MCP authorization session exists for this server");
+    }
+    const code = parseMcpAuthorizationCallback(input.callbackUrl, pending.session);
+    this.pending.delete(key);
+    const tokenSet = await this.exchange({
+      authorizationServer: pending.discovery.authorizationServer,
+      clientId: pending.session.clientId,
+      redirectUri: pending.session.redirectUri,
+      resource,
+      code,
+      codeVerifier: pending.session.codeVerifier,
+      signal: input.signal
+    });
+    const stored = {
+      serverName,
+      resource,
+      clientId: pending.session.clientId,
+      authorizationServer: pending.discovery.authorizationServer,
+      tokenSet,
+      updatedAt: new Date(this.now()).toISOString()
+    };
+    await this.options.store.save(stored);
+    this.emit("authorized", stored);
+    return statusFromStored(stored, this.now());
+  }
+  async status(serverName, resource) {
+    const normalizedName = boundedServerName(serverName);
+    const normalizedResource = canonicalMcpResource(resource);
+    this.pruneExpired();
+    const pending = this.pending.get(authorizationKey(normalizedName, normalizedResource));
+    if (pending) {
+      return {
+        serverName: normalizedName,
+        resource: normalizedResource,
+        state: "pending",
+        expiresAt: pending.expiresAt,
+        scopes: [...pending.scopes],
+        canRefresh: false
+      };
+    }
+    const stored = await this.options.store.load(normalizedName, normalizedResource);
+    return stored ? statusFromStored(stored, this.now()) : {
+      serverName: normalizedName,
+      resource: normalizedResource,
+      state: "not_authorized",
+      scopes: [],
+      canRefresh: false
+    };
+  }
+  async disconnect(serverName, resource) {
+    const normalizedName = boundedServerName(serverName);
+    const normalizedResource = canonicalMcpResource(resource);
+    this.pending.delete(authorizationKey(normalizedName, normalizedResource));
+    const removed = await this.options.store.remove(normalizedName, normalizedResource);
+    if (removed) {
+      this.options.onStateChange?.({
+        serverName: normalizedName,
+        state: "removed",
+        resource: normalizedResource
+      });
+    }
+    return removed;
+  }
+  pruneExpired() {
+    const now = this.now();
+    for (const [key, value] of this.pending) {
+      if (value.expiresAt <= now) this.pending.delete(key);
+    }
+  }
+  emit(state, value) {
+    this.options.onStateChange?.({
+      serverName: value.serverName,
+      state,
+      resource: value.resource,
+      expiresAt: value.tokenSet.expiresAt,
+      scopes: [...value.tokenSet.scopes ?? []]
+    });
+  }
+};
+function statusFromStored(value, now) {
+  return {
+    serverName: value.serverName,
+    resource: value.resource,
+    state: value.tokenSet.expiresAt !== void 0 && value.tokenSet.expiresAt <= now ? "expired" : "authorized",
+    expiresAt: value.tokenSet.expiresAt,
+    scopes: [...value.tokenSet.scopes ?? []],
+    canRefresh: !!value.tokenSet.refreshToken
+  };
+}
+function authorizationKey(serverName, resource) {
+  return `${boundedServerName(serverName)}\0${resource}`;
+}
+function boundedServerName(value) {
+  if (!value || value.length > 256 || /[\r\n\0]/.test(value)) {
+    throw new Error("MCP authorization server name is invalid");
+  }
+  return value;
+}
+
 // src/client.ts
 import { spawn } from "node:child_process";
 import { buildChildEnv } from "@wrongstack/core";
@@ -47,6 +786,207 @@ var MCP_CONSTANTS = Object.freeze({
   REQUEST_LOG_CAP: 1024
 });
 
+// src/protocol.ts
+function record2(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`Malformed MCP ${label}: expected object`);
+  }
+  return value;
+}
+function requiredString2(value, label) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`Malformed MCP ${label}: expected non-empty string`);
+  }
+  return value;
+}
+function optionalString2(value, label) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string") throw new Error(`Malformed MCP ${label}: expected string`);
+  return value;
+}
+function optionalRecord(value, label) {
+  if (value === void 0) return void 0;
+  return record2(value, label);
+}
+function optionalCursor(value, label) {
+  return optionalString2(value, `${label}.nextCursor`);
+}
+function parseServerMetadata(value) {
+  const input = record2(value, "initialize result");
+  const serverInfo = record2(input["serverInfo"], "initialize.serverInfo");
+  const capabilities = record2(input["capabilities"], "initialize.capabilities");
+  return {
+    protocolVersion: requiredString2(input["protocolVersion"], "initialize.protocolVersion"),
+    capabilities,
+    serverInfo: {
+      name: requiredString2(serverInfo["name"], "initialize.serverInfo.name"),
+      version: requiredString2(serverInfo["version"], "initialize.serverInfo.version"),
+      title: optionalString2(serverInfo["title"], "initialize.serverInfo.title")
+    },
+    instructions: optionalString2(input["instructions"], "initialize.instructions")
+  };
+}
+function parseResource(value, index) {
+  const input = record2(value, `resources/list.resources[${index}]`);
+  const size = input["size"];
+  if (size !== void 0 && (typeof size !== "number" || !Number.isFinite(size) || size < 0)) {
+    throw new Error(`Malformed MCP resources/list.resources[${index}].size`);
+  }
+  return {
+    uri: requiredString2(input["uri"], `resources/list.resources[${index}].uri`),
+    name: requiredString2(input["name"], `resources/list.resources[${index}].name`),
+    title: optionalString2(input["title"], `resources/list.resources[${index}].title`),
+    description: optionalString2(
+      input["description"],
+      `resources/list.resources[${index}].description`
+    ),
+    mimeType: optionalString2(input["mimeType"], `resources/list.resources[${index}].mimeType`),
+    size,
+    annotations: optionalRecord(
+      input["annotations"],
+      `resources/list.resources[${index}].annotations`
+    )
+  };
+}
+function parseListResourcesResult(value) {
+  const input = record2(value, "resources/list result");
+  if (!Array.isArray(input["resources"])) {
+    throw new Error("Malformed MCP resources/list result: resources must be an array");
+  }
+  return {
+    resources: input["resources"].map(parseResource),
+    nextCursor: optionalCursor(input["nextCursor"], "resources/list")
+  };
+}
+function parseListResourceTemplatesResult(value) {
+  const input = record2(value, "resources/templates/list result");
+  const templates = input["resourceTemplates"];
+  if (!Array.isArray(templates)) {
+    throw new Error(
+      "Malformed MCP resources/templates/list result: resourceTemplates must be an array"
+    );
+  }
+  return {
+    resourceTemplates: templates.map((value2, index) => {
+      const template = record2(value2, `resources/templates/list.resourceTemplates[${index}]`);
+      return {
+        uriTemplate: requiredString2(
+          template["uriTemplate"],
+          `resources/templates/list.resourceTemplates[${index}].uriTemplate`
+        ),
+        name: requiredString2(
+          template["name"],
+          `resources/templates/list.resourceTemplates[${index}].name`
+        ),
+        title: optionalString2(
+          template["title"],
+          `resources/templates/list.resourceTemplates[${index}].title`
+        ),
+        description: optionalString2(
+          template["description"],
+          `resources/templates/list.resourceTemplates[${index}].description`
+        ),
+        mimeType: optionalString2(
+          template["mimeType"],
+          `resources/templates/list.resourceTemplates[${index}].mimeType`
+        ),
+        annotations: optionalRecord(
+          template["annotations"],
+          `resources/templates/list.resourceTemplates[${index}].annotations`
+        )
+      };
+    }),
+    nextCursor: optionalCursor(input["nextCursor"], "resources/templates/list")
+  };
+}
+function parseReadResourceResult(value) {
+  const input = record2(value, "resources/read result");
+  if (!Array.isArray(input["contents"])) {
+    throw new Error("Malformed MCP resources/read result: contents must be an array");
+  }
+  return {
+    contents: input["contents"].map((value2, index) => {
+      const content = record2(value2, `resources/read.contents[${index}]`);
+      const text = optionalString2(content["text"], `resources/read.contents[${index}].text`);
+      const blob = optionalString2(content["blob"], `resources/read.contents[${index}].blob`);
+      if (text === void 0 && blob === void 0) {
+        throw new Error(`Malformed MCP resources/read.contents[${index}]: expected text or blob`);
+      }
+      return {
+        uri: requiredString2(content["uri"], `resources/read.contents[${index}].uri`),
+        mimeType: optionalString2(content["mimeType"], `resources/read.contents[${index}].mimeType`),
+        text,
+        blob
+      };
+    })
+  };
+}
+function parsePromptArgument(value, promptIndex, argIndex) {
+  const input = record2(value, `prompts/list.prompts[${promptIndex}].arguments[${argIndex}]`);
+  const required = input["required"];
+  if (required !== void 0 && typeof required !== "boolean") {
+    throw new Error(
+      `Malformed MCP prompts/list.prompts[${promptIndex}].arguments[${argIndex}].required`
+    );
+  }
+  return {
+    name: requiredString2(
+      input["name"],
+      `prompts/list.prompts[${promptIndex}].arguments[${argIndex}].name`
+    ),
+    description: optionalString2(
+      input["description"],
+      `prompts/list.prompts[${promptIndex}].arguments[${argIndex}].description`
+    ),
+    required
+  };
+}
+function parseListPromptsResult(value) {
+  const input = record2(value, "prompts/list result");
+  if (!Array.isArray(input["prompts"])) {
+    throw new Error("Malformed MCP prompts/list result: prompts must be an array");
+  }
+  return {
+    prompts: input["prompts"].map((value2, index) => {
+      const prompt = record2(value2, `prompts/list.prompts[${index}]`);
+      const args = prompt["arguments"];
+      if (args !== void 0 && !Array.isArray(args)) {
+        throw new Error(`Malformed MCP prompts/list.prompts[${index}].arguments`);
+      }
+      return {
+        name: requiredString2(prompt["name"], `prompts/list.prompts[${index}].name`),
+        title: optionalString2(prompt["title"], `prompts/list.prompts[${index}].title`),
+        description: optionalString2(
+          prompt["description"],
+          `prompts/list.prompts[${index}].description`
+        ),
+        arguments: args?.map((arg, argIndex) => parsePromptArgument(arg, index, argIndex))
+      };
+    }),
+    nextCursor: optionalCursor(input["nextCursor"], "prompts/list")
+  };
+}
+function parseGetPromptResult(value) {
+  const input = record2(value, "prompts/get result");
+  if (!Array.isArray(input["messages"])) {
+    throw new Error("Malformed MCP prompts/get result: messages must be an array");
+  }
+  return {
+    description: optionalString2(input["description"], "prompts/get.description"),
+    messages: input["messages"].map((value2, index) => {
+      const message = record2(value2, `prompts/get.messages[${index}]`);
+      const role = message["role"];
+      if (role !== "user" && role !== "assistant") {
+        throw new Error(`Malformed MCP prompts/get.messages[${index}].role`);
+      }
+      if (message["content"] === void 0) {
+        throw new Error(`Malformed MCP prompts/get.messages[${index}].content`);
+      }
+      return { role, content: message["content"] };
+    })
+  };
+}
+
 // src/tool-schema.ts
 function normalizeMCPTools(value) {
   if (!Array.isArray(value)) return [];
@@ -75,9 +1015,9 @@ function normalizeMCPTools(value) {
 }
 
 // src/transport.ts
-import { randomBytes } from "node:crypto";
-import * as https from "node:https";
-import * as net from "node:net";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import * as https2 from "node:https";
+import * as net2 from "node:net";
 import { ConfigError, ToolError } from "@wrongstack/core";
 function isTlsUnsafeAllowed() {
   return process.env["WRONGSTACK_UNSAFE_MCP_TLS"] === "1";
@@ -102,7 +1042,7 @@ function validateTransportUrl(rawUrl) {
   }
   const hostname = url.hostname;
   const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
-  const ipVersion = net.isIP(host);
+  const ipVersion = net2.isIP(host);
   if (ipVersion === 4) {
     const parts = host.split(".").map(Number);
     if (parts[0] === 169 && parts[1] === 254) {
@@ -162,7 +1102,11 @@ var SSEReader = class {
         message: `SSE: pending line exceeds ${SSE_READER_MAX_BUFFER} bytes \u2014 upstream is not framing events`,
         code: "TOOL_EXECUTION_FAILED",
         toolName: "mcp_transport_sse_reader",
-        context: { phase: "feed", bufferLength: this.buffer.length, maxBuffer: SSE_READER_MAX_BUFFER }
+        context: {
+          phase: "feed",
+          bufferLength: this.buffer.length,
+          maxBuffer: SSE_READER_MAX_BUFFER
+        }
       });
     }
     let idx = this.buffer.indexOf("\n");
@@ -190,7 +1134,11 @@ var SSEReader = class {
           message: `SSE: exceeded ${SSE_READER_MAX_DATA_LINES} data lines per event \u2014 upstream is not sending blank-line delimiters`,
           code: "TOOL_EXECUTION_FAILED",
           toolName: "mcp_transport_sse_reader",
-          context: { phase: "processLine", dataLineCount: this.dataLines.length, maxDataLines: SSE_READER_MAX_DATA_LINES }
+          context: {
+            phase: "processLine",
+            dataLineCount: this.dataLines.length,
+            maxDataLines: SSE_READER_MAX_DATA_LINES
+          }
         });
       }
       this.dataLines.push(value);
@@ -226,13 +1174,25 @@ var SSEReader = class {
 function isJsonRpcResult(v) {
   if (typeof v !== "object" || v === null) return false;
   const r = v;
-  if (r.jsonrpc !== "2.0") return false;
-  if (r.error !== void 0) {
-    return typeof r.error === "object" && r.error !== null && typeof r.error.code === "number" && typeof r.error.message === "string";
+  if (r["jsonrpc"] !== "2.0" || typeof r["id"] !== "number") return false;
+  if (Object.hasOwn(r, "method")) return false;
+  const hasResult = Object.hasOwn(r, "result");
+  const hasError = Object.hasOwn(r, "error");
+  if (hasResult === hasError) return false;
+  if (hasError) {
+    const error = r["error"];
+    return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
   }
-  return "result" in r || r.id === void 0;
+  return true;
 }
-function extractJsonRpcResults(text) {
+function isJsonRpcMethodEnvelope(v) {
+  if (typeof v !== "object" || v === null) return false;
+  const envelope = v;
+  if (envelope["jsonrpc"] !== "2.0" || typeof envelope["method"] !== "string") return false;
+  const id = envelope["id"];
+  return id === void 0 || typeof id === "number" || typeof id === "string";
+}
+function extractJsonRpcEnvelopes(text) {
   const out = [];
   let dataBuf = [];
   const flush = () => {
@@ -242,7 +1202,7 @@ function extractJsonRpcResults(text) {
     if (!joined) return;
     try {
       const parsed = JSON.parse(joined);
-      if (isJsonRpcResult(parsed)) out.push(parsed);
+      if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
     } catch {
     }
   };
@@ -266,7 +1226,7 @@ function extractJsonRpcResults(text) {
     if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
       try {
         const parsed = JSON.parse(trimmed);
-        if (isJsonRpcResult(parsed)) out.push(parsed);
+        if (isJsonRpcResult(parsed) || isJsonRpcMethodEnvelope(parsed)) out.push(parsed);
       } catch {
       }
     }
@@ -274,9 +1234,8 @@ function extractJsonRpcResults(text) {
   flush();
   return out;
 }
-function pickJsonRpcResult(text, id) {
-  const results = extractJsonRpcResults(text);
-  return results.find((r) => r.id === id) ?? results[0];
+function extractJsonRpcResults(text) {
+  return extractJsonRpcEnvelopes(text).filter(isJsonRpcResult);
 }
 function assertMatchingJsonRpcResult(data, expectedId, method) {
   if (!isJsonRpcResult(data)) {
@@ -287,7 +1246,7 @@ function assertMatchingJsonRpcResult(data, expectedId, method) {
       context: { method, expectedId, reason: "not-jsonrpc-envelope" }
     });
   }
-  if (data.id !== void 0 && data.id !== expectedId) {
+  if (data.id !== expectedId) {
     throw new ToolError({
       message: `Invalid JSON-RPC response: id mismatch for ${method} (expected ${expectedId}, got ${data.id})`,
       code: "TOOL_EXECUTION_FAILED",
@@ -295,14 +1254,6 @@ function assertMatchingJsonRpcResult(data, expectedId, method) {
       context: { method, expectedId, actualId: data.id, reason: "id-mismatch" }
     });
   }
-  if (data.id === void 0 && !method.startsWith("notifications/")) {
-    throw new ToolError({
-      message: `Invalid JSON-RPC response: missing id for ${method}`,
-      code: "TOOL_EXECUTION_FAILED",
-      toolName: "mcp_transport_jsonrpc",
-      context: { method, expectedId, reason: "missing-id" }
-    });
-  }
   return data;
 }
 function makeAbortError(method) {
@@ -336,16 +1287,26 @@ var BaseHTTPTransport = class {
   headers;
   timeout;
   requestTimeout;
+  name;
+  authorizationProvider;
+  authorizationResource;
   /** Per-request TLS agent — created once from HttpTransportOptions.tls */
   tlsAgent;
   tools = [];
+  serverMetadata;
   abortController;
   disconnectHandlers = [];
   toolsChangedListeners = /* @__PURE__ */ new Set();
+  resourcesChangedListeners = /* @__PURE__ */ new Set();
+  promptsChangedListeners = /* @__PURE__ */ new Set();
+  protocolVersion;
   constructor(opts, transportName) {
     validateTransportUrl(opts.url);
+    this.name = opts.name;
     this.url = opts.url;
     this.headers = { ...opts.headers };
+    this.authorizationProvider = opts.authorizationProvider;
+    this.authorizationResource = canonicalMcpResource(opts.url);
     this.timeout = opts.startupTimeoutMs ?? 1e4;
     this.requestTimeout = opts.requestTimeoutMs ?? 6e4;
     if (opts.tls) {
@@ -361,7 +1322,7 @@ var BaseHTTPTransport = class {
           `[mcp:${transportName}] \u26A0\uFE0F TLS verification DISABLED for ${this.url}. Network attacks are possible \u2014 only use on localhost.`
         );
       }
-      this.tlsAgent = new https.Agent({
+      this.tlsAgent = new https2.Agent({
         ca: opts.tls.ca,
         rejectUnauthorized: opts.tls.rejectUnauthorized
       });
@@ -370,9 +1331,52 @@ var BaseHTTPTransport = class {
   getState() {
     return this.state;
   }
+  async fetchWithAuthorization(input, init, signal) {
+    const context = {
+      serverName: this.name,
+      resource: this.authorizationResource,
+      signal
+    };
+    const send = async () => {
+      signal?.throwIfAborted();
+      const headers = new Headers(init.headers);
+      if (this.protocolVersion) headers.set("MCP-Protocol-Version", this.protocolVersion);
+      const token = await this.authorizationProvider?.getAccessToken(context);
+      signal?.throwIfAborted();
+      if (token) {
+        headers.set(
+          "Authorization",
+          authorizationHeaderForToken(token, this.authorizationResource)
+        );
+      }
+      return fetch(input, { ...init, headers });
+    };
+    let response = await send();
+    if (response.status !== 401 || !this.authorizationProvider?.handleUnauthorized) {
+      return response;
+    }
+    const challenge = parseMcpBearerChallenge(
+      response.headers.get("www-authenticate"),
+      this.authorizationResource
+    );
+    const retry = await this.authorizationProvider.handleUnauthorized(challenge, context);
+    if (!retry) return response;
+    await response.body?.cancel().catch(() => void 0);
+    response = await send();
+    return response;
+  }
   listTools() {
     return [...this.tools];
   }
+  getServerMetadata() {
+    const metadata = this.serverMetadata;
+    if (!metadata) return void 0;
+    return {
+      ...metadata,
+      capabilities: { ...metadata.capabilities },
+      serverInfo: { ...metadata.serverInfo }
+    };
+  }
   onDisconnect(cb) {
     this.disconnectHandlers.push(cb);
     return () => {
@@ -386,7 +1390,15 @@ var BaseHTTPTransport = class {
       this.toolsChangedListeners.delete(cb);
     };
   }
-  /**
+  onResourcesChanged(cb) {
+    this.resourcesChangedListeners.add(cb);
+    return () => this.resourcesChangedListeners.delete(cb);
+  }
+  onPromptsChanged(cb) {
+    this.promptsChangedListeners.add(cb);
+    return () => this.promptsChangedListeners.delete(cb);
+  }
+  /**
    * Fire all disconnect handlers. Subclasses call this when the connection
    * drops so the registry can schedule reconnects.
    */
@@ -398,6 +1410,22 @@ var BaseHTTPTransport = class {
       }
     }
   }
+  notifyResourcesChanged() {
+    for (const cb of this.resourcesChangedListeners) {
+      try {
+        cb();
+      } catch {
+      }
+    }
+  }
+  notifyPromptsChanged() {
+    for (const cb of this.promptsChangedListeners) {
+      try {
+        cb();
+      } catch {
+      }
+    }
+  }
   /**
    * Apply the pinned TLS agent (if configured) to a `RequestInit` object.
    * Uses `HttpDispatcher` from `@wrongstack/core`'s dispatcher-types shim,
@@ -444,6 +1472,7 @@ var SSETransport = class extends BaseHTTPTransport {
   }
   async connect() {
     this.state = "connecting";
+    this.serverMetadata = void 0;
     this.abortController = new AbortController();
     const signal = this.abortController.signal;
     const startupTimer = setTimeout(() => this.abortController?.abort(), this.timeout);
@@ -454,7 +1483,7 @@ var SSETransport = class extends BaseHTTPTransport {
         signal
       };
       this.applyTlsAgent(fetchOpts);
-      const response = await fetch(sseUrl, fetchOpts);
+      const response = await this.fetchWithAuthorization(sseUrl, fetchOpts, signal);
       if (!response.ok) {
         throw new ToolError({
           message: `SSE connect HTTP ${response.status}: ${response.statusText}`,
@@ -478,6 +1507,10 @@ var SSETransport = class extends BaseHTTPTransport {
         if (msg.method && !msg.id) {
           if (msg.method === "notifications/tools/list_changed") {
             void this.handleToolsListChanged();
+          } else if (msg.method === "notifications/resources/list_changed") {
+            this.notifyResourcesChanged();
+          } else if (msg.method === "notifications/prompts/list_changed") {
+            this.notifyPromptsChanged();
           }
         }
       });
@@ -500,6 +1533,8 @@ var SSETransport = class extends BaseHTTPTransport {
           context: { transport: "sse", url: this.url }
         });
       }
+      this.serverMetadata = parseServerMetadata(initRes.result);
+      this.protocolVersion = this.serverMetadata.protocolVersion;
       try {
         await this.httpPost("notifications/initialized", {});
       } catch {
@@ -509,11 +1544,7 @@ var SSETransport = class extends BaseHTTPTransport {
         this.tools.splice(0, this.tools.length);
       } else {
         const result = toolsRes.result;
-        this.tools.splice(
-          0,
-          this.tools.length,
-          ...normalizeMCPTools(result?.tools)
-        );
+        this.tools.splice(0, this.tools.length, ...normalizeMCPTools(result?.tools));
       }
       this.state = "connected";
       clearTimeout(startupTimer);
@@ -542,7 +1573,7 @@ var SSETransport = class extends BaseHTTPTransport {
   buildSSEUrl() {
     try {
       const url = new URL(this.url);
-      url.searchParams.set("session", randomBytes(16).toString("hex"));
+      url.searchParams.set("session", randomBytes2(16).toString("hex"));
       return url.toString();
     } catch {
       return this.url;
@@ -565,7 +1596,7 @@ var SSETransport = class extends BaseHTTPTransport {
     };
     this.applyTlsAgent(fetchOpts);
     try {
-      const res = await fetch(this.url, fetchOpts);
+      const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
         const body2 = await res.text();
         const cap = MCP_CONSTANTS.REQUEST_LOG_CAP;
@@ -624,13 +1655,12 @@ var SSETransport = class extends BaseHTTPTransport {
     };
   }
   /** Generic JSON-RPC request — used by MCPClient.request() for SSE transports. */
-  async request(method, params, timeoutMs) {
+  async request(method, params, timeoutMs, opts) {
     const id = this.genId();
     const body = JSON.stringify({ jsonrpc: "2.0", id, method, params });
-    const timeoutSignal = createTimeoutSignal(
-      this.abortController?.signal,
-      timeoutMs ?? this.requestTimeout
-    );
+    const external = opts?.signal;
+    const parent = external && this.abortController ? AbortSignal.any([this.abortController.signal, external]) : external ?? this.abortController?.signal;
+    const timeoutSignal = createTimeoutSignal(parent, timeoutMs ?? this.requestTimeout);
     const fetchOpts = {
       method: "POST",
       headers: {
@@ -642,7 +1672,7 @@ var SSETransport = class extends BaseHTTPTransport {
     };
     this.applyTlsAgent(fetchOpts);
     try {
-      const res = await fetch(this.url, fetchOpts);
+      const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
         throw new ToolError({
           message: `HTTP ${res.status}: ${res.statusText}`,
@@ -670,6 +1700,16 @@ var SSETransport = class extends BaseHTTPTransport {
       }
       const result = assertMatchingJsonRpcResult(data, id, method);
       return { jsonrpc: "2.0", id, result: result.result, error: result.error };
+    } catch (err) {
+      if (external?.aborted && !method.startsWith("notifications/")) {
+        void this.httpPost("notifications/cancelled", {
+          requestId: id,
+          reason: "client aborted"
+        }).catch(() => {
+        });
+        throw makeAbortError(method);
+      }
+      throw err;
     } finally {
       timeoutSignal.dispose();
     }
@@ -700,8 +1740,45 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
   genId() {
     return this._nextId++;
   }
+  consumeResponseText(text, requestId) {
+    const envelopes = extractJsonRpcEnvelopes(text);
+    for (const envelope of envelopes) {
+      if ("method" in envelope && envelope.id === void 0) {
+        this.handleNotification(envelope.method);
+      }
+    }
+    const responses = envelopes.filter(isJsonRpcResult);
+    return responses.find((envelope) => envelope.id === requestId) ?? responses.find((envelope) => envelope.id !== void 0) ?? responses[0];
+  }
+  handleNotification(method) {
+    if (method === "notifications/resources/list_changed") {
+      this.notifyResourcesChanged();
+    } else if (method === "notifications/prompts/list_changed") {
+      this.notifyPromptsChanged();
+    } else if (method === "notifications/tools/list_changed") {
+      void this.refreshTools();
+    }
+  }
+  async refreshTools() {
+    try {
+      const response = await this.postRaw("tools/list", {});
+      if (response.error) return;
+      const tools = normalizeMCPTools(
+        response.result?.tools
+      );
+      this.tools.splice(0, this.tools.length, ...tools);
+      for (const listener of this.toolsChangedListeners) {
+        try {
+          listener([...tools]);
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
   async connect() {
     this.state = "connecting";
+    this.serverMetadata = void 0;
     this.abortController = new AbortController();
     const signal = this.abortController.signal;
     const startupTimer = setTimeout(() => this.abortController?.abort(), this.timeout);
@@ -726,7 +1803,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         signal
       };
       this.applyTlsAgent(initFetchOpts);
-      const initRes = await fetch(this.url, initFetchOpts);
+      const initRes = await this.fetchWithAuthorization(this.url, initFetchOpts, signal);
       if (!initRes.ok) {
         throw new Error(`initialize HTTP ${initRes.status}: ${initRes.statusText}`);
       }
@@ -745,6 +1822,8 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       if (data.error) {
         throw new Error(`initialize failed: ${data.error.message}`);
       }
+      this.serverMetadata = parseServerMetadata(data.result);
+      this.protocolVersion = this.serverMetadata.protocolVersion;
       this.sessionId = initRes.headers.get("mcp-session-id") ?? void 0;
       await this.postRaw("notifications/initialized", {});
       const toolsRes = await this.postRaw("tools/list", {});
@@ -782,7 +1861,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
     };
     this.applyTlsAgent(fetchOpts);
     try {
-      const res = await fetch(this.url, fetchOpts);
+      const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
         throw new Error(`HTTP ${res.status}: ${res.statusText}`);
       }
@@ -790,7 +1869,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         await res.text().catch(() => void 0);
         return { jsonrpc: "2.0" };
       }
-      const match = pickJsonRpcResult(await res.text(), id);
+      const match = this.consumeResponseText(await res.text(), id);
       if (match) {
         return assertMatchingJsonRpcResult(match, id, method);
       }
@@ -810,13 +1889,12 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
     }
   }
   /** Generic JSON-RPC request — used by MCPClient.request() for SSE/streamable-http transports. */
-  async request(method, params, timeoutMs) {
+  async request(method, params, timeoutMs, opts) {
     const id = this.genId();
     const body = JSON.stringify({ jsonrpc: "2.0", id, method, params });
-    const timeoutSignal = createTimeoutSignal(
-      this.abortController?.signal,
-      timeoutMs ?? this.requestTimeout
-    );
+    const external = opts?.signal;
+    const parent = external && this.abortController ? AbortSignal.any([this.abortController.signal, external]) : external ?? this.abortController?.signal;
+    const timeoutSignal = createTimeoutSignal(parent, timeoutMs ?? this.requestTimeout);
     const fetchOpts = {
       method: "POST",
       headers: {
@@ -829,8 +1907,8 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
       signal: timeoutSignal.signal
     };
     this.applyTlsAgent(fetchOpts);
-    const res = await fetch(this.url, fetchOpts);
     try {
+      const res = await this.fetchWithAuthorization(this.url, fetchOpts, timeoutSignal.signal);
       if (!res.ok) {
         throw new Error(`HTTP ${res.status}: ${res.statusText}`);
       }
@@ -838,7 +1916,7 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         await res.text().catch(() => void 0);
         return { jsonrpc: "2.0", id };
       }
-      const parsed = pickJsonRpcResult(await res.text(), id);
+      const parsed = this.consumeResponseText(await res.text(), id);
       if (parsed) {
         return {
           jsonrpc: "2.0",
@@ -848,6 +1926,16 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
         };
       }
       throw new Error("Could not parse response as JSON-RPC");
+    } catch (err) {
+      if (external?.aborted && !method.startsWith("notifications/")) {
+        void this.postRaw("notifications/cancelled", {
+          requestId: id,
+          reason: "client aborted"
+        }).catch(() => {
+        });
+        throw makeAbortError(method);
+      }
+      throw err;
     } finally {
       timeoutSignal.dispose();
     }
@@ -875,6 +1963,18 @@ var StreamableHTTPTransport = class extends BaseHTTPTransport {
 };
 
 // src/client.ts
+function isJsonRpcResponse(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const response = value;
+  if (response["jsonrpc"] !== "2.0" || typeof response["id"] !== "number") return false;
+  if (Object.hasOwn(response, "method")) return false;
+  const hasResult = Object.hasOwn(response, "result");
+  const hasError = Object.hasOwn(response, "error");
+  if (hasResult === hasError) return false;
+  if (!hasError) return true;
+  const error = response["error"];
+  return typeof error === "object" && error !== null && typeof error["code"] === "number" && typeof error["message"] === "string";
+}
 var MCPClient = class {
   constructor(opts) {
     this.opts = opts;
@@ -891,6 +1991,8 @@ var MCPClient = class {
   pending = /* @__PURE__ */ new Map();
   rxBuffer = "";
   _tools = [];
+  /** Server-declared handshake metadata. Populated for stdio in the first protocol slice. */
+  _serverMetadata;
   /** Cached tool list — survives reconnects so the registry can re-register without re-discovering. */
   _toolsCache;
   _drainPending = false;
@@ -902,11 +2004,22 @@ var MCPClient = class {
   exitListeners = /* @__PURE__ */ new Set();
   /** Notified when the server announces a tools/list_changed notification. */
   toolsChangedListeners = /* @__PURE__ */ new Set();
+  resourcesChangedListeners = /* @__PURE__ */ new Set();
+  promptsChangedListeners = /* @__PURE__ */ new Set();
   /** Notified when an HTTP transport (SSE or streamable-http) disconnects. */
   disconnectListeners = /* @__PURE__ */ new Set();
   getState() {
     return this.state;
   }
+  getServerMetadata() {
+    const metadata = this._serverMetadata;
+    if (!metadata) return void 0;
+    return {
+      ...metadata,
+      capabilities: { ...metadata.capabilities },
+      serverInfo: { ...metadata.serverInfo }
+    };
+  }
   listTools() {
     return this._tools.length > 0 ? [...this._tools] : this._toolsCache ? [...this._toolsCache] : [];
   }
@@ -936,6 +2049,7 @@ var MCPClient = class {
   }
   async connect() {
     this.state = "connecting";
+    this._serverMetadata = void 0;
     if (this.opts.transport === "stdio") {
       await this.connectStdio();
     } else if (this.opts.transport === "sse") {
@@ -1007,6 +2121,12 @@ var MCPClient = class {
       this.state = "failed";
       throw new Error(`MCP initialize failed: ${initialize.error.message}`);
     }
+    try {
+      this._serverMetadata = parseServerMetadata(initialize.result);
+    } catch (err) {
+      this.state = "failed";
+      throw new Error(`MCP initialize returned malformed server metadata: ${toErrorMessage(err)}`);
+    }
     try {
       await this.notify("notifications/initialized", {});
     } catch (err) {
@@ -1034,7 +2154,8 @@ var MCPClient = class {
       url: this.opts.url,
       headers: this.opts.headers,
       startupTimeoutMs: this.opts.startupTimeoutMs,
-      requestTimeoutMs: this.opts.requestTimeoutMs
+      requestTimeoutMs: this.opts.requestTimeoutMs,
+      authorizationProvider: this.opts.authorizationProvider
     };
     this.sseTransport = new SSETransport(httpOpts);
     this.sseTransport.onDisconnect(() => {
@@ -1056,6 +2177,8 @@ var MCPClient = class {
         }
       }
     });
+    this.sseTransport.onResourcesChanged(() => this.emitCapabilityChanged("resources"));
+    this.sseTransport.onPromptsChanged(() => this.emitCapabilityChanged("prompts"));
     try {
       await this.sseTransport.connect();
     } catch (err) {
@@ -1068,6 +2191,7 @@ var MCPClient = class {
     }
     this._tools = this.sseTransport.listTools();
     this._toolsCache = this._tools;
+    this._serverMetadata = this.sseTransport.getServerMetadata();
     this.state = "connected";
   }
   async connectStreamableHTTP() {
@@ -1080,7 +2204,8 @@ var MCPClient = class {
       url: this.opts.url,
       headers: this.opts.headers,
       startupTimeoutMs: this.opts.startupTimeoutMs,
-      requestTimeoutMs: this.opts.requestTimeoutMs
+      requestTimeoutMs: this.opts.requestTimeoutMs,
+      authorizationProvider: this.opts.authorizationProvider
     };
     this.httpTransport = new StreamableHTTPTransport(httpOpts);
     this.httpTransport.onDisconnect(() => {
@@ -1102,6 +2227,8 @@ var MCPClient = class {
         }
       }
     });
+    this.httpTransport.onResourcesChanged(() => this.emitCapabilityChanged("resources"));
+    this.httpTransport.onPromptsChanged(() => this.emitCapabilityChanged("prompts"));
     try {
       await this.httpTransport.connect();
     } catch (err) {
@@ -1114,6 +2241,7 @@ var MCPClient = class {
     }
     this._tools = this.httpTransport.listTools();
     this._toolsCache = this._tools;
+    this._serverMetadata = this.httpTransport.getServerMetadata();
     this.state = "connected";
   }
   async callTool(name, input, opts) {
@@ -1136,6 +2264,79 @@ var MCPClient = class {
       isError: Boolean(result?.isError)
     };
   }
+  async listResources(opts = {}) {
+    const params = pageParams(opts.cursor, "resources/list cursor");
+    return this.requestCapability(
+      "resources",
+      "resources/list",
+      params,
+      parseListResourcesResult,
+      opts
+    );
+  }
+  async listResourceTemplates(opts = {}) {
+    const params = pageParams(opts.cursor, "resources/templates/list cursor");
+    return this.requestCapability(
+      "resources",
+      "resources/templates/list",
+      params,
+      parseListResourceTemplatesResult,
+      opts
+    );
+  }
+  async readResource(uri, opts = {}) {
+    validateProtocolString(uri, "resource URI");
+    return this.requestCapability(
+      "resources",
+      "resources/read",
+      { uri },
+      parseReadResourceResult,
+      opts
+    );
+  }
+  async subscribeResource(uri, opts = {}) {
+    validateProtocolString(uri, "resource URI");
+    this.requireResourceSubscriptions("resources/subscribe");
+    await this.requestCapability(
+      "resources",
+      "resources/subscribe",
+      { uri },
+      parseEmptyResult,
+      opts
+    );
+  }
+  async unsubscribeResource(uri, opts = {}) {
+    validateProtocolString(uri, "resource URI");
+    this.requireResourceSubscriptions("resources/unsubscribe");
+    await this.requestCapability(
+      "resources",
+      "resources/unsubscribe",
+      { uri },
+      parseEmptyResult,
+      opts
+    );
+  }
+  async listPrompts(opts = {}) {
+    const params = pageParams(opts.cursor, "prompts/list cursor");
+    return this.requestCapability("prompts", "prompts/list", params, parseListPromptsResult, opts);
+  }
+  async getPrompt(name, args, opts = {}) {
+    validateProtocolString(name, "prompt name");
+    if (args && Object.keys(args).length > 64) {
+      throw new Error("MCP prompt arguments exceed the limit of 64");
+    }
+    for (const [key, value] of Object.entries(args ?? {})) {
+      validateProtocolString(key, "prompt argument name");
+      validateProtocolString(value, `prompt argument "${key}"`, true);
+    }
+    return this.requestCapability(
+      "prompts",
+      "prompts/get",
+      args === void 0 ? { name } : { name, arguments: args },
+      parseGetPromptResult,
+      opts
+    );
+  }
   async close() {
     if (this.child) {
       const child = this.child;
@@ -1170,8 +2371,8 @@ var MCPClient = class {
     this.state = "disconnected";
   }
   request(method, params, timeoutMs = this.opts.requestTimeoutMs ?? 6e4, opts) {
-    if (this.sseTransport) return this.sseTransport.request(method, params, timeoutMs);
-    if (this.httpTransport) return this.httpTransport.request(method, params, timeoutMs);
+    if (this.sseTransport) return this.sseTransport.request(method, params, timeoutMs, opts);
+    if (this.httpTransport) return this.httpTransport.request(method, params, timeoutMs, opts);
     const signal = opts?.signal;
     if (signal?.aborted) {
       const err = new Error(`MCP "${this.opts.name}" request "${method}" aborted before send`);
@@ -1238,6 +2439,37 @@ var MCPClient = class {
       }
     });
   }
+  async requestCapability(capability, method, params, parse, opts) {
+    if (this.state !== "connected") {
+      throw new Error(`MCP client "${this.opts.name}" not connected (state=${this.state})`);
+    }
+    const metadata = this._serverMetadata;
+    if (!metadata) {
+      throw new Error(
+        `MCP server "${this.opts.name}" capability metadata is unavailable for ${method}`
+      );
+    }
+    if (!metadata.capabilities[capability]) {
+      throw new Error(
+        `MCP server "${this.opts.name}" does not advertise the ${capability} capability`
+      );
+    }
+    const response = await this.request(method, params, void 0, opts);
+    if (response.error) {
+      throw new Error(`MCP ${method} failed: ${response.error.message}`);
+    }
+    return parse(response.result);
+  }
+  requireResourceSubscriptions(method) {
+    if (this.state !== "connected") {
+      throw new Error(`MCP client "${this.opts.name}" not connected (state=${this.state})`);
+    }
+    if (this._serverMetadata?.capabilities.resources?.subscribe !== true) {
+      throw new Error(
+        `MCP server "${this.opts.name}" does not advertise resource subscriptions for ${method}`
+      );
+    }
+  }
   /**
    * Reject every in-flight {@link request} call. Used when the underlying
    * transport dies — without this, callers awaiting `tools/call` over a
@@ -1322,14 +2554,48 @@ var MCPClient = class {
     } catch {
       return;
     }
-    if (msg.id !== void 0 && this.pending.has(msg.id)) {
+    if (typeof msg !== "object" || msg === null) return;
+    const envelope = msg;
+    if (envelope["jsonrpc"] !== "2.0") return;
+    if (typeof envelope["method"] === "string") {
+      const id = envelope["id"];
+      if (typeof id === "number" || typeof id === "string") {
+        this.handleServerRequest({
+          jsonrpc: "2.0",
+          id,
+          method: envelope["method"],
+          params: envelope["params"]
+        });
+        return;
+      }
+      if (Object.hasOwn(envelope, "id")) return;
+      if (envelope["method"] === "notifications/tools/list_changed") {
+        void this.handleToolsListChanged();
+      } else if (envelope["method"] === "notifications/resources/list_changed") {
+        this.emitCapabilityChanged("resources");
+      } else if (envelope["method"] === "notifications/prompts/list_changed") {
+        this.emitCapabilityChanged("prompts");
+      }
+      return;
+    }
+    if (!isJsonRpcResponse(msg)) return;
+    if (this.pending.has(msg.id)) {
       const entry = this.pending.get(msg.id);
       this.pending.delete(msg.id);
       entry?.resolve(msg);
-      return;
     }
-    if (typeof msg.method === "string" && msg.method === "notifications/tools/list_changed") {
-      void this.handleToolsListChanged();
+  }
+  handleServerRequest(request3) {
+    const message = request3.method === "sampling/createMessage" ? "Client sampling is disabled by policy" : `Method not found: ${request3.method}`;
+    const response = {
+      jsonrpc: "2.0",
+      id: request3.id,
+      error: { code: -32601, message }
+    };
+    try {
+      this.child?.stdin?.write(`${JSON.stringify(response)}
+`);
+    } catch {
     }
   }
   /**
@@ -1361,138 +2627,761 @@ var MCPClient = class {
   removeToolsChangedListener(listener) {
     this.toolsChangedListeners.delete(listener);
   }
+  addResourcesChangedListener(listener) {
+    this.resourcesChangedListeners.add(listener);
+  }
+  removeResourcesChangedListener(listener) {
+    this.resourcesChangedListeners.delete(listener);
+  }
+  addPromptsChangedListener(listener) {
+    this.promptsChangedListeners.add(listener);
+  }
+  removePromptsChangedListener(listener) {
+    this.promptsChangedListeners.delete(listener);
+  }
+  emitCapabilityChanged(capability) {
+    const listeners = capability === "resources" ? this.resourcesChangedListeners : this.promptsChangedListeners;
+    for (const listener of listeners) {
+      try {
+        listener(this.opts.name);
+      } catch {
+      }
+    }
+  }
 };
 function quoteWindowsArg(arg) {
   if (!/[\s"]/.test(arg)) return arg;
   return `"${arg.replace(/"/g, '""')}"`;
 }
-
-// src/wrap-tool.ts
-import { ToolCapabilities } from "@wrongstack/core";
-var MUTATING_RE = /create|update|delete|write|send|set|put|post|patch|remove|rename|move/i;
-function isMutatingTool(mcpTool) {
-  if (MUTATING_RE.test(mcpTool.name)) return true;
-  const schema = mcpTool.inputSchema;
-  if (schema && typeof schema === "object") {
-    const props = schema.properties;
-    if (props) {
-      for (const key of Object.keys(props)) {
-        if (MUTATING_RE.test(key)) return true;
-      }
-    }
+var MAX_PROTOCOL_INPUT_CHARS = 8192;
+function validateProtocolString(value, label, allowEmpty = false) {
+  if (typeof value !== "string" || !allowEmpty && value.length === 0) {
+    throw new Error(`MCP ${label} must be ${allowEmpty ? "a string" : "a non-empty string"}`);
+  }
+  if (value.length > MAX_PROTOCOL_INPUT_CHARS) {
+    throw new Error(`MCP ${label} exceeds ${MAX_PROTOCOL_INPUT_CHARS} characters`);
   }
-  return false;
 }
-function wrapMCPTool(serverName, mcpTool, client, permission = "confirm") {
-  const qualifiedName = `mcp__${serverName}__${mcpTool.name}`;
+function pageParams(cursor, label) {
+  if (cursor === void 0) return {};
+  validateProtocolString(cursor, label);
+  return { cursor };
+}
+function parseEmptyResult(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Malformed MCP empty result: expected object");
+  }
+}
+
+// src/content-selection.ts
+var DEFAULT_MCP_INSERTION_MAX_BYTES = 256 * 1024;
+var DEFAULT_MCP_RESOURCE_SCHEMES = [
+  "file",
+  "git",
+  "http",
+  "https",
+  "mcp",
+  "mem",
+  "repo",
+  "resource"
+];
+function prepareResourceInsertion(serverName, requestedUri, result, policy = {}) {
+  requireIdentity(serverName, "server name");
+  validateUri(requestedUri, policy);
+  if (result.contents.length > 64) {
+    throw new Error("MCP resource insertion exceeds the limit of 64 content blocks");
+  }
+  let byteSize = 0;
+  for (const content of result.contents) {
+    validateUri(content.uri, policy);
+    if (content.text !== void 0) byteSize += utf8Bytes(content.text);
+    if (content.blob !== void 0) byteSize += base64DecodedBytes(content.blob);
+    enforceSize(byteSize, policy);
+  }
   return {
-    name: qualifiedName,
-    description: mcpTool.description ?? `${qualifiedName} (MCP tool)`,
-    usageHint: `Tool provided by MCP server "${serverName}". ${mcpTool.description ?? ""}`,
-    permission,
-    mutating: isMutatingTool(mcpTool),
-    capabilities: [ToolCapabilities.MCP_PROXY],
-    inputSchema: mcpTool.inputSchema ?? { type: "object", properties: {} },
-    async execute(input, _ctx, opts) {
-      const live = typeof client === "function" ? await client() : client;
-      const res = await live.callTool(mcpTool.name, input, { signal: opts.signal });
-      if (res.isError) {
-        throw new Error(stringify(res.content));
-      }
-      return stringify(res.content);
-    }
+    kind: "resource",
+    untrusted: true,
+    byteSize,
+    provenance: {
+      origin: "mcp",
+      serverName,
+      capability: "resource",
+      resourceUri: requestedUri
+    },
+    contents: structuredClone(result.contents)
   };
 }
-function stringify(c) {
-  if (typeof c === "string") return c;
-  if (Array.isArray(c)) {
-    return c.map((item) => {
-      if (item && typeof item === "object") {
-        const t = item.type;
-        if (t === "text") return item.text ?? "";
-        return JSON.stringify(item);
-      }
-      return String(item);
-    }).join("\n");
+function preparePromptInsertion(serverName, promptName, args, result, policy = {}) {
+  requireIdentity(serverName, "server name");
+  requireIdentity(promptName, "prompt name");
+  if (result.messages.length > 128) {
+    throw new Error("MCP prompt insertion exceeds the limit of 128 messages");
   }
-  if (c && typeof c === "object") {
-    if ("text" in c) {
-      return String(c.text);
-    }
-    return JSON.stringify(c);
+  for (const message of result.messages) validateEmbeddedUris(message.content, policy, 0);
+  let serialized;
+  try {
+    serialized = JSON.stringify(result.messages);
+  } catch {
+    throw new Error("MCP prompt insertion contains non-serializable content");
   }
-  return String(c ?? "");
-}
-
-// src/registry.ts
-import { expectDefined } from "@wrongstack/core";
-
-// src/manifest-cache.ts
-import { createHash } from "node:crypto";
-import * as fs from "node:fs/promises";
-import * as path from "node:path";
-function manifestConfigHash(cfg) {
-  const basis = JSON.stringify({
-    transport: cfg.transport,
-    command: cfg.command ?? null,
-    args: cfg.args ?? null,
-    url: cfg.url ?? null
-  });
-  return createHash("sha256").update(basis).digest("hex").slice(0, 16);
+  const byteSize = utf8Bytes(serialized);
+  enforceSize(byteSize, policy);
+  return {
+    kind: "prompt",
+    untrusted: true,
+    byteSize,
+    provenance: {
+      origin: "mcp",
+      serverName,
+      capability: "prompt",
+      promptName,
+      promptArgumentNames: Object.keys(args ?? {}).sort()
+    },
+    description: result.description,
+    messages: structuredClone(result.messages)
+  };
 }
-function manifestFile(cacheDir, name) {
-  const safe = name.replace(/[^a-zA-Z0-9._-]/g, "_");
-  return path.join(cacheDir, "mcp-tools", `${safe}.json`);
+function validateEmbeddedUris(value, policy, depth) {
+  if (depth > 32) throw new Error("MCP prompt insertion exceeds the nesting depth limit");
+  if (Array.isArray(value)) {
+    for (const item of value) validateEmbeddedUris(item, policy, depth + 1);
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, nested] of Object.entries(value)) {
+    if (key === "uri" && typeof nested === "string") validateUri(nested, policy);
+    validateEmbeddedUris(nested, policy, depth + 1);
+  }
 }
-async function readManifest(cacheDir, name, configHash) {
+function validateUri(uri, policy) {
+  if (uri.length === 0 || uri.length > 8192) {
+    throw new Error("MCP insertion URI must contain 1\u20138192 characters");
+  }
+  let parsed;
   try {
-    const raw = await fs.readFile(manifestFile(cacheDir, name), "utf8");
-    const parsed = JSON.parse(raw);
-    if (parsed.configHash !== configHash || !Array.isArray(parsed.tools)) return null;
-    return parsed.tools;
+    parsed = new URL(uri);
   } catch {
-    return null;
+    throw new Error("MCP insertion URI must be absolute");
+  }
+  const scheme = parsed.protocol.slice(0, -1).toLowerCase();
+  const allowed = new Set(
+    (policy.allowedUriSchemes ?? DEFAULT_MCP_RESOURCE_SCHEMES).map((value) => value.toLowerCase())
+  );
+  if (!allowed.has(scheme)) {
+    throw new Error(`MCP insertion URI scheme "${scheme}" is not allowed`);
+  }
+  if ((scheme === "http" || scheme === "https") && (parsed.username || parsed.password)) {
+    throw new Error("MCP insertion URI must not contain credentials");
   }
 }
-async function writeManifest(cacheDir, name, configHash, tools) {
+function enforceSize(byteSize, policy) {
+  const maxBytes = policy.maxBytes ?? DEFAULT_MCP_INSERTION_MAX_BYTES;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new Error("MCP insertion maxBytes must be a positive safe integer");
+  }
+  if (byteSize > maxBytes) {
+    throw new Error(`MCP insertion exceeds the ${maxBytes}-byte content limit`);
+  }
+}
+function base64DecodedBytes(blob) {
+  if (!/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(blob)) {
+    throw new Error("MCP resource insertion contains invalid base64 content");
+  }
+  const padding = blob.endsWith("==") ? 2 : blob.endsWith("=") ? 1 : 0;
+  return blob.length / 4 * 3 - padding;
+}
+function utf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function requireIdentity(value, label) {
+  if (value.length === 0 || value.length > 256) {
+    throw new Error(`MCP insertion ${label} must contain 1\u2013256 characters`);
+  }
+}
+
+// src/manage.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import * as fs from "node:fs/promises";
+async function readConfig(path2) {
   try {
-    const file = manifestFile(cacheDir, name);
-    await fs.mkdir(path.dirname(file), { recursive: true });
-    const body = { configHash, tools };
-    const tmp = `${file}.tmp`;
-    await fs.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
-    await fs.rename(tmp, file);
+    return JSON.parse(await fs.readFile(path2, "utf8"));
   } catch {
+    return {};
   }
 }
-
-// src/registry.ts
-var MCPRegistry = class _MCPRegistry {
-  servers = /* @__PURE__ */ new Map();
-  toolRegistry;
-  events;
-  log;
-  lazyMode;
-  cacheDir;
-  idleTimeoutMs;
-  /** Single shared idle sweep timer (started lazily; unref'd; cleared on stopAll). */
-  idleTimer;
-  constructor(opts) {
-    this.toolRegistry = opts.toolRegistry;
-    this.events = opts.events;
-    this.log = opts.log;
-    this.lazyMode = opts.lazyMode ?? false;
-    this.cacheDir = opts.cacheDir;
-    this.idleTimeoutMs = opts.idleTimeoutMs ?? MCP_CONSTANTS.IDLE.DEFAULT_TIMEOUT_MS;
+async function writeConfig(path2, cfg) {
+  const raw = JSON.stringify(cfg, null, 2);
+  const tmp = `${path2}.${process.pid}.${randomBytes3(6).toString("hex")}.tmp`;
+  await fs.writeFile(tmp, raw, "utf8");
+  try {
+    await fs.rename(tmp, path2);
+  } catch (err) {
+    await fs.rm(tmp, { force: true }).catch(() => void 0);
+    throw err;
   }
-  async start(cfg) {
-    if (cfg.enabled === false) return;
-    if (this.servers.has(cfg.name)) {
-      throw new Error(
-        `MCP server "${cfg.name}" is already registered \u2014 use restart() to re-cycle a running server`
-      );
-    }
-    const lazy = !!cfg.lazy && !!this.cacheDir;
+}
+function isMcpServerRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+async function readServers(configPath) {
+  const full = await readConfig(configPath);
+  const servers = isMcpServerRecord(full.mcpServers) ? { ...full.mcpServers } : {};
+  return { full, servers };
+}
+async function persist(configPath, full, servers) {
+  full.mcpServers = servers;
+  await writeConfig(configPath, full);
+}
+function normalizeTransport(t) {
+  if (t === "sse") return "sse";
+  if (t === "http" || t === "streamable-http") return "streamable-http";
+  return "stdio";
+}
+function buildConfig(input, base) {
+  const cfg = {
+    name: input.name,
+    transport: input.transport ? normalizeTransport(String(input.transport)) : base?.transport ?? "stdio"
+  };
+  const description = input.description ?? base?.description;
+  if (description !== void 0) cfg.description = description;
+  const command = input.command ?? base?.command;
+  if (command !== void 0) cfg.command = command;
+  const args = input.args ?? base?.args;
+  if (args !== void 0) cfg.args = args;
+  const env = input.env ?? base?.env;
+  if (env !== void 0) cfg.env = env;
+  const url = input.url ?? base?.url;
+  if (url !== void 0) cfg.url = url;
+  const headers = input.headers ?? base?.headers;
+  if (headers !== void 0) cfg.headers = headers;
+  const allowedTools = input.allowedTools ?? base?.allowedTools;
+  if (allowedTools !== void 0) cfg.allowedTools = allowedTools;
+  const permission = input.permission ?? base?.permission;
+  if (permission !== void 0) cfg.permission = permission;
+  const enabled = input.enabled ?? base?.enabled;
+  if (enabled !== void 0) cfg.enabled = enabled;
+  const lazy = input.lazy ?? base?.lazy;
+  if (lazy !== void 0) cfg.lazy = lazy;
+  const passthroughEnv = input.passthroughEnv ?? base?.passthroughEnv;
+  if (passthroughEnv !== void 0) cfg.passthroughEnv = passthroughEnv;
+  const health = input.health ?? base?.health;
+  if (health !== void 0) cfg.health = health;
+  return cfg;
+}
+function projectServer(name, cfg, registry) {
+  const live = registry.list().find((s) => s.name === name);
+  const info = {
+    name,
+    transport: cfg.transport,
+    enabled: cfg.enabled !== false,
+    status: live ? live.state : "stopped",
+    tools: live?.tools ?? []
+  };
+  if (cfg.description !== void 0) info.description = cfg.description;
+  if (cfg.url !== void 0) info.url = cfg.url;
+  if (cfg.command !== void 0) info.command = cfg.command;
+  if (cfg.lazy !== void 0) info.lazy = cfg.lazy;
+  return info;
+}
+function liveState(name, registry) {
+  const live = registry.list().find((s) => s.name === name);
+  return { state: live?.state ?? "stopped", tools: live?.tools ?? [] };
+}
+function errMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+async function listMcp(deps) {
+  const { servers } = await readServers(deps.configPath);
+  return Object.entries(servers).map(
+    ([name, cfg]) => projectServer(name, { ...cfg, name }, deps.registry)
+  );
+}
+async function addMcp(input, deps) {
+  if (!input.name) return { ok: false, message: "Server name is required" };
+  const { full, servers } = await readServers(deps.configPath);
+  if (servers[input.name]) {
+    return { ok: false, message: `Server "${input.name}" already exists` };
+  }
+  const preset = deps.presets?.[input.name];
+  const hasExplicitConfig = !!(input.transport || input.command || input.url);
+  const cfg = hasExplicitConfig ? buildConfig(input, preset) : preset ? buildConfig({ ...input, name: input.name }, preset) : buildConfig(input);
+  if (!hasExplicitConfig && !preset) {
+    const known = Object.keys(deps.presets ?? {}).join(", ");
+    return {
+      ok: false,
+      message: known ? `Unknown server "${input.name}". Available presets: ${known}` : `No configuration provided for "${input.name}"`
+    };
+  }
+  cfg.enabled = input.enabled ?? false;
+  servers[input.name] = cfg;
+  await persist(deps.configPath, full, servers);
+  if (cfg.enabled) {
+    return startServer(input.name, cfg, deps, `Server "${input.name}" added`);
+  }
+  trackDisabled(deps.registry, cfg);
+  return {
+    ok: true,
+    message: `Server "${input.name}" added (disabled)`,
+    server: projectServer(input.name, cfg, deps.registry)
+  };
+}
+async function updateMcp(input, deps) {
+  if (!input.name) return { ok: false, message: "Server name is required" };
+  const { full, servers } = await readServers(deps.configPath);
+  const existing = servers[input.name];
+  if (!existing) return { ok: false, message: `Server "${input.name}" not found` };
+  const cfg = buildConfig(input, { ...existing, name: input.name });
+  servers[input.name] = cfg;
+  await persist(deps.configPath, full, servers);
+  if (cfg.enabled !== false) {
+    return startServer(input.name, cfg, deps, `Server "${input.name}" updated`, { restart: true });
+  }
+  await safeStop(input.name, deps);
+  trackDisabled(deps.registry, cfg);
+  return {
+    ok: true,
+    message: `Server "${input.name}" updated`,
+    server: projectServer(input.name, cfg, deps.registry)
+  };
+}
+async function removeMcp(name, deps) {
+  if (!name) return { ok: false, message: "Server name is required" };
+  const { full, servers } = await readServers(deps.configPath);
+  if (!servers[name]) return { ok: false, message: `Server "${name}" not found` };
+  await safeStop(name, deps);
+  forgetRegistryState(deps.registry, name);
+  delete servers[name];
+  await persist(deps.configPath, full, servers);
+  return { ok: true, message: `Server "${name}" removed` };
+}
+async function enableMcp(name, deps) {
+  if (!name) return { ok: false, message: "Server name is required" };
+  const { full, servers } = await readServers(deps.configPath);
+  const cfg = servers[name];
+  if (!cfg) {
+    return { ok: false, message: `Server "${name}" is not in config. Add it first.` };
+  }
+  cfg.enabled = true;
+  servers[name] = cfg;
+  await persist(deps.configPath, full, servers);
+  return startServer(name, cfg, deps, `Server "${name}" enabled`, { restart: true });
+}
+async function disableMcp(name, deps) {
+  if (!name) return { ok: false, message: "Server name is required" };
+  const { full, servers } = await readServers(deps.configPath);
+  const cfg = servers[name];
+  if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
+  await safeStop(name, deps);
+  cfg.enabled = false;
+  trackDisabled(deps.registry, { ...cfg, name });
+  servers[name] = cfg;
+  await persist(deps.configPath, full, servers);
+  return {
+    ok: true,
+    message: `Server "${name}" disabled`,
+    server: projectServer(name, cfg, deps.registry)
+  };
+}
+async function restartMcp(name, deps) {
+  if (!name) return { ok: false, message: "Server name is required" };
+  const registered = deps.registry.list().some((s) => s.name === name);
+  if (registered) {
+    try {
+      await deps.registry.restart(name);
+      const { state, tools } = liveState(name, deps.registry);
+      return { ok: true, message: `Server "${name}" restarted`, state, tools };
+    } catch (err) {
+      return { ok: false, message: `Failed to restart "${name}": ${errMessage(err)}` };
+    }
+  }
+  const { servers } = await readServers(deps.configPath);
+  const cfg = servers[name];
+  if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
+  return startServer(name, { ...cfg, name }, deps, `Server "${name}" started`, { restart: true });
+}
+async function discoverMcp(name, deps) {
+  if (!name) return { ok: false, message: "Server name is required" };
+  const result = await restartMcp(name, deps);
+  if (!result.ok) return result;
+  const { state, tools } = liveState(name, deps.registry);
+  return {
+    ok: true,
+    message: `Discovered ${tools.length} tool${tools.length === 1 ? "" : "s"} from "${name}"`,
+    state,
+    tools
+  };
+}
+async function startServer(name, cfg, deps, okMessage, opts) {
+  try {
+    const alreadyRegistered = deps.registry.list().some((s) => s.name === name);
+    if (alreadyRegistered && opts?.restart) {
+      await deps.registry.restart(name);
+    } else if (alreadyRegistered) {
+      await deps.registry.restart(name);
+    } else {
+      await deps.registry.start({ ...cfg, enabled: true });
+    }
+    const { state, tools } = liveState(name, deps.registry);
+    return {
+      ok: true,
+      message: okMessage,
+      server: projectServer(name, cfg, deps.registry),
+      state,
+      tools
+    };
+  } catch (err) {
+    const message = errMessage(err);
+    return {
+      ok: true,
+      // config persisted — surface a soft warning, not a hard failure
+      message: `${okMessage} in config, but failed to start: ${message}`,
+      server: projectServer(name, cfg, deps.registry),
+      registryError: message
+    };
+  }
+}
+async function safeStop(name, deps) {
+  try {
+    await deps.registry.stop(name);
+  } catch {
+  }
+}
+function trackDisabled(registry, cfg) {
+  if (typeof registry.markDisabled === "function") registry.markDisabled(cfg);
+}
+function forgetRegistryState(registry, name) {
+  if (typeof registry.forget === "function") registry.forget(name);
+}
+
+// src/manifest-cache.ts
+import { createHash as createHash2 } from "node:crypto";
+import * as fs2 from "node:fs/promises";
+import * as path from "node:path";
+function manifestConfigHash(cfg) {
+  const basis = JSON.stringify({
+    transport: cfg.transport,
+    command: cfg.command ?? null,
+    args: cfg.args ?? null,
+    url: cfg.url ?? null
+  });
+  return createHash2("sha256").update(basis).digest("hex").slice(0, 16);
+}
+function manifestFile(cacheDir, name) {
+  const safe = name.replace(/[^a-zA-Z0-9._-]/g, "_");
+  return path.join(cacheDir, "mcp-tools", `${safe}.json`);
+}
+async function readManifest(cacheDir, name, configHash) {
+  const manifest = await readCapabilityManifest(cacheDir, name, configHash);
+  return manifest?.tools ?? null;
+}
+async function readCapabilityManifest(cacheDir, name, configHash) {
+  try {
+    const raw = await fs2.readFile(manifestFile(cacheDir, name), "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.configHash !== configHash || !Array.isArray(parsed.tools)) return null;
+    return {
+      tools: parsed.tools,
+      serverMetadata: parsed.serverMetadata === void 0 ? void 0 : parseServerMetadata(parsed.serverMetadata),
+      resources: parsed.resources === void 0 ? void 0 : parseListResourcesResult({ resources: parsed.resources }).resources,
+      resourceTemplates: parsed.resourceTemplates === void 0 ? void 0 : parseListResourceTemplatesResult({ resourceTemplates: parsed.resourceTemplates }).resourceTemplates,
+      prompts: parsed.prompts === void 0 ? void 0 : parseListPromptsResult({ prompts: parsed.prompts }).prompts
+    };
+  } catch {
+    return null;
+  }
+}
+async function writeManifest(cacheDir, name, configHash, tools) {
+  const previous = await readCapabilityManifest(cacheDir, name, configHash);
+  await writeCapabilityManifest(cacheDir, name, configHash, {
+    ...previous,
+    tools
+  });
+}
+async function writeCapabilityManifest(cacheDir, name, configHash, manifest) {
+  try {
+    const file = manifestFile(cacheDir, name);
+    await fs2.mkdir(path.dirname(file), { recursive: true });
+    const body = { version: 2, configHash, ...manifest };
+    const tmp = `${file}.tmp`;
+    await fs2.writeFile(tmp, JSON.stringify(body, null, 2), "utf8");
+    await fs2.rename(tmp, file);
+  } catch {
+  }
+}
+
+// src/operations.ts
+var MCP_OPERATION_LIMITS = Object.freeze({
+  LATENCY_SAMPLES: 128,
+  RECENT_EVENTS: 32,
+  REASON_CHARS: 64
+});
+var SAFE_OPERATION_REASONS = /* @__PURE__ */ new Set([
+  "automatic",
+  "complete",
+  "connect-attempt-failed",
+  "connected",
+  "http-disconnect",
+  "http-disconnect-lazy",
+  "idle-timeout",
+  "lazy-demand",
+  "manual",
+  "ok",
+  "process-exit",
+  "process-exit-lazy",
+  "prompt-discovery-failed",
+  "reconnect-exhausted",
+  "resource-discovery-failed",
+  "resource-template-discovery-failed",
+  "started",
+  "tool-call-failed"
+]);
+function createMCPServerOperationState() {
+  return {
+    consecutiveFailures: 0,
+    failures: { transport: 0, protocol: 0, tool: 0 },
+    reconnectCount: 0,
+    wakeCount: 0,
+    sleepCount: 0,
+    restartCount: 0,
+    connectionSamples: [],
+    discoverySamples: [],
+    callSamples: [],
+    inFlightCalls: 0,
+    peakInFlightCalls: 0,
+    recentEvents: []
+  };
+}
+function healthStateFor(connectionState, operations, enabled = true) {
+  if (!enabled) return "disabled";
+  if (connectionState === "dormant") return "dormant";
+  if (connectionState === "connecting" || connectionState === "reconnecting" || connectionState === "idle") {
+    return "connecting";
+  }
+  if (connectionState === "failed") return "failed";
+  if (connectionState === "disconnected" || operations.consecutiveFailures > 0) return "degraded";
+  return "healthy";
+}
+function evaluateHealthThresholds(operations, thresholds) {
+  if (!thresholds) return [];
+  const checks = [];
+  if (thresholds.connectionLatencyP95Ms !== void 0 && operations.connectionSamples.length > 0) {
+    const value = percentile([...operations.connectionSamples].sort((a, b) => a - b), 0.95);
+    checks.push({
+      name: "connection-latency-p95",
+      passed: value <= thresholds.connectionLatencyP95Ms,
+      value,
+      threshold: thresholds.connectionLatencyP95Ms
+    });
+  }
+  if (thresholds.discoveryLatencyP95Ms !== void 0 && operations.discoverySamples.length > 0) {
+    const value = percentile([...operations.discoverySamples].sort((a, b) => a - b), 0.95);
+    checks.push({
+      name: "discovery-latency-p95",
+      passed: value <= thresholds.discoveryLatencyP95Ms,
+      value,
+      threshold: thresholds.discoveryLatencyP95Ms
+    });
+  }
+  if (thresholds.callLatencyP95Ms !== void 0 && operations.callSamples.length > 0) {
+    const value = percentile([...operations.callSamples].sort((a, b) => a - b), 0.95);
+    checks.push({
+      name: "call-latency-p95",
+      passed: value <= thresholds.callLatencyP95Ms,
+      value,
+      threshold: thresholds.callLatencyP95Ms
+    });
+  }
+  if (thresholds.inFlightCalls !== void 0) {
+    checks.push({
+      name: "in-flight-calls",
+      passed: operations.peakInFlightCalls <= thresholds.inFlightCalls,
+      value: operations.peakInFlightCalls,
+      threshold: thresholds.inFlightCalls
+    });
+  }
+  return checks;
+}
+function applyHealthThresholds(state, checks) {
+  if (state !== "healthy") return state;
+  return checks.some((c) => !c.passed) ? "degraded" : "healthy";
+}
+function summarizeLatency(samples) {
+  if (samples.length === 0) return { count: 0 };
+  const sorted = [...samples].sort((a, b) => a - b);
+  return {
+    count: samples.length,
+    lastMs: samples[samples.length - 1],
+    minMs: sorted[0],
+    maxMs: sorted[sorted.length - 1],
+    p50Ms: percentile(sorted, 0.5),
+    p95Ms: percentile(sorted, 0.95)
+  };
+}
+function pushBounded(target, value, limit) {
+  target.push(value);
+  if (target.length > limit) target.splice(0, target.length - limit);
+}
+function safeOperationReason(reason) {
+  const normalized = reason.toLowerCase().replace(/[^a-z0-9_.:-]+/g, "-");
+  const bounded = normalized.slice(0, MCP_OPERATION_LIMITS.REASON_CHARS);
+  return SAFE_OPERATION_REASONS.has(bounded) ? bounded : "other";
+}
+function percentile(sorted, ratio) {
+  return sorted[Math.min(sorted.length - 1, Math.max(0, Math.ceil(sorted.length * ratio) - 1))];
+}
+
+// src/registry.ts
+import { expectDefined } from "@wrongstack/core";
+
+// src/wrap-tool.ts
+import { ToolCapabilities } from "@wrongstack/core";
+var MUTATING_RE = /create|update|delete|write|send|set|put|post|patch|remove|rename|move/i;
+function isMutatingTool(mcpTool) {
+  if (MUTATING_RE.test(mcpTool.name)) return true;
+  const schema = mcpTool.inputSchema;
+  if (schema && typeof schema === "object") {
+    const props = schema.properties;
+    if (props) {
+      for (const key of Object.keys(props)) {
+        if (MUTATING_RE.test(key)) return true;
+      }
+    }
+  }
+  return false;
+}
+function wrapMCPTool(serverName, mcpTool, client, permission = "confirm", observer) {
+  const qualifiedName = `mcp__${serverName}__${mcpTool.name}`;
+  return {
+    name: qualifiedName,
+    description: mcpTool.description ?? `${qualifiedName} (MCP tool)`,
+    usageHint: `Tool provided by MCP server "${serverName}". ${mcpTool.description ?? ""}`,
+    permission,
+    mutating: isMutatingTool(mcpTool),
+    capabilities: [ToolCapabilities.MCP_PROXY],
+    inputSchema: mcpTool.inputSchema ?? { type: "object", properties: {} },
+    async execute(input, _ctx, opts) {
+      const startedAt = Date.now();
+      observer?.onStart();
+      let ok = false;
+      try {
+        const live = typeof client === "function" ? await client() : client;
+        const res = await live.callTool(mcpTool.name, input, { signal: opts.signal });
+        if (res.isError) {
+          throw new Error(stringify(res.content));
+        }
+        ok = true;
+        return stringify(res.content);
+      } finally {
+        observer?.onFinish({ durationMs: Date.now() - startedAt, ok });
+      }
+    }
+  };
+}
+function stringify(c) {
+  if (typeof c === "string") return c;
+  if (Array.isArray(c)) {
+    return c.map((item) => {
+      if (item && typeof item === "object") {
+        const t = item.type;
+        if (t === "text") return item.text ?? "";
+        return JSON.stringify(item);
+      }
+      return String(item);
+    }).join("\n");
+  }
+  if (c && typeof c === "object") {
+    if ("text" in c) {
+      return String(c.text);
+    }
+    return JSON.stringify(c);
+  }
+  return String(c ?? "");
+}
+
+// src/registry.ts
+var MCPRegistry = class _MCPRegistry {
+  servers = /* @__PURE__ */ new Map();
+  /** Configured-off servers are tracked without creating a transport/client. */
+  disabledServers = /* @__PURE__ */ new Map();
+  toolRegistry;
+  events;
+  log;
+  lazyMode;
+  cacheDir;
+  idleTimeoutMs;
+  authorizationProviderFactory;
+  authorizationManager;
+  operationListeners = /* @__PURE__ */ new Set();
+  /** Single shared idle sweep timer (started lazily; unref'd; cleared on stopAll). */
+  idleTimer;
+  constructor(opts) {
+    this.toolRegistry = opts.toolRegistry;
+    this.events = opts.events;
+    this.log = opts.log;
+    this.lazyMode = opts.lazyMode ?? false;
+    this.cacheDir = opts.cacheDir;
+    this.idleTimeoutMs = opts.idleTimeoutMs ?? MCP_CONSTANTS.IDLE.DEFAULT_TIMEOUT_MS;
+    this.authorizationProviderFactory = opts.authorizationProviderFactory;
+    this.authorizationManager = opts.authorizationManager;
+  }
+  requireSlot(name) {
+    const slot = this.servers.get(name);
+    if (!slot) throw new Error(`MCP server "${name}" not registered`);
+    return slot;
+  }
+  async beginAuthorization(name, input) {
+    const manager = this.requireAuthorizationManager();
+    const cfg = this.requireHttpServerConfig(name);
+    return manager.begin({
+      serverName: name,
+      resource: cfg.url,
+      ...input
+    });
+  }
+  async completeAuthorization(name, callbackUrl, signal) {
+    const manager = this.requireAuthorizationManager();
+    const cfg = this.requireHttpServerConfig(name);
+    return manager.complete({ serverName: name, resource: cfg.url, callbackUrl, signal });
+  }
+  async authorizationStatus(name) {
+    const manager = this.requireAuthorizationManager();
+    const cfg = this.requireHttpServerConfig(name);
+    return manager.status(name, cfg.url);
+  }
+  async disconnectAuthorization(name) {
+    const manager = this.requireAuthorizationManager();
+    const cfg = this.requireHttpServerConfig(name);
+    return manager.disconnect(name, cfg.url);
+  }
+  requireAuthorizationManager() {
+    if (!this.authorizationManager) {
+      throw new Error("MCP authorization management is not configured for this host");
+    }
+    return this.authorizationManager;
+  }
+  requireHttpServerConfig(name) {
+    const cfg = this.servers.get(name)?.cfg ?? this.disabledServers.get(name);
+    if (!cfg) throw new Error(`MCP server "${name}" not registered`);
+    if (cfg.transport === "stdio" || !cfg.url) {
+      throw new Error(`MCP server "${name}" does not use an HTTP transport`);
+    }
+    return cfg;
+  }
+  async start(cfg) {
+    if (cfg.enabled === false) {
+      if (this.servers.has(cfg.name)) {
+        await this.stop(cfg.name);
+      }
+      this.markDisabled(cfg);
+      return;
+    }
+    this.disabledServers.delete(cfg.name);
+    if (this.servers.has(cfg.name)) {
+      throw new Error(
+        `MCP server "${cfg.name}" is already registered \u2014 use restart() to re-cycle a running server`
+      );
+    }
+    const lazy = !!cfg.lazy && !!this.cacheDir;
     const slot = {
       cfg,
       state: "idle",
@@ -1503,7 +3392,8 @@ var MCPRegistry = class _MCPRegistry {
       reconnectCycles: 0,
       lazy,
       lastUsed: Date.now(),
-      registeredLazy: false
+      registeredLazy: false,
+      operations: createMCPServerOperationState()
     };
     this.servers.set(cfg.name, slot);
     if (lazy) {
@@ -1512,6 +3402,16 @@ var MCPRegistry = class _MCPRegistry {
       await this.attemptConnect(slot);
     }
   }
+  /** Record an intentionally disabled configuration without opening a transport. */
+  markDisabled(cfg) {
+    this.servers.delete(cfg.name);
+    this.disabledServers.set(cfg.name, { ...cfg, enabled: false });
+  }
+  /** Remove residual operational/configuration state after a management delete. */
+  forget(name) {
+    this.servers.delete(name);
+    this.disabledServers.delete(name);
+  }
   /**
    * Boot a lazy server WITHOUT spawning it. If a tool manifest is cached (from a
    * prior connect with matching config), register resolver-backed wrappers and
@@ -1525,13 +3425,17 @@ var MCPRegistry = class _MCPRegistry {
       return;
     }
     const hash = manifestConfigHash(slot.cfg);
-    const cached = await readManifest(cacheDir, slot.cfg.name, hash);
-    if (cached && cached.length > 0) {
-      this.applyTools(slot, cached);
+    const cached = await readCapabilityManifest(cacheDir, slot.cfg.name, hash);
+    if (cached) {
+      slot.serverMetadata = cached.serverMetadata;
+      slot.resources = cached.resources;
+      slot.resourceTemplates = cached.resourceTemplates;
+      slot.prompts = cached.prompts;
+      this.applyTools(slot, cached.tools);
       slot.state = "dormant";
       this.ensureIdleSweep();
       this.log.info(
-        `MCP server "${slot.cfg.name}" registered lazily from cache (${cached.length} tools, dormant)`
+        `MCP server "${slot.cfg.name}" registered lazily from cache (${cached.tools.length} tools, dormant)`
       );
       return;
     }
@@ -1547,6 +3451,11 @@ var MCPRegistry = class _MCPRegistry {
     slot.lastUsed = Date.now();
     if (slot.client && slot.state === "connected") return slot.client;
     if (slot.connecting) return slot.connecting;
+    const waking = slot.state === "dormant";
+    if (waking) {
+      slot.operations.wakeCount++;
+      this.recordOperation(slot, "wake", "lazy-demand");
+    }
     slot.connecting = (async () => {
       try {
         slot.attempts = 0;
@@ -1627,6 +3536,7 @@ var MCPRegistry = class _MCPRegistry {
       slot.client.removeExitListener(this.onChildExit);
       if (slot.onDisconnect) slot.client.removeDisconnectListener(slot.onDisconnect);
       slot.client.removeToolsChangedListener(this.onToolsChanged);
+      this.removeCatalogListeners(slot.client);
       await slot.client.close();
       slot.client = void 0;
     }
@@ -1635,13 +3545,20 @@ var MCPRegistry = class _MCPRegistry {
     for (const t of slot.toolNames) this.toolRegistry.unregister(t);
     slot.toolNames = [];
     slot.lazyTools = [];
+    slot.serverMetadata = void 0;
+    slot.resources = void 0;
+    slot.resourceTemplates = void 0;
+    slot.prompts = void 0;
     slot.registeredLazy = false;
     slot.state = "disconnected";
+    this.recordOperation(slot, "stop", "manual");
     this.events.emit("mcp.server.disconnected", { name, reason: "stop" });
   }
   async restart(name) {
     const slot = this.servers.get(name);
     if (!slot) throw new Error(`MCP server "${name}" not registered`);
+    slot.operations.restartCount++;
+    this.recordOperation(slot, "restart", "manual");
     await this.stop(name);
     slot.attempts = 0;
     slot.reconnectCycles = 0;
@@ -1658,6 +3575,131 @@ var MCPRegistry = class _MCPRegistry {
       };
     });
   }
+  /**
+   * Subscribe to payload-free operational signals. Callers must still avoid
+   * using `serverName` as an unbounded metric label.
+   */
+  onOperation(listener) {
+    this.operationListeners.add(listener);
+    return () => this.operationListeners.delete(listener);
+  }
+  /** Detailed, defensively-copied operational snapshots for CLI/WebUI/HQ. */
+  operationalHealth() {
+    const active = Array.from(this.servers.values()).map((slot) => {
+      const op = slot.operations;
+      const baseHealth = healthStateFor(slot.state, op, slot.cfg.enabled !== false);
+      const checks = evaluateHealthThresholds(op, slot.cfg.health?.thresholds);
+      return {
+        name: slot.cfg.name,
+        connectionState: slot.state,
+        healthState: applyHealthThresholds(baseHealth, checks),
+        lastSuccessAt: op.lastSuccessAt,
+        lastFailureAt: op.lastFailureAt,
+        lastFailureKind: op.lastFailureKind,
+        lastReason: op.lastReason,
+        consecutiveFailures: op.consecutiveFailures,
+        failures: { ...op.failures },
+        reconnectCount: op.reconnectCount,
+        wakeCount: op.wakeCount,
+        sleepCount: op.sleepCount,
+        restartCount: op.restartCount,
+        connectionLatency: summarizeLatency(op.connectionSamples),
+        discoveryLatency: summarizeLatency(op.discoverySamples),
+        callLatency: summarizeLatency(op.callSamples),
+        inFlightCalls: op.inFlightCalls,
+        peakInFlightCalls: op.peakInFlightCalls,
+        recentEvents: op.recentEvents.map((event) => ({ ...event })),
+        healthChecks: checks
+      };
+    });
+    const disabled = Array.from(this.disabledServers.values()).map((cfg) => {
+      const operations = createMCPServerOperationState();
+      return {
+        name: cfg.name,
+        connectionState: "idle",
+        healthState: "disabled",
+        consecutiveFailures: 0,
+        failures: { ...operations.failures },
+        reconnectCount: 0,
+        wakeCount: 0,
+        sleepCount: 0,
+        restartCount: 0,
+        connectionLatency: summarizeLatency([]),
+        discoveryLatency: summarizeLatency([]),
+        callLatency: summarizeLatency([]),
+        inFlightCalls: 0,
+        peakInFlightCalls: 0,
+        recentEvents: [],
+        healthChecks: []
+      };
+    });
+    return [...active, ...disabled];
+  }
+  getCatalog(name) {
+    const slot = this.servers.get(name);
+    if (!slot) return void 0;
+    return catalogSnapshot(slot);
+  }
+  async listResources(name, opts = {}) {
+    const slot = this.requireSlot(name);
+    if (!opts.refresh && slot.resources) return cloneRecords(slot.resources);
+    const client = await this.ensureConnected(name);
+    if (!client.getServerMetadata()?.capabilities.resources) return [];
+    slot.resources = await collectPages(
+      (cursor) => client.listResources(cursor ? { cursor } : {}),
+      (page) => page.resources
+    );
+    await this.persistCapabilityManifest(slot);
+    return cloneRecords(slot.resources);
+  }
+  async listResourceTemplates(name, opts = {}) {
+    const slot = this.requireSlot(name);
+    if (!opts.refresh && slot.resourceTemplates) return cloneRecords(slot.resourceTemplates);
+    const client = await this.ensureConnected(name);
+    if (!client.getServerMetadata()?.capabilities.resources) return [];
+    slot.resourceTemplates = await collectPages(
+      (cursor) => client.listResourceTemplates(cursor ? { cursor } : {}),
+      (page) => page.resourceTemplates
+    );
+    await this.persistCapabilityManifest(slot);
+    return cloneRecords(slot.resourceTemplates);
+  }
+  async readResource(name, uri) {
+    return (await this.ensureConnected(name)).readResource(uri);
+  }
+  async selectResourceForInsertion(name, uri, policy) {
+    return prepareResourceInsertion(name, uri, await this.readResource(name, uri), policy);
+  }
+  async subscribeResource(name, uri) {
+    await (await this.ensureConnected(name)).subscribeResource(uri);
+  }
+  async unsubscribeResource(name, uri) {
+    await (await this.ensureConnected(name)).unsubscribeResource(uri);
+  }
+  async listPrompts(name, opts = {}) {
+    const slot = this.requireSlot(name);
+    if (!opts.refresh && slot.prompts) return cloneRecords(slot.prompts);
+    const client = await this.ensureConnected(name);
+    if (!client.getServerMetadata()?.capabilities.prompts) return [];
+    slot.prompts = await collectPages(
+      (cursor) => client.listPrompts(cursor ? { cursor } : {}),
+      (page) => page.prompts
+    );
+    await this.persistCapabilityManifest(slot);
+    return cloneRecords(slot.prompts);
+  }
+  async getPrompt(serverName, promptName, args) {
+    return (await this.ensureConnected(serverName)).getPrompt(promptName, args);
+  }
+  async selectPromptForInsertion(serverName, promptName, args, policy) {
+    return preparePromptInsertion(
+      serverName,
+      promptName,
+      args,
+      await this.getPrompt(serverName, promptName, args),
+      policy
+    );
+  }
   /**
    * Resolve the live tool names for a slot — the registered names in normal
    * mode, or the cached lazy-tool names when running in lazy mode (where
@@ -1679,7 +3721,30 @@ var MCPRegistry = class _MCPRegistry {
     const filtered = tools.filter((t) => !allowed || allowed.includes(t.name));
     const clientArg = slot.lazy ? () => this.ensureConnected(slot.cfg.name) : expectDefined(client);
     const wrapped = filtered.map(
-      (t) => wrapMCPTool(slot.cfg.name, t, clientArg, slot.cfg.permission ?? "confirm")
+      (t) => wrapMCPTool(slot.cfg.name, t, clientArg, slot.cfg.permission ?? "confirm", {
+        onStart: () => {
+          slot.operations.inFlightCalls++;
+          slot.operations.peakInFlightCalls = Math.max(
+            slot.operations.peakInFlightCalls,
+            slot.operations.inFlightCalls
+          );
+          this.recordOperation(slot, "call", "started", void 0, void 0, false);
+        },
+        onFinish: ({ durationMs, ok }) => {
+          slot.operations.inFlightCalls = Math.max(0, slot.operations.inFlightCalls - 1);
+          pushBounded(
+            slot.operations.callSamples,
+            durationMs,
+            MCP_OPERATION_LIMITS.LATENCY_SAMPLES
+          );
+          if (ok) {
+            this.recordSuccess(slot);
+            this.recordOperation(slot, "call", "ok", void 0, durationMs, false);
+          } else {
+            this.recordFailure(slot, "tool", "tool-call-failed", durationMs);
+          }
+        }
+      })
     );
     if (this.lazyMode) {
       slot.lazyTools = wrapped;
@@ -1693,7 +3758,71 @@ var MCPRegistry = class _MCPRegistry {
         this.log.warn(`MCP tool "${tool.name}" not registered`, err);
       }
     }
-    if (slot.lazy) slot.registeredLazy = true;
+    if (slot.lazy && wrapped.length > 0) slot.registeredLazy = true;
+  }
+  async discoverCapabilities(slot, client) {
+    const startedAt = Date.now();
+    slot.serverMetadata = client.getServerMetadata();
+    const capabilities = slot.serverMetadata?.capabilities;
+    if (capabilities?.resources) {
+      try {
+        slot.resources = await collectPages(
+          (cursor) => client.listResources(cursor ? { cursor } : {}),
+          (page) => page.resources
+        );
+      } catch (err) {
+        slot.resources = void 0;
+        this.recordFailure(slot, "protocol", "resource-discovery-failed");
+        this.log.warn(`MCP server "${slot.cfg.name}" resource discovery failed`, err);
+      }
+      try {
+        slot.resourceTemplates = await collectPages(
+          (cursor) => client.listResourceTemplates(cursor ? { cursor } : {}),
+          (page) => page.resourceTemplates
+        );
+      } catch (err) {
+        slot.resourceTemplates = void 0;
+        this.recordFailure(slot, "protocol", "resource-template-discovery-failed");
+        this.log.warn(`MCP server "${slot.cfg.name}" resource template discovery failed`, err);
+      }
+    } else {
+      slot.resources = void 0;
+      slot.resourceTemplates = void 0;
+    }
+    if (capabilities?.prompts) {
+      try {
+        slot.prompts = await collectPages(
+          (cursor) => client.listPrompts(cursor ? { cursor } : {}),
+          (page) => page.prompts
+        );
+      } catch (err) {
+        slot.prompts = void 0;
+        this.recordFailure(slot, "protocol", "prompt-discovery-failed");
+        this.log.warn(`MCP server "${slot.cfg.name}" prompt discovery failed`, err);
+      }
+    } else {
+      slot.prompts = void 0;
+    }
+    const durationMs = Date.now() - startedAt;
+    pushBounded(slot.operations.discoverySamples, durationMs, MCP_OPERATION_LIMITS.LATENCY_SAMPLES);
+    this.recordOperation(slot, "discover", "complete", void 0, durationMs, false);
+  }
+  async persistCapabilityManifest(slot) {
+    if (!slot.lazy || !this.cacheDir) return;
+    const cacheDir = this.cacheDir;
+    const previous = slot.manifestWrite ?? Promise.resolve();
+    const pending = previous.then(
+      () => writeCapabilityManifest(cacheDir, slot.cfg.name, manifestConfigHash(slot.cfg), {
+        tools: slot.client?.listTools() ?? [],
+        serverMetadata: slot.serverMetadata,
+        resources: slot.resources,
+        resourceTemplates: slot.resourceTemplates,
+        prompts: slot.prompts
+      })
+    );
+    slot.manifestWrite = pending;
+    await pending;
+    if (slot.manifestWrite === pending) slot.manifestWrite = void 0;
   }
   /** Start the shared idle sweep timer once (unref'd so it never holds the process). */
   ensureIdleSweep() {
@@ -1728,11 +3857,14 @@ var MCPRegistry = class _MCPRegistry {
       slot.client.removeExitListener(this.onChildExit);
       if (slot.onDisconnect) slot.client.removeDisconnectListener(slot.onDisconnect);
       slot.client.removeToolsChangedListener(this.onToolsChanged);
+      this.removeCatalogListeners(slot.client);
       await slot.client.close();
       slot.client = void 0;
     }
     slot.onDisconnect = void 0;
     slot.state = "dormant";
+    slot.operations.sleepCount++;
+    this.recordOperation(slot, "sleep", "idle-timeout");
     this.log.info(`MCP server "${slot.cfg.name}" idle \u2014 sleeping (tools stay registered)`);
     this.events.emit("mcp.server.disconnected", { name: slot.cfg.name, reason: "idle-sleep" });
   }
@@ -1743,7 +3875,7 @@ var MCPRegistry = class _MCPRegistry {
    * triggering connections.
    */
   describe() {
-    return Array.from(this.servers.values()).map((s) => {
+    const active = Array.from(this.servers.values()).map((s) => {
       const tools = this.toolNamesForSlot(s);
       return {
         name: s.cfg.name,
@@ -1753,6 +3885,14 @@ var MCPRegistry = class _MCPRegistry {
         tools
       };
     });
+    const disabled = Array.from(this.disabledServers.values()).map((cfg) => ({
+      name: cfg.name,
+      state: "idle",
+      toolCount: 0,
+      enabled: false,
+      tools: []
+    }));
+    return [...active, ...disabled];
   }
   async stopAll() {
     if (this.idleTimer) {
@@ -1762,6 +3902,7 @@ var MCPRegistry = class _MCPRegistry {
     for (const name of Array.from(this.servers.keys())) {
       await this.stop(name);
     }
+    this.disabledServers.clear();
   }
   /**
    * Health check — returns 'ok' for connected servers, the current state otherwise.
@@ -1792,10 +3933,8 @@ var MCPRegistry = class _MCPRegistry {
     slot.toolNames = [];
     slot.registeredLazy = false;
     const discovered = slot.client.listTools();
-    if (slot.lazy && this.cacheDir) {
-      void writeManifest(this.cacheDir, slot.cfg.name, manifestConfigHash(slot.cfg), discovered);
-    }
     this.applyTools(slot, discovered, slot.client);
+    void this.persistCapabilityManifest(slot);
     this.events.emit("mcp.server.connected", {
       name: slot.cfg.name,
       toolCount: slot.toolNames.length
@@ -1804,12 +3943,36 @@ var MCPRegistry = class _MCPRegistry {
       `MCP server "${slot.cfg.name}" tools refreshed (${this.toolNamesForSlot(slot).length} active)`
     );
   };
+  onResourcesChanged = (name) => {
+    const slot = this.servers.get(name);
+    if (!slot) return;
+    slot.resources = void 0;
+    slot.resourceTemplates = void 0;
+    void this.persistCapabilityManifest(slot);
+    this.log.info(`MCP server "${name}" resource catalog invalidated`);
+  };
+  onPromptsChanged = (name) => {
+    const slot = this.servers.get(name);
+    if (!slot) return;
+    slot.prompts = void 0;
+    void this.persistCapabilityManifest(slot);
+    this.log.info(`MCP server "${name}" prompt catalog invalidated`);
+  };
+  addCatalogListeners(client) {
+    client.addResourcesChangedListener(this.onResourcesChanged);
+    client.addPromptsChangedListener(this.onPromptsChanged);
+  }
+  removeCatalogListeners(client) {
+    client.removeResourcesChangedListener(this.onResourcesChanged);
+    client.removePromptsChangedListener(this.onPromptsChanged);
+  }
   onChildExit = (name, code, _signal) => {
     const slot = this.servers.get(name);
     if (!slot) return;
     if (slot.lazy) {
       slot.client = void 0;
       slot.state = "dormant";
+      this.recordFailure(slot, "transport", "process-exit-lazy");
       this.events.emit("mcp.server.disconnected", {
         name,
         reason: `exit:${code ?? "unknown"} (dormant)`
@@ -1824,7 +3987,12 @@ var MCPRegistry = class _MCPRegistry {
     }
     slot.toolNames = [];
     slot.lazyTools = [];
+    slot.serverMetadata = void 0;
+    slot.resources = void 0;
+    slot.resourceTemplates = void 0;
+    slot.prompts = void 0;
     slot.state = "disconnected";
+    this.recordFailure(slot, "transport", "process-exit");
     this.events.emit("mcp.server.disconnected", { name, reason: `exit:${code ?? "unknown"}` });
     this.scheduleReconnect(slot);
   };
@@ -1835,6 +4003,7 @@ var MCPRegistry = class _MCPRegistry {
     if (slot.lazy) {
       slot.client = void 0;
       slot.state = "dormant";
+      this.recordFailure(slot, "transport", "http-disconnect-lazy");
       this.events.emit("mcp.server.disconnected", { name, reason: "http-disconnect (dormant)" });
       return;
     }
@@ -1846,7 +4015,12 @@ var MCPRegistry = class _MCPRegistry {
     }
     slot.toolNames = [];
     slot.lazyTools = [];
+    slot.serverMetadata = void 0;
+    slot.resources = void 0;
+    slot.resourceTemplates = void 0;
+    slot.prompts = void 0;
     slot.state = "disconnected";
+    this.recordFailure(slot, "transport", "http-disconnect");
     this.events.emit("mcp.server.disconnected", { name, reason: "http-disconnect" });
     this.scheduleReconnect(slot);
   };
@@ -1865,6 +4039,7 @@ var MCPRegistry = class _MCPRegistry {
     if (slot.reconnectPending) return;
     if (slot.reconnectCycles >= _MCPRegistry.MAX_RECONNECT_CYCLES) {
       slot.state = "failed";
+      this.recordFailure(slot, "transport", "reconnect-exhausted");
       this.log.error(
         `MCP server "${slot.cfg.name}" giving up after ${slot.reconnectCycles} reconnect cycles. Use \`/mcp restart ${slot.cfg.name}\` to retry.`
       );
@@ -1893,345 +4068,196 @@ var MCPRegistry = class _MCPRegistry {
   async attemptReconnect(slot) {
     slot.reconnectPending = false;
     slot.reconnectCycles++;
+    slot.operations.reconnectCount++;
+    this.recordOperation(slot, "reconnect", "automatic");
     await this.attemptConnect(slot);
   }
-  async attemptConnect(slot) {
-    const MAX_ATTEMPTS = MCP_CONSTANTS.RECONNECT.MAX_ATTEMPTS;
-    let attempt = 0;
-    while (attempt < MAX_ATTEMPTS) {
-      attempt++;
-      slot.state = attempt === 1 ? "connecting" : "reconnecting";
-      slot.attempts = attempt;
-      let client;
-      let boundDisconnect;
-      try {
-        client = new MCPClient({
-          name: slot.cfg.name,
-          transport: slot.cfg.transport,
-          command: slot.cfg.command,
-          args: slot.cfg.args,
-          env: slot.cfg.env,
-          url: slot.cfg.url,
-          headers: slot.cfg.headers,
-          startupTimeoutMs: slot.cfg.startupTimeoutMs,
-          requestTimeoutMs: slot.cfg.requestTimeoutMs,
-          passthroughEnv: slot.cfg.passthroughEnv
-        });
-        if (slot.cfg.transport === "stdio") {
-          client.addExitListener(this.onChildExit);
-        } else {
-          boundDisconnect = () => this.onTransportDisconnect(slot.cfg.name);
-          client.addDisconnectListener(boundDisconnect);
-        }
-        client.addToolsChangedListener(this.onToolsChanged);
-        await client.connect();
-        if (slot.client && slot.client !== client) {
-          const prior = slot.client;
-          const priorDisconnect = slot.onDisconnect;
-          slot.client.removeExitListener(this.onChildExit);
-          if (priorDisconnect) prior.removeDisconnectListener(priorDisconnect);
-          prior.removeToolsChangedListener(this.onToolsChanged);
-          prior.close().catch(() => {
-          });
-        }
-        slot.client = client;
-        slot.onDisconnect = boundDisconnect;
-        const isReconnect = attempt > 1;
-        slot.state = "connected";
-        slot.reconnectCycles = 0;
-        const mc = client;
-        const discovered = mc.listTools();
-        if (slot.lazy && this.cacheDir) {
-          await writeManifest(
-            this.cacheDir,
-            slot.cfg.name,
-            manifestConfigHash(slot.cfg),
-            discovered
-          );
-        }
-        this.applyTools(slot, discovered, mc);
-        slot.lastUsed = Date.now();
-        if (slot.lazy) this.ensureIdleSweep();
-        this.events.emit(isReconnect ? "mcp.server.reconnected" : "mcp.server.connected", {
-          name: slot.cfg.name,
-          toolCount: slot.toolNames.length
-        });
-        return;
-      } catch (err) {
-        this.log.warn(`MCP server "${slot.cfg.name}" connect attempt ${attempt} failed`, err);
-        if (client) {
-          client.removeExitListener(this.onChildExit);
-          if (boundDisconnect) client.removeDisconnectListener(boundDisconnect);
-          client.removeToolsChangedListener(this.onToolsChanged);
-          await client.close().catch(() => {
-          });
-        }
-        if (attempt >= MAX_ATTEMPTS) {
-          this.log.error(
-            `MCP server "${slot.cfg.name}" connect exhausted after ${MAX_ATTEMPTS} attempts`,
-            err
-          );
-          slot.state = "failed";
-          slot.client = void 0;
-          if (slot.reconnectTimer) {
-            clearTimeout(slot.reconnectTimer);
-            slot.reconnectTimer = void 0;
-          }
-          slot.reconnectPending = false;
-          this.events.emit("mcp.server.disconnected", {
-            name: slot.cfg.name,
-            reason: err instanceof Error ? err.message : "unknown"
-          });
-          return;
-        }
-        const delay = 500 * 2 ** attempt;
-        await new Promise((r) => setTimeout(r, delay));
-      }
-    }
-  }
-};
-
-// src/manage.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import * as fs2 from "node:fs/promises";
-async function readConfig(path2) {
-  try {
-    return JSON.parse(await fs2.readFile(path2, "utf8"));
-  } catch {
-    return {};
-  }
-}
-async function writeConfig(path2, cfg) {
-  const raw = JSON.stringify(cfg, null, 2);
-  const tmp = `${path2}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
-  await fs2.writeFile(tmp, raw, "utf8");
-  try {
-    await fs2.rename(tmp, path2);
-  } catch (err) {
-    await fs2.rm(tmp, { force: true }).catch(() => void 0);
-    throw err;
+  recordSuccess(slot, resetFailures = true) {
+    const operations = this.operationsFor(slot);
+    operations.lastSuccessAt = Date.now();
+    if (resetFailures) operations.consecutiveFailures = 0;
   }
-}
-function isMcpServerRecord(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value);
-}
-async function readServers(configPath) {
-  const full = await readConfig(configPath);
-  const servers = isMcpServerRecord(full.mcpServers) ? { ...full.mcpServers } : {};
-  return { full, servers };
-}
-async function persist(configPath, full, servers) {
-  full.mcpServers = servers;
-  await writeConfig(configPath, full);
-}
-function normalizeTransport(t) {
-  if (t === "sse") return "sse";
-  if (t === "http" || t === "streamable-http") return "streamable-http";
-  return "stdio";
-}
-function buildConfig(input, base) {
-  const cfg = {
-    name: input.name,
-    transport: input.transport ? normalizeTransport(String(input.transport)) : base?.transport ?? "stdio"
-  };
-  const description = input.description ?? base?.description;
-  if (description !== void 0) cfg.description = description;
-  const command = input.command ?? base?.command;
-  if (command !== void 0) cfg.command = command;
-  const args = input.args ?? base?.args;
-  if (args !== void 0) cfg.args = args;
-  const env = input.env ?? base?.env;
-  if (env !== void 0) cfg.env = env;
-  const url = input.url ?? base?.url;
-  if (url !== void 0) cfg.url = url;
-  const headers = input.headers ?? base?.headers;
-  if (headers !== void 0) cfg.headers = headers;
-  const allowedTools = input.allowedTools ?? base?.allowedTools;
-  if (allowedTools !== void 0) cfg.allowedTools = allowedTools;
-  const permission = input.permission ?? base?.permission;
-  if (permission !== void 0) cfg.permission = permission;
-  const enabled = input.enabled ?? base?.enabled;
-  if (enabled !== void 0) cfg.enabled = enabled;
-  const lazy = input.lazy ?? base?.lazy;
-  if (lazy !== void 0) cfg.lazy = lazy;
-  const passthroughEnv = input.passthroughEnv ?? base?.passthroughEnv;
-  if (passthroughEnv !== void 0) cfg.passthroughEnv = passthroughEnv;
-  return cfg;
-}
-function projectServer(name, cfg, registry) {
-  const live = registry.list().find((s) => s.name === name);
-  const info = {
-    name,
-    transport: cfg.transport,
-    enabled: cfg.enabled !== false,
-    status: live ? live.state : "stopped",
-    tools: live?.tools ?? []
-  };
-  if (cfg.description !== void 0) info.description = cfg.description;
-  if (cfg.url !== void 0) info.url = cfg.url;
-  if (cfg.command !== void 0) info.command = cfg.command;
-  if (cfg.lazy !== void 0) info.lazy = cfg.lazy;
-  return info;
-}
-function liveState(name, registry) {
-  const live = registry.list().find((s) => s.name === name);
-  return { state: live?.state ?? "stopped", tools: live?.tools ?? [] };
-}
-function errMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-async function listMcp(deps) {
-  const { servers } = await readServers(deps.configPath);
-  return Object.entries(servers).map(
-    ([name, cfg]) => projectServer(name, { ...cfg, name }, deps.registry)
-  );
-}
-async function addMcp(input, deps) {
-  if (!input.name) return { ok: false, message: "Server name is required" };
-  const { full, servers } = await readServers(deps.configPath);
-  if (servers[input.name]) {
-    return { ok: false, message: `Server "${input.name}" already exists` };
+  recordFailure(slot, failureKind, reason, durationMs) {
+    const operations = this.operationsFor(slot);
+    const safeReason = safeOperationReason(reason);
+    operations.lastFailureAt = Date.now();
+    operations.lastFailureKind = failureKind;
+    operations.lastReason = safeReason;
+    operations.consecutiveFailures++;
+    operations.failures[failureKind]++;
+    this.recordOperation(slot, "failure", safeReason, failureKind, durationMs);
   }
-  const preset = deps.presets?.[input.name];
-  const hasExplicitConfig = !!(input.transport || input.command || input.url);
-  const cfg = hasExplicitConfig ? buildConfig(input, preset) : preset ? buildConfig({ ...input, name: input.name }, preset) : buildConfig(input);
-  if (!hasExplicitConfig && !preset) {
-    const known = Object.keys(deps.presets ?? {}).join(", ");
-    return {
-      ok: false,
-      message: known ? `Unknown server "${input.name}". Available presets: ${known}` : `No configuration provided for "${input.name}"`
+  recordOperation(slot, kind, reason, failureKind, durationMs, retain = true) {
+    const operations = this.operationsFor(slot);
+    const baseHealth = healthStateFor(slot.state, operations, slot.cfg.enabled !== false);
+    const checks = evaluateHealthThresholds(operations, slot.cfg.health?.thresholds);
+    const event = {
+      serverName: slot.cfg.name,
+      kind,
+      at: Date.now(),
+      connectionState: slot.state,
+      healthState: applyHealthThresholds(baseHealth, checks)
     };
+    if (reason !== void 0) event.reason = safeOperationReason(reason);
+    if (failureKind !== void 0) event.failureKind = failureKind;
+    if (durationMs !== void 0) event.durationMs = Math.max(0, Math.round(durationMs));
+    if (retain) {
+      pushBounded(operations.recentEvents, event, MCP_OPERATION_LIMITS.RECENT_EVENTS);
+    }
+    for (const listener of this.operationListeners) {
+      try {
+        listener({ ...event });
+      } catch {
+      }
+    }
   }
-  cfg.enabled = input.enabled ?? false;
-  servers[input.name] = cfg;
-  await persist(deps.configPath, full, servers);
-  if (cfg.enabled) {
-    return startServer(input.name, cfg, deps, `Server "${input.name}" added`);
-  }
-  return {
-    ok: true,
-    message: `Server "${input.name}" added (disabled)`,
-    server: projectServer(input.name, cfg, deps.registry)
-  };
-}
-async function updateMcp(input, deps) {
-  if (!input.name) return { ok: false, message: "Server name is required" };
-  const { full, servers } = await readServers(deps.configPath);
-  const existing = servers[input.name];
-  if (!existing) return { ok: false, message: `Server "${input.name}" not found` };
-  const cfg = buildConfig(input, { ...existing, name: input.name });
-  servers[input.name] = cfg;
-  await persist(deps.configPath, full, servers);
-  if (cfg.enabled !== false) {
-    return startServer(input.name, cfg, deps, `Server "${input.name}" updated`, { restart: true });
+  /** Keeps private-method unit fixtures from needing to duplicate every slot field. */
+  operationsFor(slot) {
+    if (!slot.operations) slot.operations = createMCPServerOperationState();
+    return slot.operations;
   }
-  await safeStop(input.name, deps);
-  return {
-    ok: true,
-    message: `Server "${input.name}" updated`,
-    server: projectServer(input.name, cfg, deps.registry)
-  };
-}
-async function removeMcp(name, deps) {
-  if (!name) return { ok: false, message: "Server name is required" };
-  const { full, servers } = await readServers(deps.configPath);
-  if (!servers[name]) return { ok: false, message: `Server "${name}" not found` };
-  await safeStop(name, deps);
-  delete servers[name];
-  await persist(deps.configPath, full, servers);
-  return { ok: true, message: `Server "${name}" removed` };
-}
-async function enableMcp(name, deps) {
-  if (!name) return { ok: false, message: "Server name is required" };
-  const { full, servers } = await readServers(deps.configPath);
-  const cfg = servers[name];
-  if (!cfg) {
-    return { ok: false, message: `Server "${name}" is not in config. Add it first.` };
+  async attemptConnect(slot) {
+    const MAX_ATTEMPTS = MCP_CONSTANTS.RECONNECT.MAX_ATTEMPTS;
+    let attempt = 0;
+    while (attempt < MAX_ATTEMPTS) {
+      attempt++;
+      const startedAt = Date.now();
+      slot.state = attempt === 1 ? "connecting" : "reconnecting";
+      slot.attempts = attempt;
+      let client;
+      let boundDisconnect;
+      try {
+        client = new MCPClient({
+          name: slot.cfg.name,
+          transport: slot.cfg.transport,
+          command: slot.cfg.command,
+          args: slot.cfg.args,
+          env: slot.cfg.env,
+          url: slot.cfg.url,
+          headers: slot.cfg.headers,
+          startupTimeoutMs: slot.cfg.startupTimeoutMs,
+          requestTimeoutMs: slot.cfg.requestTimeoutMs,
+          passthroughEnv: slot.cfg.passthroughEnv,
+          authorizationProvider: this.authorizationProviderFactory?.(slot.cfg)
+        });
+        if (slot.cfg.transport === "stdio") {
+          client.addExitListener(this.onChildExit);
+        } else {
+          boundDisconnect = () => this.onTransportDisconnect(slot.cfg.name);
+          client.addDisconnectListener(boundDisconnect);
+        }
+        client.addToolsChangedListener(this.onToolsChanged);
+        this.addCatalogListeners(client);
+        await client.connect();
+        if (slot.client && slot.client !== client) {
+          const prior = slot.client;
+          const priorDisconnect = slot.onDisconnect;
+          slot.client.removeExitListener(this.onChildExit);
+          if (priorDisconnect) prior.removeDisconnectListener(priorDisconnect);
+          prior.removeToolsChangedListener(this.onToolsChanged);
+          this.removeCatalogListeners(prior);
+          prior.close().catch(() => {
+          });
+        }
+        slot.client = client;
+        slot.onDisconnect = boundDisconnect;
+        const isReconnect = slot.reconnectCycles > 0 || attempt > 1;
+        slot.state = "connected";
+        slot.reconnectCycles = 0;
+        const mc = client;
+        const discovered = mc.listTools();
+        await this.discoverCapabilities(slot, mc);
+        await this.persistCapabilityManifest(slot);
+        this.applyTools(slot, discovered, mc);
+        const durationMs = Date.now() - startedAt;
+        pushBounded(
+          slot.operations.connectionSamples,
+          durationMs,
+          MCP_OPERATION_LIMITS.LATENCY_SAMPLES
+        );
+        this.recordSuccess(slot, (slot.operations.lastFailureAt ?? 0) < startedAt);
+        this.recordOperation(
+          slot,
+          isReconnect ? "reconnect" : "connect",
+          "connected",
+          void 0,
+          durationMs
+        );
+        slot.lastUsed = Date.now();
+        if (slot.lazy) this.ensureIdleSweep();
+        this.events.emit(isReconnect ? "mcp.server.reconnected" : "mcp.server.connected", {
+          name: slot.cfg.name,
+          toolCount: slot.toolNames.length
+        });
+        return;
+      } catch (err) {
+        this.recordFailure(slot, "transport", "connect-attempt-failed", Date.now() - startedAt);
+        this.log.warn(`MCP server "${slot.cfg.name}" connect attempt ${attempt} failed`, err);
+        if (client) {
+          client.removeExitListener(this.onChildExit);
+          if (boundDisconnect) client.removeDisconnectListener(boundDisconnect);
+          client.removeToolsChangedListener(this.onToolsChanged);
+          this.removeCatalogListeners(client);
+          await client.close().catch(() => {
+          });
+        }
+        if (attempt >= MAX_ATTEMPTS) {
+          this.log.error(
+            `MCP server "${slot.cfg.name}" connect exhausted after ${MAX_ATTEMPTS} attempts`,
+            err
+          );
+          slot.state = "failed";
+          slot.client = void 0;
+          if (slot.reconnectTimer) {
+            clearTimeout(slot.reconnectTimer);
+            slot.reconnectTimer = void 0;
+          }
+          slot.reconnectPending = false;
+          this.events.emit("mcp.server.disconnected", {
+            name: slot.cfg.name,
+            reason: err instanceof Error ? err.message : "unknown"
+          });
+          return;
+        }
+        const delay = 500 * 2 ** attempt;
+        await new Promise((r) => setTimeout(r, delay));
+      }
+    }
   }
-  cfg.enabled = true;
-  servers[name] = cfg;
-  await persist(deps.configPath, full, servers);
-  return startServer(name, cfg, deps, `Server "${name}" enabled`, { restart: true });
-}
-async function disableMcp(name, deps) {
-  if (!name) return { ok: false, message: "Server name is required" };
-  const { full, servers } = await readServers(deps.configPath);
-  const cfg = servers[name];
-  if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
-  await safeStop(name, deps);
-  cfg.enabled = false;
-  servers[name] = cfg;
-  await persist(deps.configPath, full, servers);
-  return {
-    ok: true,
-    message: `Server "${name}" disabled`,
-    server: projectServer(name, cfg, deps.registry)
-  };
-}
-async function restartMcp(name, deps) {
-  if (!name) return { ok: false, message: "Server name is required" };
-  const registered = deps.registry.list().some((s) => s.name === name);
-  if (registered) {
-    try {
-      await deps.registry.restart(name);
-      const { state, tools } = liveState(name, deps.registry);
-      return { ok: true, message: `Server "${name}" restarted`, state, tools };
-    } catch (err) {
-      return { ok: false, message: `Failed to restart "${name}": ${errMessage(err)}` };
+};
+var MAX_CATALOG_PAGES = 100;
+var MAX_CATALOG_ITEMS = 1e4;
+async function collectPages(load, select) {
+  const items = [];
+  const seenCursors = /* @__PURE__ */ new Set();
+  let cursor;
+  for (let pageNumber = 0; pageNumber < MAX_CATALOG_PAGES; pageNumber++) {
+    const page = await load(cursor);
+    items.push(...select(page));
+    if (items.length > MAX_CATALOG_ITEMS) {
+      throw new Error(`MCP catalog exceeds ${MAX_CATALOG_ITEMS} items`);
     }
+    const next = page.nextCursor;
+    if (!next) return items;
+    if (seenCursors.has(next)) throw new Error(`MCP catalog repeated cursor "${next}"`);
+    seenCursors.add(next);
+    cursor = next;
   }
-  const { servers } = await readServers(deps.configPath);
-  const cfg = servers[name];
-  if (!cfg) return { ok: false, message: `Server "${name}" is not in config.` };
-  return startServer(name, { ...cfg, name }, deps, `Server "${name}" started`, { restart: true });
+  throw new Error(`MCP catalog exceeds ${MAX_CATALOG_PAGES} pages`);
 }
-async function discoverMcp(name, deps) {
-  if (!name) return { ok: false, message: "Server name is required" };
-  const result = await restartMcp(name, deps);
-  if (!result.ok) return result;
-  const { state, tools } = liveState(name, deps.registry);
+function cloneRecords(records) {
+  return structuredClone(records);
+}
+function catalogSnapshot(slot) {
   return {
-    ok: true,
-    message: `Discovered ${tools.length} tool${tools.length === 1 ? "" : "s"} from "${name}"`,
-    state,
-    tools
+    name: slot.cfg.name,
+    state: slot.state,
+    serverMetadata: slot.serverMetadata ? structuredClone(slot.serverMetadata) : void 0,
+    resources: slot.resources ? cloneRecords(slot.resources) : void 0,
+    resourceTemplates: slot.resourceTemplates ? cloneRecords(slot.resourceTemplates) : void 0,
+    prompts: slot.prompts ? cloneRecords(slot.prompts) : void 0
   };
 }
-async function startServer(name, cfg, deps, okMessage, opts) {
-  try {
-    const alreadyRegistered = deps.registry.list().some((s) => s.name === name);
-    if (alreadyRegistered && opts?.restart) {
-      await deps.registry.restart(name);
-    } else if (alreadyRegistered) {
-      await deps.registry.restart(name);
-    } else {
-      await deps.registry.start({ ...cfg, enabled: true });
-    }
-    const { state, tools } = liveState(name, deps.registry);
-    return {
-      ok: true,
-      message: okMessage,
-      server: projectServer(name, cfg, deps.registry),
-      state,
-      tools
-    };
-  } catch (err) {
-    const message = errMessage(err);
-    return {
-      ok: true,
-      // config persisted — surface a soft warning, not a hard failure
-      message: `${okMessage} in config, but failed to start: ${message}`,
-      server: projectServer(name, cfg, deps.registry),
-      registryError: message
-    };
-  }
-}
-async function safeStop(name, deps) {
-  try {
-    await deps.registry.stop(name);
-  } catch {
-  }
-}
 
 // src/server.ts
 import { createServer } from "node:http";
@@ -2245,6 +4271,8 @@ var MCPServer = class {
   host;
   serverInfo;
   logger;
+  resources;
+  prompts;
   constructor(opts) {
     this.host = opts.host;
     this.serverInfo = opts.serverInfo ?? {
@@ -2252,6 +4280,8 @@ var MCPServer = class {
       version: MCP_CONSTANTS.CLIENT_INFO.version
     };
     this.logger = opts.logger;
+    this.resources = structuredClone(opts.resources ?? []);
+    this.prompts = structuredClone(opts.prompts ?? []);
   }
   /**
    * Handle one raw JSON-RPC line. Returns the response JSON string for
@@ -2296,7 +4326,11 @@ var MCPServer = class {
       case "initialize":
         return {
           protocolVersion: MCP_CONSTANTS.PROTOCOL_VERSION,
-          capabilities: { tools: { listChanged: false } },
+          capabilities: {
+            tools: { listChanged: false },
+            ...this.resources.length > 0 ? { resources: { subscribe: false, listChanged: false } } : {},
+            ...this.prompts.length > 0 ? { prompts: { listChanged: false } } : {}
+          },
           serverInfo: this.serverInfo
         };
       case "ping":
@@ -2314,6 +4348,54 @@ var MCPServer = class {
         const res = await this.host.callTool(p.name, args);
         return { content: toContentBlocks(res.content), isError: res.isError };
       }
+      case "resources/list": {
+        if (this.resources.length === 0) return METHOD_NOT_FOUND_SENTINEL;
+        const page = paginate(this.resources, params);
+        return {
+          resources: page.items.map(({ contents: _contents, ...resource }) => resource),
+          ...page.nextCursor ? { nextCursor: page.nextCursor } : {}
+        };
+      }
+      case "resources/templates/list":
+        if (this.resources.length === 0) return METHOD_NOT_FOUND_SENTINEL;
+        return { resourceTemplates: [] };
+      case "resources/read": {
+        if (this.resources.length === 0) return METHOD_NOT_FOUND_SENTINEL;
+        const uri = requiredParamString(params, "uri", "resources/read");
+        const resource = this.resources.find((candidate) => candidate.uri === uri);
+        if (!resource) throw new Error(`Resource not found: ${uri}`);
+        return { contents: structuredClone(resource.contents) };
+      }
+      case "prompts/list": {
+        if (this.prompts.length === 0) return METHOD_NOT_FOUND_SENTINEL;
+        const page = paginate(this.prompts, params);
+        return {
+          prompts: page.items.map(
+            ({ messages: _messages, template: _template, ...prompt }) => prompt
+          ),
+          ...page.nextCursor ? { nextCursor: page.nextCursor } : {}
+        };
+      }
+      case "prompts/get": {
+        if (this.prompts.length === 0) return METHOD_NOT_FOUND_SENTINEL;
+        const name = requiredParamString(params, "name", "prompts/get");
+        const prompt = this.prompts.find((candidate) => candidate.name === name);
+        if (!prompt) throw new Error(`Prompt not found: ${name}`);
+        const input = paramsRecord(params);
+        const args = stringRecord(input["arguments"], "prompts/get arguments");
+        for (const argument of prompt.arguments ?? []) {
+          if (argument.required && args[argument.name] === void 0) {
+            throw new Error(`Prompt "${name}" requires argument "${argument.name}"`);
+          }
+        }
+        const messages = prompt.template ? [
+          {
+            role: "user",
+            content: { type: "text", text: renderPromptTemplate(prompt.template, args) }
+          }
+        ] : structuredClone(prompt.messages ?? []);
+        return { description: prompt.description, messages };
+      }
       default:
         return METHOD_NOT_FOUND_SENTINEL;
     }
@@ -2322,6 +4404,53 @@ var MCPServer = class {
     return JSON.stringify({ jsonrpc: "2.0", id, error: { code, message } });
   }
 };
+var SERVER_PAGE_SIZE = 100;
+function paginate(items, params) {
+  const cursor = paramsRecord(params)["cursor"];
+  let offset = 0;
+  if (cursor !== void 0) {
+    if (typeof cursor !== "string" || !/^\d+$/.test(cursor)) {
+      throw new Error("MCP pagination cursor must be a non-negative integer string");
+    }
+    offset = Number(cursor);
+    if (!Number.isSafeInteger(offset)) throw new Error("MCP pagination cursor is too large");
+  }
+  const page = items.slice(offset, offset + SERVER_PAGE_SIZE);
+  const next = offset + page.length;
+  return {
+    items: page,
+    ...next < items.length ? { nextCursor: String(next) } : {}
+  };
+}
+function paramsRecord(params) {
+  return params && typeof params === "object" && !Array.isArray(params) ? params : {};
+}
+function requiredParamString(params, field, method) {
+  const value = paramsRecord(params)[field];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`${method} requires a non-empty string "${field}"`);
+  }
+  return value;
+}
+function stringRecord(value, label) {
+  if (value === void 0) return {};
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item !== "string") throw new Error(`${label}.${key} must be a string`);
+    result[key] = item;
+  }
+  return result;
+}
+function renderPromptTemplate(template, args) {
+  return template.replace(/\{\{([A-Za-z_][A-Za-z0-9_.-]*)\}\}/g, (_match, name) => {
+    const value = args[name];
+    if (value === void 0) throw new Error(`Missing prompt template argument "${name}"`);
+    return value;
+  });
+}
 var METHOD_NOT_FOUND_SENTINEL = /* @__PURE__ */ Symbol("method-not-found");
 function toContentBlocks(content) {
   if (typeof content === "string") return [{ type: "text", text: content }];
@@ -2512,28 +4641,349 @@ async function handleHttpRequest(server, req, res, token, log) {
     });
   });
 }
+
+// src/token-store.ts
+import * as fs3 from "node:fs/promises";
+import { atomicWrite, withFileLock } from "@wrongstack/core/utils";
+var TOKEN_STORE_VERSION = 1;
+var MAX_STORE_BYTES = 1024 * 1024;
+var MAX_ENTRIES = 256;
+var DEFAULT_REFRESH_SKEW_MS = 6e4;
+var MCPVaultTokenStore = class {
+  constructor(filePath, vault) {
+    this.filePath = filePath;
+    this.vault = vault;
+  }
+  filePath;
+  vault;
+  async load(serverName, resource) {
+    const canonicalResource = canonicalMcpResource(resource);
+    return withFileLock(this.filePath, async () => {
+      const file = await this.readFile();
+      const entry = file.entries.find(
+        (candidate) => candidate.serverName === serverName && candidate.resource === canonicalResource
+      );
+      return entry ? this.decryptEntry(entry) : void 0;
+    });
+  }
+  async save(value) {
+    const normalized = normalizeStoredAuthorization(value);
+    await withFileLock(this.filePath, async () => {
+      const file = await this.readFile();
+      const next = file.entries.filter(
+        (entry) => !(entry.serverName === normalized.serverName && entry.resource === normalized.resource)
+      );
+      next.push(this.encryptEntry(normalized));
+      if (next.length > MAX_ENTRIES)
+        throw new Error(`MCP token store exceeds ${MAX_ENTRIES} entries`);
+      await this.writeFile(next);
+    });
+  }
+  async remove(serverName, resource) {
+    const canonicalResource = canonicalMcpResource(resource);
+    return withFileLock(this.filePath, async () => {
+      const file = await this.readFile();
+      const next = file.entries.filter(
+        (entry) => !(entry.serverName === serverName && entry.resource === canonicalResource)
+      );
+      if (next.length === file.entries.length) return false;
+      await this.writeFile(next);
+      return true;
+    });
+  }
+  async readFile() {
+    let raw;
+    try {
+      const stat2 = await fs3.stat(this.filePath);
+      if (stat2.size > MAX_STORE_BYTES) throw new Error("MCP token store exceeds size limit");
+      raw = await fs3.readFile(this.filePath, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return emptyFile();
+      throw error;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new Error("MCP token store is not valid JSON");
+    }
+    return validateStoreFile(parsed);
+  }
+  async writeFile(entries) {
+    const file = {
+      version: TOKEN_STORE_VERSION,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      entries
+    };
+    await atomicWrite(this.filePath, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+  }
+  encryptEntry(value) {
+    const accessToken = this.vault.encrypt(value.tokenSet.accessToken);
+    const refreshToken = value.tokenSet.refreshToken ? this.vault.encrypt(value.tokenSet.refreshToken) : void 0;
+    if (!this.vault.isEncrypted(accessToken) || refreshToken && !this.vault.isEncrypted(refreshToken)) {
+      throw new Error("MCP token store requires an encrypting SecretVault");
+    }
+    return {
+      serverName: value.serverName,
+      resource: value.resource,
+      clientId: value.clientId,
+      authorizationServer: value.authorizationServer,
+      accessToken,
+      refreshToken,
+      tokenType: value.tokenSet.tokenType ?? "Bearer",
+      expiresAt: value.tokenSet.expiresAt,
+      scopes: [...value.tokenSet.scopes ?? []],
+      updatedAt: value.updatedAt
+    };
+  }
+  decryptEntry(entry) {
+    if (!this.vault.isEncrypted(entry.accessToken) || entry.refreshToken !== void 0 && !this.vault.isEncrypted(entry.refreshToken)) {
+      throw new Error("MCP token store contains an unencrypted token");
+    }
+    const value = {
+      serverName: entry.serverName,
+      resource: entry.resource,
+      clientId: entry.clientId,
+      authorizationServer: entry.authorizationServer,
+      tokenSet: {
+        accessToken: this.vault.decrypt(entry.accessToken),
+        refreshToken: entry.refreshToken ? this.vault.decrypt(entry.refreshToken) : void 0,
+        tokenType: entry.tokenType,
+        resource: entry.resource,
+        expiresAt: entry.expiresAt,
+        scopes: [...entry.scopes]
+      },
+      updatedAt: entry.updatedAt
+    };
+    return normalizeStoredAuthorization(value);
+  }
+};
+var MCPRefreshingAuthorizationProvider = class {
+  constructor(options) {
+    this.options = options;
+    this.resource = canonicalMcpResource(options.resource);
+    this.refreshSkewMs = options.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+  }
+  options;
+  refreshPromise;
+  resource;
+  refreshSkewMs;
+  async getAccessToken(context) {
+    this.assertContext(context);
+    let state = await this.options.store.load(this.options.serverName, this.resource);
+    if (!state) return void 0;
+    if (state.tokenSet.expiresAt !== void 0 && state.tokenSet.expiresAt <= Date.now() + this.refreshSkewMs) {
+      state = await this.refresh(state, context.signal);
+    }
+    if (!state) return void 0;
+    if (state.tokenSet.expiresAt !== void 0 && state.tokenSet.expiresAt <= Date.now()) {
+      this.emit("reauth_required", state);
+      return void 0;
+    }
+    authorizationHeaderForToken(state.tokenSet, this.resource);
+    return { ...state.tokenSet, scopes: [...state.tokenSet.scopes ?? []] };
+  }
+  async handleUnauthorized(challenge, context) {
+    this.assertContext(context);
+    if (challenge.resource !== this.resource) return false;
+    const state = await this.options.store.load(this.options.serverName, this.resource);
+    if (!state?.tokenSet.refreshToken) {
+      if (state) this.emit("reauth_required", state);
+      return false;
+    }
+    return await this.refresh(state, context.signal) !== void 0;
+  }
+  refresh(state, signal) {
+    if (this.refreshPromise) return this.refreshPromise;
+    this.refreshPromise = this.refreshInner(state, signal).finally(() => {
+      this.refreshPromise = void 0;
+    });
+    return this.refreshPromise;
+  }
+  async refreshInner(state, signal) {
+    const refreshToken = state.tokenSet.refreshToken;
+    if (!refreshToken) {
+      this.emit("reauth_required", state);
+      return void 0;
+    }
+    const tokenSet = await refreshMcpAccessToken({
+      authorizationServer: state.authorizationServer,
+      clientId: state.clientId,
+      resource: state.resource,
+      refreshToken,
+      signal
+    });
+    const next = normalizeStoredAuthorization({
+      ...state,
+      tokenSet,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    await this.options.store.save(next);
+    this.emit("refreshed", next);
+    return next;
+  }
+  assertContext(context) {
+    if (context.serverName !== this.options.serverName || context.resource !== this.resource) {
+      throw new Error("MCP authorization provider context does not match its server/resource");
+    }
+  }
+  emit(state, value) {
+    this.options.onStateChange?.({
+      serverName: value.serverName,
+      state,
+      resource: value.resource,
+      expiresAt: value.tokenSet.expiresAt,
+      scopes: [...value.tokenSet.scopes ?? []]
+    });
+  }
+};
+function createVaultBackedMcpAuthorizationProviderFactory(options) {
+  const providers = /* @__PURE__ */ new Map();
+  return (server) => {
+    if (server.transport === "stdio" || !server.url) return void 0;
+    const resource = canonicalMcpResource(server.url);
+    const key = `${server.name}\0${resource}`;
+    let provider = providers.get(key);
+    if (!provider) {
+      provider = new MCPRefreshingAuthorizationProvider({
+        serverName: server.name,
+        resource,
+        store: options.store,
+        refreshSkewMs: options.refreshSkewMs,
+        onStateChange: options.onStateChange
+      });
+      providers.set(key, provider);
+    }
+    return provider;
+  };
+}
+function emptyFile() {
+  return { version: TOKEN_STORE_VERSION, updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(), entries: [] };
+}
+function validateStoreFile(value) {
+  if (!isRecord(value) || value["version"] !== TOKEN_STORE_VERSION || !Array.isArray(value["entries"])) {
+    throw new Error("MCP token store has an unsupported or malformed structure");
+  }
+  if (value["entries"].length > MAX_ENTRIES)
+    throw new Error("MCP token store has too many entries");
+  return {
+    version: TOKEN_STORE_VERSION,
+    updatedAt: boundedString(value["updatedAt"], "updatedAt", 128),
+    entries: value["entries"].map(validateEncryptedEntry)
+  };
+}
+function validateEncryptedEntry(value) {
+  if (!isRecord(value)) throw new Error("MCP token store entry must be an object");
+  const resource = canonicalMcpResource(boundedString(value["resource"], "resource", 4096));
+  const authorizationServer = validateMcpAuthorizationServerMetadata(value["authorizationServer"]);
+  const scopes = stringArray(value["scopes"], "scopes", 128);
+  const expiresAt = value["expiresAt"];
+  if (expiresAt !== void 0 && (typeof expiresAt !== "number" || !Number.isFinite(expiresAt))) {
+    throw new Error("MCP token store expiresAt must be a finite number");
+  }
+  return {
+    serverName: boundedString(value["serverName"], "serverName", 256),
+    resource,
+    clientId: boundedString(value["clientId"], "clientId", 4096),
+    authorizationServer,
+    accessToken: boundedString(value["accessToken"], "accessToken", 32768),
+    refreshToken: value["refreshToken"] === void 0 ? void 0 : boundedString(value["refreshToken"], "refreshToken", 32768),
+    tokenType: boundedString(value["tokenType"], "tokenType", 64),
+    expiresAt,
+    scopes,
+    updatedAt: boundedString(value["updatedAt"], "updatedAt", 128)
+  };
+}
+function normalizeStoredAuthorization(value) {
+  const serverName = boundedString(value.serverName, "serverName", 256);
+  const resource = canonicalMcpResource(value.resource);
+  const authorizationServer = validateMcpAuthorizationServerMetadata(value.authorizationServer);
+  if (canonicalMcpResource(value.tokenSet.resource) !== resource) {
+    throw new Error("MCP token resource mismatch");
+  }
+  const tokenSet = {
+    ...value.tokenSet,
+    resource,
+    scopes: stringArray(value.tokenSet.scopes ?? [], "scopes", 128)
+  };
+  authorizationHeaderForToken({ ...tokenSet, expiresAt: void 0 }, resource);
+  return {
+    serverName,
+    resource,
+    clientId: boundedString(value.clientId, "clientId", 4096),
+    authorizationServer,
+    tokenSet,
+    updatedAt: boundedString(value.updatedAt, "updatedAt", 128)
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function boundedString(value, field, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || /[\r\n]/.test(value)) {
+    throw new Error(`MCP token store field "${field}" is invalid`);
+  }
+  return value;
+}
+function stringArray(value, field, maxItems) {
+  if (!Array.isArray(value) || value.length > maxItems) {
+    throw new Error(`MCP token store field "${field}" must be a bounded array`);
+  }
+  return [...new Set(value.map((entry) => boundedString(entry, field, 256)))];
+}
 export {
+  DEFAULT_MCP_INSERTION_MAX_BYTES,
+  DEFAULT_MCP_RESOURCE_SCHEMES,
+  MCPAuthorizationManager,
   MCPClient,
+  MCPRefreshingAuthorizationProvider,
   MCPRegistry,
   MCPServer,
+  MCPVaultTokenStore,
   MCP_CONSTANTS,
+  MCP_OPERATION_LIMITS,
   SSEReader,
   SSETransport,
   StreamableHTTPTransport,
   addMcp,
+  authorizationHeaderForToken,
+  authorizationServerMetadataUrls,
+  canonicalMcpResource,
+  createMcpAuthorizationRequest,
+  createVaultBackedMcpAuthorizationProviderFactory,
   disableMcp,
   discoverMcp,
+  discoverMcpAuthorization,
   enableMcp,
+  exchangeMcpAuthorizationCode,
   listMcp,
   manifestConfigHash,
+  parseAuthorizationServerMetadata,
+  parseGetPromptResult,
+  parseListPromptsResult,
+  parseListResourceTemplatesResult,
+  parseListResourcesResult,
+  parseMcpAuthorizationCallback,
+  parseMcpBearerChallenge,
+  parseProtectedResourceMetadata,
+  parseReadResourceResult,
+  parseServerMetadata,
+  preparePromptInsertion,
+  prepareResourceInsertion,
+  protectedResourceMetadataUrls,
+  readCapabilityManifest,
   readManifest,
+  refreshMcpAccessToken,
   removeMcp,
   restartMcp,
   serveHttp,
   serveStdio,
   toContentBlocks,
   updateMcp,
+  validateMcpAuthorizationServerMetadata,
   wrapMCPTool,
+  writeCapabilityManifest,
   writeManifest
 };
 //# sourceMappingURL=index.js.map