@zuplo/runtime 6.74.2 → 6.74.7

package/out/esm/mcp-gateway/index.js

@@ -22,29 +22,30 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{$b as Ur,$c as Do,Ab as Je,Ac as q,Bb as Fe,Bc as ko,Cb as we,Cc as U,Db as be,Dc as xo,Eb as Gt,Ec as Ce,Fb as uo,Fc as Pr,Gb as re,Gc as Wt,Hb as lo,Hc as Er,Ib as ce,Ic as Vt,Jb as b,Jc as mt,Kb as Jt,Kc as Ke,Lb as N,Lc as Uo,Mb as Re,Mc as ue,Nb as Pc,Nc as Or,Ob as Ec,Oc as Mr,Pb as Oc,Pc as To,Qb as Mc,Qc as Yt,Rb as qc,Rc as qr,Sb as Dc,Sc as Dr,Tb as zc,Tc as Po,U as no,Ub as jc,Uc as z,Vb as Hc,Vc as Eo,Wb as Bc,Wc as Oo,Xb as po,Xc as zr,Yb as mo,Yc as Mo,Zb as fo,Zc as qo,_b as Ft,_c as jr,ac as $t,ad as Ee,bc as Zt,bd as zo,cc as ut,cd as ft,dc as ho,dd as jo,ec as go,ed as Xt,fc as yo,fd as ht,gc as lt,gd as Ho,hc as _o,hd as Bo,ic as $e,id as Lo,jc as wo,jd as No,k as ae,kc as Tr,kd as Go,lc as bo,ld as Jo,mc as pt,md as Fo,nc as Kt,nd as $o,oc as Ro,od as Qt,pc as Co,pd as Zo,qb as oo,qc as So,qd as Ko,r as Pe,rb as K,rc as Io,rd as C,s as Kn,sb as io,sc as ee,sd as A,tb as ao,tc as L,td as J,ub as D,uc as vo,ud as le,vb as so,vc as Ao,vd as P,wb as Ne,wc as S,wd as er,xb as co,xc as de,xd as Lc,y as Vn,yb as Ge,yc as Ze,yd as Nc,z as Lt,zb as y,zc as G}from"../chunk-B5LJC45G.js";import"../chunk-WGENGK72.js";import{a as I}from"../chunk-5BL2UFIS.js";import{a as Wo}from"../chunk-6SNZ4DOC.js";import{a as Wn}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as eo,F as to,G as ro,H as d,g as Yn,k as m,m as Xn,n as xr,o as se,q as Qn,s as w,t as _e,u as Nt}from"../chunk-SH5GYJN3.js";import"../chunk-UKQQD2JN.js";import{W as Q,X as h,Y as k,Z as Zn,_ as Bt}from"../chunk-N22BFR2U.js";import{a as o}from"../chunk-TYV53J3B.js";function Gc(e){let t=Zt.safeParse(e);return t.success?t.data.id:void 0}o(Gc,"parseJsonRpcRequestId");function Vo(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return Gc(t)}catch{return}}o(Vo,"readJsonRpcRequestIdFromBody");function tr(e){return ho.parse({jsonrpc:$t,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}o(tr,"jsonRpcErrorResponse");function Yo(e){return new yo([go.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}o(Yo,"urlElicitationRequiredError");var nr=d.record(d.string(),d.unknown()),Jc=d.record(d.string(),d.unknown()),Ie=d.array(d.string().min(1)).min(1).optional(),Fc=d.object({name:d.string().min(1),description:d.string().min(1).optional(),annotations:Jc.optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),$c=d.object({name:d.string().min(1),description:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Zc=d.object({uri:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Kc=d.object({uriTemplate:d.string().min(1),name:d.string().min(1).optional(),description:d.string().min(1).optional(),mimeType:d.string().min(1).optional(),_meta:nr.optional(),roles:Ie,groups:Ie,public:d.boolean().optional()}).strict(),Wc=d.array(d.union([d.string(),Fc])),Vc=d.array(d.union([d.string(),$c])),Yc=d.array(d.union([d.string(),Zc])),Xc=d.array(d.union([d.string(),Kc])),Qc=d.object({module:d.unknown(),export:d.string().min(1)}).strict(),ed=d.object({mode:d.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:d.string().min(1).optional(),groupClaim:d.string().min(1).optional(),identifier:Qc.optional()}).strict(),td=d.object({tools:Wc.optional(),prompts:Vc.optional(),resources:Yc.optional(),resourceTemplates:Xc.optional(),accessControl:ed.optional()}).strict(),Se=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function rd(e,t){return io(td,e,`MCP capability filter policy "${t}"`)}o(rd,"parseMcpCapabilityFilterOptions");function $(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}o($,"isRecord");function gt(e){return typeof e.method=="string"?e.method:void 0}o(gt,"messageMethod");function Xo(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}o(Xo,"correlationKey");function Qo(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}o(Qo,"asStringArray");function ei(e,t){if(!$(e))return[];let r=t in e?e[t]:t.split(".").reduce((n,i)=>$(n)?n[i]:void 0,e);return Array.isArray(r)?r.filter(n=>typeof n=="string"):typeof r=="string"?r.split(/\s+/).filter(n=>n.length>0):[]}o(ei,"readClaimValues");function Lr(e,t){if(typeof e=="string")return{key:e,public:!1};if(!$(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:Qo(e.roles),groups:Qo(e.groups),public:e.public===!0}}o(Lr,"normalizeEntry");function nd(e,t,r){if(e.public)return!0;let n=e.roles??[],i=e.groups??[];return n.length===0&&i.length===0?!1:n.some(a=>t.has(a))||i.some(a=>r.has(a))}o(nd,"isCallerAllowed");function rr(e,t,r,n){if(e===void 0)return;let i=[];for(let a of e){let s=Lr(a,t);s!==void 0&&nd(s,r,n)&&i.push(s.key)}return i}o(rr,"allowedKeys");var ni=o((e,t,r)=>{let n=r.accessControl?.roleClaim??"roles",i=r.accessControl?.groupClaim??"groups",a=new Set(ei(e.user?.data,n)),s=new Set(ei(e.user?.data,i));return{tools:rr(r.tools,"name",a,s),prompts:rr(r.prompts,"name",a,s),resources:rr(r.resources,"uri",a,s),resourceTemplates:rr(r.resourceTemplates,"uriTemplate",a,s)}},"claimsCapabilityResolver");function od(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);if(s===void 0)continue;let c=(s.roles?.length??0)>0||(s.groups?.length??0)>0;s.public&&c&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}o(od,"assertNoConflictingMarkup");function id(e,t){let r=[];for(let n of Se){let i=e[n.option];if(i!==void 0)for(let a of i){let s=Lr(a,n.itemProperty);s!==void 0&&((s.roles?.length??0)>0||(s.groups?.length??0)>0||s.public)&&r.push(`${n.option} "${s.key}"`)}}if(r.length>0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}o(id,"assertNoMarkup");function ad(e,t){let r=e.identifier;if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new k(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let n=r.module[r.export];if(typeof n!="function")throw new k(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let i=n;return async(a,s,c)=>{let u=await i(a,s,c);if(u==null)throw new h(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new h(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}o(ad,"buildCustomResolver");function sd(e,t){let r=e.accessControl,n=r?.mode??"allPublic";if(n==="function"){if(r===void 0)throw new k(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return ad(r,t)}if(n==="rolesAndGroups")return od(e,t),ni;id(e,t)}o(sd,"buildCapabilityResolver");function cd(e){let t={};for(let r of Se){let n=e[r.option];if(n===void 0)continue;let i=new Map;for(let a of n){let s=md(a,r.itemProperty);s!==void 0&&i.set(s.key,s)}t[r.option]=i}return t}o(cd,"buildProjectionMaps");function Hr(e){return e===void 0?void 0:Se.find(t=>t.listMethod===e)}o(Hr,"findListRule");function dd(e){return e===void 0?void 0:Se.find(t=>t.directMethods.includes(e))}o(dd,"findDirectRule");function ud(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}o(ud,"directCapabilityAccess");function ld(e){let t=dd(gt(e));if(t===void 0||!$(e.raw))return;let r=e.raw.params;if(!$(r))return;let n=r[t.itemProperty==="uri"?"uri":"name"];return typeof n=="string"?{option:t.option,target:n}:void 0}o(ld,"rawDirectCapabilityAccess");function pd(e){return Response.json(tr({...e==null?{}:{id:e},error:{code:ut.MethodNotFound,message:"Method not found"}}))}o(pd,"methodNotFoundResponse");function md(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!$(e))return;let r=e[t];if(typeof r!="string")return;let n={...e};return delete n.roles,delete n.groups,delete n.public,{key:r,overlay:n}}o(md,"buildProjection");function ti(e){let t=e.base[e.property],r=e.overlay[e.property];return $(r)?$(t)?{...t,...r}:r:t}o(ti,"mergeRecordProperty");function fd(e,t){let r={...e,...t.overlay},n=ti({base:e,overlay:t.overlay,property:"annotations"});n!==void 0&&(r.annotations=n);let i=ti({base:e,overlay:t.overlay,property:"_meta"});return i!==void 0&&(r._meta=i),r}o(fd,"applyProjection");function ri(e,t,r,n){if(!$(e))return e;let i=e.result;if(!$(i))return e;let a=i[t.resultProperty];return!Array.isArray(a)||!a.every(s=>$(s)&&typeof s[t.itemProperty]=="string")?e:{...e,result:{...i,[t.resultProperty]:a.flatMap(s=>{if(!$(s))return[];let c=s[t.itemProperty];if(typeof c!="string")return[];if(n!==void 0&&!n.has(c))return[];let u=r.get(c);return u===void 0?[]:[fd(s,u)]})}}}o(ri,"filterAndProjectItems");function hd(e){let{envelope:t,responseBody:r,projectionMaps:n,allowedSets:i}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let l of t.messages){let p=Hr(gt(l)),g=p===void 0?void 0:Xo(l.id);p!==void 0&&g!==void 0&&u.set(g,p)}return u.size===0?r:r.map(l=>{if(!$(l)||"error"in l)return l;let p=Xo(l.id),g=p===void 0?void 0:u.get(p),R=g===void 0?void 0:n[g.option];return g===void 0||R===void 0?l:ri(l,g,R,i?.[g.option])})}if(t.shape!=="single"||!$(r)||"error"in r)return r;let a=t.messages[0],s=Hr(a===void 0?void 0:gt(a)),c=s===void 0?void 0:n[s.option];return s===void 0||c===void 0?r:ri(r,s,c,i?.[s.option])}o(hd,"filterResponseBody");function gd(e){return e.headers.get("content-type")?.includes("json")??!1}o(gd,"isJsonResponse");var Br=class extends Lt{static{o(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let n=rd(t,r);super(n,r),this.#r=r,this.#e=cd(n),this.#t=sd(n,r)}async handler(t,r){let n=await Wo(t);if(n===null)return t;let i=this.#t!==void 0&&this.#n(n)?await this.#i(t,r):void 0;for(let s of n.messages){let c=s.type==="request"?ud(s):ld(s);if(c===void 0)continue;let u=this.#e[c.option];if(u===void 0)continue;let l=i?.[c.option];if(!u.has(c.target)||l!==void 0&&!l.has(c.target))return pd(s.type==="request"?s.id:s.id??void 0)}if(!this.#o(n))return t;let a=this.#e;return r.addResponseSendingHook(async s=>{if(!gd(s))return s;let c;try{c=await s.clone().json()}catch{return s}let u=hd({envelope:n,responseBody:c,projectionMaps:a,allowedSets:i});if(u===c)return s;let l=new Headers(s.headers);return l.delete("content-length"),new Response(JSON.stringify(u),{status:s.status,statusText:s.statusText,headers:l})}),t}#n(t){return t.messages.some(r=>{let n=gt(r);return n===void 0?!1:Se.some(i=>this.#e[i.option]===void 0?!1:i.listMethod===n||i.directMethods.includes(n))})}#o(t){return t.messages.some(r=>{let n=Hr(gt(r));return n!==void 0&&this.#e[n.option]!==void 0})}async#i(t,r){let n=this.#t;if(n===void 0)return{};let i;try{i=await n(t,r,this.options)}catch(s){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,s);let c={};for(let u of Se)this.#e[u.option]!==void 0&&(c[u.option]=new Set);return c}let a={};for(let s of Se){let c=this.#e[s.option];if(c===void 0)continue;let u=i[s.option];if(u===void 0)continue;let l=new Set;if(Array.isArray(u))for(let p of u)typeof p=="string"&&c.has(p)&&l.add(p);a[s.option]=l}return a}};var Nr;Nr=globalThis.crypto;async function yd(e){return(await Nr).getRandomValues(new Uint8Array(e))}o(yd,"getRandomValues");async function _d(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,n="";for(;n.length<e;){let i=await yd(e-n.length);for(let a of i)a<r&&(n+=t[a%t.length])}return n}o(_d,"random");async function wd(e){return await _d(e)}o(wd,"generateVerifier");async function bd(e){let t=await(await Nr).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}o(bd,"generateChallenge");async function Gr(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await wd(e),r=await bd(t);return{code_verifier:t,code_challenge:r}}o(Gr,"pkceChallenge");var H=Xn().superRefine((e,t)=>{if(!URL.canParse(e))return t.addIssue({code:to.custom,message:"URL must be parseable",fatal:!0}),Yn}).refine(e=>{let t=new URL(e);return t.protocol!=="javascript:"&&t.protocol!=="data:"&&t.protocol!=="vbscript:"},{message:"URL cannot use javascript:, data:, or vbscript: scheme"}),or=Nt({resource:m().url(),authorization_servers:w(H).optional(),jwks_uri:m().url().optional(),scopes_supported:w(m()).optional(),bearer_methods_supported:w(m()).optional(),resource_signing_alg_values_supported:w(m()).optional(),resource_name:m().optional(),resource_documentation:m().optional(),resource_policy_uri:m().url().optional(),resource_tos_uri:m().url().optional(),tls_client_certificate_bound_access_tokens:se().optional(),authorization_details_types_supported:w(m()).optional(),dpop_signing_alg_values_supported:w(m()).optional(),dpop_bound_access_tokens_required:se().optional()}),yt=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),service_documentation:H.optional(),revocation_endpoint:H.optional(),revocation_endpoint_auth_methods_supported:w(m()).optional(),revocation_endpoint_auth_signing_alg_values_supported:w(m()).optional(),introspection_endpoint:m().optional(),introspection_endpoint_auth_methods_supported:w(m()).optional(),introspection_endpoint_auth_signing_alg_values_supported:w(m()).optional(),code_challenge_methods_supported:w(m()).optional(),client_id_metadata_document_supported:se().optional()}),Rd=Nt({issuer:m(),authorization_endpoint:H,token_endpoint:H,userinfo_endpoint:H.optional(),jwks_uri:H,registration_endpoint:H.optional(),scopes_supported:w(m()).optional(),response_types_supported:w(m()),response_modes_supported:w(m()).optional(),grant_types_supported:w(m()).optional(),acr_values_supported:w(m()).optional(),subject_types_supported:w(m()),id_token_signing_alg_values_supported:w(m()),id_token_encryption_alg_values_supported:w(m()).optional(),id_token_encryption_enc_values_supported:w(m()).optional(),userinfo_signing_alg_values_supported:w(m()).optional(),userinfo_encryption_alg_values_supported:w(m()).optional(),userinfo_encryption_enc_values_supported:w(m()).optional(),request_object_signing_alg_values_supported:w(m()).optional(),request_object_encryption_alg_values_supported:w(m()).optional(),request_object_encryption_enc_values_supported:w(m()).optional(),token_endpoint_auth_methods_supported:w(m()).optional(),token_endpoint_auth_signing_alg_values_supported:w(m()).optional(),display_values_supported:w(m()).optional(),claim_types_supported:w(m()).optional(),claims_supported:w(m()).optional(),service_documentation:m().optional(),claims_locales_supported:w(m()).optional(),ui_locales_supported:w(m()).optional(),claims_parameter_supported:se().optional(),request_parameter_supported:se().optional(),request_uri_parameter_supported:se().optional(),require_request_uri_registration:se().optional(),op_policy_uri:H.optional(),op_tos_uri:H.optional(),client_id_metadata_document_supported:se().optional()}),ir=_e({...Rd.shape,...yt.pick({code_challenge_methods_supported:!0}).shape}),We=_e({access_token:m(),id_token:m().optional(),token_type:m(),expires_in:ro.number().optional(),scope:m().optional(),refresh_token:m().optional()}).strip(),ii=_e({error:m(),error_description:m().optional(),error_uri:m().optional()}),oi=H.optional().or(eo("").transform(()=>{})),Cd=_e({redirect_uris:w(H),token_endpoint_auth_method:m().optional(),grant_types:w(m()).optional(),response_types:w(m()).optional(),client_name:m().optional(),client_uri:H.optional(),logo_uri:oi,scope:m().optional(),contacts:w(m()).optional(),tos_uri:oi,policy_uri:m().optional(),jwks_uri:H.optional(),jwks:Qn().optional(),software_id:m().optional(),software_version:m().optional(),software_statement:m().optional()}).strip(),ar=_e({client_id:m(),client_secret:m().optional(),client_id_issued_at:xr().optional(),client_secret_expires_at:xr().optional()}).strip(),_t=Cd.merge(ar),hg=_e({error:m(),error_description:m().optional()}).strip(),gg=_e({token:m(),token_type_hint:m().optional()}).strip();function ai(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}o(ai,"resourceUrlFromServerUrl");function si({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),n=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==n.origin||r.pathname.length<n.pathname.length)return!1;let i=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",a=n.pathname.endsWith("/")?n.pathname:n.pathname+"/";return i.startsWith(a)}o(si,"checkResourceAllowed");var x=class extends Error{static{o(this,"OAuthError")}constructor(t,r){super(t),this.errorUri=r,this.name=this.constructor.name}toResponseObject(){let t={error:this.errorCode,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}get errorCode(){return this.constructor.errorCode}},wt=class extends x{static{o(this,"InvalidRequestError")}};wt.errorCode="invalid_request";var Oe=class extends x{static{o(this,"InvalidClientError")}};Oe.errorCode="invalid_client";var Me=class extends x{static{o(this,"InvalidGrantError")}};Me.errorCode="invalid_grant";var qe=class extends x{static{o(this,"UnauthorizedClientError")}};qe.errorCode="unauthorized_client";var bt=class extends x{static{o(this,"UnsupportedGrantTypeError")}};bt.errorCode="unsupported_grant_type";var Rt=class extends x{static{o(this,"InvalidScopeError")}};Rt.errorCode="invalid_scope";var Ct=class extends x{static{o(this,"AccessDeniedError")}};Ct.errorCode="access_denied";var pe=class extends x{static{o(this,"ServerError")}};pe.errorCode="server_error";var St=class extends x{static{o(this,"TemporarilyUnavailableError")}};St.errorCode="temporarily_unavailable";var It=class extends x{static{o(this,"UnsupportedResponseTypeError")}};It.errorCode="unsupported_response_type";var vt=class extends x{static{o(this,"UnsupportedTokenTypeError")}};vt.errorCode="unsupported_token_type";var At=class extends x{static{o(this,"InvalidTokenError")}};At.errorCode="invalid_token";var kt=class extends x{static{o(this,"MethodNotAllowedError")}};kt.errorCode="method_not_allowed";var xt=class extends x{static{o(this,"TooManyRequestsError")}};xt.errorCode="too_many_requests";var De=class extends x{static{o(this,"InvalidClientMetadataError")}};De.errorCode="invalid_client_metadata";var Ut=class extends x{static{o(this,"InsufficientScopeError")}};Ut.errorCode="insufficient_scope";var Tt=class extends x{static{o(this,"InvalidTargetError")}};Tt.errorCode="invalid_target";var ci={[wt.errorCode]:wt,[Oe.errorCode]:Oe,[Me.errorCode]:Me,[qe.errorCode]:qe,[bt.errorCode]:bt,[Rt.errorCode]:Rt,[Ct.errorCode]:Ct,[pe.errorCode]:pe,[St.errorCode]:St,[It.errorCode]:It,[vt.errorCode]:vt,[At.errorCode]:At,[kt.errorCode]:kt,[xt.errorCode]:xt,[De.errorCode]:De,[Ut.errorCode]:Ut,[Tt.errorCode]:Tt};function Sd(e){return["client_secret_basic","client_secret_post","none"].includes(e)}o(Sd,"isClientAuthMethod");var Jr="code",Fr="S256";function Id(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&Sd(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}o(Id,"selectClientAuthMethod");function vd(e,t,r,n){let{client_id:i,client_secret:a}=t;switch(e){case"client_secret_basic":Ad(i,a,r);return;case"client_secret_post":kd(i,a,n);return;case"none":xd(i,n);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}o(vd,"applyClientAuthentication");function Ad(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let n=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${n}`)}o(Ad,"applyBasicAuth");function kd(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}o(kd,"applyPostAuth");function xd(e,t){t.set("client_id",e)}o(xd,"applyPublicAuth");async function ui(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let n=ii.parse(JSON.parse(r)),{error:i,error_description:a,error_uri:s}=n,c=ci[i]||pe;return new c(a||"",s)}catch(n){let i=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${n}. Raw body: ${r}`;return new pe(i)}}o(ui,"parseErrorResponse");async function Kr(e,t){try{return await $r(e,t)}catch(r){if(r instanceof Oe||r instanceof qe)return await e.invalidateCredentials?.("all"),await $r(e,t);if(r instanceof Me)return await e.invalidateCredentials?.("tokens"),await $r(e,t);throw r}}o(Kr,"auth");async function $r(e,{serverUrl:t,authorizationCode:r,scope:n,resourceMetadataUrl:i,fetchFn:a}){let s=await e.discoveryState?.(),c,u,l,p=i;if(!p&&s?.resourceMetadataUrl&&(p=new URL(s.resourceMetadataUrl)),s?.authorizationServerUrl){if(u=s.authorizationServerUrl,c=s.resourceMetadata,l=s.authorizationServerMetadata??await mi(u,{fetchFn:a}),!c)try{c=await pi(t,{resourceMetadataUrl:p},a)}catch{}(l!==s.authorizationServerMetadata||c!==s.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}else{let M=await Md(t,{resourceMetadataUrl:p,fetchFn:a});u=M.authorizationServerUrl,l=M.authorizationServerMetadata,c=M.resourceMetadata,await e.saveDiscoveryState?.({authorizationServerUrl:String(u),resourceMetadataUrl:p?.toString(),resourceMetadata:c,authorizationServerMetadata:l})}let g=await Ud(t,e,c),R=n||c?.scopes_supported?.join(" ")||e.clientMetadata.scope,_=await Promise.resolve(e.clientInformation());if(!_){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let M=l?.client_id_metadata_document_supported===!0,j=e.clientMetadataUrl;if(j&&!Wr(j))throw new De(`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${j}`);if(M&&j)_={client_id:j},await e.saveClientInformation?.(_);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");let $n=await Hd(u,{metadata:l,clientMetadata:e.clientMetadata,scope:R,fetchFn:a});await e.saveClientInformation($n),_=$n}}let O=!e.redirectUrl;if(r!==void 0||O){let M=await jd(e,u,{metadata:l,resource:g,authorizationCode:r,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}let T=await e.tokens();if(T?.refresh_token)try{let M=await zd(u,{metadata:l,clientInformation:_,refreshToken:T.refresh_token,resource:g,addClientAuthentication:e.addClientAuthentication,fetchFn:a});return await e.saveTokens(M),"AUTHORIZED"}catch(M){if(!(!(M instanceof x)||M instanceof pe))throw M}let B=e.state?await e.state():void 0,{authorizationUrl:Le,codeVerifier:X}=await qd(u,{metadata:l,clientInformation:_,state:B,redirectUrl:e.redirectUrl,scope:R,resource:g});return await e.saveCodeVerifier(X),await e.redirectToAuthorization(Le),"REDIRECT"}o($r,"authInternal");function Wr(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}o(Wr,"isHttpsUrl");async function Ud(e,t,r){let n=ai(e);if(t.validateResourceURL)return await t.validateResourceURL(n,r?.resource);if(r){if(!si({requestedResource:n,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${n} (or origin)`);return new URL(r.resource)}}o(Ud,"selectResourceURL");function li(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,n]=t.split(" ");if(r.toLowerCase()!=="bearer"||!n)return{};let i=Zr(e,"resource_metadata")||void 0,a;if(i)try{a=new URL(i)}catch{}let s=Zr(e,"scope")||void 0,c=Zr(e,"error")||void 0;return{resourceMetadataUrl:a,scope:s,error:c}}o(li,"extractWWWAuthenticateParams");function Zr(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let n=new RegExp(`${t}=(?:"([^"]+)"|([^\\s,]+))`),i=r.match(n);return i?i[1]||i[2]:null}o(Zr,"extractFieldFromWwwAuth");async function pi(e,t,r=fetch){let n=await Ed(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!n||n.status===404)throw await n?.body?.cancel(),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!n.ok)throw await n.body?.cancel(),new Error(`HTTP ${n.status} trying to load well-known OAuth protected resource metadata.`);return or.parse(await n.json())}o(pi,"discoverOAuthProtectedResourceMetadata");async function Vr(e,t,r=fetch){try{return await r(e,{headers:t})}catch(n){if(n instanceof TypeError)return t?Vr(e,void 0,r):void 0;throw n}}o(Vr,"fetchWithCorsRetry");function Td(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}o(Td,"buildWellKnownPath");async function di(e,t,r=fetch){return await Vr(e,{"MCP-Protocol-Version":t},r)}o(di,"tryMetadataDiscovery");function Pd(e,t){return!e||e.status>=400&&e.status<500&&t!=="/"}o(Pd,"shouldAttemptFallback");async function Ed(e,t,r,n){let i=new URL(e),a=n?.protocolVersion??Ur,s;if(n?.metadataUrl)s=new URL(n.metadataUrl);else{let u=Td(t,i.pathname);s=new URL(u,n?.metadataServerUrl??i),s.search=i.search}let c=await di(s,a,r);if(!n?.metadataUrl&&Pd(c,i.pathname)){let u=new URL(`/.well-known/${t}`,i);c=await di(u,a,r)}return c}o(Ed,"discoverMetadataWithFallback");function Od(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",n=[];if(!r)return n.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"}),n.push({url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),n;let i=t.pathname;return i.endsWith("/")&&(i=i.slice(0,-1)),n.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:"oauth"}),n.push({url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:"oidc"}),n.push({url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:"oidc"}),n}o(Od,"buildDiscoveryUrls");async function mi(e,{fetchFn:t=fetch,protocolVersion:r=Ur}={}){let n={"MCP-Protocol-Version":r,Accept:"application/json"},i=Od(e);for(let{url:a,type:s}of i){let c=await Vr(a,n,t);if(c){if(!c.ok){if(await c.body?.cancel(),c.status>=400&&c.status<500)continue;throw new Error(`HTTP ${c.status} trying to load ${s==="oauth"?"OAuth":"OpenID provider"} metadata from ${a}`)}return s==="oauth"?yt.parse(await c.json()):ir.parse(await c.json())}}}o(mi,"discoverAuthorizationServerMetadata");async function Md(e,t){let r,n;try{r=await pi(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(n=r.authorization_servers[0])}catch{}n||(n=String(new URL("/",e)));let i=await mi(n,{fetchFn:t?.fetchFn});return{authorizationServerUrl:n,authorizationServerMetadata:i,resourceMetadata:r}}o(Md,"discoverOAuthServerInfo");async function qd(e,{metadata:t,clientInformation:r,redirectUrl:n,scope:i,state:a,resource:s}){let c;if(t){if(c=new URL(t.authorization_endpoint),!t.response_types_supported.includes(Jr))throw new Error(`Incompatible auth server: does not support response type ${Jr}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(Fr))throw new Error(`Incompatible auth server: does not support code challenge method ${Fr}`)}else c=new URL("/authorize",e);let u=await Gr(),l=u.code_verifier,p=u.code_challenge;return c.searchParams.set("response_type",Jr),c.searchParams.set("client_id",r.client_id),c.searchParams.set("code_challenge",p),c.searchParams.set("code_challenge_method",Fr),c.searchParams.set("redirect_uri",String(n)),a&&c.searchParams.set("state",a),i&&c.searchParams.set("scope",i),i?.includes("offline_access")&&c.searchParams.append("prompt","consent"),s&&c.searchParams.set("resource",s.href),{authorizationUrl:c,codeVerifier:l}}o(qd,"startAuthorization");function Dd(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}o(Dd,"prepareAuthorizationCodeRequest");async function fi(e,{metadata:t,tokenRequestParams:r,clientInformation:n,addClientAuthentication:i,resource:a,fetchFn:s}){let c=t?.token_endpoint?new URL(t.token_endpoint):new URL("/token",e),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});if(a&&r.set("resource",a.href),i)await i(u,r,c,t);else if(n){let p=t?.token_endpoint_auth_methods_supported??[],g=Id(n,p);vd(g,n,u,r)}let l=await(s??fetch)(c,{method:"POST",headers:u,body:r});if(!l.ok)throw await ui(l);return We.parse(await l.json())}o(fi,"executeTokenRequest");async function zd(e,{metadata:t,clientInformation:r,refreshToken:n,resource:i,addClientAuthentication:a,fetchFn:s}){let c=new URLSearchParams({grant_type:"refresh_token",refresh_token:n}),u=await fi(e,{metadata:t,tokenRequestParams:c,clientInformation:r,addClientAuthentication:a,resource:i,fetchFn:s});return{refresh_token:n,...u}}o(zd,"refreshAuthorization");async function jd(e,t,{metadata:r,resource:n,authorizationCode:i,fetchFn:a}={}){let s=e.clientMetadata.scope,c;if(e.prepareTokenRequest&&(c=await e.prepareTokenRequest(s)),!c){if(!i)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");let l=await e.codeVerifier();c=Dd(i,l,e.redirectUrl)}let u=await e.clientInformation();return fi(t,{metadata:r,tokenRequestParams:c,clientInformation:u??void 0,addClientAuthentication:e.addClientAuthentication,resource:n,fetchFn:a})}o(jd,"fetchToken");async function Hd(e,{metadata:t,clientMetadata:r,scope:n,fetchFn:i}){let a;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");a=new URL(t.registration_endpoint)}else a=new URL("/register",e);let s=await(i??fetch)(a,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...r,...n!==void 0?{scope:n}:{}})});if(!s.ok)throw await ui(s);return _t.parse(await s.json())}o(Hd,"registerClient");var Yr="zuplo.com",Bd=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),Ld=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function hi(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}o(hi,"s2FaviconHref");function Nd(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}o(Nd,"strictFaviconHref");var sr=hi(Yr);function Xr(e){let t=e.toLowerCase();return t===Yr||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?hi(Yr):Nd(e)}o(Xr,"resolveIconHref");function Gd(e){try{return new URL(`http://${e}`).hostname}catch{return e}}o(Gd,"hostnameFromHost");function Jd(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}o(Jd,"isLocalOrAddressHost");function Fd(e){let t=Gd(e).toLowerCase().replace(/\.$/,"");if(Jd(t)||Ld.some(a=>t===a.slice(1)||t.endsWith(a)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let n=r.slice(-2).join("."),i=Bd.has(n)?3:2;return r.slice(-i).join(".")}o(Fd,"inferFaviconDomain");function Qr(e){return{src:Xr(Fd(e)),mimeType:"image/png",sizes:["128x128"]}}o(Qr,"resolveMcpFaviconIcon");function cr(e){try{return Qr(new URL(e).host)}catch{return}}o(cr,"resolveMcpFaviconIconFromUrl");function ve(e){let t=ee().connectionsById.get(e);if(!t)throw new k(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}o(ve,"getUpstreamServerConfig");function dr(e){let t=ee().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new k(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}o(dr,"getUpstreamAuthConfig");function Ve(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new k(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}o(Ve,"requireUpstreamOAuthConfig");function gi(e,t){let r=dr({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new k(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}o(gi,"requireUpstreamIdJagConfig");function yi(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=o(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}o(yi,"mergeAbortSignals");async function $d(e){try{await e.cancel()}catch{}}o($d,"cancelReader");async function ur(e,t){if(!e)return new Uint8Array;let r=e.getReader(),n=[],i=0,a=await r.read();for(;!a.done;){let u=a.value;if(i+=u.byteLength,i>t.maxBytes)throw await $d(r),t.createLimitError();n.push(u),a=await r.read()}let s=new Uint8Array(i),c=0;for(let u of n)s.set(u,c),c+=u.byteLength;return s}o(ur,"readBoundedByteStream");var Zd=2,Kd=1024*1024,Wd=1e4,Vd=new Set([301,302,303,307,308]),Yd=["authorization","proxy-authorization","cookie","cookie2"];function en(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}o(en,"readRequestUrl");function Ye(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}o(Ye,"readRequestMethod");function Xd(e,t,r){let n=e.headers.get("content-length");if(!n)return;let i=Number.parseInt(n,10);if(Number.isFinite(i)&&i>t)throw new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}})}o(Xd,"assertContentLengthWithinLimit");async function Qd(e,t,r){return Xd(e,t,r),ur(e.body,{maxBytes:t,createLimitError:o(()=>new h({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[y]:r}}),"createLimitError")})}o(Qd,"readBoundedResponseBody");function eu(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}o(eu,"responseFromBufferedBody");function tu(e,t){if(!Vd.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}o(tu,"resolveRedirectUrl");function _i(e,t){try{return t.validateUrl(e)}catch(r){throw new h({message:"Outbound URL was not allowed.",extensionMembers:{[y]:t.problemCode}},{cause:r})}}o(_i,"validateOutboundUrl");function ru(e,t){throw e instanceof h&&Gt(e.extensionMembers?.[y])?e:new h({message:"Outbound fetch failed.",extensionMembers:{[y]:t}},{cause:e})}o(ru,"normalizeFetchError");function Pt(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[n,i]of Object.entries(t.extra))i!==void 0&&(r[n]=i);t.error!==void 0&&G(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}o(Pt,"logOutboundFailure");async function nu(e,t,r,n,i,a,s){let c=Ye(r,n);try{return await t(r,n)}catch(u){let l=u instanceof DOMException&&u.name==="AbortError";Pt(e,{event:l?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:i,method:c,host:q(a),error:u,extra:{abortReason:s()}}),ru(u,i)}}o(nu,"fetchWithNormalizedError");function ou(e){if(e.redirects>=e.maxRedirects)throw new h({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[y]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new h({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[y]:e.problemCode}})}o(ou,"assertRedirectAllowed");function iu(e,t){let r=new Headers(e);for(let n of Yd)r.delete(n);for(let n of t)r.delete(n);return r}o(iu,"stripCrossOriginHeaders");function au(e,t,r,n,i){let a={...e,method:t,redirect:"manual",signal:r};return n&&(a.headers=iu(e.headers,i)),a}o(au,"buildRedirectInit");function su(e,t,r){let n={...t,redirect:"manual",signal:r};return n.headers===void 0&&e instanceof Request&&(n.headers=e.headers),n}o(su,"buildInitialRequestInit");function cu(e){let t=Ye(e.currentInput,e.currentInit);ou({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=_i(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),n=new URL(e.currentUrl),i=r.origin!==n.origin,a=r.toString();return{currentInput:a,currentUrl:a,currentInit:au(e.currentInit,t,e.signal,i,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}o(cu,"followRedirect");async function tn(e,t,r){let n=r.problemCode??"invalid_request",i=r.maxRedirects??Zd,a=r.maxResponseBytes??Kd,s=r.timeoutMs??Wd,c=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],l=r.context,p=new AbortController,g=yi(p,t.signal),R=!1,_=setTimeout(()=>{R=!0,p.abort()},s),O=e,T=su(e,t,p.signal),B;try{B=_i(en(e),{problemCode:n,validateUrl:r.validateUrl}).toString()}catch(X){throw Pt(l,{event:"outbound_url_blocked",problemCode:n,method:Ye(e,t),host:q(en(e)),error:X}),clearTimeout(_),g?.(),X}let Le=0;try{for(;;){let X=await nu(l,c,O,T,n,B,()=>R?`timeout_after_${s}ms`:void 0),M=tu(X,B);if(M!==void 0)try{let j=cu({currentInput:O,currentInit:T,currentUrl:B,redirectUrl:M,redirects:Le,maxRedirects:i,problemCode:n,validateUrl:r.validateUrl,signal:p.signal,additionalCrossOriginStrippedHeaders:u});O=j.currentInput,T=j.currentInit,B=j.currentUrl,Le=j.redirects;continue}catch(j){throw Pt(l,{event:"outbound_redirect_blocked",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{redirects:Le,maxRedirects:i,redirectTargetHost:q(M)}}),j}try{return eu(X,await Qd(X,a,n))}catch(j){throw Pt(l,{event:"outbound_response_size_exceeded",problemCode:n,method:Ye(O,T),host:q(B),error:j,extra:{maxResponseBytes:a,status:X.status}}),j}}}finally{clearTimeout(_),g?.()}}o(tn,"runSafeOutboundExchange");async function Et(e,t,r){let n=await tn(e,t,r);try{return{response:n,json:await n.clone().json()}}catch(i){throw Pt(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Ye(e,t),host:q(en(e)),error:i,extra:{status:n.status,contentType:n.headers.get("content-type")??void 0}}),new h({message:"Outbound JSON response could not be parsed.",extensionMembers:{[y]:r.problemCode??"invalid_request"}},{cause:i})}}o(Et,"runSafeOutboundJsonExchange");function wi(e,t={},r={}){return tn(e,t,{...r,validateUrl:ft})}o(wi,"fetchConfiguredOutbound");function bi(e,t={},r={}){return Et(e,t,{...r,validateUrl:ft})}o(bi,"fetchConfiguredOutboundJson");function lr(e,t={},r={}){return Et(e,t,{...r,validateUrl:jo})}o(lr,"fetchIdentityProviderJson");function Ri(e,t={},r={}){return Et(e,t,{...r,validateUrl:Xt})}o(Ri,"fetchCimdClientMetadataJson");function Ci(e,t={},r={}){return Et(e,t,{...r,validateUrl:ht})}o(Ci,"fetchCimdClientJwksJson");import{errors as xi,jwtVerify as Ui,SignJWT as Ti}from"jose";var Z="zuplo-mcp-gateway",W=Z,V="HS256";import{base64url as du}from"jose";var uu=new TextEncoder,lu="MCP gateway could not initialize secure key material.",pu=32,Si=new Map,Ii=new Map,mu;function fu(){return mu??Zn.instance.authPrivateKey}o(fu,"readAuthPrivateKey");function vi(e){return new Q(lu,e===void 0?void 0:{cause:e})}o(vi,"createGeneratedKeyMaterialError");function Ai(e,t){let r=du.decode(t);if(r.byteLength!==pu)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}o(Ai,"decodeJwkKeyField");function hu(e){let t=fu();if(!t)throw vi();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let n=Ai("d",r.d);Ai("x",r.x);let i=uu.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),a=new Uint8Array(i.byteLength+n.byteLength);return a.set(i),a.set(n,i.byteLength),a}catch(r){throw vi(r)}}o(hu,"decodeGeneratedKeyMaterial");function gu(e){let t=Si.get(e);return t||(t=hu(e),Si.set(e,t)),t}o(gu,"getMasterKeyMaterial");async function oe(e){let t=Ii.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(gu(e.keyMaterialPurpose));return Ii.set(e.purpose,r),r}o(oe,"readCachedDerivedKey");var yu="SHA-256",_u=32,wu="zuplo-mcp-gateway:",bu=new TextEncoder,ki=new WeakMap;async function Ae(e,t){let r=ki.get(e);r||(r=new Map,ki.set(e,r));let n=r.get(t);if(n)return n;let i=await Ru(e,t);return r.set(t,i),i}o(Ae,"deriveGatewaySigningKey");async function Ru(e,t){let r=J(e),n=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),i=bu.encode(`${wu}${t}`),a=await crypto.subtle.deriveBits({name:"HKDF",hash:yu,salt:new Uint8Array,info:J(i)},n,_u*8);return new Uint8Array(a)}o(Ru,"hkdfExpand");var Pi=900,Cu=900,Su=bo.extend({id:Go}),Iu=Su.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Ei=Tr.extend({id:Jo,purpose:d.literal("browser_connect")}),vu=Tr.extend({purpose:d.literal("browser_connect")}),Au=Ei.extend({exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Oi=Pi*1e3;async function Mi(){return oe({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"oauth-state"),"derive")})}o(Mi,"getOAuthStateKey");async function qi(){return oe({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"browser-connect"),"derive")})}o(qi,"getBrowserConnectKey");async function Di(e){let t=Math.floor(Date.now()/1e3)+Pi;return new Ti(e).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await Mi())}o(Di,"signOAuthState");async function pr(e){try{let{payload:t}=await Ui(e,await Mi(),{algorithms:[V],issuer:Z,audience:W});return Iu.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"OAuth state could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(pr,"verifyOAuthState");async function zi(e){let t=Math.floor(Date.now()/1e3)+Cu,r=vu.parse(e),n=Ei.parse({...r,id:Ko()});return new Ti(n).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(t).sign(await qi())}o(zi,"signBrowserConnectTicket");async function ji(e){try{let{payload:t}=await Ui(e,await qi(),{algorithms:[V],issuer:Z,audience:W});return Au.parse(t)}catch(t){throw t instanceof xi.JWTExpired?new h({message:"Browser connect ticket has expired",extensionMembers:{[y]:"oauth_state_expired"}},{cause:t}):new h({message:"Browser connect ticket could not be verified",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:t})}}o(ji,"verifyBrowserConnectTicket");async function Hi(e){if((await C().consumeBrowserConnectTicket({id:e.id,expiresAt:S(new Date(e.exp*1e3)),now:S(new Date)})).kind==="consumed")throw new h({message:"Browser connect ticket has already been used",extensionMembers:{[y]:"oauth_state_reused"}})}o(Hi,"consumeBrowserConnectTicket");function ku(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}o(ku,"buildConnectRequiredMessage");async function xu(e){let t=D(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await zi({...pt(e),purpose:"browser_connect"})),r.toString()}o(xu,"buildGatewayBrowserTicketUrl");function Uu(e){return L().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}o(Uu,"buildGatewayConnectPath");async function rn(e){return xu({...e,path:Uu(e.upstreamServerId),redirect:!0})}o(rn,"buildGatewayConnectUrl");async function mr(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await rn(t),message:ku(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}o(mr,"buildRedirectConnectRequiredResponse");function Bi(e){return Tu({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}o(Bi,"buildAdminConnectRequiredResponse");function Tu(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}o(Tu,"buildAdminSetupRequiredResponse");var Li=12;async function Ni(e){let t=await crypto.subtle.digest("SHA-256",J(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}o(Ni,"sha256Hex");async function ze(e){if(e)return(await Ni(e)).slice(0,Li)}o(ze,"fingerprintSecret");async function Xe(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await Ni(t)).slice(0,Li)}o(Xe,"fingerprintConnectionIdentity");var Pu=6e4;function Qe(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,n)=>t.scopes[n]!==r)}o(Qe,"credentialGenerationChanged");function F(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+Pu)return"near_expiry"}return"usable"}o(F,"describeAccessTokenState");var Gi=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function Eu(e,t){return e&&e.length>0?e.join(t):void 0}o(Eu,"joinOAuthScopes");function Ou(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of Gi)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}o(Ou,"sanitizeAuthorizationServerMetadata");function Ji(e){let t=Ou(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}o(Ji,"sanitizeOAuthDiscoveryState");function Fi(e){let t=new URL(e);for(let r of Gi){let n=t.searchParams.getAll(r);n.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,n.at(-1)??""))}return t}o(Fi,"dedupeSingletonAuthorizationRequestParams");function fr(e){let t=new URL(e);return K(t)&&oo(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}o(fr,"normalizeLoopbackOAuthRedirectUri");function $i(e){return Eu(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}o($i,"readProtectedResourceMetadataScope");function Mu(e){return`Zuplo MCP Gateway - ${e}`}o(Mu,"buildGatewayOAuthClientName");function qu(e,t){return e&&e.length>0?e.join(t):void 0}o(qu,"joinOAuthScopeList");function Du(e){if(e.clientRegistration.mode!=="auto")return qu(e.scopes,e.scopeDelimiter)}o(Du,"readPublicClientMetadataScope");function nn(e){return new URL(L().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}o(nn,"buildOAuthClientMetadataDocumentUrl");function on(e){let t=ve(e.upstreamServerId);return{client_name:Mu(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}o(on,"buildGatewayOAuthClientMetadata");function Zi(e,t,r){let n=Ve(t,r),i=Du(n);return{client_id:nn({origin:e,upstreamServerId:t}),...on({origin:e,upstreamServerId:t,redirectUri:fr(new URL(n.redirectPath,e)).toString(),scope:i})}}o(Zi,"buildOAuthClientMetadataDocument");import{base64url as ke}from"jose";var zu="SHA-256",et="AES-GCM",ju=12,sn="zuplo-secret",cn=1,Ki="generated:auth_private_key:token-encryption",Hu=d.object({version:d.literal(cn),keyId:d.literal(Ki),algorithm:d.literal(et),iv:d.string().min(1),ciphertext:d.string().min(1)}).strict();async function an(){return oe({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:o(async e=>{let t=await crypto.subtle.digest(zu,J(e));return crypto.subtle.importKey("raw",t,{name:et},!1,["encrypt","decrypt"])},"derive")})}o(an,"getEncryptionKey");function Wi(e){return J(new TextEncoder().encode(`${sn}:v${e.version}:${e.keyId}`))}o(Wi,"getAssociatedData");function Bu(e){return`${sn}:v${e.version}:${ke.encode(new TextEncoder().encode(JSON.stringify(e)))}`}o(Bu,"encodeEnvelope");function Lu(e){let t=`${sn}:v${cn}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),n=new TextDecoder().decode(ke.decode(r));return Hu.parse(JSON.parse(n))}o(Lu,"decodeEnvelope");async function me(e){let t=await an(),r=crypto.getRandomValues(new Uint8Array(ju)),n={version:cn,keyId:Ki},i=await crypto.subtle.encrypt({name:et,iv:r,additionalData:Wi(n)},t,new TextEncoder().encode(e));return Bu({...n,algorithm:et,iv:ke.encode(r),ciphertext:ke.encode(new Uint8Array(i))})}o(me,"encryptSecret");async function fe(e){let t=Lu(e);if(t){let s=await an(),c=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(t.iv)),additionalData:Wi(t)},s,J(ke.decode(t.ciphertext)));return new TextDecoder().decode(c)}let[r,n]=e.split(".");if(!r||!n)throw new Q("Encrypted payload is malformed");let i=await an(),a=await crypto.subtle.decrypt({name:et,iv:J(ke.decode(r))},i,J(ke.decode(n)));return new TextDecoder().decode(a)}o(fe,"decryptSecret");var Nu=d.union([_t,ar]),Gu=d.object({authorizationServerUrl:d.url(),resourceMetadataUrl:d.url().optional(),resourceMetadata:or.optional(),authorizationServerMetadata:d.union([yt,ir]).optional()}).passthrough(),Ju="Bearer",Fu="__zuplo_refresh_only_upstream_access_token__";function dn(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}o(dn,"splitScopes");function un(e,t){let r=new Set(e);return t.every(n=>r.has(n))}o(un,"scopesCover");function $u(e){return Ge.parse(e)}o($u,"parsePkceCodeVerifier");function Zu(e){if(typeof e.expires_in=="number")return S(new Date(Date.now()+e.expires_in*1e3))}o(Zu,"readTokenExpiry");async function Ku(e){if(e!==void 0)return me(JSON.stringify(e))}o(Ku,"encryptJson");async function Wu(e,t){if(!e)return;let r=await fe(e);try{return t.parse(JSON.parse(r))}catch(n){throw new h({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[y]:"oauth_state_invalid"}},{cause:n})}}o(Wu,"decryptJson");function Vu(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}o(Vu,"clientInformationAllowsRedirectUri");function Yu(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}o(Yu,"clientInformationMatchesCurrentClientMetadataUrl");function Xu(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}o(Xu,"isUrlBasedClientInformation");function Qu(e,t){return t===void 0?e:{...e,scope:t}}o(Qu,"applyOAuthClientMetadataScope");function el(e,t){return $i({state:e,delimiter:t})}o(el,"readResourceMetadataScope");function tl(e,t){return e&&e.length>0?e.join(t):void 0}o(tl,"joinOAuthScopeList");function rl(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new k(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return _t.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}o(rl,"buildManualOAuthClientInformation");function nl(e,t){let r=nn({origin:new URL(t).origin,upstreamServerId:e});return Wr(r)?r:void 0}o(nl,"buildClientMetadataUrl");function ol(e){for(let t of e)if(t!==void 0)return t}o(ol,"firstDefined");function il(e){let t=Ve(e.target.upstreamServerId,e.target.authProfileId),r=tl(t.scopes,t.scopeDelimiter),n=on({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,configuredClientInformation:rl({clientMetadata:n,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let i=nl(e.target.upstreamServerId,e.redirectUri);return i===void 0?{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt}:{clientMetadata:n,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,clientMetadataUrl:i}}o(il,"buildInitialOAuthClientSetup");function al(e,t){if(t===void 0)return ol([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}o(al,"readEncryptedClientInformation");var xe=class{static{o(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=il({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=al(t,this.configuredClientInformation)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let n=dn(this.configuredScope??r??this.readEffectiveScope());return un(t.scopes,n)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&F(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let n=U();n&&n.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await Xe({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await ze(await fe(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await C().conditionalUpsertUpstreamConnection(t,r)}catch(n){let i=U();if(i){let a=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:n}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});i.error(a,"Upstream OAuth conditional storage write failed")}throw n}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return Qu(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return Di({id:t.id,...pt({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(){return this.configuredClientInformation?this.configuredClientInformation:this.loadPersistedClientInformation()}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,U()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!Xu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await Ku(t),await this.syncPendingState(!1)))}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=Ji(Gu.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,U()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:q(r.authorizationServerUrl),resourceMetadataHost:q(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=el(r,this.scopeDelimiter);let n=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&n!==void 0){let i=dn(this.configuredScope).filter(a=>!n.includes(a));i.length>0&&U()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:i,scopesSupported:n},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(){return this.loadStoredTokens()}async saveTokens(t){let r=We.parse(t),n=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,i=this.credentialState.sourceConnection,a=!r.refresh_token&&!!i?.encryptedRefreshToken,s=r.refresh_token?await me(r.refresh_token):i?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!i?.encryptedRefreshToken?r:We.parse({...r,refresh_token:await fe(i.encryptedRefreshToken)}),this.tokensLoaded=!0;let c={id:i?.id??Qt(),ownerMode:this.target.owner.mode,subjectId:n,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await me(r.access_token),encryptedRefreshToken:s,scopes:dn(r.scope??this.readEffectiveScope()),expiresAt:Zu(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=i?{expectedUpdatedAt:i.updatedAt}:{expectAbsent:!0},l=await this.conditionalUpsertCredential(c,u),p=!1;if(l.kind==="precondition_failed"&&l.connection!==void 0&&(F(l.connection)!=="usable"||!un(l.connection.scopes,c.scopes)||!Qe(i,l.connection))){p=!0;let R=l.connection,_={id:R.id,ownerMode:R.ownerMode,subjectId:R.subjectId,upstreamServerId:R.upstreamServerId,authProfileId:R.authProfileId,status:"active",encryptedAccessToken:c.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?R.encryptedRefreshToken:c.encryptedRefreshToken,scopes:c.scopes,expiresAt:c.expiresAt,metadata:R.metadata};U()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:R.id,sourceUpdatedAt:i?.updatedAt,winnerUpdatedAt:R.updatedAt,sourceScopeCount:i?.scopes.length,winnerScopeCount:R.scopes.length,resultingScopeCount:_.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),l=await this.conditionalUpsertCredential(_,{expectedUpdatedAt:R.updatedAt})}if(l.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=l.kind,l.kind==="persisted"?(this.credentialState.currentConnection=l.connection,this.credentialState.peerAdoption=void 0):l.kind==="precondition_failed"&&l.connection!==void 0?(this.credentialState.currentConnection=l.connection,Qe(i,l.connection)&&F(l.connection)==="usable"&&un(l.connection.scopes,c.scopes)?this.adoptPeerConnection(l.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),p){let R=l.kind==="persisted"?"succeeded":l.kind==="precondition_failed"?"lost":"exhausted";U()?.info({event:`upstream_oauth_bounded_rebase_${R}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:i?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:i?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${R}`)}let g=l.kind==="persisted"?l.connection:void 0;U()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:g?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!s,sourceScopeCount:i?.scopes.length,priorStatus:i?.status,priorUpdatedAt:i?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await ze(r.refresh_token),reusedSnapshotRefreshToken:a,scopeCount:c.scopes.length,expiresAt:c.expiresAt,outcome:l.kind,rebaseAttempted:p,resultingUpdatedAt:g?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:g?.scopes.length??this.credentialState.currentConnection?.scopes.length},g?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Fi(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:$u(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new h({message:"OAuth code verifier is missing",extensionMembers:{[y]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",n=t==="all"||t==="client",i=t==="all"||t==="discovery",a=t==="all"||t==="verifier";n&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),i&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(a),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:Zo(),...pt({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:S(new Date(Date.now()+Oi)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await C().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation})}async loadPersistedClientInformation(){if(this.clientInformationLoaded)return this.cachedClientInformation;let t;try{t=await Wu(this.encryptedClientInformation,Nu)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(t&&(!Vu(t,this.redirectUriValue)||!Yu({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return t===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(t=ar.parse({client_id:this.clientMetadataUrl})),this.cachedClientInformation=t,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){U()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await fe(t.encryptedAccessToken):void 0,n=t.encryptedRefreshToken?await fe(t.encryptedRefreshToken):void 0;if(!r&&!n)return;let i=U();this.usedRefreshTokenFingerprintValue=i?await ze(n):void 0,i?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!n,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let a=We.parse({access_token:r??Fu,token_type:Ju,refresh_token:n,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=a,a}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let n=r.status,i=r.updatedAt,a={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(a.status="reconsent_required",a.encryptedAccessToken=void 0,a.encryptedRefreshToken=void 0,a.scopes=[],a.expiresAt=void 0),a.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let s=await this.conditionalUpsertCredential(a,{expectedUpdatedAt:r.updatedAt});s.kind==="persisted"?(this.credentialState.currentConnection=s.connection,this.credentialState.peerAdoption=void 0):s.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):s.connection!==void 0&&(this.credentialState.currentConnection=s.connection,Qe(r,s.connection)&&F(s.connection)==="usable"&&this.connectionSatisfiesRequestedScope(s.connection)?this.adoptPeerConnection(s.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let c=U();if(c){let u=s.kind==="missing"?void 0:s.connection,l={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:n,newStatus:u?.status,priorUpdatedAt:i,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:s.kind};s.kind==="precondition_failed"?c.warn({...l,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?c.warn(l,"Upstream OAuth credentials invalidated; connection now requires reconsent"):c.debug(l,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var sl=3e4,cl=256*1024,dl=2,ul="does not support dynamic client registration",ll=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],pl=["HTTP 403 Forbidden","Access Denied","permission to access"],ml=new Set(["access_denied","invalid_client","invalid_grant","invalid_request","invalid_scope","invalid_target","unauthorized_client","unsupported_grant_type"]);function fl(e){return e instanceof Error&&e.message.includes(ul)}o(fl,"isDynamicClientRegistrationUnsupported");function hl(e){return e instanceof Error&&ll.some(t=>e.message.includes(t))}o(hl,"isProtectedResourceMetadataUnavailable");function gl(e){return e instanceof Error&&pl.some(t=>e.message.includes(t))}o(gl,"isUpstreamProviderAccessDenied");function yl(e){return e instanceof x&&ml.has(e.errorCode)}o(yl,"isStoredConnectionReconsentError");function _l(e){if(e.error instanceof h&&e.error.extensionMembers?.[y]!==void 0)return e.error;if(fl(e.error))return new h({message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`,extensionMembers:{[y]:"upstream_client_registration_required"}},{cause:e.error});if(hl(e.error))return new h({message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`,extensionMembers:{[y]:"upstream_oauth_discovery_unavailable"}},{cause:e.error});if(gl(e.error))return new h({message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`,extensionMembers:{[y]:"upstream_provider_access_denied"}},{cause:e.error})}o(_l,"mapUpstreamOAuthSetupError");function wl(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}o(wl,"readOAuthFetchRequest");function bl(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}o(bl,"responseLooksJson");function Rl(e,t){let r=e.headers.get("content-type")??"",n=t.trimStart().toLowerCase();return r.includes("html")||n.startsWith("<!doctype html")||n.startsWith("<html")}o(Rl,"responseLooksHtml");function Cl(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new h({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[y]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[we]:e.response.status,[Je]:r,[be]:e.request.url.toString(),[Fe]:e.body}})}o(Cl,"throwUpstreamHtmlError");function Sl(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}o(Sl,"readUpstreamOAuthErrorBody");function Il(e){let{error:t,errorDescription:r}=Sl(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.request.method??"GET",host:q(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}o(Il,"logUpstreamOAuthHttpError");function Yi(e){return async(t,r)=>{let n=wl(t),i=U(),a=Date.now(),s=await wi(t,r,{maxRedirects:dl,maxResponseBytes:cl,problemCode:"upstream_token_exchange_failed",timeoutMs:sl}),c=await s.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:n.method??"GET",host:q(n.url),path:n.url.pathname,status:s.status,durationMs:Date.now()-a,responseChars:c.length},"Upstream OAuth HTTP request completed"),s.ok||Il({log:i,upstreamServerId:e,request:n,response:s,body:c}),!s.ok&&Rl(s,c)&&Cl({upstreamServerId:e,request:n,response:s,body:c}),!bl(s,c))return s;try{JSON.parse(c)}catch(u){throw new h({message:`Upstream OAuth fetch ${n.url.origin}${n.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}},{cause:u})}return s}}o(Yi,"createUpstreamOAuthFetch");function Xi(e){U()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:q(e.serverUrl),resourceMetadataHost:q(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}o(Xi,"logUpstreamOAuthFlowStarted");function Qi(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=q(e.serverUrl);r!==void 0&&(t.serverHost=r);let n=e.error instanceof h?e.error.extensionMembers?.[y]:void 0;typeof n=="string"&&(t.code=n),G(t,"error",e.error),U()?.warn(t,"Upstream OAuth flow failed before a connection was established")}o(Qi,"logUpstreamOAuthFlowFailed");function ea(e,t){return e.configuredAuthorizationScope??t.requestedScope}o(ea,"readAuthorizationRequestScope");async function ta(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);return n!==void 0&&(r.scope=n),await Kr(e,r)}catch(r){Qi({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let n=_l({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw n!==void 0?n:r}}o(ta,"runUpstreamOAuth");async function vl(e,t){e.applyChallengeScope(t.requestedScope),Xi({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Yi(t.upstreamServerId)},n=ea(e,t);n!==void 0&&(r.scope=n);try{return await Kr(e,r)}catch(i){throw Qi({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:i}),i}}o(vl,"exchangeUpstreamAuthorizationCode");async function Vi(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await C().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||F(r)!=="usable"||!Qe(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}o(Vi,"adoptPeerCredentialAtResolutionBoundary");async function ra(e,t){let r=await ta(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new h({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(ra,"requireUpstreamAuthorizationRedirect");async function na(e){let t=F(e.connection),r=!!e.forceRefresh,n=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),i=U(),a=i?await Xe({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(i?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:a,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!n,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},n?"Reusing stored upstream access token":"Refreshing upstream credential"),n)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let s;try{s=await ta(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(c){if(e.connection===void 0||!yl(c))throw c;return i?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:c.errorCode,connectionFingerprint:a,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(s==="AUTHORIZED"){let c=e.provider.readUsablePeerAdoption(e.requestedScope);return c!==void 0&&await e.provider.adoptConnectionForDirectResolution(c,"cas_loss"),!e.provider.tokenWriteWasPersisted&&c===void 0?{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(s!=="REDIRECT")throw new h({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new h({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return await Vi({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ln({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}o(na,"authorizeUpstreamOAuthSession");async function Al(e){let t=await pr(e.stateToken),r=await C().consumeUpstreamOAuthState({id:t.id,now:S(new Date)}),n=kl(r);return xl({storedState:n,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),Ul(n),n}o(Al,"consumeStoredCallbackState");function kl(e){switch(e.kind){case"consumed":throw new h({message:"OAuth state has already been used",extensionMembers:{[y]:"oauth_state_reused"}});case"missing":throw new h({message:"OAuth state is missing or expired",extensionMembers:{[y]:"oauth_state_expired"}});case"available":return e.record}}o(kl,"readConsumedCallbackState");function xl(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new h({message:"OAuth callback did not match the initiating request",extensionMembers:{[y]:"oauth_callback_mismatch"}})}o(xl,"assertStoredCallbackStateMatches");function Ul(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new h({message:"OAuth state has expired",extensionMembers:{[y]:"oauth_state_expired"}})}o(Ul,"assertStoredCallbackStateFresh");async function ln(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),Bi(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),mr(t)}o(ln,"buildOAuthConnectRequiredResponse");async function oa(e){let t=await Al({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Kt(t),[n]=await C().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),i={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};n!==void 0&&(i.connection=n);let a=new xe(i),s=await vl(a,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(s==="AUTHORIZED"){let c=a.readUsablePeerAdoption();if(c!==void 0&&await a.adoptConnectionForDirectResolution(c,"cas_loss"),!a.tokenWriteWasPersisted&&c===void 0)throw new h({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[y]:"upstream_token_exchange_failed"}});return t}throw s!=="REDIRECT"?new h({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${s}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}}):new h({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[y]:"upstream_token_exchange_failed"}})}o(oa,"finishUpstreamOAuthCallback");import{importPKCS8 as Tl,SignJWT as Pl}from"jose";var aa=1e4,sa=64*1024,ca=2,El=300,ne=d.string().min(1),Ol=d.object({access_token:ne,issued_token_type:d.literal(Er),token_type:d.string().optional(),expires_in:d.number().int().positive().optional(),scope:ne.optional()}).passthrough(),Ml=d.object({id_token:ne,token_type:ne.optional(),expires_in:d.number().int().positive().optional(),refresh_token:ne.optional(),scope:ne.optional()}).passthrough(),ql=d.object({access_token:ne,token_type:ne,expires_in:d.number().int().positive().optional(),scope:ne.optional(),resource:ne.optional(),refresh_token:ne.optional()}).passthrough();function ia(e){return encodeURIComponent(e).replace(/%20/g,"+")}o(ia,"formEncodeClientCredential");function Dl(e){return e.replaceAll("\\n",`
-`)}o(Dl,"normalizePem");async function zl(e){let t=e.clientAuth.algorithm??"RS256",r=e.clientAuth.expiresInSeconds??El,n=await Tl(Dl(e.clientAuth.privateKeyPem),t),i={alg:t,typ:"JWT",...e.clientAuth.keyId===void 0?{}:{kid:e.clientAuth.keyId}};return new Pl({jti:crypto.randomUUID()}).setProtectedHeader(i).setIssuer(e.clientAuth.clientId).setSubject(e.clientAuth.clientId).setAudience(e.clientAuth.audience??e.tokenUrl).setIssuedAt().setExpirationTime(`${r}s`).sign(n)}o(zl,"createPrivateKeyJwtClientAssertion");async function jl(e){switch(e.clientAuth.method){case"client_secret_post":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_secret",e.clientAuth.clientSecret);return;case"client_secret_basic":{let t=ia(e.clientAuth.clientId),r=ia(e.clientAuth.clientSecret);e.headers.authorization=`Basic ${btoa(`${t}:${r}`)}`;return}case"private_key_jwt":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_assertion_type",Vt),e.form.set("client_assertion",await zl({clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}));return}}o(jl,"appendClientAuthentication");async function pn(e){let t={"Content-Type":"application/x-www-form-urlencoded"};return await jl({form:e.form,headers:t,clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}),{method:"POST",headers:t,body:e.form.toString()}}o(pn,"buildFormRequest");function da(e){return(t,r)=>lr(t,r,{context:e,maxRedirects:ca,maxResponseBytes:sa,problemCode:"upstream_token_exchange_failed",timeoutMs:aa})}o(da,"defaultIdpFetchJson");function Hl(e){return(t,r)=>bi(t,r,{context:e,maxRedirects:ca,maxResponseBytes:sa,problemCode:"upstream_token_exchange_failed",timeoutMs:aa})}o(Hl,"defaultResourceAsFetchJson");function hr(e){let t={[y]:e.code,[be]:e.tokenUrl};return e.response!==void 0&&(t[we]=e.response.status),new h({message:e.message,extensionMembers:t},e.cause===void 0?void 0:{cause:e.cause})}o(hr,"runtimeError");function mn(e){if(!e.response.ok)throw hr({code:"upstream_token_exchange_failed",message:(()=>{switch(e.stage){case"idp_refresh_token":return"IdP refresh-token grant failed while renewing the upstream ID-JAG subject token.";case"idp_token_exchange":return"IdP token exchange failed while requesting an upstream ID-JAG.";case"resource_as_jwt_bearer":return"Upstream Resource AS rejected the ID-JAG JWT-bearer exchange."}})(),tokenUrl:e.tokenUrl,response:e.response})}o(mn,"assertTokenEndpointSucceeded");function Bl(e){let t=Ml.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"IdP refresh-token grant returned an invalid subject-token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={idToken:t.data.id_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),t.data.scope!==void 0&&(r.scope=t.data.scope),r}o(Bl,"parseIdpRefreshTokenResponse");function Ll(e){let t=Ol.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"IdP token exchange returned an invalid ID-JAG response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={assertion:t.data.access_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),r}o(Ll,"parseIdJagTokenExchangeResponse");function Nl(e){let t=ql.safeParse(e.json);if(!t.success)throw hr({code:"upstream_token_response_invalid",message:"Upstream Resource AS returned an invalid JWT-bearer token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={accessToken:t.data.access_token,tokenType:t.data.token_type};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),t.data.resource!==void 0&&(r.resource=t.data.resource),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),r}o(Nl,"parseAccessTokenResponse");async function ua(e){let t=new URLSearchParams({grant_type:Wt,requested_token_type:Er,subject_token:e.subjectToken,subject_token_type:e.subjectTokenType,audience:e.audience});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope),e.authorizationDetails!==void 0&&t.set("authorization_details",JSON.stringify(e.authorizationDetails));let r=e.fetchJson??da(e.context),{response:n,json:i}=await r(e.idp.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return mn({response:n,tokenUrl:e.idp.tokenUrl,stage:"idp_token_exchange"}),Ll({json:i,response:n,tokenUrl:e.idp.tokenUrl})}o(ua,"requestIdJag");async function la(e){let t=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken}),r=e.fetchJson??da(e.context),{response:n,json:i}=await r(e.idp.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return mn({response:n,tokenUrl:e.idp.tokenUrl,stage:"idp_refresh_token"}),Bl({json:i,response:n,tokenUrl:e.idp.tokenUrl})}o(la,"refreshIdpSubjectToken");async function pa(e){let t=new URLSearchParams({grant_type:Ce,assertion:e.assertion});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope);let r=e.fetchJson??Hl(e.context),{response:n,json:i}=await r(e.resourceAs.tokenUrl,await pn({form:t,clientAuth:e.clientAuth,tokenUrl:e.resourceAs.tokenUrl}));return mn({response:n,tokenUrl:e.resourceAs.tokenUrl,stage:"resource_as_jwt_bearer"}),Nl({json:i,response:n,tokenUrl:e.resourceAs.tokenUrl})}o(pa,"exchangeIdJagForAccessToken");function Gl(e){return F(e)==="usable"}o(Gl,"hasUsableAccessToken");function Jl(e){if(e.tokenType.toLowerCase()!=="bearer")throw new h({message:"Upstream Resource AS returned a token type the MCP gateway cannot send as a bearer token.",extensionMembers:{[y]:"upstream_token_response_invalid"}})}o(Jl,"assertBearerToken");function ma(e,t){if(t===Ke)return!1;let r=e?.metadata?.idpSubjectTokenExpiresAt;return r!==void 0&&new Date(r).getTime()<=Date.now()}o(ma,"hasExpiredSubjectToken");async function Fl(e){let t=await fe(e.encryptedSubjectToken);if(e.subjectTokenType!==Ke)return{connection:e.connection,subjectToken:t,subjectTokenType:e.subjectTokenType};let r=await la({idp:e.idp,refreshToken:t,clientAuth:e.clientAuth,context:e.context});if(r.refreshToken===void 0)return{connection:e.connection,subjectToken:r.idToken,subjectTokenType:mt};let n=await C().upsertUpstreamConnection({id:e.connection.id,ownerMode:e.connection.ownerMode,subjectId:e.connection.subjectId,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,status:"active",encryptedAccessToken:e.connection.encryptedAccessToken,encryptedRefreshToken:e.connection.encryptedRefreshToken,scopes:e.connection.scopes,expiresAt:e.connection.expiresAt,metadata:{...e.connection.metadata??{},encryptedIdpSubjectToken:await me(r.refreshToken),idpSubjectTokenType:Ke,idpSubjectTokenExpiresAt:void 0}});return U()?.info({event:"upstream_id_jag_subject_token_rotated",upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,connectionFingerprint:e.connectionFingerprint,connectionId:n.id,priorStatus:e.connection.status,priorUpdatedAt:e.connection.updatedAt,usedSubjectRefreshTokenFingerprint:await ze(t),newSubjectRefreshTokenFingerprint:await ze(r.refreshToken)},"Upstream ID-JAG IdP subject refresh token rotated and persisted"),{connection:n,subjectToken:r.idToken,subjectTokenType:mt}}o(Fl,"resolveIdJagSubjectToken");async function fa(e){let t="preloadedConnection"in e?e.preloadedConnection:(await C().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0],r=F(t),n=!!e.forceRefresh,i=!n&&r==="usable",a=U(),s=a?await Xe({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}):void 0;if(a?.debug({event:"upstream_id_jag_auth_decision",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode,connectionFingerprint:s,connectionId:t?.id,accessTokenState:r,forceRefresh:n,willMint:!i,expiresAt:t?.expiresAt,connectionUpdatedAt:t?.updatedAt},i?"Reusing stored upstream ID-JAG access token":"Minting upstream ID-JAG access token"),!e.forceRefresh&&Gl(t))return{kind:"authorized",credential:{type:"bearer_token",token:await fe(t.encryptedAccessToken)}};let c=t?.metadata?.encryptedIdpSubjectToken,u=t?.metadata?.idpSubjectTokenType;if(t?.status!=="active"||c===void 0||u===void 0||ma(t,u))return a?.debug({event:"upstream_id_jag_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:s,connectionId:t?.id,status:t?.status??"not_connected",hasSubjectToken:c!==void 0,subjectTokenType:u,subjectTokenExpired:u!==void 0&&ma(t,u)},"Upstream ID-JAG requires an admin subject-token binding"),{kind:"connect_required",payload:{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,message:`An IdP subject-token binding is required for ${e.upstreamDisplayName} before this tool can use XAA / ID-JAG.`,nextAction:"admin_setup_required"}};let l=ve(e.upstreamServerId),p=gi(e.upstreamServerId,e.authProfileId),g=p.resourceAs.resource??l.transport.baseUrl,R=e.requestedScope??(p.scopes.length===0?void 0:p.scopes.join(p.scopeDelimiter)),_=await Fl({connection:t,connectionFingerprint:s,encryptedSubjectToken:c,subjectTokenType:u,idp:{tokenUrl:p.idp.tokenUrl},clientAuth:p.idp.clientAuth,context:e.context}),O=await ua({idp:{tokenUrl:p.idp.tokenUrl},subjectToken:_.subjectToken,subjectTokenType:_.subjectTokenType,audience:p.resourceAs.audience,resource:g,scope:R,clientAuth:p.idp.clientAuth,context:e.context}),T=O.scope??R,B=await pa({resourceAs:{tokenUrl:p.resourceAs.tokenUrl},assertion:O.assertion,resource:g,scope:T,clientAuth:p.resourceAs.clientAuth,context:e.context});if(Jl(B),t!==void 0){let X=(B.scope??T)?.split(/[,\s]+/).filter(Boolean)??[],M=B.expiresIn===void 0?void 0:S(new Date(Date.now()+B.expiresIn*1e3)),j=await C().upsertUpstreamConnection({id:_.connection.id,ownerMode:_.connection.ownerMode,subjectId:_.connection.subjectId,upstreamServerId:_.connection.upstreamServerId,authProfileId:_.connection.authProfileId,status:"active",encryptedAccessToken:await me(B.accessToken),encryptedRefreshToken:_.connection.encryptedRefreshToken,scopes:X,expiresAt:M,metadata:_.connection.metadata});a?.info({event:"upstream_id_jag_access_token_persisted",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:s,connectionId:j.id,priorStatus:_.connection.status,priorUpdatedAt:_.connection.updatedAt,scopeCount:X.length,expiresAt:M},"Upstream ID-JAG access token persisted; connection is active")}return{kind:"authorized",credential:{type:"bearer_token",token:B.accessToken}}}o(fa,"authorizeUpstreamIdJagRequest");var gr=new Map;function $l(e){return[...new Set(e?.split(/[,\s]+/).filter(Boolean)??[])].sort().join(" ")}o($l,"normalizeRefreshFlightScope");function Zl(e){return fr(new URL(e.callbackPath,D(e.requestUrl,e.requestHeaders))).toString()}o(Zl,"buildGatewayOAuthRedirectUri");async function fn(e){let t=ve(e.upstreamServerId),r=Ve(e.upstreamServerId,e.authProfileId),n=Zl({callbackPath:r.redirectPath,requestUrl:e.request.url,requestHeaders:e.request.headers}),i="preloadedConnection"in e?e.preloadedConnection:(await C().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0];return{upstreamServerConfig:t,connection:i,providerInput:{target:{owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,returnTo:e.returnTo},redirectUri:n,returnOrigin:D(e.request.url,e.request.headers)}}}o(fn,"prepareUpstreamOAuthRequest");async function ha(e){let t=await fn(e),r=new xe({...t.providerInput,...t.connection?.metadata===void 0?{}:{connectionMetadata:t.connection.metadata}});return ra(r,{upstreamServerId:e.upstreamServerId,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl})}o(ha,"startUpstreamConnect");async function ga(e){let t=await fn(e),r=new xe({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),n=o(()=>na({target:e,provider:r,connection:t.connection,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,upstreamDisplayName:t.upstreamServerConfig.displayName,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl}),"runSession");if(!e.forceRefresh&&t.connection!==void 0&&F(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return n();let i=Fo({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}),a=JSON.stringify([i,$l(r.configuredAuthorizationScope??e.requestedScope)]),s=gr.get(a);if(s!==void 0){U()?.debug({event:"upstream_oauth_refresh_single_flight_coalesced",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode},"Upstream OAuth refresh joined an isolate-local single-flight");let l=await s;if(l.kind==="usable"&&r.connectionSatisfiesRequestedScope(l.connection,e.requestedScope))return await r.adoptConnectionForDirectResolution(l.connection,"single_flight"),{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:r}};let{preloadedConnection:p,...g}=e;if(t=await fn(g),r=new xe({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),!e.forceRefresh&&t.connection!==void 0&&F(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return n()}let c=n(),u;return u=c.then(()=>{let l=r.currentConnection;return l!==void 0&&F(l)==="usable"?{kind:"usable",connection:l}:{kind:"unresolved"}}).catch(()=>({kind:"unresolved"})).finally(()=>{gr.get(a)===u&&gr.delete(a)}),gr.set(a,u),c}o(ga,"authorizeUpstreamRequest");async function tt(e){let{routeAuth:t}=e;switch(t.authMode){case"shared-oauth":case"user-oauth":return ga({request:e.request,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo});case"id-jag":return fa({request:e.request,context:e.context,authMode:t.authMode,ownerMode:t.ownerMode,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,upstreamDisplayName:t.upstreamDisplayName,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo})}let r=t;throw new Q(`Unsupported upstream auth route context ${JSON.stringify(r)}.`)}o(tt,"resolveUpstreamCredentialForRoute");async function ya(e){if(e.connectRequest.authMode==="id-jag")throw new Q(`Upstream server ${e.connectRequest.upstreamServerId} uses XAA / ID-JAG and does not support browser OAuth connection flows.`);let t=await ha({request:e.request,owner:e.connectRequest.owner,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,upstreamServerId:e.connectRequest.upstreamServerId,authProfileId:e.connectRequest.authProfileId,operationId:e.connectRequest.operationId,returnTo:e.connectRequest.returnTo});return{authProfileId:e.connectRequest.authProfileId,authUrl:t,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,owner:e.connectRequest.owner,upstreamDisplayName:e.connectRequest.upstreamDisplayName,operationId:e.connectRequest.operationId}}o(ya,"startUpstreamConnectForRequest");async function _a(e){let r=(await pr(e.callbackRequest.state)).authProfileId;if(dr({upstreamServerId:e.callbackRequest.upstreamServerId,authProfileId:r}).mode==="id-jag")throw new Q(`Upstream server ${e.callbackRequest.upstreamServerId} uses XAA / ID-JAG and does not support OAuth callbacks.`);return oa({request:e.request,upstreamServerId:e.callbackRequest.upstreamServerId,authorizationCode:e.callbackRequest.code,stateToken:e.callbackRequest.state,upstreamServerConfig:ve(e.callbackRequest.upstreamServerId)})}o(_a,"finishUpstreamCallbackForRequest");function Kl(e){return{upstreamServerId:e.connection.upstreamServerId,operationId:e.operationId,authProfileId:e.connection.authProfileId,upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}o(Kl,"buildRouteAuthBaseFromConnection");function wa(e){return{upstreamServerId:e.connection.id,operationId:e.operationId,authProfileId:Ro(e.connection.id,e.connection.authMode),upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}o(wa,"buildRouteAuthBaseFromPolicyOptions");function yr(e,t){let n=ee().byOperationId.get(t);if(!n)throw new k(`Unknown MCP route "${t}". Ensure routes.oas.json declares this operationId before starting an upstream connection flow.`);if(n.connection===void 0)throw new k(`MCP route "${t}" does not declare an MCP token exchange policy. Add one before starting an upstream connection flow.`);if(n.connection.upstreamServerId!==e)throw new k(`MCP route "${t}" does not bind upstream "${e}". Check the route's MCP upstream policies and bind the upstream before starting an upstream connection flow.`);return Kl({connection:n.connection,operationId:t})}o(yr,"resolveRouteAuthBase");function hn(e,t){switch(e){case"user":return $e(t);case"shared":return wo()}}o(hn,"buildOwnerForSubject");function rt(e,t){switch(e.authMode){case"shared-oauth":return{...e,authMode:"shared-oauth",ownerMode:"shared",owner:hn("shared",t),initiatedBySubjectId:t};case"user-oauth":return{...e,authMode:"user-oauth",ownerMode:"user",owner:hn("user",t),initiatedBySubjectId:t};case"id-jag":return{...e,authMode:"id-jag",ownerMode:"user",owner:hn("user",t),initiatedBySubjectId:t}}}o(rt,"resolveRouteAuthForSubject");var Wl=ut.InvalidRequest,Vl=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function Yl(e,t){return{credentialType:e.type,forceRefresh:t}}o(Yl,"buildCredentialResolvedAttributes");function Xl(e){switch(e){case"admin_connect_required":return"admin_connect_required";case"authenticating":return"connect_required"}}o(Xl,"connectRequiredReasonCode");function ba(e){A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED,outcome:"success",routeBinding:e.routeBinding,attributes:Yl(e.credential,e.forceRefresh===!0)})}o(ba,"emitCredentialResolvedAnalyticsEvent");function Ra(e){let t={forceRefresh:e.forceRefresh===!0,nextAction:e.payload.nextAction,state:e.payload.state};if(A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"connect_required",reasonClass:"auth",attributes:t}),e.payload.state==="reconsent_required"){A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"reconsent_required",reasonClass:"auth",attributes:t});return}A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_CONNECT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:Xl(e.payload.state),reasonClass:"auth",attributes:t})}o(Ra,"emitCredentialMissingAnalyticsEvents");function Ql(e){let t=e.route.raw();return Ft.parse(t?.operationId)}o(Ql,"readOperationId");async function ep(e,t,r,n){let i=await tt({request:e,context:n,routeAuth:t});if(i.kind==="connect_required")return Ra({context:n,payload:i.payload,routeBinding:t}),n.log.info({event:"mcp_upstream_connect_required",upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId},"MCP upstream proxy: upstream connection required"),{kind:"connect_required",payload:i.payload};let a=i.credential;if(ba({context:n,credential:a,routeBinding:t}),a.type==="bearer_token")return{kind:"headers",headers:[["authorization",`Bearer ${a.token}`]]};let s=await a.provider.tokens();return s?{kind:"headers",headers:[["authorization",`${s.token_type??"Bearer"} ${s.access_token}`]]}:(n.log.warn({event:"mcp_upstream_no_tokens",upstreamServerId:t.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens"),Response.json({error:"no_upstream_tokens"},{status:401}))}o(ep,"buildCredentialHeaders");var tp=new Set(["authorization","cookie","cookie2"]);function rp(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return t&&typeof t=="object"&&!Array.isArray(t)&&"method"in t&&typeof t.method=="string"?t.method:void 0}catch{return}}o(rp,"readJsonRequestMethod");function np(e){let t=e.headers.get("content-type")??"";return/\bapplication\/(?:[\w.+-]+\+)?json\b/i.test(t)}o(np,"isJsonResponse");function gn(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}o(gn,"isRecord");function op(e){return Array.isArray(e)&&e.length>0}o(op,"hasIconList");function ip(e){if(e.connection.serverInfo?.icons!==void 0&&e.connection.serverInfo.icons.length>0)return e.connection.serverInfo.icons;try{let t=cr(po(e.context.route.handler));return t===void 0?void 0:[t]}catch{return}}o(ip,"readFallbackServerIcons");function ap(e){if(!gn(e.body))return e.body;let t=e.body.result;if(!gn(t))return e.body;let r=t.serverInfo;return!gn(r)||op(r.icons)?e.body:{...e.body,result:{...t,serverInfo:{...r,icons:e.icons}}}}o(ap,"addMissingServerIcons");function sp(e,t){let r=Ca(e);for(let n of tp)r.delete(n);for(let[n,i]of t)r.set(n,i);return new Wn(e,{headers:r})}o(sp,"applyUpstreamHeaders");var cp=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function dp(e){let t=e.get("connection");return t===null?[]:t.split(",").map(r=>r.trim()).filter(r=>cp.test(r))}o(dp,"connectionNominatedHeaderNames");function Ca(e){let t=new Headers(e.headers);for(let r of dp(t))t.delete(r);for(let r of Vl)t.delete(r);return t}o(Ca,"buildProxyHeaders");async function up(e){if(!(e.method==="GET"||e.method==="HEAD"))return e.clone().arrayBuffer()}o(up,"readRetryBody");function Sa(e,t){let r=t.authUrl===void 0?void 0:Yo({message:t.message,elicitationId:["connect",t.operationId,t.upstreamServerId,t.authProfileId].join(":"),url:t.authUrl});return Response.json(tr({id:Vo(e),error:{code:r?.code??Wl,message:t.message,data:{...r?.data??{},connectRequired:t}}}))}o(Sa,"connectRequiredJsonRpcResponse");async function lp(e){let{scope:t}=li(e.upstreamResponse),r=await tt({request:e.request,context:e.context,routeAuth:e.routeAuth,forceRefresh:!0,requestedScope:t});if(r.kind==="connect_required")return Ra({context:e.context,payload:r.payload,routeBinding:e.routeAuth,forceRefresh:!0}),{kind:"connect_required",payload:r.payload};let n=new Headers(e.headers),i=r.credential;if(ba({context:e.context,credential:i,routeBinding:e.routeAuth,forceRefresh:!0}),i.type==="bearer_token")return n.set("authorization",`Bearer ${i.token}`),{kind:"headers",headers:n};let a=await i.provider.tokens();return a?(n.set("authorization",`${a.token_type??"Bearer"} ${a.access_token}`),{kind:"headers",headers:n}):(e.context.log.warn({event:"mcp_upstream_no_tokens_after_refresh",upstreamServerId:e.routeAuth.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens after refresh"),{kind:"response",response:Response.json({error:"no_upstream_tokens"},{status:401})})}o(lp,"applyRefreshedCredentialHeaders");function pp(e){e.context.addResponseSendingHook(async(t,r)=>{if(t.status!==401)return t;let n=await lp({request:e.request,context:e.context,headers:Ca(r),routeAuth:e.routeAuth,upstreamResponse:t});if(n.kind==="connect_required")return Sa(e.requestBody,n.payload);if(n.kind==="response")return n.response;let i=mo({handler:e.context.route.handler,request:r,body:e.requestBody,headers:n.headers});return Bt.fetch(i.url,i.init)})}o(pp,"installUpstreamAuthRetryHook");function mp(e){if(rp(e.requestBody)!=="initialize")return;let t=ip({connection:e.connection,context:e.context});t===void 0||t.length===0||e.context.addResponseSendingHook(async r=>{if(!np(r))return r;let n;try{n=await r.clone().json()}catch{return r}let i=ap({body:n,icons:t});if(i===n)return r;let a=new Headers(r.headers);return a.delete("content-length"),new Response(JSON.stringify(i),{status:r.status,statusText:r.statusText,headers:a})})}o(mp,"installInitializeIconHook");async function yn(e,t,r){let n=Ql(t),i=await up(e),a=wa({connection:r,operationId:n}),s=Ee(e.user,e.url,e.headers);t.log.setLogProperties?.({requestId:t.requestId}),ko(t,s);let c=rt(a,s.subjectId),u=await ep(e,c,r,t);if(!(u instanceof Response)&&u.kind==="connect_required")return Sa(i,u.payload);if(u instanceof Response)return u;let l=sp(e,u.headers);return pp({request:l,context:t,requestBody:i,routeAuth:c}),mp({context:t,requestBody:i,connection:r}),l}o(yn,"mcpTokenExchangePolicy");var _n=class extends Lt{static{o(this,"McpTokenExchangeInboundPolicy")}static policyType="mcp-token-exchange";#e;constructor(t,r){let n=Co(t,r);super(n,r),this.#e=n}async handler(t,r){return yn(t,r,this.#e)}};var Ia=Symbol("Html");function fp(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}o(fp,"escapeHtml");function hp(e){return e===null||typeof e!="object"?!1:e[Ia]===!0}o(hp,"isHtml");function va(e){return e==null||e===!1?"":Array.isArray(e)?e.map(va).join(""):hp(e)?e.value:fp(String(e))}o(va,"renderValue");function he(e){return{[Ia]:!0,value:e}}o(he,"trustedHtml");var te=he("");function v(e,...t){let r=e[0]??"";for(let n=0;n<t.length;n+=1)r+=va(t[n]),r+=e[n+1]??"";return he(r)}o(v,"html");function nt(e){return e.value}o(nt,"renderHtml");function Aa(e){return v`<p class="card__description">${e.detail}</p>${e.guidance} ${e.technicalDetails} ${e.action}`}o(Aa,"renderBrowserErrorPage");var ot=he('*,:before,:after{box-sizing:border-box}:root{--bg:#f5f6f8;--surface:#fff;--surface-2:#f8fafc;--border:#e5e7eb;--border-strong:#d1d5db;--text:#0f172a;--text-2:#475569;--text-3:#64748b;--text-muted:#94a3b8;--accent:#0f172a;--accent-hover:#1e293b;--accent-text:#fff;--focus-ring:#0f172a29;--danger:#b91c1c;--danger-bg:#b91c1c0f;--danger-border:#b91c1c38;--warning:#92400e;--warning-bg:#fffbeb;--warning-border:#fde68a;--success:#15803d;--success-bg:#f0fdf4;--success-border:#bbf7d0;--radius-sm:4px;--radius:8px;--radius-lg:12px;--radius-pill:9999px;--shadow-sm:0 1px 2px #0f172a0d;--shadow:0 1px 2px #0f172a0a,0 6px 16px #0f172a0f;--font-sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;--font-mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Monaco,Consolas,monospace}@media (prefers-color-scheme:dark){:root{--bg:#0a0c10;--surface:#15171c;--surface-2:#1e2128;--border:#262932;--border-strong:#3a3e48;--text:#fafafa;--text-2:#cbd5e1;--text-3:#94a3b8;--text-muted:#71717a;--accent:#fafafa;--accent-hover:#e4e4e7;--accent-text:#0a0c10;--focus-ring:#fafafa2e;--danger:#f87171;--danger-bg:#f8717114;--danger-border:#f871714d;--warning:#fbbf24;--warning-bg:#fbbf2414;--warning-border:#fbbf2447;--success:#34d399;--success-bg:#34d39914;--success-border:#34d3994d;--shadow-sm:0 1px 2px #0006;--shadow:0 1px 2px #0006,0 8px 24px #0006}}html,body{margin:0;padding:0}body{font-family:var(--font-sans);background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;flex-direction:column;justify-content:center;align-items:center;min-height:100dvh;padding:48px 20px;font-size:14px;line-height:1.5;display:flex}.card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius-lg);width:100%;max-width:480px;box-shadow:var(--shadow);overflow:hidden}.card__head{text-align:center;padding:32px 32px 24px}.card__icon{border-radius:var(--radius);background:var(--surface-2);object-fit:contain;border:1px solid var(--border);width:48px;height:48px;margin:0 auto 16px;display:block}.card__title{letter-spacing:-.01em;color:var(--text);margin:0;font-size:20px;font-weight:600;line-height:1.3}.card__subtitle{color:var(--text-2);margin:8px 0 0;font-size:14px;line-height:1.55}.card__subtitle strong{color:var(--text);font-weight:600}.card__description{color:var(--text-3);margin:12px 0 0;font-size:13px;line-height:1.55}.card__principal{color:var(--text-3);background:var(--surface-2);border-radius:var(--radius-pill);text-overflow:ellipsis;white-space:nowrap;align-items:center;gap:6px;max-width:100%;margin:16px 0 0;padding:4px 12px;font-size:12.5px;display:inline-flex;overflow:hidden}.card__body{flex-direction:column;gap:20px;padding:8px 32px 24px;display:flex}.card__head+.card__body{border-top:1px solid var(--border);padding-top:24px}.card__footer{border-top:1px solid var(--border);background:var(--surface-2);flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:8px;padding:16px 24px;display:flex}.card__fineprint{color:var(--text-3);text-align:center;margin:0;font-size:12.5px;line-height:1.5}.card__fineprint strong{color:var(--text-2);font-weight:600}.section-label{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);align-items:baseline;gap:6px;margin:0;font-size:11px;font-weight:600;display:flex}.section-label__count{color:var(--text-3);letter-spacing:0;font-weight:500}.banner{border-radius:var(--radius);border:1px solid;align-items:flex-start;gap:10px;padding:12px 14px;font-size:13px;display:flex}.banner__icon{flex-shrink:0;justify-content:center;align-items:center;width:16px;height:16px;margin-top:1px;display:inline-flex}.banner__body{flex-direction:column;flex:1;gap:2px;min-width:0;display:flex}.banner__title{color:var(--text);margin:0;font-size:13px;font-weight:600}.banner__message{color:var(--text-2);margin:0;font-size:13px;line-height:1.5}.banner--warning{background:var(--warning-bg);border-color:var(--warning-border)}.banner--warning .banner__icon{color:var(--warning)}.banner--alert{background:var(--danger-bg);border-color:var(--danger-border)}.banner--alert .banner__icon,.banner--alert .banner__title{color:var(--danger)}.upstream-list{flex-direction:column;gap:8px;margin:0;padding:0;list-style:none;display:flex}.upstream-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);flex-direction:column;gap:10px;padding:14px;display:flex}.upstream-card--needs-action{border-color:var(--warning-border);background:var(--warning-bg)}.upstream-card__head{align-items:flex-start;gap:10px;display:flex}.icon-frame{border-radius:var(--radius-sm);border:1px solid var(--border);background:var(--surface-2);width:32px;height:32px;color:var(--text-3);flex-shrink:0;justify-content:center;align-items:center;display:inline-flex;overflow:hidden}.icon-frame img{object-fit:contain;max-width:100%;max-height:100%}.icon-frame--fallback svg{width:18px;height:18px}.inline-icon{object-fit:contain;vertical-align:-2px;border-radius:2px;width:14px;height:14px;margin-right:4px}.upstream-card__main{flex-direction:column;flex:1;gap:3px;min-width:0;display:flex}.upstream-card__title-row{justify-content:space-between;align-items:center;gap:10px;min-width:0;display:flex}.upstream-card__title{color:var(--text);letter-spacing:-.005em;text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;margin:0;font-size:14px;font-weight:600;line-height:1.3;overflow:hidden}.upstream-card__meta{color:var(--text-3);flex-wrap:wrap;align-items:center;gap:6px;font-size:12px;display:flex}.upstream-card__host{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);padding:1px 6px;font-size:11.5px}.upstream-card__sep{color:var(--border-strong)}.upstream-card__description{color:var(--text-2);margin:4px 0 0;font-size:12.5px;line-height:1.5}.status-badge{border-radius:var(--radius-pill);white-space:nowrap;border:1px solid #0000;flex-shrink:0;align-items:center;gap:6px;padding:2px 8px;font-size:11.5px;font-weight:600;display:inline-flex}.status-badge:before{content:"";background:currentColor;border-radius:50%;flex-shrink:0;width:5px;height:5px}.status-badge--success{background:var(--success-bg);color:var(--success);border-color:var(--success-border)}.status-badge--warning{background:var(--warning-bg);color:var(--warning);border-color:var(--warning-border)}.status-badge--neutral{background:var(--surface-2);color:var(--text-2);border-color:var(--border)}.upstream-card__capabilities,.upstream-card__scopes{border-top:1px solid var(--border);margin-top:2px;padding-top:10px}.upstream-card__capabilities--empty{color:var(--text-3);font-size:12px;font-style:italic}.capabilities-summary,.scopes-summary{cursor:pointer;user-select:none;color:var(--text-2);justify-content:space-between;align-items:center;gap:12px;padding:2px 0;font-size:12.5px;list-style:none;display:flex}.capabilities-summary::-webkit-details-marker,.scopes-summary::-webkit-details-marker{display:none}.capabilities-summary:hover,.scopes-summary:hover{color:var(--text)}.capabilities-summary:focus-visible,.scopes-summary:focus-visible{outline:2px solid var(--accent);outline-offset:2px;border-radius:var(--radius-sm)}.capabilities-summary__counts{flex-wrap:wrap;align-items:center;gap:12px;display:flex}.count-pill{color:var(--text-2);align-items:baseline;gap:4px;font-size:12.5px;display:inline-flex}.count-pill__num{font-variant-numeric:tabular-nums;color:var(--text);font-size:13px;font-weight:600}.count-pill--destructive .count-pill__num,.count-pill--destructive .count-pill__label{color:var(--danger)}.capabilities-summary__chevron{color:var(--text-3);flex-shrink:0;transition:transform .15s;display:inline-flex}details[open]>.capabilities-summary .capabilities-summary__chevron,details[open]>.scopes-summary .capabilities-summary__chevron{transform:rotate(180deg)}.capabilities-detail{margin-top:10px}.capability-section{margin-top:14px}.capability-section:first-child{margin-top:6px}.capability-section__title{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);margin:0 0 6px;font-size:11px;font-weight:600}.capability-list{flex-direction:column;gap:5px;margin:0;padding:0;font-size:12.5px;list-style:none;display:flex}.capability-row{flex-wrap:wrap;align-items:baseline;gap:6px;padding:2px 0;display:flex}.capability-row__name{font-weight:500;font-family:var(--font-mono);color:var(--text);font-size:12.5px}.capability-row__description{color:var(--text-3);flex-basis:100%;font-size:12px;line-height:1.45}.capability-row__description code{font-family:var(--font-mono);background:var(--surface-2);border-radius:var(--radius-sm);color:var(--text-2);padding:1px 4px}.capability-row--more{color:var(--text-3);font-size:12px;font-style:italic}.scopes-list{flex-wrap:wrap;gap:4px;margin-top:8px;display:flex}.scope-chip{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);border:1px solid var(--border);padding:2px 7px;font-size:11.5px}.badge{border-radius:var(--radius-sm);letter-spacing:.04em;text-transform:uppercase;align-items:center;padding:1px 5px;font-size:10px;font-weight:600;display:inline-flex}.badge--destructive{background:var(--danger-bg);color:var(--danger)}.badge--muted{background:var(--surface-2);color:var(--text-3)}.badge-row{flex-wrap:wrap;gap:4px;display:inline-flex}.muted{color:var(--text-3)}.button{font:inherit;border-radius:var(--radius);cursor:pointer;white-space:nowrap;border:1px solid #0000;justify-content:center;align-items:center;gap:6px;min-height:40px;padding:8px 16px;font-size:14px;font-weight:500;text-decoration:none;transition:background .12s,border-color .12s,color .12s,box-shadow .12s,transform 40ms;display:inline-flex}.button:active{transform:translateY(1px)}.button:focus-visible{box-shadow:0 0 0 3px var(--focus-ring);outline:0}.button--small{padding:5px 10px;font-size:12.5px}.button--primary{background:var(--accent);color:var(--accent-text);border-color:var(--accent)}.button--primary:hover:not(:disabled):not([aria-disabled=true]){background:var(--accent-hover);border-color:var(--accent-hover)}.button:disabled,.button[aria-disabled=true]{cursor:not-allowed;opacity:.55}.button:disabled:hover,.button[aria-disabled=true]:hover{background:var(--accent);border-color:var(--accent)}.button--secondary{background:var(--surface);color:var(--text);border-color:var(--border-strong)}.button--secondary:hover{background:var(--surface-2);border-color:var(--border-strong)}.button--block{width:100%}.reconnect-action{align-items:center;margin-right:auto;display:inline-flex;position:relative}.reconnect-button{gap:7px}.tooltip{width:16px;height:16px;color:var(--accent);background:color-mix(in srgb,var(--accent)8%,transparent);cursor:help;border:1.5px solid;border-radius:50%;justify-content:center;align-items:center;font-size:10.5px;font-weight:700;line-height:1;display:inline-flex;position:relative}.tooltip:after{content:attr(aria-label);z-index:10;border-radius:var(--radius-sm);background:var(--accent);width:280px;max-width:min(280px,100vw - 48px);color:var(--accent-text);box-shadow:var(--shadow);text-align:left;white-space:normal;opacity:0;pointer-events:none;padding:12px 14px;font-size:13px;font-weight:600;line-height:1.45;transition:opacity .12s;position:absolute;bottom:calc(100% + 12px);left:50%;transform:translate(-50%)}.tooltip:before{content:"";z-index:11;border-left:7px solid #0000;border-right:7px solid #0000;border-top:8px solid var(--accent);opacity:0;pointer-events:none;transition:opacity .12s;position:absolute;bottom:calc(100% + 5px);left:50%;transform:translate(-50%)}.tooltip:hover:after,.tooltip:hover:before,.tooltip:focus-visible:after,.tooltip:focus-visible:before{opacity:1}.form{flex-direction:column;gap:6px;display:flex}.form__label{color:var(--text);margin:8px 0 0;font-size:13px;font-weight:600;display:block}.form__label:first-child{margin-top:0}.form__input{box-sizing:border-box;border:1px solid var(--border-strong);border-radius:var(--radius);width:100%;font:inherit;background:var(--surface);color:var(--text);padding:9px 12px;font-size:14px;transition:border-color .12s,box-shadow .12s}.form__input:focus{border-color:var(--accent);box-shadow:0 0 0 3px var(--focus-ring);outline:0}.form__note{color:var(--text-3);margin:4px 0 0;font-size:12.5px;line-height:1.5}.form__submit{margin-top:8px}.empty{text-align:center;color:var(--text-3);border:1px dashed var(--border);border-radius:var(--radius);background:var(--surface);padding:24px 16px;font-size:13px}.actions{gap:8px;margin:0;display:flex}@media (width<=480px){body{padding:0}.card{box-shadow:none;border-left:0;border-right:0;border-radius:0;min-height:100dvh}.card__head{padding:24px 20px 16px}.card__body{padding:16px 20px}.card__footer{flex-direction:column-reverse;align-items:stretch;padding:14px 20px}.card__footer .button{width:100%}.reconnect-action{justify-content:center;width:100%;margin-right:0}.reconnect-action .button{flex:1}.tooltip:after{left:auto;right:0;transform:none}}@media (prefers-reduced-motion:reduce){*{transition:none!important}}');function it(e){return v`<!doctype html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name="referrer" content="no-referrer" /><meta name="robots" content="noindex" /><title>${e.title}</title><link rel="icon" href="${e.iconHref}" /><style>
+import{$ as xa,$a as Ic,$b as Cd,$c as ur,$e as ct,$f as _r,Aa as Qa,Ab as Xc,Ac as Dd,Af as Pu,Ag as Xu,Ba as ec,Bb as Qc,Bc as Ld,Bf as Mi,Bg as Qu,Ca as tc,Cb as ed,Cc as Hd,Cf as Eu,Cg as el,Da as rc,Db as td,Dc as Bd,Df as zn,Dg as tl,Ea as nc,Eb as rd,Ec as Fd,Ef as Oo,Eg as rl,Fa as oc,Fb as nd,Fc as Jd,Ff as xu,Fg as No,Ga as ic,Gb as od,Gc as Gd,Gf as Uu,Gg as nl,Ha as Ti,Hb as id,Hc as Vd,Hf as Ou,Hg as ol,Ia as sc,Ib as sd,Ic as Kd,If as qu,Ig as j,Ja as ac,Jb as ad,Jc as Wd,Jf as Ae,Jg as G,Ka as cc,Kb as cd,Kc as Zd,Kf as de,Kg as me,La as dc,Lb as dd,Lc as Yd,Lf as zu,Lg as Ke,Ma as uc,Mb as ud,Mc as Xd,Mf as Mu,Mg as Y,Na as lc,Nb as ld,Nc as Qd,Nf as $,Ng as $o,Oa as pc,Ob as pd,Oc as eu,Oe as Su,Of as Ge,Og as Qf,P as Co,Pa as mc,Pb as md,Pc as tu,Pe as Re,Pf as Sr,Pg as eg,Q as bi,Qa as hc,Qb as ki,Qc as ru,Qe as _u,Qf as pe,R as sr,Ra as fc,Rb as hd,Rc as nu,Re as wu,Rf as ee,S as En,Sa as gc,Sb as fd,Sc as ou,Se as re,Sf as ju,T as ar,Ta as yc,Tb as gd,Tc as iu,Te as Ru,Tf as W,U as cr,Ua as Sc,Ub as yd,Uc as su,Ue as mr,Uf as Nu,V as xn,Va as _c,Vb as Sd,Vc as au,Ve as bu,Vf as ut,W as dr,Wa as wc,Wb as _d,Wc as cu,We as hr,Wf as ji,X as ka,Xa as Rc,Xb as wd,Xc as du,Xe as I,Xf as qo,Y as Aa,Ya as bc,Yb as Rd,Yc as uu,Ye as fr,Yf as Ni,Z as Pa,Za as vc,Zb as bd,Zc as lu,Ze as gr,Zf as zo,_ as Ea,_a as Cc,_b as vd,_c as pu,_e as at,_f as Mn,aa as Ua,ab as Tc,ac as Id,ad as lr,af as Eo,ag as $u,ba as Oa,bb as kc,bc as Td,bd as mu,bf as vu,bg as Ve,ca as qa,cb as Ac,cc as kd,cd as pr,cf as Oe,cg as $i,da as za,db as Pc,dc as Ad,dd as st,df as Cu,dg as Di,ea as Ma,eb as Ec,ec as Pd,ed as zi,ef as Je,eg as Du,fa as ja,fb as xc,fc as Ai,fd as Po,ff as x,fg as Mo,ga as Na,gb as Uc,gc as Io,gd as hu,gf as xo,gg as Li,ha as $a,hb as Oc,hc as To,hd as On,hf as le,hg as Hi,ia as Da,ib as qc,ic as Pi,id as jt,if as dt,ig as Lu,ja as La,jb as zc,jc as Ei,jd as fu,jf as Bf,jg as ne,k as Fe,ka as Ha,kb as Mc,kc as xi,kd as gu,kf as Ff,kg as Hu,la as Mt,lb as jc,lc as Ed,lf as Jf,lg as Bu,ma as vi,mb as Nc,mc as Ui,mf as Gf,mg as Bi,na as Ci,nb as $c,nc as Oi,nf as Vf,ng as Fu,oa as Un,ob as Dc,oc as xd,of as Kf,og as Ju,pa as Ii,pb as Lc,pc as Ud,pf as Wf,pg as Fi,qa as Ba,qb as Hc,qc as qi,qd as yu,qf as Zf,qg as Gu,r as zt,ra as Fa,rb as Bc,rc as ko,rf as Yf,rg as Nt,s as Ra,sa as Ja,sb as Fc,sc as Ao,sf as Xf,sg as Vu,ta as Ga,tb as Jc,tc as Od,tf as Iu,tg as jn,ua as Va,ub as Gc,uc as qd,uf as Tu,ug as Ku,va as Ka,vb as Vc,vc as zd,vf as ku,vg as jo,wa as Wa,wb as Kc,wc as Md,wf as Uo,wg as Nn,xa as Za,xb as Wc,xc as jd,xf as qn,xg as Wu,y as va,ya as Ya,yb as Zc,yc as Nd,yf as Au,yg as Zu,z as Ro,za as Xa,zb as Yc,zc as $d,zf as yr,zg as Yu}from"../chunk-ELNSPW6X.js";import"../chunk-ZB7PAWBM.js";import{a as H}from"../chunk-2UG5Z76T.js";import{a as il}from"../chunk-6SNZ4DOC.js";import{a as ba}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as f,B as z,C as Ri,D as vo,G as l,h as _i,i as An,j as Ca,k as d,l as Ia,m as Ta,n as b,o as E,p as bo,r as q,s as _,t as m,u as M,v as A,w as wi,x as Pn,y as T,z as N}from"../chunk-SMQPMERU.js";import"../chunk-UKQQD2JN.js";import{W as ke,X as v,Y as K,Z as wa,_ as wo}from"../chunk-7AMMYBFQ.js";import{a as n}from"../chunk-TYV53J3B.js";var tg=Object.create,Do=Object.defineProperty,rg=Object.getOwnPropertyDescriptor,ng=Object.getOwnPropertyNames,og=Object.getPrototypeOf,ig=Object.prototype.hasOwnProperty,sl=n((e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),"__commonJSMin"),al=n((e,t)=>{let r={};for(var o in e)Do(r,o,{get:e[o],enumerable:!0});return t&&Do(r,Symbol.toStringTag,{value:"Module"}),r},"__exportAll"),sg=n((e,t,r,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(var i=ng(t),s=0,a=i.length,c;s<a;s++)c=i[s],!ig.call(e,c)&&c!==r&&Do(e,c,{get:(u=>t[u]).bind(null,c),enumerable:!(o=rg(t,c))||o.enumerable});return e},"__copyProps"),cl=n((e,t,r)=>(r=e!=null?tg(og(e)):{},sg(t||!e||!e.__esModule?Do(r,"default",{value:e,enumerable:!0}):r,e)),"__toESM");var ag=new Set(["https://json-schema.org/draft/2019-09/schema","http://json-schema.org/draft/2019-09/schema"]);function dl(e){return typeof e=="string"&&ag.has(e.replace(/#$/,""))}n(dl,"declares2019Dialect");var Zi=Symbol.for("mcp.sdk.errorBrands");function $t(e,t){let r=new Set,o=t;for(;typeof o=="function";){let i=o.mcpBrand;Object.prototype.hasOwnProperty.call(o,"mcpBrand")&&typeof i=="string"&&r.add(i),o=Object.getPrototypeOf(o)}r.size!==0&&Object.defineProperty(e,Zi,{value:r,enumerable:!1,configurable:!0})}n($t,"stampErrorBrands");function be(e,t){try{if(typeof t=="object"&&t!==null&&Object.prototype.hasOwnProperty.call(e,"mcpBrand")&&typeof e.mcpBrand=="string"&&Object.prototype.hasOwnProperty.call(t,Zi)){let r=t[Zi];if(r&&typeof r.has=="function"&&r.has(e.mcpBrand))return!0}}catch{}return Function.prototype[Symbol.hasInstance].call(e,t)}n(be,"brandedHasInstance");var ue=(function(e){return e.InvalidRequest="invalid_request",e.InvalidClient="invalid_client",e.InvalidGrant="invalid_grant",e.UnauthorizedClient="unauthorized_client",e.UnsupportedGrantType="unsupported_grant_type",e.InvalidScope="invalid_scope",e.AccessDenied="access_denied",e.ServerError="server_error",e.TemporarilyUnavailable="temporarily_unavailable",e.UnsupportedResponseType="unsupported_response_type",e.UnsupportedTokenType="unsupported_token_type",e.InvalidToken="invalid_token",e.MethodNotAllowed="method_not_allowed",e.TooManyRequests="too_many_requests",e.InvalidClientMetadata="invalid_client_metadata",e.InvalidRedirectUri="invalid_redirect_uri",e.InsufficientScope="insufficient_scope",e.InvalidTarget="invalid_target",e})({}),pt=class _l extends Error{static{n(this,"OAuthError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthError"})}static[Symbol.hasInstance](t){return be(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,t)}constructor(t,r,o){super(r),this.code=t,this.errorUri=o,this.name="OAuthError",$t(this,new.target)}toResponseObject(){let t={error:this.code,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}static fromResponse(t){return new _l(t.error,t.error_description??t.error,t.error_uri)}},ie=(function(e){return e.NotConnected="NOT_CONNECTED",e.AlreadyConnected="ALREADY_CONNECTED",e.NotInitialized="NOT_INITIALIZED",e.CapabilityNotSupported="CAPABILITY_NOT_SUPPORTED",e.RequestTimeout="REQUEST_TIMEOUT",e.ConnectionClosed="CONNECTION_CLOSED",e.SendFailed="SEND_FAILED",e.InvalidResult="INVALID_RESULT",e.UnsupportedResultType="UNSUPPORTED_RESULT_TYPE",e.InputRequiredRoundsExceeded="INPUT_REQUIRED_ROUNDS_EXCEEDED",e.ListPaginationExceeded="LIST_PAGINATION_EXCEEDED",e.MethodNotSupportedByProtocolVersion="METHOD_NOT_SUPPORTED_BY_PROTOCOL_VERSION",e.EraNegotiationFailed="ERA_NEGOTIATION_FAILED",e.ClientHttpNotImplemented="CLIENT_HTTP_NOT_IMPLEMENTED",e.ClientHttpAuthentication="CLIENT_HTTP_AUTHENTICATION",e.ClientHttpForbidden="CLIENT_HTTP_FORBIDDEN",e.ClientHttpUnexpectedContent="CLIENT_HTTP_UNEXPECTED_CONTENT",e.ClientHttpFailedToOpenStream="CLIENT_HTTP_FAILED_TO_OPEN_STREAM",e.ClientHttpFailedToTerminateSession="CLIENT_HTTP_FAILED_TO_TERMINATE_SESSION",e})({}),te=class extends Error{static{n(this,"SdkError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkError"})}static[Symbol.hasInstance](e){return be(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,e)}constructor(e,t,r){super(t),this.code=e,this.data=r,this.name="SdkError",$t(this,new.target)}},_g=class extends te{static{n(this,"SdkHttpError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkHttpError"})}constructor(e,t,r){super(e,t,r),this.name="SdkHttpError"}get status(){return this.data.status}get statusText(){return this.data.statusText}};function wl(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}n(wl,"resourceUrlFromServerUrl");function Rl({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),o=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==o.origin||r.pathname.length<o.pathname.length)return!1;let i=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",s=o.pathname.endsWith("/")?o.pathname:o.pathname+"/";return i.startsWith(s)}n(Rl,"checkResourceAllowed");var wg="2026-07-28";function bl(e){return e>=wg}n(bl,"isModernProtocolVersion");function vl(e){let t=e.structuredContent;return t===void 0||!(typeof t!="object"||t===null||Array.isArray(t))||(e.content?.some(r=>r.type==="text")??!1)?e:{...e,content:[...e.content??[],{type:"text",text:JSON.stringify(t)}]}}n(vl,"appendTextFallbackForNonObject");var Cl=["task","inputRequests","requestState"];function Rg(e){return e===null||typeof e!="object"||Array.isArray(e)||e.content!==void 0||Cl.some(t=>t in e)?e:{...e,content:[]}}n(Rg,"normalizeContentlessToolResult");function bg(){let e=Ri(()=>A([d(),b(),E(),bo(),T(d(),e),_(e)])),t=T(d(),e),r=A([d(),b().int()]),o=d(),i=m({ttl:b().optional()}),s=m({taskId:d()}),a=M({progressToken:r.optional(),"io.modelcontextprotocol/related-task":s.optional()}),c=m({_meta:a.optional()}),u=c.extend({task:i.optional()}),p=m({method:d(),params:c.loose().optional()}),h=m({_meta:a.optional()}),g=m({method:d(),params:h.loose().optional()}),S=M({_meta:a.optional()}),y=A([d(),b().int()]),k=S.strict(),w=h.extend({requestId:y.optional(),reason:d().optional()}),C=g.extend({method:f("notifications/cancelled"),params:w}),U=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:N(["light","dark"]).optional()}),O=m({icons:_(U).optional()}),L=m({name:d(),title:d().optional()}),F=L.extend({...L.shape,...O.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),Q=Pn(m({applyDefaults:E().optional()}),t),J=vo(ce=>ce&&typeof ce=="object"&&!Array.isArray(ce)&&Object.keys(ce).length===0?{form:{}}:ce,Pn(m({form:Q.optional(),url:t.optional()}),t.optional())),V=M({list:t.optional(),cancel:t.optional(),requests:M({sampling:M({createMessage:t.optional()}).optional(),elicitation:M({create:t.optional()}).optional()}).optional()}),Le=M({list:t.optional(),cancel:t.optional(),requests:M({tools:M({call:t.optional()}).optional()}).optional()}),oe=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:J.optional(),roots:m({listChanged:E().optional()}).optional(),tasks:V.optional(),extensions:T(d(),t).optional()}),ze=c.extend({protocolVersion:d(),capabilities:oe,clientInfo:F}),D=p.extend({method:f("initialize"),params:ze}),Ee=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:E().optional()}).optional(),resources:m({subscribe:E().optional(),listChanged:E().optional()}).optional(),tools:m({listChanged:E().optional()}).optional(),tasks:Le.optional(),extensions:T(d(),t).optional()}),qr=S.extend({protocolVersion:d(),capabilities:Ee,serverInfo:F,instructions:d().optional()}),Bt=g.extend({method:f("notifications/initialized"),params:h.optional()}),et=p.extend({method:f("ping"),params:c.optional()}),bt=m({progress:b(),total:z(b()),message:z(d())}),Me=m({...h.shape,...bt.shape,progressToken:r}),tt=g.extend({method:f("notifications/progress"),params:Me}),Ft=c.extend({cursor:o.optional()}),He=p.extend({params:Ft.optional()}),Be=S.extend({nextCursor:o.optional()}),Jt=m({uri:d(),mimeType:z(d()),_meta:T(d(),q()).optional()}),Gt=Jt.extend({text:d()}),vt=d().refine(ce=>{try{return atob(ce),!0}catch{return!1}},{message:"Invalid Base64 string"}),Vt=Jt.extend({blob:vt}),je=N(["user","assistant"]),xe=m({audience:_(je).optional(),priority:b().min(0).max(1).optional(),lastModified:An.datetime({offset:!0}).optional()}),Ct=m({...L.shape,...O.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:xe.optional(),_meta:z(M({}))}),zr=m({...L.shape,...O.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:xe.optional(),_meta:z(M({}))}),Mr=He.extend({method:f("resources/list")}),jr=Be.extend({resources:_(Ct)}),rt=He.extend({method:f("resources/templates/list")}),Kt=Be.extend({resourceTemplates:_(zr)}),It=c.extend({uri:d()}),Nr=It,$r=p.extend({method:f("resources/read"),params:Nr}),Dr=S.extend({contents:_(A([Gt,Vt]))}),Lr=g.extend({method:f("notifications/resources/list_changed"),params:h.optional()}),Hr=It,Br=p.extend({method:f("resources/subscribe"),params:Hr}),Fr=It,Jr=p.extend({method:f("resources/unsubscribe"),params:Fr}),Gr=h.extend({uri:d()}),Vr=g.extend({method:f("notifications/resources/updated"),params:Gr}),Kr=m({name:d(),description:z(d()),required:z(E())}),Wr=m({...L.shape,...O.shape,description:z(d()),arguments:z(_(Kr)),_meta:z(M({}))}),Zr=He.extend({method:f("prompts/list")}),Yr=Be.extend({prompts:_(Wr)}),Xr=c.extend({name:d(),arguments:T(d(),d()).optional()}),Qr=p.extend({method:f("prompts/get"),params:Xr}),Tt=m({type:f("text"),text:d(),annotations:xe.optional(),_meta:T(d(),q()).optional()}),kt=m({type:f("image"),data:vt,mimeType:d(),annotations:xe.optional(),_meta:T(d(),q()).optional()}),At=m({type:f("audio"),data:vt,mimeType:d(),annotations:xe.optional(),_meta:T(d(),q()).optional()}),en=m({type:f("tool_use"),name:d(),id:d(),input:T(d(),q()),_meta:T(d(),q()).optional()}),nt=m({type:f("resource"),resource:A([Gt,Vt]),annotations:xe.optional(),_meta:T(d(),q()).optional()}),tn=Ct.extend({type:f("resource_link")}),Te=A([Tt,kt,At,tn,nt]),Wt=m({role:je,content:Te}),Zt=S.extend({description:d().optional(),messages:_(Wt)}),Pt=g.extend({method:f("notifications/prompts/list_changed"),params:h.optional()}),rn=m({title:d().optional(),readOnlyHint:E().optional(),destructiveHint:E().optional(),idempotentHint:E().optional(),openWorldHint:E().optional()}),Yt=m({taskSupport:N(["required","optional","forbidden"]).optional()}),Et=m({...L.shape,...O.shape,description:d().optional(),inputSchema:m({type:f("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(q()),outputSchema:m({type:f("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(q()).optional(),annotations:rn.optional(),execution:Yt.optional(),_meta:T(d(),q()).optional()}),Xt=He.extend({method:f("tools/list")}),Qt=Be.extend({tools:_(Et)}),er=S.extend({content:_(Te),structuredContent:T(d(),q()).optional(),isError:E().optional()}),ae=u.extend({name:d(),arguments:T(d(),q()).optional()}),nn=p.extend({method:f("tools/call"),params:ae}),ro=g.extend({method:f("notifications/tools/list_changed"),params:h.optional()}),tr=N(["debug","info","notice","warning","error","critical","alert","emergency"]),on=c.extend({level:tr}),sn=p.extend({method:f("logging/setLevel"),params:on}),an=h.extend({level:tr,logger:d().optional(),data:q()}),cn=g.extend({method:f("notifications/message"),params:an}),dn=m({name:d().optional()}),un=m({hints:_(dn).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),ln=m({mode:N(["auto","required","none"]).optional()}),no=m({type:f("tool_result"),toolUseId:d().describe("The unique identifier for the corresponding tool call."),content:_(Te),structuredContent:m({}).loose().optional(),isError:E().optional(),_meta:T(d(),q()).optional()}),pn=wi("type",[Tt,kt,At]),ot=wi("type",[Tt,kt,At,en,no]),mn=m({role:je,content:A([ot,_(ot)]),_meta:T(d(),q()).optional()}),hn=u.extend({messages:_(mn),modelPreferences:un.optional(),systemPrompt:d().optional(),includeContext:N(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Et).optional(),toolChoice:ln.optional()}),fn=p.extend({method:f("sampling/createMessage"),params:hn}),gn=S.extend({model:d(),stopReason:z(N(["endTurn","stopSequence","maxTokens"]).or(d())),role:je,content:pn}),yn=S.extend({model:d(),stopReason:z(N(["endTurn","stopSequence","maxTokens","toolUse"]).or(d())),role:je,content:A([ot,_(ot)])}),Sn=m({type:f("boolean"),title:d().optional(),description:d().optional(),default:E().optional()}),_n=m({type:f("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:N(["email","uri","date","date-time"]).optional(),default:d().optional()}),wn=m({type:N(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),Rn=m({type:f("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),bn=m({type:f("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),vn=m({type:f("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),Cn=A([Rn,bn]),xt=m({type:f("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:f("string"),enum:_(d())}),default:_(d()).optional()}),Ut=m({type:f("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),oo=A([xt,Ut]),io=A([vn,Cn,oo]),_e=A([io,Sn,_n,wn]),we=u.extend({mode:f("form").optional(),message:d(),requestedSchema:m({type:f("object"),properties:T(d(),_e),required:_(d()).optional()}).catchall(q())}),In=u.extend({mode:f("url"),message:d(),elicitationId:d(),url:d().url()}),Ue=A([we,In]),so=p.extend({method:f("elicitation/create"),params:Ue}),ao=h.extend({elicitationId:d()}),co=g.extend({method:f("notifications/elicitation/complete"),params:ao}),uo=S.extend({action:N(["accept","decline","cancel"]),content:vo(ce=>ce===null?void 0:ce,T(d(),A([d(),b(),E(),_(d())])).optional())}),lo=m({type:f("ref/resource"),uri:d()}),po=m({type:f("ref/prompt"),name:d()}),mo=c.extend({ref:A([po,lo]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()}),Tn=p.extend({method:f("completion/complete"),params:mo}),ho=S.extend({completion:M({values:_(d()).max(100),total:z(b().int()),hasMore:z(E())})}),fo=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),q()).optional()}),rr=p.extend({method:f("roots/list"),params:c.optional()}),kn=S.extend({roots:_(fo)}),go=g.extend({method:f("notifications/roots/list_changed"),params:h.optional()}),yo=M({ttl:b().optional(),pollInterval:b().optional()}),So=N(["working","input_required","completed","failed","cancelled"]),it=m({taskId:d(),status:So,ttl:A([b(),bo()]),createdAt:d(),lastUpdatedAt:d(),pollInterval:z(b()),statusMessage:z(d())}),fe=S.extend({task:it}),_o=h.merge(it),Ot=g.extend({method:f("notifications/tasks/status"),params:_o}),nr=p.extend({method:f("tasks/get"),params:c.extend({taskId:d()})}),or=S.merge(it),ir=p.extend({method:f("tasks/result"),params:c.extend({taskId:d()})}),Si=S.loose(),ge=He.extend({method:f("tasks/list")}),Z=Be.extend({tasks:_(it)}),qt=p.extend({method:f("tasks/cancel"),params:c.extend({taskId:d()})});return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,TaskMetadataSchema:i,RelatedTaskMetadataSchema:s,RequestMetaSchema:a,BaseRequestParamsSchema:c,TaskAugmentedRequestParamsSchema:u,RequestSchema:p,NotificationsParamsSchema:h,NotificationSchema:g,ResultSchema:S,RequestIdSchema:y,EmptyResultSchema:k,CancelledNotificationParamsSchema:w,CancelledNotificationSchema:C,IconSchema:U,IconsSchema:O,BaseMetadataSchema:L,ImplementationSchema:F,ClientTasksCapabilitySchema:V,ServerTasksCapabilitySchema:Le,ClientCapabilitiesSchema:oe,InitializeRequestParamsSchema:ze,InitializeRequestSchema:D,ServerCapabilitiesSchema:Ee,InitializeResultSchema:qr,InitializedNotificationSchema:Bt,PingRequestSchema:et,ProgressSchema:bt,ProgressNotificationParamsSchema:Me,ProgressNotificationSchema:tt,PaginatedRequestParamsSchema:Ft,PaginatedRequestSchema:He,PaginatedResultSchema:Be,ResourceContentsSchema:Jt,TextResourceContentsSchema:Gt,BlobResourceContentsSchema:Vt,RoleSchema:je,AnnotationsSchema:xe,ResourceSchema:Ct,ResourceTemplateSchema:zr,ListResourcesRequestSchema:Mr,ListResourcesResultSchema:jr,ListResourceTemplatesRequestSchema:rt,ListResourceTemplatesResultSchema:Kt,ResourceRequestParamsSchema:It,ReadResourceRequestParamsSchema:Nr,ReadResourceRequestSchema:$r,ReadResourceResultSchema:Dr,ResourceListChangedNotificationSchema:Lr,SubscribeRequestParamsSchema:Hr,SubscribeRequestSchema:Br,UnsubscribeRequestParamsSchema:Fr,UnsubscribeRequestSchema:Jr,ResourceUpdatedNotificationParamsSchema:Gr,ResourceUpdatedNotificationSchema:Vr,PromptArgumentSchema:Kr,PromptSchema:Wr,ListPromptsRequestSchema:Zr,ListPromptsResultSchema:Yr,GetPromptRequestParamsSchema:Xr,GetPromptRequestSchema:Qr,TextContentSchema:Tt,ImageContentSchema:kt,AudioContentSchema:At,ToolUseContentSchema:en,EmbeddedResourceSchema:nt,ResourceLinkSchema:tn,ContentBlockSchema:Te,PromptMessageSchema:Wt,GetPromptResultSchema:Zt,PromptListChangedNotificationSchema:Pt,ToolAnnotationsSchema:rn,ToolExecutionSchema:Yt,ToolSchema:Et,ListToolsRequestSchema:Xt,ListToolsResultSchema:Qt,CallToolResultSchema:er,CallToolRequestParamsSchema:ae,CallToolRequestSchema:nn,ToolListChangedNotificationSchema:ro,LoggingLevelSchema:tr,SetLevelRequestParamsSchema:on,SetLevelRequestSchema:sn,LoggingMessageNotificationParamsSchema:an,LoggingMessageNotificationSchema:cn,ModelHintSchema:dn,ModelPreferencesSchema:un,ToolChoiceSchema:ln,ToolResultContentSchema:no,SamplingContentSchema:pn,SamplingMessageContentBlockSchema:ot,SamplingMessageSchema:mn,CreateMessageRequestParamsSchema:hn,CreateMessageRequestSchema:fn,CreateMessageResultSchema:gn,CreateMessageResultWithToolsSchema:yn,BooleanSchemaSchema:Sn,StringSchemaSchema:_n,NumberSchemaSchema:wn,UntitledSingleSelectEnumSchemaSchema:Rn,TitledSingleSelectEnumSchemaSchema:bn,LegacyTitledEnumSchemaSchema:vn,SingleSelectEnumSchemaSchema:Cn,UntitledMultiSelectEnumSchemaSchema:xt,TitledMultiSelectEnumSchemaSchema:Ut,MultiSelectEnumSchemaSchema:oo,EnumSchemaSchema:io,PrimitiveSchemaDefinitionSchema:_e,ElicitRequestFormParamsSchema:we,ElicitRequestURLParamsSchema:In,ElicitRequestParamsSchema:Ue,ElicitRequestSchema:so,ElicitationCompleteNotificationParamsSchema:ao,ElicitationCompleteNotificationSchema:co,ElicitResultSchema:uo,ResourceTemplateReferenceSchema:lo,PromptReferenceSchema:po,CompleteRequestParamsSchema:mo,CompleteRequestSchema:Tn,CompleteResultSchema:ho,RootSchema:fo,ListRootsRequestSchema:rr,ListRootsResultSchema:kn,RootsListChangedNotificationSchema:go,TaskCreationParamsSchema:yo,TaskStatusSchema:So,TaskSchema:it,CreateTaskResultSchema:fe,TaskStatusNotificationParamsSchema:_o,TaskStatusNotificationSchema:Ot,GetTaskRequestSchema:nr,GetTaskResultSchema:or,GetTaskPayloadRequestSchema:ir,GetTaskPayloadResultSchema:Si,ListTasksRequestSchema:ge,ListTasksResultSchema:Z,CancelTaskRequestSchema:qt,CancelTaskResultSchema:S.merge(it),ClientRequestSchema:A([et,D,Tn,sn,Qr,Zr,Mr,rt,$r,Br,Jr,nn,Xt,nr,ir,ge,qt]),ClientNotificationSchema:A([C,tt,Bt,go,Ot]),ClientResultSchema:A([k,gn,yn,uo,kn,or,Z,fe]),ServerRequestSchema:A([et,fn,so,rr,nr,ir,ge,qt]),ServerNotificationSchema:A([C,tt,cn,Vr,Lr,ro,Pt,Ot,co]),ServerResultSchema:A([k,qr,ho,Zt,Yr,jr,Kt,Dr,er,Qt,or,Z,fe]),CallToolResultWireSchema:q().superRefine((ce,Hf)=>{if(!(typeof ce!="object"||ce===null||Array.isArray(ce)||ce.content!==void 0)){for(let _a of Cl)if(_a in ce){Hf.addIssue({code:"custom",message:`content is required when the body carries '${_a}' \u2014 another result family cannot default into an empty tools/call success`});return}}}).transform(Rg).pipe(er)}}n(bg,"build$1");var vg;function rs(){return vg??=bg()}n(rs,"buildSchemas2025");function Il(e){return e.type!=="object"}n(Il,"isNonObjectJsonSchemaRoot");var Cg=new Set(["const","enum","default","examples"]),Ig=new Set(["properties","patternProperties","$defs","definitions","dependentSchemas","dependencies"]);function ul(e){return e!==void 0&&!(typeof e=="string"&&e.startsWith("#"))}n(ul,"establishesNewBase");function Tg(e){let t=typeof e.$schema=="string"?e.$schema:void 0;if(ul(e.$id))return{...t!==void 0&&{$schema:t},type:"object",properties:{result:e},required:["result"]};let r=dl(e.$schema)&&e.$recursiveAnchor!==!0,o=n((i,s)=>{if(Array.isArray(i))return i.map(u=>o(u,!1));if(i===null||typeof i!="object"||!s&&ul(i.$id))return i;let a={},c=!1;for(let[u,p]of Object.entries(i))s?a[u]=o(p,!1):(u==="$ref"||u==="$dynamicRef")&&typeof p=="string"?a[u]=p==="#"?"#/properties/result":p.startsWith("#/")?`#/properties/result${p.slice(1)}`:p:u==="$recursiveRef"&&p==="#"&&r?c=!0:Cg.has(u)?a[u]=p:Ig.has(u)?a[u]=o(p,!0):a[u]=o(p,!1);return c&&("$ref"in a?a.allOf=[...Array.isArray(a.allOf)?a.allOf:[],{$ref:"#/properties/result"}]:a.$ref="#/properties/result"),a},"rewriteRefs");return{...t!==void 0&&{$schema:t},type:"object",properties:{result:o(e,!1)},required:["result"]}}n(Tg,"wrapOutputSchemaForLegacy");var Tl={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"tasks/get":null,"tasks/result":null,"tasks/list":null,"tasks/cancel":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},kl={"notifications/cancelled":null,"notifications/progress":null,"notifications/initialized":null,"notifications/roots/list_changed":null,"notifications/tasks/status":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/elicitation/complete":null},kg={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},Lo;function Jo(){if(Lo)return Lo;let e=rs();return Lo={requestSchemas:{ping:e.PingRequestSchema,initialize:e.InitializeRequestSchema,"completion/complete":e.CompleteRequestSchema,"logging/setLevel":e.SetLevelRequestSchema,"prompts/get":e.GetPromptRequestSchema,"prompts/list":e.ListPromptsRequestSchema,"resources/list":e.ListResourcesRequestSchema,"resources/templates/list":e.ListResourceTemplatesRequestSchema,"resources/read":e.ReadResourceRequestSchema,"resources/subscribe":e.SubscribeRequestSchema,"resources/unsubscribe":e.UnsubscribeRequestSchema,"tools/call":e.CallToolRequestSchema,"tools/list":e.ListToolsRequestSchema,"tasks/get":e.GetTaskRequestSchema,"tasks/result":e.GetTaskPayloadRequestSchema,"tasks/list":e.ListTasksRequestSchema,"tasks/cancel":e.CancelTaskRequestSchema,"sampling/createMessage":e.CreateMessageRequestSchema,"elicitation/create":e.ElicitRequestSchema,"roots/list":e.ListRootsRequestSchema},notificationSchemas:{"notifications/cancelled":e.CancelledNotificationSchema,"notifications/progress":e.ProgressNotificationSchema,"notifications/initialized":e.InitializedNotificationSchema,"notifications/roots/list_changed":e.RootsListChangedNotificationSchema,"notifications/tasks/status":e.TaskStatusNotificationSchema,"notifications/message":e.LoggingMessageNotificationSchema,"notifications/resources/updated":e.ResourceUpdatedNotificationSchema,"notifications/resources/list_changed":e.ResourceListChangedNotificationSchema,"notifications/tools/list_changed":e.ToolListChangedNotificationSchema,"notifications/prompts/list_changed":e.PromptListChangedNotificationSchema,"notifications/elicitation/complete":e.ElicitationCompleteNotificationSchema},resultSchemas:{ping:e.EmptyResultSchema,initialize:e.InitializeResultSchema,"completion/complete":e.CompleteResultSchema,"logging/setLevel":e.EmptyResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"resources/subscribe":e.EmptyResultSchema,"resources/unsubscribe":e.EmptyResultSchema,"tools/call":e.CallToolResultWireSchema,"tools/list":e.ListToolsResultSchema,"sampling/createMessage":e.CreateMessageResultWithToolsSchema,"elicitation/create":e.ElicitResultSchema,"roots/list":e.ListRootsResultSchema}},Lo}n(Jo,"registryMaps");function Ag(){Jo()}n(Ag,"warmRegistryMaps2025");function Al(e){return Object.prototype.hasOwnProperty.call(Tl,e)}n(Al,"hasRequestMethod2025");function Pl(e){return Object.prototype.hasOwnProperty.call(kl,e)}n(Pl,"hasNotificationMethod2025");function Pg(e){return Object.prototype.hasOwnProperty.call(kg,e)}n(Pg,"hasResultMethod");function Eg(e){return Pg(e)?Jo().resultSchemas[e]:void 0}n(Eg,"getResultSchema");function xg(e){return Al(e)?Jo().requestSchemas[e]:void 0}n(xg,"getRequestSchema");function Ug(e){return Pl(e)?Jo().notificationSchemas[e]:void 0}n(Ug,"getNotificationSchema");var II=Object.keys(Tl),TI=Object.keys(kl);function Yi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Yi,"isPlainObject$4");function Ho(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n(Ho,"triState$1");var ll={ok:!1,reason:"not-in-era"};function pl(e){return Yi(e)&&Yi(e.outputSchema)&&Il(e.outputSchema)}n(pl,"toolNeedsLegacyWrap");var ns={era:"2025-11-25",hasRequestMethod:Al,hasNotificationMethod:Pl,validateRequest:n((e,t)=>Ho(xg(e),t),"validateRequest"),validateResult:n((e,t)=>Ho(Eg(e),t),"validateResult"),validateNotification:n((e,t)=>Ho(Ug(e),t),"validateNotification"),hasInputRequestMethod:n(()=>!1,"hasInputRequestMethod"),validateInputRequest:n(()=>ll,"validateInputRequest"),validateInputResponse:n(()=>ll,"validateInputResponse"),samplingResultVariant:n(((e,t)=>{let r=rs();return Ho(e?r.CreateMessageResultWithToolsSchema:r.CreateMessageResultSchema,t)}),"samplingResultVariant"),outboundEnvelope:n(e=>{},"outboundEnvelope"),validateEnvelopeMeta:n(e=>[],"validateEnvelopeMeta"),projectCallToolResult(e,t){let r=vl(e),o=r.structuredContent;if(o===void 0)return r;let i=typeof o!="object"||o===null||Array.isArray(o),s=t!==void 0&&Il(t);return!i&&!s?r:{...r,structuredContent:{result:o}}},decodeResult(e,t){if(Yi(t)&&"resultType"in t){let r={...t};return delete r.resultType,{kind:"complete",result:r}}return{kind:"complete",result:t}},encodeResult(e,t){if(e!=="tools/list")return t;let r=t.tools;return!Array.isArray(r)||!r.some(o=>pl(o))?t:{...t,tools:r.map(o=>pl(o)?{...o,outputSchema:Tg(o.outputSchema)}:o)}},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope:n(e=>{},"checkInboundEnvelope")};function Og(){let e=Ri(()=>A([d(),b(),E(),bo(),T(d(),e),_(e)])),t=T(d(),e),r=A([d(),b().int()]),o=d(),i=A([d(),b().int()]),s=N(["user","assistant"]),a=N(["debug","info","notice","warning","error","critical","alert","emergency"]),c=d().refine(Z=>{try{return atob(Z),!0}catch{return!1}},{message:"Invalid Base64 string"}),u=m({ttl:b().optional()}),p=m({taskId:d()}),h=M({progressToken:r.optional(),"io.modelcontextprotocol/related-task":p.optional()}),g=m({_meta:h.optional()}),S=g.extend({task:u.optional()}),y=m({_meta:h.optional()}),k=m({method:d(),params:y.loose().optional()}),w=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:N(["light","dark"]).optional()}),C=m({icons:_(w).optional()}),U=m({name:d(),title:d().optional()}),O=U.extend({...U.shape,...C.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),L=Pn(m({applyDefaults:E().optional()}),t),F=vo(Z=>Z&&typeof Z=="object"&&!Array.isArray(Z)&&Object.keys(Z).length===0?{form:{}}:Z,Pn(m({form:L.optional(),url:t.optional()}),t.optional())),Q=M({list:t.optional(),cancel:t.optional(),requests:M({sampling:M({createMessage:t.optional()}).optional(),elicitation:M({create:t.optional()}).optional()}).optional()}),J=M({list:t.optional(),cancel:t.optional(),requests:M({tools:M({call:t.optional()}).optional()}).optional()}),V=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:F.optional(),roots:m({listChanged:E().optional()}).optional(),tasks:Q.optional(),extensions:T(d(),t).optional()}),Le=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:E().optional()}).optional(),resources:m({subscribe:E().optional(),listChanged:E().optional()}).optional(),tools:m({listChanged:E().optional()}).optional(),tasks:J.optional(),extensions:T(d(),t).optional()}),oe=m({progress:b(),total:z(b()),message:z(d())}),ze=m({...y.shape,...oe.shape,progressToken:r}),D=k.extend({method:f("notifications/progress"),params:ze}),Ee=y.extend({level:a,logger:d().optional(),data:q()}),qr=k.extend({method:f("notifications/message"),params:Ee}),Bt=m({uri:d(),mimeType:z(d()),_meta:T(d(),q()).optional()}),et=Bt.extend({text:d()}),bt=Bt.extend({blob:c}),Me=m({audience:_(s).optional(),priority:b().min(0).max(1).optional(),lastModified:An.datetime({offset:!0}).optional()}),tt=m({...U.shape,...C.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:Me.optional(),_meta:z(M({}))}),Ft=m({...U.shape,...C.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:Me.optional(),_meta:z(M({}))}),He=k.extend({method:f("notifications/resources/list_changed"),params:y.optional()}),Be=y.extend({uri:d()}),Jt=k.extend({method:f("notifications/resources/updated"),params:Be}),Gt=m({name:d(),description:z(d()),required:z(E())}),vt=m({...U.shape,...C.shape,description:z(d()),arguments:z(_(Gt)),_meta:z(M({}))}),Vt=k.extend({method:f("notifications/prompts/list_changed"),params:y.optional()}),je=m({type:f("text"),text:d(),annotations:Me.optional(),_meta:T(d(),q()).optional()}),xe=m({type:f("image"),data:c,mimeType:d(),annotations:Me.optional(),_meta:T(d(),q()).optional()}),Ct=m({type:f("audio"),data:c,mimeType:d(),annotations:Me.optional(),_meta:T(d(),q()).optional()}),zr=m({type:f("tool_use"),name:d(),id:d(),input:T(d(),q()),_meta:T(d(),q()).optional()}),Mr=m({type:f("resource"),resource:A([et,bt]),annotations:Me.optional(),_meta:T(d(),q()).optional()}),jr=tt.extend({type:f("resource_link")}),rt=A([je,xe,Ct,jr,Mr]),Kt=m({role:s,content:rt}),It=m({title:d().optional(),readOnlyHint:E().optional(),destructiveHint:E().optional(),idempotentHint:E().optional(),openWorldHint:E().optional()}),Nr=k.extend({method:f("notifications/tools/list_changed"),params:y.optional()}),$r=m({name:d().optional()}),Dr=m({hints:_($r).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),Lr=m({mode:N(["auto","required","none"]).optional()}),Hr=m({type:f("boolean"),title:d().optional(),description:d().optional(),default:E().optional()}),Br=m({type:f("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:N(["email","uri","date","date-time"]).optional(),default:d().optional()}),Fr=m({type:N(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),Jr=m({type:f("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),Gr=m({type:f("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),Vr=m({type:f("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),Kr=A([Jr,Gr]),Wr=m({type:f("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:f("string"),enum:_(d())}),default:_(d()).optional()}),Zr=m({type:f("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),Yr=A([Wr,Zr]),Xr=A([Vr,Kr,Yr]),Qr=A([Xr,Hr,Br,Fr]),Tt=S.extend({mode:f("form").optional(),message:d(),requestedSchema:m({type:f("object"),properties:T(d(),Qr),required:_(d()).optional()}).catchall(q())}),kt=m({type:f("ref/resource"),uri:d()}),At=m({type:f("ref/prompt"),name:d()}),en=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),q()).optional()}),nt=V.shape,tn=m({experimental:nt.experimental,sampling:nt.sampling,elicitation:nt.elicitation,roots:nt.roots,extensions:nt.extensions}),Te=Le.shape,Wt=m({experimental:Te.experimental,logging:Te.logging,completions:Te.completions,prompts:Te.prompts,resources:Te.resources,tools:Te.tools,extensions:Te.extensions}),Zt=M({progressToken:r.optional(),[sr]:d(),[En]:O.optional(),[cr]:tn,[xn]:a.optional()}),Pt=m({...U.shape,...C.shape,description:d().optional(),inputSchema:M({$schema:d().optional(),type:f("object")}),outputSchema:M({$schema:d().optional()}).optional(),annotations:It.optional(),_meta:T(d(),q()).optional()}),rn=m({type:f("tool_result"),toolUseId:d(),content:_(rt),structuredContent:q().optional(),isError:E().optional(),_meta:T(d(),q()).optional()}),Yt=A([je,xe,Ct,zr,rn]),Et=m({role:s,content:A([Yt,_(Yt)]),_meta:T(d(),q()).optional()}),Xt=d(),Qt=M({[ar]:O.optional().catch(void 0)}),er=Qt.optional();function ae(Z){return M({_meta:er,resultType:Xt.default("complete"),...Z})}n(ae,"wireResult");let nn=ae({}),ro=ae({nextCursor:o.optional()}),tr=ae({content:_(rt),structuredContent:q().optional(),isError:E().optional()}),on=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),tools:_(Pt),nextCursor:o.optional()}),sn=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),prompts:_(vt),nextCursor:o.optional()}),an=ae({description:d().optional(),messages:_(Kt)}),cn=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),resources:_(tt),nextCursor:o.optional()}),dn=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),resourceTemplates:_(Ft),nextCursor:o.optional()}),un=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),contents:_(A([et,bt]))}),ln=ae({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:E().optional()}).loose()}),no=ae({ttlMs:b().int().min(0),cacheScope:N(["public","private"])}),pn=ae({ttlMs:b().int().min(0).catch(0),cacheScope:N(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Wt,instructions:d().optional()}),ot=m({messages:_(Et),modelPreferences:Dr.optional(),systemPrompt:d().optional(),includeContext:N(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Pt).optional(),toolChoice:Lr.optional()}),mn=m({method:f("sampling/createMessage"),params:ot}),hn=m({method:f("roots/list"),params:m({_meta:T(d(),q()).optional()}).optional()}),fn=m({...Et.shape,model:d(),stopReason:d().optional()}),gn=m({roots:_(en)}),yn=m({action:N(["accept","decline","cancel"]),content:T(d(),A([d(),b(),E(),_(d())])).optional()}),Sn=m({mode:f("url"),message:d(),url:d().url()}),_n=A([Tt,Sn]),wn=m({method:f("elicitation/create"),params:_n}),Rn=A([mn,hn,wn]),bn=A([fn,gn,yn]),vn=T(d(),Rn),Cn=T(d(),bn),xt=ae({inputRequests:vn.optional(),requestState:d().optional()}),Ut={inputResponses:Cn.optional(),requestState:d().optional()},oo=m({_meta:Zt,...Ut}),io=M({progressToken:r.optional()});function _e(Z,qt){return m({method:f(Z),params:m({_meta:Zt,...qt})})}n(_e,"wireRequest");function we(Z,qt){return m({method:f(Z),params:m({_meta:io.optional(),...qt}).optional()})}n(we,"dispatchRequest");let In={name:d(),arguments:T(d(),q()).optional(),...Ut},Ue={cursor:o.optional()},so=_e("tools/call",In),ao=_e("tools/list",Ue),co=_e("prompts/list",Ue),uo=_e("prompts/get",{name:d(),arguments:T(d(),d()).optional(),...Ut}),lo=_e("resources/list",Ue),po=_e("resources/templates/list",Ue),mo=_e("resources/read",{uri:d(),...Ut}),Tn={ref:A([At,kt]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()},ho=_e("completion/complete",Tn),fo=_e("server/discover",{}),rr=m({toolsListChanged:E().optional(),promptsListChanged:E().optional(),resourcesListChanged:E().optional(),resourceSubscriptions:_(d()).optional()}),kn={notifications:rr},go=_e("subscriptions/listen",kn),yo=Qt.extend({"io.modelcontextprotocol/subscriptionId":i}),So=M({_meta:yo,resultType:Xt.default("complete")}),it={"tools/call":we("tools/call",In),"tools/list":we("tools/list",Ue),"prompts/get":we("prompts/get",{name:d(),arguments:T(d(),d()).optional()}),"prompts/list":we("prompts/list",Ue),"resources/list":we("resources/list",Ue),"resources/templates/list":we("resources/templates/list",Ue),"resources/read":we("resources/read",{uri:d()}),"completion/complete":we("completion/complete",Tn),"server/discover":we("server/discover",{}),"subscriptions/listen":we("subscriptions/listen",kn)};function fe(Z){return M({_meta:er,...Z})}n(fe,"liftedResult");let _o={"tools/call":fe({content:_(rt),structuredContent:q().optional(),isError:E().optional()}),"tools/list":fe({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),tools:_(Pt),nextCursor:o.optional()}),"prompts/get":fe({description:d().optional(),messages:_(Kt)}),"prompts/list":fe({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),prompts:_(vt),nextCursor:o.optional()}),"resources/list":fe({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),resources:_(tt),nextCursor:o.optional()}),"resources/templates/list":fe({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),resourceTemplates:_(Ft),nextCursor:o.optional()}),"resources/read":fe({ttlMs:b().int().min(0),cacheScope:N(["public","private"]),contents:_(A([et,bt]))}),"completion/complete":fe({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:E().optional()}).loose()}),"server/discover":fe({ttlMs:b().int().min(0).catch(0),cacheScope:N(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Wt,instructions:d().optional()}),"subscriptions/listen":fe({})},Ot=M({"io.modelcontextprotocol/subscriptionId":i.optional()}),nr=m({method:f("notifications/subscriptions/acknowledged"),params:m({_meta:Ot.optional(),notifications:rr})}),or=m({_meta:Ot.optional(),requestId:i,reason:d().optional()}),ir=m({method:f("notifications/cancelled"),params:or}),Si={"notifications/cancelled":ir,"notifications/progress":D,"notifications/message":qr,"notifications/resources/updated":Jt,"notifications/resources/list_changed":He,"notifications/tools/list_changed":Nr,"notifications/prompts/list_changed":Vt,"notifications/subscriptions/acknowledged":nr},ge=n(Z=>m({jsonrpc:f("2.0"),id:A([d(),b().int()]),result:Z}).strict(),"wireResultResponse");return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,RequestIdSchema:i,RoleSchema:s,LoggingLevelSchema:a,TaskMetadataSchema:u,RelatedTaskMetadataSchema:p,RequestMetaSchema:h,BaseRequestParamsSchema:g,TaskAugmentedRequestParamsSchema:S,NotificationsParamsSchema:y,NotificationSchema:k,IconSchema:w,IconsSchema:C,BaseMetadataSchema:U,ImplementationSchema:O,ClientTasksCapabilitySchema:Q,ServerTasksCapabilitySchema:J,ClientCapabilitiesSchema:V,ServerCapabilitiesSchema:Le,ProgressSchema:oe,ProgressNotificationParamsSchema:ze,ProgressNotificationSchema:D,LoggingMessageNotificationParamsSchema:Ee,LoggingMessageNotificationSchema:qr,ResourceContentsSchema:Bt,TextResourceContentsSchema:et,BlobResourceContentsSchema:bt,AnnotationsSchema:Me,ResourceSchema:tt,ResourceTemplateSchema:Ft,ResourceListChangedNotificationSchema:He,ResourceUpdatedNotificationParamsSchema:Be,ResourceUpdatedNotificationSchema:Jt,PromptArgumentSchema:Gt,PromptSchema:vt,PromptListChangedNotificationSchema:Vt,TextContentSchema:je,ImageContentSchema:xe,AudioContentSchema:Ct,ToolUseContentSchema:zr,EmbeddedResourceSchema:Mr,ResourceLinkSchema:jr,ContentBlockSchema:rt,PromptMessageSchema:Kt,ToolAnnotationsSchema:It,ToolListChangedNotificationSchema:Nr,ModelHintSchema:$r,ModelPreferencesSchema:Dr,ToolChoiceSchema:Lr,BooleanSchemaSchema:Hr,StringSchemaSchema:Br,NumberSchemaSchema:Fr,UntitledSingleSelectEnumSchemaSchema:Jr,TitledSingleSelectEnumSchemaSchema:Gr,LegacyTitledEnumSchemaSchema:Vr,SingleSelectEnumSchemaSchema:Kr,UntitledMultiSelectEnumSchemaSchema:Wr,TitledMultiSelectEnumSchemaSchema:Zr,MultiSelectEnumSchemaSchema:Yr,EnumSchemaSchema:Xr,PrimitiveSchemaDefinitionSchema:Qr,ElicitRequestFormParamsSchema:Tt,ResourceTemplateReferenceSchema:kt,PromptReferenceSchema:At,RootSchema:en,ClientCapabilities2026Schema:tn,ServerCapabilities2026Schema:Wt,RequestMetaEnvelopeSchema:Zt,ToolSchema:Pt,ToolResultContentSchema:rn,SamplingMessageContentBlockSchema:Yt,SamplingMessageSchema:Et,ResultTypeSchema:Xt,ResultMetaSchema:Qt,ResultSchema:nn,PaginatedResultSchema:ro,CallToolResultSchema:tr,ListToolsResultSchema:on,ListPromptsResultSchema:sn,GetPromptResultSchema:an,ListResourcesResultSchema:cn,ListResourceTemplatesResultSchema:dn,ReadResourceResultSchema:un,CompleteResultSchema:ln,CacheableResultSchema:no,DiscoverResultSchema:pn,CreateMessageRequestParamsSchema:ot,CreateMessageRequestSchema:mn,ListRootsRequestSchema:hn,CreateMessageResultSchema:fn,ListRootsResultSchema:gn,ElicitResultSchema:yn,ElicitRequestURLParamsSchema:Sn,ElicitRequestParamsSchema:_n,ElicitRequestSchema:wn,InputRequestSchema:Rn,InputResponseSchema:bn,InputRequestsSchema:vn,InputResponsesSchema:Cn,InputRequiredResultSchema:xt,InputResponseRequestParamsSchema:oo,CallToolRequestSchema:so,ListToolsRequestSchema:ao,ListPromptsRequestSchema:co,GetPromptRequestSchema:uo,ListResourcesRequestSchema:lo,ListResourceTemplatesRequestSchema:po,ReadResourceRequestSchema:mo,CompleteRequestSchema:ho,DiscoverRequestSchema:fo,SubscriptionFilterSchema:rr,SubscriptionsListenRequestSchema:go,SubscriptionsListenResultMetaSchema:yo,SubscriptionsListenResultSchema:So,dispatchRequestSchemas:it,dispatchResultSchemas:_o,NotificationMetaSchema:Ot,SubscriptionsAcknowledgedNotificationSchema:nr,CancelledNotificationParamsSchema:or,CancelledNotificationSchema:ir,notificationSchemas2026:Si,JSONRPCResultResponseSchema:ge(nn),CallToolResultResponseSchema:ge(A([tr,xt])),ListToolsResultResponseSchema:ge(on),ListPromptsResultResponseSchema:ge(sn),GetPromptResultResponseSchema:ge(A([an,xt])),ListResourcesResultResponseSchema:ge(cn),ListResourceTemplatesResultResponseSchema:ge(dn),ReadResourceResultResponseSchema:ge(A([un,xt])),CompleteResultResponseSchema:ge(ln),DiscoverResultResponseSchema:ge(pn)}}n(Og,"build");var qg;function lt(){return qg??=Og()}n(lt,"buildSchemas2026");var zg=["tools/list","prompts/list","resources/list","resources/templates/list","resources/read","server/discover"];function Mg(e){return zg.includes(e)}n(Mg,"isCacheableResultMethod");var os=Symbol("modelcontextprotocol.resultCacheHintFallback");function jg(e){return e[os]}n(jg,"cacheHintFallbackOf");function El(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}n(El,"isValidCacheTtlMs");function xl(e){return e==="public"||e==="private"}n(xl,"isValidCacheScope");var P=(function(e){return e[e.ParseError=-32700]="ParseError",e[e.InvalidRequest=-32600]="InvalidRequest",e[e.MethodNotFound=-32601]="MethodNotFound",e[e.InvalidParams=-32602]="InvalidParams",e[e.InternalError=-32603]="InternalError",e[e.ResourceNotFound=-32002]="ResourceNotFound",e[e.MissingRequiredClientCapability=-32021]="MissingRequiredClientCapability",e[e.UnsupportedProtocolVersion=-32022]="UnsupportedProtocolVersion",e[e.UrlElicitationRequired=-32042]="UrlElicitationRequired",e})({}),se=class Ul extends Error{static{n(this,"ProtocolError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ProtocolError"})}static[Symbol.hasInstance](t){return be(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,t)}constructor(t,r,o){super(r),this.code=t,this.data=o,this.name="ProtocolError",$t(this,new.target)}static fromError(t,r,o){if(t===P.UrlElicitationRequired&&o){let i=o;if(i.elicitations)return new Go(i.elicitations,r)}if(t===P.UnsupportedProtocolVersion&&o){let i=o;if(Array.isArray(i.supported)&&typeof i.requested=="string")return new ql({supported:i.supported,requested:i.requested},r)}if(t===P.InvalidParams||t===P.ResourceNotFound){let i=o;if(typeof i?.uri=="string"&&(t===P.ResourceNotFound||Object.keys(i).length===1))return new Ol(i.uri,r)}if(t===P.MissingRequiredClientCapability&&o){let i=o;if(i.requiredCapabilities!==null&&typeof i.requiredCapabilities=="object"&&!Array.isArray(i.requiredCapabilities))return new zl({requiredCapabilities:i.requiredCapabilities},r)}return new Ul(t,r,o)}},Ol=class extends se{static{n(this,"ResourceNotFoundError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ResourceNotFoundError"})}constructor(e,t=`Resource not found: ${e}`){super(P.InvalidParams,t,{uri:e})}get uri(){return this.data.uri}},Go=class extends se{static{n(this,"UrlElicitationRequiredError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UrlElicitationRequiredError"})}constructor(e,t=`URL elicitation${e.length>1?"s":""} required`){super(P.UrlElicitationRequired,t,{elicitations:e})}get elicitations(){return this.data?.elicitations??[]}},ql=class extends se{static{n(this,"UnsupportedProtocolVersionError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnsupportedProtocolVersionError"})}constructor(e,t=`Unsupported protocol version: ${e.requested}`){super(P.UnsupportedProtocolVersion,t,e)}get supported(){return this.data.supported}get requested(){return this.data.requested}},zl=class extends se{static{n(this,"MissingRequiredClientCapabilityError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.MissingRequiredClientCapabilityError"})}constructor(e,t=`Missing required client capabilities: ${Object.keys(e.requiredCapabilities).join(", ")}`){super(P.MissingRequiredClientCapability,t,e)}get requiredCapabilities(){return this.data.requiredCapabilities}},Ng=0,$g="private",Dg=["tools/call","prompts/get","resources/read"];function Lg(e,t){let r=t.resultType;if(r===void 0)return{...t,resultType:"complete"};if(r==="complete"||Dg.includes(e))return t;throw new se(P.InternalError,`Handler for ${e} returned resultType '${String(r)}', but results of ${e} only support 'complete' on protocol revision 2026-07-28`)}n(Lg,"stampResultType");function Hg(e,t){let r=jg(t);if(t.resultType!=="complete"||!Mg(e))return r===void 0?t:Vg(t);let o=t,i=El(o.ttlMs)?o.ttlMs:Jg(r),s=xl(o.cacheScope)?o.cacheScope:Gg(r),a={...o,ttlMs:i,cacheScope:s};return delete a[os],a}n(Hg,"fillCacheFields");function Bg(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Bg,"isPlainObject$3");function Fg(e,t){if(t===void 0)return e;let r=e._meta;return r===void 0?{...e,_meta:{[ar]:t}}:!Bg(r)||r[ar]!==void 0?e:{...e,_meta:{...r,[ar]:t}}}n(Fg,"stampServerInfoMeta");function Jg(e){return e!==void 0&&El(e.ttlMs)?e.ttlMs:Ng}n(Jg,"resolveTtlMs");function Gg(e){return e!==void 0&&xl(e.cacheScope)?e.cacheScope:$g}n(Gg,"resolveCacheScope");function Vg(e){let t={...e};return delete t[os],t}n(Vg,"stripCacheHintFallback");var Kg=["elicitation/create","sampling/createMessage","roots/list"],Bo;function is(){if(Bo)return Bo;let e=lt();return Bo={request:{"elicitation/create":m({method:f("elicitation/create"),params:e.ElicitRequestParamsSchema}),"sampling/createMessage":m({method:f("sampling/createMessage"),params:e.CreateMessageRequestParamsSchema}),"roots/list":m({method:f("roots/list"),params:M({}).optional()})},response:{"elicitation/create":e.ElicitResultSchema,"sampling/createMessage":e.CreateMessageResultSchema,"roots/list":e.ListRootsResultSchema}},Bo}n(is,"inputSchemaMaps");function Wg(){is()}n(Wg,"warmInputSchemaMaps2026");function Ml(e){return Kg.includes(e)}n(Ml,"isInputRequestMethod2026");function Ji(e){return Ml(e)?is().request[e]:void 0}n(Ji,"getInputRequestSchema2026");function Zg(e){return Ml(e)?is().response[e]:void 0}n(Zg,"getInputResponseSchema2026");var ss={"tools/call":null,"tools/list":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"completion/complete":null,"server/discover":null,"subscriptions/listen":null},jl={"notifications/cancelled":null,"notifications/progress":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/subscriptions/acknowledged":null};function Nl(e){return Object.prototype.hasOwnProperty.call(ss,e)}n(Nl,"hasRequestMethod2026");function $l(e){return Object.prototype.hasOwnProperty.call(jl,e)}n($l,"hasNotificationMethod2026");function Yg(e){return Object.prototype.hasOwnProperty.call(ss,e)}n(Yg,"hasResultMethod2026");function Xg(e){return Nl(e)?lt().dispatchRequestSchemas[e]:void 0}n(Xg,"getRequestSchema2026");function Qg(e){return Yg(e)?lt().dispatchResultSchemas[e]:void 0}n(Qg,"getResultSchema2026");function ey(e){return $l(e)?lt().notificationSchemas2026[e]:void 0}n(ey,"getNotificationSchema2026");var kI=Object.keys(ss),AI=Object.keys(jl);function Ln(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Ln,"isPlainObject$2");function $n(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n($n,"triState");var ty={ok:!1,reason:"not-in-era"},ry=[sr,cr];function ny(e,t){let r=t,o=!1,i=n(()=>(o||(r={...r},o=!0),r),"copy"),s=t.tools;e==="tools/list"&&Array.isArray(s)&&s.some(c=>Ln(c)&&"execution"in c)&&(i().tools=s.map(c=>{if(!Ln(c)||!("execution"in c))return c;let u={...c};return delete u.execution,u}));let a=t.capabilities;if(Ln(a)&&"tasks"in a){let c={...a};delete c.tasks,i().capabilities=c}return r}n(ny,"enforceDeletedFields");var as={era:"2026-07-28",hasRequestMethod:Nl,hasNotificationMethod:$l,hasInputRequestMethod:n(e=>Ji(e)!==void 0,"hasInputRequestMethod"),validateRequest:n((e,t)=>$n(Xg(e),t),"validateRequest"),validateResult:n((e,t)=>$n(Qg(e),t),"validateResult"),validateNotification:n((e,t)=>$n(ey(e),t),"validateNotification"),validateInputRequest:n((e,t)=>$n(Ji(e),t),"validateInputRequest"),validateInputResponse:n((e,t)=>$n(Zg(e),t),"validateInputResponse"),samplingResultVariant:n(()=>ty,"samplingResultVariant"),outboundEnvelope(e){return{[sr]:e.protocolVersion,[En]:e.clientInfo,[cr]:e.clientCapabilities,...e.logLevel!==void 0&&{[xn]:e.logLevel}}},validateEnvelopeMeta(e){let t=[];for(let o of ry)o in e||t.push({key:o,problem:"missing"});let r=lt().RequestMetaEnvelopeSchema.safeParse(e);if(!r.success)for(let o of r.error.issues){let i=o.path.map(String),s=i.length>0?i.join("."):"_meta";i.length===1&&t.some(a=>a.key===s&&a.problem==="missing")||t.push({key:s,problem:o.message})}return t},projectCallToolResult:n(e=>vl(e),"projectCallToolResult"),inputRequestSchema:Ji,decodeResult(e,t){if(!Ln(t))return{kind:"invalid",error:new te(ie.InvalidResult,`Invalid result for ${e}: not an object`,{method:e})};let r=t.resultType;if(r===void 0)return{kind:"invalid",error:new te(ie.InvalidResult,`Invalid result for ${e}: missing required resultType \u2014 servers implementing protocol revision 2026-07-28 MUST include it (the absent-means-complete bridge applies only to earlier-revision servers)`,{method:e,violation:"missing-resultType"})};if(typeof r!="string")return{kind:"invalid",error:new te(ie.InvalidResult,`Invalid result for ${e}: non-string resultType`,{method:e,resultType:r})};if(r==="input_required"){let a=t.inputRequests,c=Ln(a)?a:{},u=t.requestState;return Object.keys(c).length===0&&typeof u!="string"?{kind:"invalid",error:new te(ie.InvalidResult,`Invalid result for ${e}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`,{method:e,violation:"input-required-missing-both"})}:{kind:"input_required",inputRequests:c,...typeof u=="string"&&{requestState:u}}}if(r!=="complete")return{kind:"invalid",error:new te(ie.UnsupportedResultType,`Unsupported result type '${r}' for ${e}`,{resultType:r,method:e})};let o=Dl(),i=Object.hasOwn(o,e)?o[e]:void 0;if(i!==void 0){let a=i.safeParse(t);if(!a.success)return{kind:"invalid",error:new te(ie.InvalidResult,`Invalid result for ${e}: ${a.error}`,{method:e})}}let s={...t};return delete s.resultType,{kind:"complete",result:s}},encodeResult(e,t,r){return Fg(Hg(e,Lg(e,ny(e,t))),r)},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope(e){if(e.envelope===void 0)return"Request is missing the required _meta envelope for protocol revision 2026-07-28 (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities)";let t=lt().RequestMetaEnvelopeSchema.safeParse(e.envelope);if(!t.success)return`Invalid _meta envelope for protocol revision 2026-07-28: ${t.error.issues.map(r=>r.message).join("; ")}`}},Fo;function Dl(){if(Fo)return Fo;let e=lt();return Fo={"tools/call":e.CallToolResultSchema,"tools/list":e.ListToolsResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"completion/complete":e.CompleteResultSchema,"server/discover":e.DiscoverResultSchema},Fo}n(Dl,"getWireResultSchemas");function oy(){Dl()}n(oy,"warmWireResultSchemas2026");var cs="2026-07-28";function Bn(e){return e!==void 0&&bl(e)?as:ns}n(Bn,"codecForVersion");function ml(e){return e.revision!==void 0?Bn(e.revision).era:e.era==="modern"?as.era:ns.era}n(ml,"classifiedWireEra");function Gi(e){return Ll.some(t=>t.hasRequestMethod(e))}n(Gi,"isSpecRequestMethod");function Vi(e){return Ll.some(t=>t.hasNotificationMethod(e))}n(Vi,"isSpecNotificationMethod");var Ll=[ns,as],iy=al({AnnotationsSchema:n(()=>yc,"AnnotationsSchema"),AudioContentSchema:n(()=>Zc,"AudioContentSchema"),BaseMetadataSchema:n(()=>Wa,"BaseMetadataSchema"),BaseRequestParamsSchema:n(()=>za,"BaseRequestParamsSchema"),BlobResourceContentsSchema:n(()=>fc,"BlobResourceContentsSchema"),BooleanSchemaSchema:n(()=>Ai,"BooleanSchemaSchema"),CallToolRequestParamsSchema:n(()=>ld,"CallToolRequestParamsSchema"),CallToolRequestSchema:n(()=>pd,"CallToolRequestSchema"),CallToolResultSchema:n(()=>dd,"CallToolResultSchema"),CancelTaskRequestSchema:n(()=>iu,"CancelTaskRequestSchema"),CancelTaskResultSchema:n(()=>su,"CancelTaskResultSchema"),CancelledNotificationParamsSchema:n(()=>Ja,"CancelledNotificationParamsSchema"),CancelledNotificationSchema:n(()=>Ga,"CancelledNotificationSchema"),ClientCapabilitiesSchema:n(()=>Qa,"ClientCapabilitiesSchema"),ClientNotificationSchema:n(()=>cu,"ClientNotificationSchema"),ClientRequestSchema:n(()=>au,"ClientRequestSchema"),ClientResultSchema:n(()=>du,"ClientResultSchema"),ClientTasksCapabilitySchema:n(()=>Ya,"ClientTasksCapabilitySchema"),CompatibilityCallToolResultSchema:n(()=>ud,"CompatibilityCallToolResultSchema"),CompleteRequestParamsSchema:n(()=>Dd,"CompleteRequestParamsSchema"),CompleteRequestSchema:n(()=>Ld,"CompleteRequestSchema"),CompleteResultSchema:n(()=>Hd,"CompleteResultSchema"),ContentBlockSchema:n(()=>ed,"ContentBlockSchema"),CreateMessageRequestParamsSchema:n(()=>Td,"CreateMessageRequestParamsSchema"),CreateMessageRequestSchema:n(()=>kd,"CreateMessageRequestSchema"),CreateMessageResultSchema:n(()=>Ad,"CreateMessageResultSchema"),CreateMessageResultWithToolsSchema:n(()=>Pd,"CreateMessageResultWithToolsSchema"),CreateTaskResultSchema:n(()=>Zd,"CreateTaskResultSchema"),CursorSchema:n(()=>xa,"CursorSchema"),DiscoverRequestSchema:n(()=>ic,"DiscoverRequestSchema"),DiscoverResultSchema:n(()=>Ti,"DiscoverResultSchema"),ElicitRequestFormParamsSchema:n(()=>ko,"ElicitRequestFormParamsSchema"),ElicitRequestParamsSchema:n(()=>Od,"ElicitRequestParamsSchema"),ElicitRequestSchema:n(()=>qd,"ElicitRequestSchema"),ElicitRequestURLParamsSchema:n(()=>Ao,"ElicitRequestURLParamsSchema"),ElicitResultSchema:n(()=>jd,"ElicitResultSchema"),ElicitationCompleteNotificationParamsSchema:n(()=>zd,"ElicitationCompleteNotificationParamsSchema"),ElicitationCompleteNotificationSchema:n(()=>Md,"ElicitationCompleteNotificationSchema"),EmbeddedResourceSchema:n(()=>Xc,"EmbeddedResourceSchema"),EmptyResultSchema:n(()=>Fa,"EmptyResultSchema"),EnumSchemaSchema:n(()=>Ud,"EnumSchemaSchema"),GetPromptRequestParamsSchema:n(()=>Gc,"GetPromptRequestParamsSchema"),GetPromptRequestSchema:n(()=>Vc,"GetPromptRequestSchema"),GetPromptResultSchema:n(()=>rd,"GetPromptResultSchema"),GetTaskPayloadRequestSchema:n(()=>tu,"GetTaskPayloadRequestSchema"),GetTaskPayloadResultSchema:n(()=>ru,"GetTaskPayloadResultSchema"),GetTaskRequestSchema:n(()=>Qd,"GetTaskRequestSchema"),GetTaskResultSchema:n(()=>eu,"GetTaskResultSchema"),IconSchema:n(()=>Va,"IconSchema"),IconsSchema:n(()=>Ka,"IconsSchema"),ImageContentSchema:n(()=>Wc,"ImageContentSchema"),ImplementationSchema:n(()=>Za,"ImplementationSchema"),InitializeRequestParamsSchema:n(()=>ec,"InitializeRequestParamsSchema"),InitializeRequestSchema:n(()=>tc,"InitializeRequestSchema"),InitializeResultSchema:n(()=>nc,"InitializeResultSchema"),InitializedNotificationSchema:n(()=>oc,"InitializedNotificationSchema"),JSONArraySchema:n(()=>Pa,"JSONArraySchema"),JSONObjectSchema:n(()=>Aa,"JSONObjectSchema"),JSONRPCErrorResponseSchema:n(()=>Un,"JSONRPCErrorResponseSchema"),JSONRPCMessageSchema:n(()=>Ii,"JSONRPCMessageSchema"),JSONRPCNotificationSchema:n(()=>vi,"JSONRPCNotificationSchema"),JSONRPCRequestSchema:n(()=>Mt,"JSONRPCRequestSchema"),JSONRPCResponseSchema:n(()=>Ba,"JSONRPCResponseSchema"),JSONRPCResultResponseSchema:n(()=>Ci,"JSONRPCResultResponseSchema"),JSONValueSchema:n(()=>ka,"JSONValueSchema"),LegacyTitledEnumSchemaSchema:n(()=>xi,"LegacyTitledEnumSchemaSchema"),ListChangedOptionsBaseSchema:n(()=>ki,"ListChangedOptionsBaseSchema"),ListPromptsRequestSchema:n(()=>Fc,"ListPromptsRequestSchema"),ListPromptsResultSchema:n(()=>Jc,"ListPromptsResultSchema"),ListResourceTemplatesRequestSchema:n(()=>bc,"ListResourceTemplatesRequestSchema"),ListResourceTemplatesResultSchema:n(()=>vc,"ListResourceTemplatesResultSchema"),ListResourcesRequestSchema:n(()=>wc,"ListResourcesRequestSchema"),ListResourcesResultSchema:n(()=>Rc,"ListResourcesResultSchema"),ListRootsRequestSchema:n(()=>Fd,"ListRootsRequestSchema"),ListRootsResultSchema:n(()=>Jd,"ListRootsResultSchema"),ListTasksRequestSchema:n(()=>nu,"ListTasksRequestSchema"),ListTasksResultSchema:n(()=>ou,"ListTasksResultSchema"),ListToolsRequestSchema:n(()=>ad,"ListToolsRequestSchema"),ListToolsResultSchema:n(()=>cd,"ListToolsResultSchema"),LoggingLevelSchema:n(()=>hd,"LoggingLevelSchema"),LoggingMessageNotificationParamsSchema:n(()=>yd,"LoggingMessageNotificationParamsSchema"),LoggingMessageNotificationSchema:n(()=>Sd,"LoggingMessageNotificationSchema"),ModelHintSchema:n(()=>_d,"ModelHintSchema"),ModelPreferencesSchema:n(()=>wd,"ModelPreferencesSchema"),MultiSelectEnumSchemaSchema:n(()=>xd,"MultiSelectEnumSchemaSchema"),NotificationSchema:n(()=>$a,"NotificationSchema"),NotificationsParamsSchema:n(()=>Na,"NotificationsParamsSchema"),NumberSchemaSchema:n(()=>To,"NumberSchemaSchema"),PaginatedRequestParamsSchema:n(()=>uc,"PaginatedRequestParamsSchema"),PaginatedRequestSchema:n(()=>lc,"PaginatedRequestSchema"),PaginatedResultSchema:n(()=>pc,"PaginatedResultSchema"),PingRequestSchema:n(()=>sc,"PingRequestSchema"),PrimitiveSchemaDefinitionSchema:n(()=>qi,"PrimitiveSchemaDefinitionSchema"),ProgressNotificationParamsSchema:n(()=>cc,"ProgressNotificationParamsSchema"),ProgressNotificationSchema:n(()=>dc,"ProgressNotificationSchema"),ProgressSchema:n(()=>ac,"ProgressSchema"),ProgressTokenSchema:n(()=>Ea,"ProgressTokenSchema"),PromptArgumentSchema:n(()=>Hc,"PromptArgumentSchema"),PromptListChangedNotificationSchema:n(()=>nd,"PromptListChangedNotificationSchema"),PromptMessageSchema:n(()=>td,"PromptMessageSchema"),PromptReferenceSchema:n(()=>$d,"PromptReferenceSchema"),PromptSchema:n(()=>Bc,"PromptSchema"),ReadResourceRequestParamsSchema:n(()=>Ic,"ReadResourceRequestParamsSchema"),ReadResourceRequestSchema:n(()=>Tc,"ReadResourceRequestSchema"),ReadResourceResultSchema:n(()=>kc,"ReadResourceResultSchema"),RelatedTaskMetadataSchema:n(()=>Oa,"RelatedTaskMetadataSchema"),RequestIdSchema:n(()=>Ha,"RequestIdSchema"),RequestMetaSchema:n(()=>qa,"RequestMetaSchema"),RequestSchema:n(()=>ja,"RequestSchema"),ResourceContentsSchema:n(()=>mc,"ResourceContentsSchema"),ResourceLinkSchema:n(()=>Qc,"ResourceLinkSchema"),ResourceListChangedNotificationSchema:n(()=>Ac,"ResourceListChangedNotificationSchema"),ResourceRequestParamsSchema:n(()=>Cc,"ResourceRequestParamsSchema"),ResourceSchema:n(()=>Sc,"ResourceSchema"),ResourceTemplateReferenceSchema:n(()=>Nd,"ResourceTemplateReferenceSchema"),ResourceTemplateSchema:n(()=>_c,"ResourceTemplateSchema"),ResourceUpdatedNotificationParamsSchema:n(()=>Dc,"ResourceUpdatedNotificationParamsSchema"),ResourceUpdatedNotificationSchema:n(()=>Lc,"ResourceUpdatedNotificationSchema"),ResultMetaObjectSchema:n(()=>Da,"ResultMetaObjectSchema"),ResultSchema:n(()=>La,"ResultSchema"),RoleSchema:n(()=>gc,"RoleSchema"),RootSchema:n(()=>Bd,"RootSchema"),RootsListChangedNotificationSchema:n(()=>Gd,"RootsListChangedNotificationSchema"),SamplingContentSchema:n(()=>vd,"SamplingContentSchema"),SamplingMessageContentBlockSchema:n(()=>Cd,"SamplingMessageContentBlockSchema"),SamplingMessageSchema:n(()=>Id,"SamplingMessageSchema"),ServerCapabilitiesSchema:n(()=>rc,"ServerCapabilitiesSchema"),ServerNotificationSchema:n(()=>lu,"ServerNotificationSchema"),ServerRequestSchema:n(()=>uu,"ServerRequestSchema"),ServerResultSchema:n(()=>pu,"ServerResultSchema"),ServerTasksCapabilitySchema:n(()=>Xa,"ServerTasksCapabilitySchema"),SetLevelRequestParamsSchema:n(()=>fd,"SetLevelRequestParamsSchema"),SetLevelRequestSchema:n(()=>gd,"SetLevelRequestSchema"),SingleSelectEnumSchemaSchema:n(()=>Ed,"SingleSelectEnumSchemaSchema"),StringSchemaSchema:n(()=>Io,"StringSchemaSchema"),SubscribeRequestParamsSchema:n(()=>Pc,"SubscribeRequestParamsSchema"),SubscribeRequestSchema:n(()=>Ec,"SubscribeRequestSchema"),SubscriptionFilterSchema:n(()=>Oc,"SubscriptionFilterSchema"),SubscriptionsAcknowledgedNotificationParamsSchema:n(()=>Mc,"SubscriptionsAcknowledgedNotificationParamsSchema"),SubscriptionsAcknowledgedNotificationSchema:n(()=>jc,"SubscriptionsAcknowledgedNotificationSchema"),SubscriptionsListenRequestParamsSchema:n(()=>qc,"SubscriptionsListenRequestParamsSchema"),SubscriptionsListenRequestSchema:n(()=>zc,"SubscriptionsListenRequestSchema"),SubscriptionsListenResultMetaSchema:n(()=>Nc,"SubscriptionsListenResultMetaSchema"),SubscriptionsListenResultSchema:n(()=>$c,"SubscriptionsListenResultSchema"),TaskAugmentedRequestParamsSchema:n(()=>Ma,"TaskAugmentedRequestParamsSchema"),TaskCreationParamsSchema:n(()=>Vd,"TaskCreationParamsSchema"),TaskMetadataSchema:n(()=>Ua,"TaskMetadataSchema"),TaskSchema:n(()=>Wd,"TaskSchema"),TaskStatusNotificationParamsSchema:n(()=>Yd,"TaskStatusNotificationParamsSchema"),TaskStatusNotificationSchema:n(()=>Xd,"TaskStatusNotificationSchema"),TaskStatusSchema:n(()=>Kd,"TaskStatusSchema"),TextContentSchema:n(()=>Kc,"TextContentSchema"),TextResourceContentsSchema:n(()=>hc,"TextResourceContentsSchema"),TitledMultiSelectEnumSchemaSchema:n(()=>Oi,"TitledMultiSelectEnumSchemaSchema"),TitledSingleSelectEnumSchemaSchema:n(()=>Ei,"TitledSingleSelectEnumSchemaSchema"),ToolAnnotationsSchema:n(()=>od,"ToolAnnotationsSchema"),ToolChoiceSchema:n(()=>Rd,"ToolChoiceSchema"),ToolExecutionSchema:n(()=>id,"ToolExecutionSchema"),ToolListChangedNotificationSchema:n(()=>md,"ToolListChangedNotificationSchema"),ToolResultContentSchema:n(()=>bd,"ToolResultContentSchema"),ToolSchema:n(()=>sd,"ToolSchema"),ToolUseContentSchema:n(()=>Yc,"ToolUseContentSchema"),UnsubscribeRequestParamsSchema:n(()=>xc,"UnsubscribeRequestParamsSchema"),UnsubscribeRequestSchema:n(()=>Uc,"UnsubscribeRequestSchema"),UntitledMultiSelectEnumSchemaSchema:n(()=>Ui,"UntitledMultiSelectEnumSchemaSchema"),UntitledSingleSelectEnumSchemaSchema:n(()=>Pi,"UntitledSingleSelectEnumSchemaSchema")});var Hl=n(e=>Mt.safeParse(e).success,"isJSONRPCRequest"),Bl=n(e=>vi.safeParse(e).success,"isJSONRPCNotification"),Xi=n(e=>Ci.safeParse(e).success,"isJSONRPCResultResponse"),Fl=n(e=>Un.safeParse(e).success,"isJSONRPCErrorResponse");var Hn=-32020,PI=[{rung:"http-method",order:1,evaluatedAt:"edge",codes:[-32e3],conformance:[],rationale:"The modern era is POST-only; GET/DELETE are body-less 2025-era session operations and are method-routed to legacy serving (405 when legacy serving is not configured), before any body is read."},{rung:"jsonrpc-shape",order:2,evaluatedAt:"edge",codes:[P.InvalidRequest],conformance:["server-stateless"],rationale:"The body must be a JSON-RPC request or notification: posted responses and batch arrays containing a modern or invalid element are rejected before classification (element-wise batch rule); all-legacy arrays stay legacy traffic."},{rung:"era-classification",order:3,evaluatedAt:"edge",codes:[Hn,P.UnsupportedProtocolVersion],conformance:["server-stateless","http-header-validation","http-custom-header-server-validation"],rationale:"Body-primary era classification with the protocol-version header as a cross-check; a header/body disagreement is rejected with -32020 (HeaderMismatch), and an envelope-less request on a modern-only endpoint is answered with the unsupported-protocol-version error naming the supported revisions."},{rung:"envelope",order:4,evaluatedAt:"edge",codes:[P.InvalidParams],conformance:["server-stateless"],rationale:"A present envelope claim with a malformed envelope \u2014 and a missing envelope on a request whose protocol-version header names a modern revision \u2014 is an invalid-params rejection naming the offending or missing key(s); never a silent fall back to legacy handling. This is the only place an invalid-params rejection maps to HTTP 400."},{rung:"method-registry",order:5,evaluatedAt:"dispatch",codes:[P.MethodNotFound],conformance:["server-stateless"],rationale:"Method existence outranks parameter validity: a method absent from the negotiated revision\u2019s registry (or with no handler installed) answers method-not-found before params or capabilities are looked at."},{rung:"request-params",order:6,evaluatedAt:"dispatch",codes:[P.InvalidParams],conformance:[],rationale:"Per-method params validation; emitted in-band by the dispatch layer (HTTP 200), never via the ladder status table."},{rung:"standard-header-validation",order:7,evaluatedAt:"pre-dispatch",codes:[Hn],conformance:["http-header-validation"],rationale:"SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."},{rung:"client-capabilities",order:8,evaluatedAt:"pre-dispatch",codes:[P.MissingRequiredClientCapability],conformance:["server-stateless"],rationale:"The capability requirement is checked by the HTTP entry, pre-dispatch, against the validated envelope the classifier produced \u2014 pinning the spec-mandated HTTP 400 independently of how dispatch- and handler-produced errors are mapped. The documented order (after method resolution and params validation) is preserved observably only while the requirement table is empty: once a served method gains a requirement entry, a request that is missing the capability and would also fail a dispatch rung is answered by this gate first, so the entry must consult the method registry before the gate if the documented precedence is to stay observable."},{rung:"param-header-validation",order:9,evaluatedAt:"pre-dispatch",codes:[Hn],conformance:["http-custom-header-server-validation"],rationale:"SEP-2243 `Mcp-Param-*` headers are validated against the named tool\u2019s `x-mcp-header` declarations and the body `arguments` after the tool registry is known and before dispatch reaches the handler; a missing/disagreeing/malformed header is rejected 400 / -32020 with the same shape as the standard-header cross-checks. The documented order (after method resolution and params validation) is preserved observably only when the body `arguments` would otherwise validate: the check runs pre-dispatch, so a `tools/call` that fails BOTH this rung and a dispatch-time rung (e.g. order-6 `request-params`, -32602) is answered by this gate first with 400 / -32020, not by the earlier-ordered rung."}],EI={[P.ParseError]:400,[P.InvalidRequest]:400,[P.MethodNotFound]:404,[P.UnsupportedProtocolVersion]:400,[P.MissingRequiredClientCapability]:400,[Hn]:400};function ds(e,t){return Ca(e,t)}n(ds,"parseSchema");function Dn(e){return new Set(e.flatMap(t=>Object.keys(t.shape)))}n(Dn,"shapeKeys");function Qi(e){if(e==null)return!1;let t=typeof e;return t!=="object"&&t!=="function"||!("~standard"in e)?!1:typeof e["~standard"]?.validate=="function"}n(Qi,"isStandardSchema");var hl=!1,es="draft-2020-12";function sy(e,t="input"){let r=e["~standard"],o;if(r.jsonSchema)o=r.jsonSchema[t]({target:es});else if(r.vendor==="zod"){if(!("_zod"in e))throw new Error("Schema appears to be from zod 3, which the SDK cannot convert to JSON Schema. Upgrade to zod >=4.2.0, or wrap your JSON Schema with fromJsonSchema().");hl||(hl=!0,console.warn("[mcp-sdk] Your zod version does not implement `~standard.jsonSchema` (added in zod 4.2.0). Falling back to z.toJSONSchema(). Upgrade to zod >=4.2.0 to silence this warning.")),o=_i(e,{target:es,io:t})}else throw new Error(`Schema library "${r.vendor}" does not implement StandardJSONSchemaV1 (\`~standard.jsonSchema\`). Upgrade to a version that does, or wrap your JSON Schema with fromJsonSchema().`);if(t==="output")return o.type!==void 0?o:Jl(o)?{type:"object",...o}:o;if(o.type!==void 0&&o.type!=="object")throw new Error(`MCP tool and prompt schemas must describe objects (got type: ${JSON.stringify(o.type)}). Wrap your schema in z.object({...}) or equivalent.`);return{type:"object",...o}}n(sy,"standardSchemaToJsonSchema");function Jl(e){if("properties"in e||"patternProperties"in e||"additionalProperties"in e||"required"in e)return!0;for(let t of["oneOf","anyOf","allOf"]){let r=e[t];if(Array.isArray(r)&&r.length>0)return r.every(o=>o!==null&&typeof o=="object"&&(o.type==="object"||Jl(o)))}return!1}n(Jl,"isProvablyObjectShapedRoot");function ay(e){return e.path?.length?`${e.path.map(t=>String(typeof t=="object"?t.key:t)).join(".")}: ${e.message}`:e.message}n(ay,"formatIssue");async function Ki(e,t){let r=await e["~standard"].validate(t);return r.issues&&r.issues.length>0?{success:!1,error:r.issues.map(o=>ay(o)).join(", ")}:{success:!0,data:r.value}}n(Ki,"validateStandardSchema");function cy(e){let t=_i(e,{target:es,io:"input"});return typeof t.pattern=="string"?t.pattern:void 0}n(cy,"zodEmittedPattern");var dy=/\\\.\\d\{(\d+)\}/;function uy(e){let t=dy.exec(e),r=[void 0,-1,0];return t&&r.push(Number(t[1])),[!1,!0].flatMap(o=>[!1,!0].flatMap(i=>r.map(s=>An.datetime({local:o,offset:i,precision:s}))))}n(uy,"datetimeReferenceSchemas");function ly(e,t){let r;switch(e){case"email":r=[Ia()];break;case"uri":r=[Ta()];break;case"date":r=[An.date()];break;case"date-time":r=uy(t);break}return new Set(r.map(o=>cy(o)).filter(o=>o!==void 0))}n(ly,"referencePatternsForFormat");function py(e,t,r){return r!=="zod"?!0:ly(e,t).has(t)}n(py,"isLibraryFormatPattern");function Fn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n(Fn,"isJsonObject");function my(e){try{return sy(e,"input")}catch(t){let r=t instanceof Error?t.message:String(t);throw new se(P.InvalidParams,`Elicitation requestedSchema must describe an object with flat primitive properties: ${r}`)}}n(my,"convertStandardElicitationSchema");var hy=new Set(["$comment","deprecated","description","examples","readOnly","title","writeOnly"]);function us(e){return hy.has(e)||e.startsWith("x-")}n(us,"isAnnotationOnlyJsonSchemaKeyword");var fy=new Set(["$schema",...Object.keys(ko.shape.requestedSchema.shape)]),fl={string:Dn([Io,Pi,Ei,xi]),number:Dn([To]),integer:Dn([To]),boolean:Dn([Ai]),array:Dn([Ui,Oi])},gy=new Set(Io.shape.format.unwrap().options);function yy(e,t,r,o){if(!Fn(e))return e;let i=typeof e.type=="string"&&Object.hasOwn(fl,e.type)?fl[e.type]:void 0;if(i===void 0)return e;let s={};for(let[a,c]of Object.entries(e))i.has(a)||us(a)?s[a]=c:a==="pattern"&&e.type==="string"&&typeof e.format=="string"?gy.has(e.format)?(typeof c!="string"||!py(e.format,c,r))&&o.push(`${t}.${a}`):s[a]=c:o.push(`${t}.${a}`);return s}n(yy,"walkProperty");function Sy(e,t){let r={},o=[];for(let[i,s]of Object.entries(e))i==="properties"&&Fn(s)?r[i]=Object.fromEntries(Object.entries(s).map(([a,c])=>[a,yy(c,`properties.${a}`,t,o)])):fy.has(i)?r[i]=s:us(i)||o.push(i);if(o.length>0)throw new se(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${o.join(", ")}`);return r}n(Sy,"walkRequestedSchema");function _y(e,t){if(!Fn(e.properties))return t;let r=Object.entries(e.properties).filter(([,o])=>!ds(qi,o).success).map(([o])=>`properties.${o}`);return r.length>0?r.join(", "):t}n(_y,"describeUnsupportedProperties");function ts(e,t,r=""){return Array.isArray(e)&&Array.isArray(t)?e.flatMap((o,i)=>ts(o,t[i],`${r}[${i}]`)):!Fn(e)||!Fn(t)?[]:Object.entries(e).flatMap(([o,i])=>{let s=r?`${r}.${o}`:o;return Object.prototype.hasOwnProperty.call(t,o)?ts(i,t[o],s):us(o)?[]:[s]})}n(ts,"findDroppedConstraintPaths");function wy(e){if(!Qi(e.requestedSchema))return{...e,mode:"form",requestedSchema:e.requestedSchema};let t=e.requestedSchema["~standard"].vendor,r=Sy(my(e.requestedSchema),t),o=ds(ko.shape.requestedSchema,r);if(!o.success)throw new se(P.InvalidParams,`Elicitation requestedSchema only supports flat primitive properties (string, number, integer, boolean, and string enums): ${_y(r,o.error.message)}`);let i=ts(r,o.data);if(i.length>0)throw new se(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${i.join(", ")}`);let s=(o.data.required??[]).filter(a=>!Object.prototype.hasOwnProperty.call(o.data.properties,a));if(s.length>0)throw new se(P.InvalidParams,`Elicitation requestedSchema lists required properties that are not defined in properties: ${s.join(", ")}`);return{...e,mode:"form",requestedSchema:o.data}}n(wy,"normalizeElicitInputParams");function Ry(e){let t=e.inputRequests!==void 0&&Object.keys(e.inputRequests).length>0,r=typeof e.requestState=="string";if(!t&&!r)throw new TypeError("inputRequired() requires at least one of inputRequests (with at least one entry) or requestState (spec: every InputRequiredResult MUST include at least one of the two)");return{resultType:"input_required",...e.inputRequests!==void 0&&{inputRequests:e.inputRequests},...e.requestState!==void 0&&{requestState:e.requestState}}}n(Ry,"buildInputRequired");var xI=Object.assign(Ry,{elicit(e){try{return{method:"elicitation/create",params:wy(e)}}catch(t){throw t instanceof se?new TypeError(t.message,{cause:t}):t}},elicitUrl(e){return{method:"elicitation/create",params:{...e,mode:"url"}}},createMessage(e){return{method:"sampling/createMessage",params:e}},listRoots(){return{method:"roots/list"}}});var by=["AnnotationsSchema","AudioContentSchema","BaseMetadataSchema","BlobResourceContentsSchema","BooleanSchemaSchema","CallToolRequestSchema","CallToolRequestParamsSchema","CallToolResultSchema","CancelledNotificationSchema","CancelledNotificationParamsSchema","CancelTaskRequestSchema","CancelTaskResultSchema","ClientCapabilitiesSchema","ClientNotificationSchema","ClientRequestSchema","ClientResultSchema","CompatibilityCallToolResultSchema","CompleteRequestSchema","CompleteRequestParamsSchema","CompleteResultSchema","ContentBlockSchema","CreateMessageRequestSchema","CreateMessageRequestParamsSchema","CreateMessageResultSchema","CreateMessageResultWithToolsSchema","CreateTaskResultSchema","CursorSchema","DiscoverRequestSchema","DiscoverResultSchema","ElicitationCompleteNotificationSchema","ElicitationCompleteNotificationParamsSchema","ElicitRequestSchema","ElicitRequestFormParamsSchema","ElicitRequestParamsSchema","ElicitRequestURLParamsSchema","ElicitResultSchema","EmbeddedResourceSchema","EmptyResultSchema","EnumSchemaSchema","GetPromptRequestSchema","GetPromptRequestParamsSchema","GetPromptResultSchema","GetTaskPayloadRequestSchema","GetTaskPayloadResultSchema","GetTaskRequestSchema","GetTaskResultSchema","IconSchema","IconsSchema","ImageContentSchema","ImplementationSchema","InitializedNotificationSchema","InitializeRequestSchema","InitializeRequestParamsSchema","InitializeResultSchema","JSONArraySchema","JSONObjectSchema","JSONRPCErrorResponseSchema","JSONRPCMessageSchema","JSONRPCNotificationSchema","JSONRPCRequestSchema","JSONRPCResponseSchema","JSONRPCResultResponseSchema","JSONValueSchema","LegacyTitledEnumSchemaSchema","ListPromptsRequestSchema","ListPromptsResultSchema","ListResourcesRequestSchema","ListResourcesResultSchema","ListResourceTemplatesRequestSchema","ListResourceTemplatesResultSchema","ListRootsRequestSchema","ListRootsResultSchema","ListTasksRequestSchema","ListTasksResultSchema","ListToolsRequestSchema","ListToolsResultSchema","LoggingLevelSchema","LoggingMessageNotificationSchema","LoggingMessageNotificationParamsSchema","ModelHintSchema","ModelPreferencesSchema","MultiSelectEnumSchemaSchema","NotificationSchema","NumberSchemaSchema","PaginatedRequestSchema","PaginatedRequestParamsSchema","PaginatedResultSchema","PingRequestSchema","PrimitiveSchemaDefinitionSchema","ProgressSchema","ProgressNotificationSchema","ProgressNotificationParamsSchema","ProgressTokenSchema","PromptSchema","PromptArgumentSchema","PromptListChangedNotificationSchema","PromptMessageSchema","PromptReferenceSchema","ReadResourceRequestSchema","ReadResourceRequestParamsSchema","ReadResourceResultSchema","RelatedTaskMetadataSchema","RequestSchema","RequestIdSchema","RequestMetaSchema","ResourceSchema","ResourceContentsSchema","ResourceLinkSchema","ResourceListChangedNotificationSchema","ResourceRequestParamsSchema","ResourceTemplateSchema","ResourceTemplateReferenceSchema","ResourceUpdatedNotificationSchema","ResourceUpdatedNotificationParamsSchema","ResultMetaObjectSchema","ResultSchema","RoleSchema","RootSchema","RootsListChangedNotificationSchema","SamplingContentSchema","SamplingMessageSchema","SamplingMessageContentBlockSchema","ServerCapabilitiesSchema","ServerNotificationSchema","ServerRequestSchema","ServerResultSchema","SetLevelRequestSchema","SetLevelRequestParamsSchema","SingleSelectEnumSchemaSchema","StringSchemaSchema","SubscribeRequestSchema","SubscribeRequestParamsSchema","SubscriptionFilterSchema","SubscriptionsAcknowledgedNotificationSchema","SubscriptionsAcknowledgedNotificationParamsSchema","SubscriptionsListenRequestSchema","SubscriptionsListenRequestParamsSchema","SubscriptionsListenResultSchema","SubscriptionsListenResultMetaSchema","TaskAugmentedRequestParamsSchema","TaskCreationParamsSchema","TaskMetadataSchema","TaskSchema","TaskStatusSchema","TaskStatusNotificationSchema","TaskStatusNotificationParamsSchema","TextContentSchema","TextResourceContentsSchema","TitledMultiSelectEnumSchemaSchema","TitledSingleSelectEnumSchemaSchema","ToolSchema","ToolAnnotationsSchema","ToolChoiceSchema","ToolExecutionSchema","ToolListChangedNotificationSchema","ToolResultContentSchema","ToolUseContentSchema","UnsubscribeRequestSchema","UnsubscribeRequestParamsSchema","UntitledMultiSelectEnumSchemaSchema","UntitledSingleSelectEnumSchemaSchema"],vy={IdJagTokenExchangeResponseSchema:zi,OAuthClientInformationFullSchema:jt,OAuthClientInformationSchema:On,OAuthClientMetadataSchema:hu,OAuthClientRegistrationErrorSchema:fu,OAuthErrorResponseSchema:Po,OAuthMetadataSchema:lr,OAuthProtectedResourceMetadataSchema:ur,OAuthTokenRevocationRequestSchema:gu,OAuthTokensSchema:st,OpenIdProviderDiscoveryMetadataSchema:pr,OpenIdProviderMetadataSchema:mu},Gl={},Vl={};function Kl(e,t){let r=e.slice(0,-6);Gl[r]=t,Vl[r]=o=>t.safeParse(o).success}n(Kl,"register");for(let e of by)Kl(e,iy[e]);for(let[e,t]of Object.entries(vy))Kl(e,t);var Cy=Object.freeze(Gl),Iy=Object.freeze(Vl);function Ty(e){switch(e){case"initialize":case"notifications/initialized":return Bn(void 0);case"server/discover":return Bn(cs);default:return}}n(Ty,"bootstrapOutboundCodec");var Wl=6e4,ky=[sr,En,cr,xn],Ay=["inputResponses","requestState"];function gl(e,t){let r=e.params;if(!Wi(r))return{message:e,lifted:{}};let o=r._meta,i=Wi(o)?ky.filter(u=>u in o):[],s=t==="request"?Ay.filter(u=>u in r):[];if(i.length===0&&s.length===0)return{message:e,lifted:{}};let a={},c={...r};if(i.length>0&&Wi(o)){let u={},p={...o};for(let h of i)u[h]=o[h],delete p[h];a.envelope=u,Object.keys(p).length>0?c._meta=p:delete c._meta}for(let u of s)u==="inputResponses"&&(a.inputResponses=c[u]),u==="requestState"&&(a.requestState=c[u]),delete c[u];return{message:{...e,params:c},lifted:a}}n(gl,"liftWireOnlyMaterial");function yl(e,t){let r=e.validateResult(t,void 0);if(!(!r.ok&&r.reason==="not-in-era"))return{"~standard":{version:1,vendor:"mcp-wire-codec",validate(o){let i=e.validateResult(t,o);return i.ok?{value:i.value}:{issues:[{message:i.reason==="invalid"?i.message:`not-in-era: ${t}`}]}}}}}n(yl,"codecResultValidator");function Zl(e){return()=>e}n(Zl,"requestStateAccessor");var Py=Zl(void 0),Ey,xy=class{static{n(this,"Protocol")}_transport;_requestMessageId=0;_requestHandlers=new Map;_requestHandlerAbortControllers=new Map;_notificationHandlers=new Map;_responseHandlers=new Map;_progressHandlers=new Map;_timeoutInfo=new Map;_pendingDebouncedNotifications=new Set;_negotiatedProtocolVersion;static{Ey=n((e,t)=>{e._negotiatedProtocolVersion=t},"writeNegotiatedProtocolVersion")}_supportedProtocolVersions;onclose;onerror;fallbackRequestHandler;fallbackNotificationHandler;constructor(e){this._options=e,this._supportedProtocolVersions=e?.supportedProtocolVersions??bi,this.setNotificationHandler("notifications/cancelled",t=>{this._oncancel(t)}),this.setNotificationHandler("notifications/progress",t=>{this._onprogress(t)}),this.setRequestHandler("ping",t=>({}))}_shouldDropInbound(e){}_outboundMetaEnvelope(){}_envelopeOutbound(e){let t=this._outboundMetaEnvelope();if(t===void 0)return e;let r=e.params??{};return{...e,params:{...r,_meta:{...t,...r._meta}}}}_resolveNonCompleteResult(e,t){return Promise.reject(new te(ie.UnsupportedResultType,`Unsupported result type '${e.kind}' for ${t.request.method}`,{resultType:e.kind,method:t.request.method}))}_getRequestHandler(e){return this._requestHandlers.get(e)}async _oncancel(e){e.params.requestId&&this._requestHandlerAbortControllers.get(e.params.requestId)?.abort(e.params.reason)}_setupTimeout(e,t,r,o,i=!1){this._timeoutInfo.set(e,{timeoutId:setTimeout(o,t),startTime:Date.now(),timeout:t,maxTotalTimeout:r,resetTimeoutOnProgress:i,onTimeout:o})}_resetTimeout(e){let t=this._timeoutInfo.get(e);if(!t)return!1;let r=Date.now()-t.startTime;if(t.maxTotalTimeout&&r>=t.maxTotalTimeout)throw this._timeoutInfo.delete(e),new te(ie.RequestTimeout,"Maximum total timeout exceeded",{maxTotalTimeout:t.maxTotalTimeout,totalElapsed:r});return clearTimeout(t.timeoutId),t.timeoutId=setTimeout(t.onTimeout,t.timeout),!0}_cleanupTimeout(e){let t=this._timeoutInfo.get(e);t&&(clearTimeout(t.timeoutId),this._timeoutInfo.delete(e))}async connect(e){this._transport=e;let t=this.transport?.onclose;this._transport.onclose=()=>{try{t?.()}finally{this._onclose()}};let r=this.transport?.onerror;this._transport.onerror=i=>{r?.(i),this._onerror(i)};let o=this._transport?.onmessage;this._transport.onmessage=(i,s)=>{o?.(i,s),Xi(i)||Fl(i)?this._onresponse(i):Hl(i)?this._onrequest(i,s):Bl(i)?this._onnotification(i,s):this._onerror(new Error(`Unknown message type: ${JSON.stringify(i)}`))},e.setSupportedProtocolVersions?.(this._supportedProtocolVersions),await this._transport.start()}_onclose(){let e=this._responseHandlers;this._responseHandlers=new Map,this._progressHandlers.clear(),this._pendingDebouncedNotifications.clear();for(let o of this._timeoutInfo.values())clearTimeout(o.timeoutId);this._timeoutInfo.clear();let t=this._requestHandlerAbortControllers;this._requestHandlerAbortControllers=new Map;let r=new te(ie.ConnectionClosed,"Connection closed");this._transport=void 0;try{this.onclose?.()}finally{for(let o of e.values())o(r);for(let o of t.values())o.abort(r)}}_onerror(e){this.onerror?.(e)}_onnotification(e,t){let{message:r}=gl(e,"notification"),o=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop")return;if(t?.classification!==void 0){let a=ml(t.classification);if(a!==o.era){this._onerror(new Error(`Era mismatch on inbound notification '${r.method}': classified as ${a} but this instance serves ${o.era}`));return}}if(Vi(r.method)&&!o.hasNotificationMethod(r.method))return;let i=this._notificationHandlers.get(r.method),s=this.fallbackNotificationHandler;i===void 0&&s===void 0||Promise.resolve().then(()=>i===void 0?s(r):i(r,o)).catch(a=>this._onerror(new Error(`Uncaught error in notification handler: ${a}`)))}_onrequest(e,t){let{message:r,lifted:o}=gl(e,"request"),i=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop"){this._onerror(new Error(`Dropped inbound request '${e.method}': not servable on this connection's protocol era`));return}let s=this._transport,a=n((w,C,U)=>{let O={jsonrpc:"2.0",id:r.id,error:{code:w,message:C,...U!==void 0&&{data:U}}};s?.send(O).catch(L=>this._onerror(new Error(`Failed to send an error response: ${L}`)))},"sendErrorResponse");if(t?.classification!==void 0){let w=ml(t.classification);if(w!==i.era){this._onerror(new Error(`Era mismatch on inbound request '${r.method}': classified as ${w} but this instance serves ${i.era}`));let C=t.classification.revision??w;a(P.UnsupportedProtocolVersion,`Unsupported protocol version: ${C}`,{supported:this._supportedProtocolVersions,requested:C});return}}if(Gi(r.method)&&!i.hasRequestMethod(r.method)){a(P.MethodNotFound,"Method not found");return}let c=this._requestHandlers.get(r.method)??this.fallbackRequestHandler;if(c===void 0){a(P.MethodNotFound,"Method not found");return}let u=i.checkInboundEnvelope(o);if(u!==void 0){a(P.InvalidParams,u);return}let p=n((w,C)=>this._notificationViaCodec(this._resolveOutboundCodec(w.method),w,{...C,relatedRequestId:r.id}),"sendNotification"),h=n((w,C,U)=>this._requestWithSchemaViaCodec(this._resolveOutboundCodec(w.method),w,C,{...U,relatedRequestId:r.id}),"sendRequest"),g=new AbortController;this._requestHandlerAbortControllers.set(r.id,g);let S=o.inputResponses===void 0?void 0:Uy(o.inputResponses),y={sessionId:s?.sessionId,mcpReq:{id:r.id,method:r.method,_meta:r.params?._meta,...o.envelope!==void 0&&{envelope:o.envelope},...S!==void 0&&{inputResponses:S.accepted},...S!==void 0&&S.droppedKeys.length>0&&{droppedInputResponseKeys:S.droppedKeys},requestState:o.requestState===void 0?Py:Zl(o.requestState),signal:g.signal,send:n(((w,C,U)=>{let O=this._resolveOutboundCodec(w.method);if(this._assertOutboundRequestInEra(O,w.method),Qi(C))return h(w,C,U);let L=yl(O,w.method);if(L===void 0)throw new TypeError(`'${w.method}' is not a spec method; pass a result schema as the second argument to ctx.mcpReq.send().`);return h(w,L,C)}),"send"),notify:p},http:t?.authInfo?{authInfo:t.authInfo}:void 0},k=this.buildContext(y,t);Promise.resolve().then(()=>c(r,k)).then(async w=>{if(g.signal.aborted)return;let C;try{C=i.encodeResult(r.method,w,this._outboundServerInfo())}catch(O){this._onerror(new Error(`Failed to encode result for ${r.method}: ${O}`)),a(P.InternalError,"Internal error");return}let U={result:C,jsonrpc:"2.0",id:r.id};await s?.send(U)},async w=>{if(g.signal.aborted)return;let C=Number.isSafeInteger(w.code)?w.code:P.InternalError,U={jsonrpc:"2.0",id:r.id,error:{code:i.encodeErrorCode(C),message:w.message??"Internal error",...w.data!==void 0&&{data:w.data}}};await s?.send(U)}).catch(w=>this._onerror(new Error(`Failed to send response: ${w}`))).finally(()=>{this._requestHandlerAbortControllers.get(r.id)===g&&this._requestHandlerAbortControllers.delete(r.id)})}_onprogress(e){let{progressToken:t,...r}=e.params,o=Number(t),i=this._progressHandlers.get(o);if(!i){this._onerror(new Error(`Received a progress notification for an unknown token: ${JSON.stringify(e)}`));return}let s=this._responseHandlers.get(o),a=this._timeoutInfo.get(o);if(a&&s&&a.resetTimeoutOnProgress)try{this._resetTimeout(o)}catch(c){this._responseHandlers.delete(o),this._progressHandlers.delete(o),this._cleanupTimeout(o),s(c);return}i(r)}_onresponse(e){let t=Number(e.id),r=this._responseHandlers.get(t);if(r===void 0){this._onerror(new Error(`Received a response for an unknown message ID: ${JSON.stringify(e)}`));return}this._responseHandlers.delete(t),this._cleanupTimeout(t),this._progressHandlers.delete(t),Xi(e)?r(e):r(se.fromError(e.error.code,e.error.message,e.error.data))}get transport(){return this._transport}async close(){await this._transport?.close()}request(e,t,r){let o=this._resolveOutboundCodec(e.method);if(this._assertOutboundRequestInEra(o,e.method),Qi(t))return this._requestWithSchemaViaCodec(o,e,t,r);let i=yl(o,e.method);if(i===void 0)throw new TypeError(`'${e.method}' is not a spec method; pass a result schema as the second argument to request().`);return this._requestWithSchemaViaCodec(o,e,i,t)}_negotiatedWireCodec(){return Bn(this._negotiatedProtocolVersion)}_wireCodec(){return this._negotiatedWireCodec()}_resolveOutboundCodec(e){if(this._negotiatedProtocolVersion===void 0){let t=Ty(e);if(t)return t}return this._negotiatedWireCodec()}_assertOutboundRequestInEra(e,t){if(Gi(t)&&!e.hasRequestMethod(t))throw new te(ie.MethodNotSupportedByProtocolVersion,`Method '${t}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t,era:e.era})}_requestWithSchema(e,t,r){let o=this._resolveOutboundCodec(e.method);return this._assertOutboundRequestInEra(o,e.method),this._requestWithSchemaViaCodec(o,e,t,r)}_requestWithSchemaViaCodec(e,t,r,o){let{relatedRequestId:i,resumptionToken:s,onresumptiontoken:a,headers:c}=o??{},u=Date.now(),p,h;return new Promise((g,S)=>{let y=n(J=>{S(J)},"earlyReject");if(!this._transport){y(new Error("Not connected"));return}if(this._options?.enforceStrictCapabilities===!0)try{this.assertCapabilityForMethod(t.method)}catch(J){y(J);return}if(o?.signal?.aborted){let J=o.signal.reason;throw J instanceof te?J:new te(ie.RequestTimeout,String(J))}let k=e.era===cs&&this._transport.hasPerRequestStream===!0?new AbortController:void 0,w=this._requestMessageId++;h=w;let C={...t,jsonrpc:"2.0",id:w};o?.onprogress&&(this._progressHandlers.set(w,o.onprogress),C.params={...t.params,_meta:{...t.params?._meta,progressToken:w}});let U=this._envelopeOutbound(C),O=!1,L=n(J=>{O||(this._progressHandlers.delete(w),k===void 0?this._transport?.send(this._envelopeOutbound({jsonrpc:"2.0",method:"notifications/cancelled",params:{requestId:w,reason:String(J)}}),{relatedRequestId:i,resumptionToken:s,onresumptiontoken:a}).catch(V=>this._onerror(new Error(`Failed to send cancellation: ${V}`))):k.abort(),S(J instanceof te?J:new te(ie.RequestTimeout,String(J))))},"cancel");this._responseHandlers.set(w,J=>{if(o?.signal?.aborted)return;if(O=!0,J instanceof Error)return S(J);let V;try{V=e.decodeResult(t.method,J.result)}catch(oe){return S(oe instanceof Error?oe:new Error(String(oe)))}if(V.kind==="invalid")return S(V.error);if(V.kind==="input_required"){if(o?.allowInputRequired===!0)return g(Oy(V));let oe={codec:e,request:t,resultSchema:r,options:o,flowStartedAt:u,retry:n((ze,D)=>this._requestWithSchemaViaCodec(e,ze===void 0?{method:t.method}:{method:t.method,params:ze},r,D),"retry")};return g(this._resolveNonCompleteResult(V,oe))}let Le=V.result;Ki(r,Le).then(oe=>{oe.success?g(oe.data):S(new te(ie.InvalidResult,`Invalid result for ${t.method}: ${oe.error}`))},S)}),p=n(()=>L(o?.signal?.reason),"onAbort"),o?.signal?.addEventListener("abort",p,{once:!0});let F=o?.timeout??Wl,Q=n(()=>L(new te(ie.RequestTimeout,"Request timed out",{timeout:F})),"timeoutHandler");this._setupTimeout(w,F,o?.maxTotalTimeout,Q,o?.resetTimeoutOnProgress??!1),this._transport.send(U,{relatedRequestId:i,resumptionToken:s,onresumptiontoken:a,headers:c,requestSignal:k?.signal}).catch(J=>{this._progressHandlers.delete(w),S(J)})}).finally(()=>{p&&o?.signal?.removeEventListener("abort",p),h!==void 0&&(this._responseHandlers.delete(h),this._cleanupTimeout(h))})}async notification(e,t){return this._notificationViaCodec(this._resolveOutboundCodec(e.method),e,t)}async _notificationViaCodec(e,t,r){if(!this._transport)throw new te(ie.NotConnected,"Not connected");if(Vi(t.method)&&!e.hasNotificationMethod(t.method))throw new te(ie.MethodNotSupportedByProtocolVersion,`Notification '${t.method}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t.method,era:e.era});this.assertNotificationCapability(t.method);let o=this._envelopeOutbound({jsonrpc:"2.0",...t});if((this._options?.debouncedNotificationMethods??[]).includes(t.method)&&!t.params&&!r?.relatedRequestId){if(this._pendingDebouncedNotifications.has(t.method))return;this._pendingDebouncedNotifications.add(t.method),Promise.resolve().then(()=>{this._pendingDebouncedNotifications.delete(t.method),this._transport&&this._transport?.send(o,r).catch(i=>this._onerror(i))});return}await this._transport.send(o,r)}setRequestHandler(e,t,r){this.assertRequestHandlerCapability(e);let o;if(typeof t=="function"){if(!Gi(e))throw new TypeError(`'${e}' is not a spec request method; pass schemas as the second argument to setRequestHandler().`);o=n((i,s)=>{let a=this._negotiatedWireCodec(),c=a.validateRequest(e,i);if(!c.ok&&c.reason==="not-in-era"&&(c=a.validateInputRequest(e,i)),!c.ok)throw c.reason==="not-in-era"?new se(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(c.message);return Promise.resolve(t(c.value,s))},"stored")}else if(r)o=n(async(i,s)=>{let a=await Ki(t.params,{...i.params});if(!a.success)throw new se(P.InvalidParams,`Invalid params for ${e}: ${a.error}`);return r(a.data,s)},"stored");else throw new TypeError("setRequestHandler: handler is required");this._requestHandlers.set(e,this._wrapHandler(e,o))}_wrapHandler(e,t){return t}_outboundServerInfo(){}removeRequestHandler(e){this._requestHandlers.delete(e)}assertCanSetRequestHandler(e){if(this._requestHandlers.has(e))throw new Error(`A request handler for ${e} already exists, which would be overridden`)}setNotificationHandler(e,t,r){if(typeof t=="function"){if(!Vi(e))throw new TypeError(`'${e}' is not a spec notification method; pass schemas as the second argument to setNotificationHandler().`);this._notificationHandlers.set(e,(o,i)=>{let s=i.validateNotification(e,o);if(!s.ok)throw s.reason==="not-in-era"?new se(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(s.message);return Promise.resolve(t(s.value))});return}if(!r)throw new TypeError("setNotificationHandler: handler is required");this._notificationHandlers.set(e,async o=>{let i=await Ki(t.params,{...o.params});if(!i.success)throw new se(P.InvalidParams,`Invalid params for notification ${e}: ${i.error}`);await r(i.data,o)})}removeNotificationHandler(e){this._notificationHandlers.delete(e)}};function Wi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Wi,"isPlainObject$1");function Sl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n(Sl,"isPlainObject");function Uy(e){let t={},r=[];if(!Sl(e))return{accepted:t,droppedKeys:r};for(let[o,i]of Object.entries(e)){if(!Sl(i)||"method"in i||"result"in i){r.push(o);continue}t[o]=i}return{accepted:t,droppedKeys:r}}n(Uy,"partitionInputResponses");function Oy(e){return{resultType:"input_required",inputRequests:e.inputRequests,...e.requestState!==void 0&&{requestState:e.requestState}}}n(Oy,"manualInputRequiredValue");var qy=sl((e=>{var t=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,r=/\\([\u000b\u0020-\u00ff])/g,o=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;e.parse=i;function i(c){if(!c)throw new TypeError("argument string is required");var u=typeof c=="object"?s(c):c;if(typeof u!="string")throw new TypeError("argument string is required to be a string");var p=u.indexOf(";"),h=p!==-1?u.slice(0,p).trim():u.trim();if(!o.test(h))throw new TypeError("invalid media type");var g=new a(h.toLowerCase());if(p!==-1){var S,y,k;for(t.lastIndex=p;y=t.exec(u);){if(y.index!==p)throw new TypeError("invalid parameter format");p+=y[0].length,S=y[1].toLowerCase(),k=y[2],k.charCodeAt(0)===34&&(k=k.slice(1,-1),k.indexOf("\\")!==-1&&(k=k.replace(r,"$1"))),g.parameters[S]=k}if(p!==u.length)throw new TypeError("invalid parameter format")}return g}n(i,"parse");function s(c){var u;if(typeof c.getHeader=="function"?u=c.getHeader("content-type"):typeof c.headers=="object"&&(u=c.headers&&c.headers["content-type"]),typeof u!="string")throw new TypeError("content-type header is missing from object");return u}n(s,"getcontenttype");function a(c){this.parameters=Object.create(null),this.type=c}n(a,"ContentType")})),UI=cl(qy(),1);var zy=10*1024*1024;function ls(){rs(),lt(),Ag(),Wg(),oy()}n(ls,"preloadSchemas");var FI=typeof self<"u"&&self.location&&self.location.origin!=="null"?new URL(self.location.origin+self.location.pathname+location.search):new URL("https://github.com/cfworker");var My=/^(\d\d\d\d)-(\d\d)-(\d\d)$/,jy=[0,31,28,31,30,31,30,31,31,30,31,30,31],Ny=/^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i,$y=/^(?=.{1,253}\.?$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*\.?$/i,Dy=/^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,Ly=/^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,Hy=/^(?:(?:https?|ftp):\/\/)(?:\S+(?::\S*)?@)?(?:(?!10(?:\.\d{1,3}){3})(?!127(?:\.\d{1,3}){3})(?!169\.254(?:\.\d{1,3}){2})(?!192\.168(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)(?:\.(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu,By=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,Fy=/^(?:\/(?:[^~/]|~0|~1)*)*$/,Jy=/^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,Gy=/^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/,Vy=n(e=>{if(e[0]==='"')return!1;let[t,r,...o]=e.split("@");return!t||!r||o.length!==0||t.length>64||r.length>253||t[0]==="."||t.endsWith(".")||t.includes("..")||!/^[a-z0-9.-]+$/i.test(r)||!/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+$/i.test(t)?!1:r.split(".").every(i=>/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i.test(i))},"EMAIL"),Ky=/^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,Wy=/^((([0-9a-f]{1,4}:){7}([0-9a-f]{1,4}|:))|(([0-9a-f]{1,4}:){6}(:[0-9a-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){5}(((:[0-9a-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){4}(((:[0-9a-f]{1,4}){1,3})|((:[0-9a-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){3}(((:[0-9a-f]{1,4}){1,4})|((:[0-9a-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){2}(((:[0-9a-f]{1,4}){1,5})|((:[0-9a-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){1}(((:[0-9a-f]{1,4}){1,6})|((:[0-9a-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9a-f]{1,4}){1,7})|((:[0-9a-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))$/i,Zy=n(e=>e.length>1&&e.length<80&&(/^P\d+([.,]\d+)?W$/.test(e)||/^P[\dYMDTHS]*(\d[.,]\d+)?[YMDHS]$/.test(e)&&/^P([.,\d]+Y)?([.,\d]+M)?([.,\d]+D)?(T([.,\d]+H)?([.,\d]+M)?([.,\d]+S)?)?$/.test(e)),"DURATION");function Ne(e){return e.test.bind(e)}n(Ne,"bind");var JI={date:Yl,time:Xl.bind(void 0,!1),"date-time":Qy,duration:Zy,uri:rS,"uri-reference":Ne(Dy),"uri-template":Ne(Ly),url:Ne(Hy),email:Vy,hostname:Ne($y),ipv4:Ne(Ky),ipv6:Ne(Wy),regex:oS,uuid:Ne(By),"json-pointer":Ne(Fy),"json-pointer-uri-fragment":Ne(Jy),"relative-json-pointer":Ne(Gy)};function Yy(e){return e%4===0&&(e%100!==0||e%400===0)}n(Yy,"isLeapYear");function Yl(e){let t=e.match(My);if(!t)return!1;let r=+t[1],o=+t[2],i=+t[3];return o>=1&&o<=12&&i>=1&&i<=(o==2&&Yy(r)?29:jy[o])}n(Yl,"date");function Xl(e,t){let r=t.match(Ny);if(!r)return!1;let o=+r[1],i=+r[2],s=+r[3],a=!!r[5];return(o<=23&&i<=59&&s<=59||o==23&&i==59&&s==60)&&(!e||a)}n(Xl,"time");var Xy=/t|\s/i;function Qy(e){let t=e.split(Xy);return t.length==2&&Yl(t[0])&&Xl(!0,t[1])}n(Qy,"date_time");var eS=/\/|:/,tS=/^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;function rS(e){return eS.test(e)&&tS.test(e)}n(rS,"uri");var nS=/[^\\]\\Z/;function oS(e){if(nS.test(e))return!1;try{return new RegExp(e,"u"),!0}catch{return!1}}n(oS,"regex");ls();var Ql=!1;var ps;ps=globalThis.crypto;async function sS(e){return(await ps).getRandomValues(new Uint8Array(e))}n(sS,"getRandomValues");async function aS(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,o="";for(;o.length<e;){let i=await sS(e-o.length);for(let s of i)s<r&&(o+=t[s%t.length])}return o}n(aS,"random");async function cS(e){return await aS(e)}n(cS,"generateVerifier");async function dS(e){let t=await(await ps).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}n(dS,"generateChallenge");async function ms(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await cS(e),r=await dS(t);return{code_verifier:t,code_challenge:r}}n(ms,"pkceChallenge");var Jn=class extends Error{static{n(this,"OAuthClientFlowError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthClientFlowError"})}static[Symbol.hasInstance](e){return be(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,e)}constructor(e){super(e),this.name=new.target.name,$t(this,new.target)}},Ss=class extends Jn{static{n(this,"IssuerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.IssuerMismatchError"})}kind;expected;received;constructor(e,t,r){super(`Issuer mismatch in ${e==="metadata"?"authorization server metadata (RFC 8414 \xA73.3)":"authorization response (RFC 9207)"}: expected ${JSON.stringify(t)}, received ${JSON.stringify(r)}`),this.kind=e,this.expected=t,this.received=r}},uS=class extends Jn{static{n(this,"RegistrationRejectedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.RegistrationRejectedError"})}status;body;submittedMetadata;constructor(e){super(`Dynamic Client Registration rejected (HTTP ${e.status}): ${e.body}`),this.status=e.status,this.body=e.body,this.submittedMetadata=e.submittedMetadata}},np=class extends Jn{static{n(this,"InsecureTokenEndpointError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsecureTokenEndpointError"})}tokenEndpoint;constructor(e){super(`Refusing to send credentials to non-https token endpoint '${e}'. OAuth token requests MUST use TLS (localhost / 127.0.0.1 / ::1 are exempt).`),this.tokenEndpoint=e}},hs=class extends Jn{static{n(this,"AuthorizationServerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.AuthorizationServerMismatchError"})}constructor(e,t){super(`Authorization server changed between redirect and callback (redirected to ${JSON.stringify(e)}, callback resolved ${JSON.stringify(t)}); refusing to send authorization_code/code_verifier to a different token endpoint`),this.recordedIssuer=e,this.currentIssuer=t}},UT=class extends Jn{static{n(this,"InsufficientScopeError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsufficientScopeError"})}requiredScope;resourceMetadataUrl;errorDescription;constructor(e){super(`Insufficient scope${e.requiredScope?`: required "${e.requiredScope}"`:""}`),this.requiredScope=e.requiredScope,this.resourceMetadataUrl=e.resourceMetadataUrl,this.errorDescription=e.errorDescription}};function ep(e,t,r){if(e!==void 0)return e.issuer===void 0?(r?.canPersistStamp!==!1&&console.warn("[mcp-sdk] SEP-2352: stored OAuth credential has no 'issuer' stamp (pre-upgrade storage or provider not round-tripping the value). SEP-2352 isolation is inactive for this read; ensure your provider round-trips the issuer field."),e):op(e.issuer,t)?e:void 0}n(ep,"discardIfIssuerMismatch");function op(e,t){return e===t||e.endsWith("/")&&e.slice(0,-1)===t||t.endsWith("/")&&t.slice(0,-1)===e}n(op,"issuersMatch");var OT=class extends Error{static{n(this,"UnauthorizedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnauthorizedError"})}static[Symbol.hasInstance](e){return be(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,e)}constructor(e){super(e??"Unauthorized"),this.name="UnauthorizedError",$t(this,new.target)}};function ip(e){return e?.authorization_response_iss_parameter_supported===!0}n(ip,"isIssParameterSupported");function sp({iss:e,expectedIssuer:t,issParameterSupported:r}){if(t!==void 0){if(e===void 0){if(r)throw new Ss("authorization_response",t,void 0);return}if(e!==t)throw new Ss("authorization_response",t,e)}}n(sp,"validateAuthorizationResponseIssuer");function lS(e){return["client_secret_basic","client_secret_post","none"].includes(e)}n(lS,"isClientAuthMethod");var fs="code",gs="S256";function pS(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&lS(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}n(pS,"selectClientAuthMethod");function mS(e,t,r,o){let{client_id:i,client_secret:s}=t;switch(e){case"client_secret_basic":hS(i,s,r);return;case"client_secret_post":fS(i,s,o);return;case"none":gS(i,o);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}n(mS,"applyClientAuthentication");function hS(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let o=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${o}`)}n(hS,"applyBasicAuth");function fS(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}n(fS,"applyPostAuth");function gS(e,t){t.set("client_id",e)}n(gS,"applyPublicAuth");function ap(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}n(ap,"isLoopbackHost");function yS(e){let t=new URL(String(e));if(t.protocol!=="https:"&&!ap(t.hostname))throw new np(t.href);return t}n(yS,"assertSecureTokenEndpoint");function SS(e){for(let t of e??[]){let r;try{r=new URL(t)}catch{continue}if(r.protocol!=="http:"&&r.protocol!=="https:"||ap(r.hostname))return"native"}return"web"}n(SS,"deriveApplicationType");function _S(e){let t=e.clientMetadata;return{...t,grant_types:t.grant_types??(e.redirectUrl===void 0?void 0:["authorization_code","refresh_token"]),application_type:t.application_type??SS(t.redirect_uris)}}n(_S,"resolveClientMetadata");async function tp(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let o=Po.parse(JSON.parse(r));return pt.fromResponse(o)}catch(o){let i=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${o}. Raw body: ${r}`;return new pt(ue.ServerError,i)}}n(tp,"parseErrorResponse");async function _s(e,t){try{return await ys(e,t)}catch(r){if(r instanceof pt){if(r.code===ue.InvalidClient||r.code===ue.UnauthorizedClient)return await e.invalidateCredentials?.("client"),await e.invalidateCredentials?.("tokens"),await ys(e,t);if(r.code===ue.InvalidGrant)return await e.invalidateCredentials?.("tokens"),await ys(e,t)}throw r}}n(_s,"auth");function wS(e){let{requestedScope:t,resourceMetadata:r,authServerMetadata:o,clientMetadata:i}=e,s=t||r?.scopes_supported?.join(" ")||i.scope;return s&&o?.scopes_supported?.includes("offline_access")&&!s.split(" ").includes("offline_access")&&i.grant_types?.includes("refresh_token")&&(s=`${s} offline_access`),s}n(wS,"determineScope");async function ys(e,{serverUrl:t,authorizationCode:r,iss:o,scope:i,resourceMetadataUrl:s,fetchFn:a,skipIssuerMetadataValidation:c,forceReauthorization:u}){let p=_S(e),h=await e.discoveryState?.(),g,S,y,k,w=s;if(!w&&h?.resourceMetadataUrl&&(w=new URL(h.resourceMetadataUrl)),h?.authorizationServerUrl){if(S=h.authorizationServerUrl,g=h.resourceMetadata,y=h.authorizationServerMetadata??await lp(S,{fetchFn:a,skipIssuerValidation:c}),!g)try{g=await dp(t,{resourceMetadataUrl:w},a)}catch(D){if(D instanceof TypeError)throw D}(y!==h.authorizationServerMetadata||g!==h.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(S),resourceMetadataUrl:w?.toString(),resourceMetadata:g,authorizationServerMetadata:y})}else{let D=await TS(t,{resourceMetadataUrl:w,fetchFn:a,skipIssuerMetadataValidation:c});S=D.authorizationServerUrl,y=D.authorizationServerMetadata,g=D.resourceMetadata,k={authorizationServerUrl:String(S),resourceMetadataUrl:w?.toString(),resourceMetadata:g,authorizationServerMetadata:y}}let C=y?.issuer??String(S),U={issuer:C};if(await e.saveAuthorizationServerUrl?.(C),r!==void 0){let D=h?.authorizationServerMetadata?.issuer??h?.authorizationServerUrl;if(D===void 0){if(e.saveDiscoveryState!==void 0)throw new hs("discoveryState was not available on the callback leg; ensure your provider persists discoveryState alongside codeVerifier",C);console.warn("[mcp-sdk] OAuthClientProvider does not implement saveDiscoveryState()/discoveryState(); the SEP-2352 callback-leg authorization-server binding cannot be checked. Implement discoveryState (persist alongside codeVerifier) \u2014 see docs/migration/upgrade-to-v2.md \xA7SEP-2352.")}else if(!op(D,C))throw new hs(D,C)}k&&await e.saveDiscoveryState?.(k);let O=await RS(t,e,g);O&&await e.saveResourceUrl?.(String(O));let L=wS({requestedScope:i,resourceMetadata:g,authServerMetadata:y,clientMetadata:e.clientMetadata}),F=await Promise.resolve(e.clientInformation(U)),Q=ep(F,C,{canPersistStamp:e.saveClientInformation!==void 0});if(Q===void 0&&F?.issuer&&e.saveClientInformation===void 0)throw new hs(F.issuer,C);if(Q&&Q.issuer===void 0&&(Q={...Q,issuer:C},await e.saveClientInformation?.(Q,U)),!Q){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let D=y?.client_id_metadata_document_supported===!0,Ee=e.clientMetadataUrl;if(Ee&&!ws(Ee))throw new pt(ue.InvalidClientMetadata,`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${Ee}`);if(D&&Ee)Q={client_id:Ee,issuer:C},await e.saveClientInformation?.(Q,U);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");Q={...await xS(S,{metadata:y,clientMetadata:p,scope:L,fetchFn:a}),issuer:C},await e.saveClientInformation(Q,U)}}let J=!e.redirectUrl;if(r!==void 0||J){r!==void 0&&sp({iss:o,expectedIssuer:y?.issuer,issParameterSupported:ip(y)});let D=await ES(e,S,{metadata:y,resource:O,authorizationCode:r,iss:o,scope:L,fetchFn:a});return await e.saveTokens({...D,issuer:C},U),"AUTHORIZED"}let V=ep(await e.tokens(U),C);if(V&&V.issuer===void 0&&(V={...V,issuer:C},await e.saveTokens(V,U)),V?.refresh_token&&!u)try{let D=await PS(S,{metadata:y,clientInformation:Q,refreshToken:V.refresh_token,resource:O,addClientAuthentication:e.addClientAuthentication,fetchFn:a});return await e.saveTokens({...D,issuer:C},U),"AUTHORIZED"}catch(D){if(D instanceof np||!(!(D instanceof pt)||D.code===ue.ServerError))throw D}let Le=e.state?await e.state():void 0,{authorizationUrl:oe,codeVerifier:ze}=await kS(S,{metadata:y,clientInformation:Q,state:Le,redirectUrl:e.redirectUrl,scope:L,resource:O});return await e.saveCodeVerifier(ze),await e.redirectToAuthorization(oe),"REDIRECT"}n(ys,"authInternal");function ws(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}n(ws,"isHttpsUrl");async function RS(e,t,r){let o=wl(e);if(t.validateResourceURL)return await t.validateResourceURL(o,r?.resource);if(r){if(!Rl({requestedResource:o,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${o} (or origin)`);return new URL(r.resource)}}n(RS,"selectResourceURL");function cp(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,o]=t.split(" ");if(r?.toLowerCase()!=="bearer"||!o)return{};let i=Vo(e,"resource_metadata")||void 0,s;if(i)try{s=new URL(i)}catch{}let a=Vo(e,"scope")||void 0,c=Vo(e,"error")||void 0,u=Vo(e,"error_description")||void 0;return{resourceMetadataUrl:s,scope:a,error:c,errorDescription:u}}n(cp,"extractWWWAuthenticateParams");function Vo(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let o=new RegExp(String.raw`${t}=(?:"([^"]+)"|([^\s,]+))`),i=r.match(o);if(i){let s=i[1]||i[2];if(s)return s}return null}n(Vo,"extractFieldFromWwwAuth");async function dp(e,t,r=fetch){let o=await CS(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!o||o.status===404)throw await o?.text?.().catch(()=>{}),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!o.ok)throw await o.text?.().catch(()=>{}),new Error(`HTTP ${o.status} trying to load well-known OAuth protected resource metadata.`);return ur.parse(await o.json())}n(dp,"discoverOAuthProtectedResourceMetadata");async function up(e,t,r=fetch){try{return await r(e,{headers:t})}catch(o){if(!(o instanceof TypeError)||!Ql)throw o;if(t)try{return await r(e,{})}catch(i){if(!(i instanceof TypeError))throw i;return}return}}n(up,"fetchWithCorsRetry");function bS(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}n(bS,"buildWellKnownPath");async function rp(e,t,r=fetch){return await up(e,{"MCP-Protocol-Version":t},r)}n(rp,"tryMetadataDiscovery");function vS(e,t){return e?t==="/"?!1:e.status>=400&&e.status<500||e.status===502:!0}n(vS,"shouldAttemptFallback");async function CS(e,t,r,o){let i=new URL(e),s=o?.protocolVersion??Co,a;if(o?.metadataUrl)a=new URL(o.metadataUrl);else{let u=bS(t,i.pathname);a=new URL(u,o?.metadataServerUrl??i),a.search=i.search}let c=await rp(a,s,r);return!o?.metadataUrl&&vS(c,i.pathname)&&(c=await rp(new URL(`/.well-known/${t}`,i),s,r)),c}n(CS,"discoverMetadataWithFallback");function IS(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",o=[];if(!r)return o.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"},{url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),o;let i=t.pathname;return i.endsWith("/")&&(i=i.slice(0,-1)),o.push({url:new URL(`/.well-known/oauth-authorization-server${i}`,t.origin),type:"oauth"},{url:new URL(`/.well-known/openid-configuration${i}`,t.origin),type:"oidc"},{url:new URL(`${i}/.well-known/openid-configuration`,t.origin),type:"oidc"}),o}n(IS,"buildDiscoveryUrls");async function lp(e,{fetchFn:t=fetch,protocolVersion:r=Co,skipIssuerValidation:o=!1}={}){let i={"MCP-Protocol-Version":r,Accept:"application/json"},s=IS(e);for(let{url:a,type:c}of s){let u=await up(a,i,t);if(!u)continue;if(!u.ok){if(await u.text?.().catch(()=>{}),u.status>=400&&u.status<500||u.status===502)continue;throw new Error(`HTTP ${u.status} trying to load ${c==="oauth"?"OAuth":"OpenID provider"} metadata from ${a}`)}let p=c==="oauth"?lr.parse(await u.json()):pr.parse(await u.json());if(!o){let h=typeof e=="string"?e:e.href;if(!(p.issuer===h||h.endsWith("/")&&p.issuer===h.slice(0,-1)))throw new Ss("metadata",h,p.issuer)}return p}}n(lp,"discoverAuthorizationServerMetadata");async function TS(e,t){let r,o;try{r=await dp(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(o=r.authorization_servers[0])}catch(s){if(s instanceof TypeError)throw s}o||(o=String(new URL("/",e)));let i=await lp(o,{fetchFn:t?.fetchFn,skipIssuerValidation:t?.skipIssuerMetadataValidation});return{authorizationServerUrl:o,authorizationServerMetadata:i,resourceMetadata:r}}n(TS,"discoverOAuthServerInfo");async function kS(e,{metadata:t,clientInformation:r,redirectUrl:o,scope:i,state:s,resource:a}){let c;if(t){if(c=new URL(t.authorization_endpoint),!t.response_types_supported.includes(fs))throw new Error(`Incompatible auth server: does not support response type ${fs}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(gs))throw new Error(`Incompatible auth server: does not support code challenge method ${gs}`)}else c=new URL("/authorize",e);let u=await ms(),p=u.code_verifier,h=u.code_challenge;return c.searchParams.set("response_type",fs),c.searchParams.set("client_id",r.client_id),c.searchParams.set("code_challenge",h),c.searchParams.set("code_challenge_method",gs),c.searchParams.set("redirect_uri",String(o)),s&&c.searchParams.set("state",s),i&&c.searchParams.set("scope",i),i?.split(" ").includes("offline_access")&&c.searchParams.append("prompt","consent"),a&&c.searchParams.set("resource",a.href),{authorizationUrl:c,codeVerifier:p}}n(kS,"startAuthorization");function AS(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}n(AS,"prepareAuthorizationCodeRequest");async function pp(e,{metadata:t,tokenRequestParams:r,clientInformation:o,addClientAuthentication:i,resource:s,fetchFn:a}){let c=yS(t?.token_endpoint??new URL("/token",e)),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});s&&r.set("resource",s.href),i?await i(u,r,c,t):o&&mS(pS(o,t?.token_endpoint_auth_methods_supported??[]),o,u,r);let p=await(a??fetch)(c,{method:"POST",headers:u,body:r});if(!p.ok)throw await tp(p);let h=await p.json();try{return st.parse(h)}catch(g){throw typeof h=="object"&&h!==null&&"error"in h?await tp(JSON.stringify(h)):g}}n(pp,"executeTokenRequest");async function PS(e,{metadata:t,clientInformation:r,refreshToken:o,resource:i,addClientAuthentication:s,fetchFn:a}){return{refresh_token:o,...await pp(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:"refresh_token",refresh_token:o}),clientInformation:r,addClientAuthentication:s,resource:i,fetchFn:a})}}n(PS,"refreshAuthorization");async function ES(e,t,{metadata:r,resource:o,authorizationCode:i,iss:s,scope:a,fetchFn:c}={}){i!==void 0&&sp({iss:s,expectedIssuer:r?.issuer,issParameterSupported:ip(r)});let u=a??e.clientMetadata.scope,p;if(e.prepareTokenRequest&&(p=await e.prepareTokenRequest(u)),!p){if(!i)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");p=AS(i,await e.codeVerifier(),e.redirectUrl)}let h=await e.clientInformation({issuer:r?.issuer??String(t)});return pp(t,{metadata:r,tokenRequestParams:p,clientInformation:h??void 0,addClientAuthentication:e.addClientAuthentication,resource:o,fetchFn:c})}n(ES,"fetchToken");async function xS(e,{metadata:t,clientMetadata:r,scope:o,fetchFn:i}){let s;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");s=new URL(t.registration_endpoint)}else s=new URL("/register",e);let a={...r,...o===void 0?{}:{scope:o}},c=await(i??fetch)(s,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(a)});if(!c.ok)throw new uS({status:c.status,body:await c.text(),submittedMetadata:a});return jt.parse(await c.json())}n(xS,"registerClient");var qT=class extends Error{static{n(this,"SseError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SseError"})}static[Symbol.hasInstance](e){return be(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return be(this,e)}constructor(e,t,r){super(`SSE error: ${t}`),this.code=e,this.event=r,$t(this,new.target)}};function US(e){let t=Mt.safeParse(e);return t.success?t.data.id:void 0}n(US,"parseJsonRpcRequestId");function mp(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return US(t)}catch{return}}n(mp,"readJsonRpcRequestIdFromBody");function Ko(e){return Un.parse({jsonrpc:dr,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}n(Ko,"jsonRpcErrorResponse");function hp(e){return new Go([Ao.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}n(hp,"urlElicitationRequiredError");var Zo=l.record(l.string(),l.unknown()),OS=l.record(l.string(),l.unknown()),ht=l.array(l.string().min(1)).min(1).optional(),qS=l.object({name:l.string().min(1),description:l.string().min(1).optional(),annotations:OS.optional(),_meta:Zo.optional(),roles:ht,groups:ht,public:l.boolean().optional()}).strict(),zS=l.object({name:l.string().min(1),description:l.string().min(1).optional(),_meta:Zo.optional(),roles:ht,groups:ht,public:l.boolean().optional()}).strict(),MS=l.object({uri:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:Zo.optional(),roles:ht,groups:ht,public:l.boolean().optional()}).strict(),jS=l.object({uriTemplate:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:Zo.optional(),roles:ht,groups:ht,public:l.boolean().optional()}).strict(),NS=l.array(l.union([l.string(),qS])),$S=l.array(l.union([l.string(),zS])),DS=l.array(l.union([l.string(),MS])),LS=l.array(l.union([l.string(),jS])),HS=l.object({module:l.unknown(),export:l.string().min(1)}).strict(),BS=l.object({mode:l.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:l.string().min(1).optional(),groupClaim:l.string().min(1).optional(),identifier:HS.optional()}).strict(),FS=l.object({tools:NS.optional(),prompts:$S.optional(),resources:DS.optional(),resourceTemplates:LS.optional(),accessControl:BS.optional()}).strict(),mt=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function JS(e,t){return _u(FS,e,`MCP capability filter policy "${t}"`)}n(JS,"parseMcpCapabilityFilterOptions");function ye(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(ye,"isRecord");function Gn(e){return typeof e.method=="string"?e.method:void 0}n(Gn,"messageMethod");function fp(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}n(fp,"correlationKey");function gp(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}n(gp,"asStringArray");function yp(e,t){if(!ye(e))return[];let r=t in e?e[t]:t.split(".").reduce((o,i)=>ye(o)?o[i]:void 0,e);return Array.isArray(r)?r.filter(o=>typeof o=="string"):typeof r=="string"?r.split(/\s+/).filter(o=>o.length>0):[]}n(yp,"readClaimValues");function vs(e,t){if(typeof e=="string")return{key:e,public:!1};if(!ye(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:gp(e.roles),groups:gp(e.groups),public:e.public===!0}}n(vs,"normalizeEntry");function GS(e,t,r){if(e.public)return!0;let o=e.roles??[],i=e.groups??[];return o.length===0&&i.length===0?!1:o.some(s=>t.has(s))||i.some(s=>r.has(s))}n(GS,"isCallerAllowed");function Wo(e,t,r,o){if(e===void 0)return;let i=[];for(let s of e){let a=vs(s,t);a!==void 0&&GS(a,r,o)&&i.push(a.key)}return i}n(Wo,"allowedKeys");var wp=n((e,t,r)=>{let o=r.accessControl?.roleClaim??"roles",i=r.accessControl?.groupClaim??"groups",s=new Set(yp(e.user?.data,o)),a=new Set(yp(e.user?.data,i));return{tools:Wo(r.tools,"name",s,a),prompts:Wo(r.prompts,"name",s,a),resources:Wo(r.resources,"uri",s,a),resourceTemplates:Wo(r.resourceTemplates,"uriTemplate",s,a)}},"claimsCapabilityResolver");function VS(e,t){let r=[];for(let o of mt){let i=e[o.option];if(i!==void 0)for(let s of i){let a=vs(s,o.itemProperty);if(a===void 0)continue;let c=(a.roles?.length??0)>0||(a.groups?.length??0)>0;a.public&&c&&r.push(`${o.option} "${a.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}n(VS,"assertNoConflictingMarkup");function KS(e,t){let r=[];for(let o of mt){let i=e[o.option];if(i!==void 0)for(let s of i){let a=vs(s,o.itemProperty);a!==void 0&&((a.roles?.length??0)>0||(a.groups?.length??0)>0||a.public)&&r.push(`${o.option} "${a.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}n(KS,"assertNoMarkup");function WS(e,t){let r=e.identifier;if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let o=r.module[r.export];if(typeof o!="function")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let i=o;return async(s,a,c)=>{let u=await i(s,a,c);if(u==null)throw new v(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new v(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}n(WS,"buildCustomResolver");function ZS(e,t){let r=e.accessControl,o=r?.mode??"allPublic";if(o==="function"){if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return WS(r,t)}if(o==="rolesAndGroups")return VS(e,t),wp;KS(e,t)}n(ZS,"buildCapabilityResolver");function YS(e){let t={};for(let r of mt){let o=e[r.option];if(o===void 0)continue;let i=new Map;for(let s of o){let a=r_(s,r.itemProperty);a!==void 0&&i.set(a.key,a)}t[r.option]=i}return t}n(YS,"buildProjectionMaps");function Rs(e){return e===void 0?void 0:mt.find(t=>t.listMethod===e)}n(Rs,"findListRule");function XS(e){return e===void 0?void 0:mt.find(t=>t.directMethods.includes(e))}n(XS,"findDirectRule");function QS(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}n(QS,"directCapabilityAccess");function e_(e){let t=XS(Gn(e));if(t===void 0||!ye(e.raw))return;let r=e.raw.params;if(!ye(r))return;let o=r[t.itemProperty==="uri"?"uri":"name"];return typeof o=="string"?{option:t.option,target:o}:void 0}n(e_,"rawDirectCapabilityAccess");function t_(e){return Response.json(Ko({...e==null?{}:{id:e},error:{code:P.MethodNotFound,message:"Method not found"}}))}n(t_,"methodNotFoundResponse");function r_(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!ye(e))return;let r=e[t];if(typeof r!="string")return;let o={...e};return delete o.roles,delete o.groups,delete o.public,{key:r,overlay:o}}n(r_,"buildProjection");function Sp(e){let t=e.base[e.property],r=e.overlay[e.property];return ye(r)?ye(t)?{...t,...r}:r:t}n(Sp,"mergeRecordProperty");function n_(e,t){let r={...e,...t.overlay},o=Sp({base:e,overlay:t.overlay,property:"annotations"});o!==void 0&&(r.annotations=o);let i=Sp({base:e,overlay:t.overlay,property:"_meta"});return i!==void 0&&(r._meta=i),r}n(n_,"applyProjection");function _p(e,t,r,o){if(!ye(e))return e;let i=e.result;if(!ye(i))return e;let s=i[t.resultProperty];return!Array.isArray(s)||!s.every(a=>ye(a)&&typeof a[t.itemProperty]=="string")?e:{...e,result:{...i,[t.resultProperty]:s.flatMap(a=>{if(!ye(a))return[];let c=a[t.itemProperty];if(typeof c!="string")return[];if(o!==void 0&&!o.has(c))return[];let u=r.get(c);return u===void 0?[]:[n_(a,u)]})}}}n(_p,"filterAndProjectItems");function o_(e){let{envelope:t,responseBody:r,projectionMaps:o,allowedSets:i}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let p of t.messages){let h=Rs(Gn(p)),g=h===void 0?void 0:fp(p.id);h!==void 0&&g!==void 0&&u.set(g,h)}return u.size===0?r:r.map(p=>{if(!ye(p)||"error"in p)return p;let h=fp(p.id),g=h===void 0?void 0:u.get(h),S=g===void 0?void 0:o[g.option];return g===void 0||S===void 0?p:_p(p,g,S,i?.[g.option])})}if(t.shape!=="single"||!ye(r)||"error"in r)return r;let s=t.messages[0],a=Rs(s===void 0?void 0:Gn(s)),c=a===void 0?void 0:o[a.option];return a===void 0||c===void 0?r:_p(r,a,c,i?.[a.option])}n(o_,"filterResponseBody");function i_(e){return e.headers.get("content-type")?.includes("json")??!1}n(i_,"isJsonResponse");var bs=class extends Ro{static{n(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let o=JS(t,r);super(o,r),this.#r=r,this.#e=YS(o),this.#t=ZS(o,r)}async handler(t,r){let o=await il(t);if(o===null)return t;let i=this.#t!==void 0&&this.#n(o)?await this.#i(t,r):void 0;for(let a of o.messages){let c=a.type==="request"?QS(a):e_(a);if(c===void 0)continue;let u=this.#e[c.option];if(u===void 0)continue;let p=i?.[c.option];if(!u.has(c.target)||p!==void 0&&!p.has(c.target))return t_(a.type==="request"?a.id:a.id??void 0)}if(!this.#o(o))return t;let s=this.#e;return r.addResponseSendingHook(async a=>{if(!i_(a))return a;let c;try{c=await a.clone().json()}catch{return a}let u=o_({envelope:o,responseBody:c,projectionMaps:s,allowedSets:i});if(u===c)return a;let p=new Headers(a.headers);return p.delete("content-length"),new Response(JSON.stringify(u),{status:a.status,statusText:a.statusText,headers:p})}),t}#n(t){return t.messages.some(r=>{let o=Gn(r);return o===void 0?!1:mt.some(i=>this.#e[i.option]===void 0?!1:i.listMethod===o||i.directMethods.includes(o))})}#o(t){return t.messages.some(r=>{let o=Rs(Gn(r));return o!==void 0&&this.#e[o.option]!==void 0})}async#i(t,r){let o=this.#t;if(o===void 0)return{};let i;try{i=await o(t,r,this.options)}catch(a){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,a);let c={};for(let u of mt)this.#e[u.option]!==void 0&&(c[u.option]=new Set);return c}let s={};for(let a of mt){let c=this.#e[a.option];if(c===void 0)continue;let u=i[a.option];if(u===void 0)continue;let p=new Set;if(Array.isArray(u))for(let h of u)typeof h=="string"&&c.has(h)&&p.add(h);s[a.option]=p}return s}};var Cs="zuplo.com",s_=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),a_=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function Rp(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}n(Rp,"s2FaviconHref");function c_(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}n(c_,"strictFaviconHref");var Yo=Rp(Cs);function Is(e){let t=e.toLowerCase();return t===Cs||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?Rp(Cs):c_(e)}n(Is,"resolveIconHref");function d_(e){try{return new URL(`http://${e}`).hostname}catch{return e}}n(d_,"hostnameFromHost");function u_(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}n(u_,"isLocalOrAddressHost");function l_(e){let t=d_(e).toLowerCase().replace(/\.$/,"");if(u_(t)||a_.some(s=>t===s.slice(1)||t.endsWith(s)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let o=r.slice(-2).join("."),i=s_.has(o)?3:2;return r.slice(-i).join(".")}n(l_,"inferFaviconDomain");function Ts(e){return{src:Is(l_(e)),mimeType:"image/png",sizes:["128x128"]}}n(Ts,"resolveMcpFaviconIcon");function Xo(e){try{return Ts(new URL(e).host)}catch{return}}n(Xo,"resolveMcpFaviconIconFromUrl");function ft(e){let t=Ae().connectionsById.get(e);if(!t)throw new K(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}n(ft,"getUpstreamServerConfig");function Qo(e){let t=Ae().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new K(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}n(Qo,"getUpstreamAuthConfig");function wr(e,t){let r=Qo({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new K(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}n(wr,"requireUpstreamOAuthConfig");function bp(e,t){let r=Qo({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new K(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}n(bp,"requireUpstreamIdJagConfig");function vp(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=n(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}n(vp,"mergeAbortSignals");async function p_(e){try{await e.cancel()}catch{}}n(p_,"cancelReader");async function ei(e,t){if(!e)return new Uint8Array;let r=e.getReader(),o=[],i=0,s=await r.read();for(;!s.done;){let u=s.value;if(i+=u.byteLength,i>t.maxBytes)throw await p_(r),t.createLimitError();o.push(u),s=await r.read()}let a=new Uint8Array(i),c=0;for(let u of o)a.set(u,c),c+=u.byteLength;return a}n(ei,"readBoundedByteStream");var m_=2,h_=1024*1024,f_=1e4,g_=new Set([301,302,303,307,308]),y_=["authorization","proxy-authorization","cookie","cookie2"];function ks(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}n(ks,"readRequestUrl");function Rr(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}n(Rr,"readRequestMethod");function S_(e,t,r){let o=e.headers.get("content-length");if(!o)return;let i=Number.parseInt(o,10);if(Number.isFinite(i)&&i>t)throw new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[I]:r}})}n(S_,"assertContentLengthWithinLimit");async function __(e,t,r){return S_(e,t,r),ei(e.body,{maxBytes:t,createLimitError:n(()=>new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[I]:r}}),"createLimitError")})}n(__,"readBoundedResponseBody");function w_(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}n(w_,"responseFromBufferedBody");function R_(e,t){if(!g_.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}n(R_,"resolveRedirectUrl");function Cp(e,t){try{return t.validateUrl(e)}catch(r){throw new v({message:"Outbound URL was not allowed.",extensionMembers:{[I]:t.problemCode}},{cause:r})}}n(Cp,"validateOutboundUrl");function b_(e,t){throw e instanceof v&&Eo(e.extensionMembers?.[I])?e:new v({message:"Outbound fetch failed.",extensionMembers:{[I]:t}},{cause:e})}n(b_,"normalizeFetchError");function Vn(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[o,i]of Object.entries(t.extra))i!==void 0&&(r[o]=i);t.error!==void 0&&pe(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}n(Vn,"logOutboundFailure");async function v_(e,t,r,o,i,s,a){let c=Rr(r,o);try{return await t(r,o)}catch(u){let p=u instanceof DOMException&&u.name==="AbortError";Vn(e,{event:p?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:i,method:c,host:ee(s),error:u,extra:{abortReason:a()}}),b_(u,i)}}n(v_,"fetchWithNormalizedError");function C_(e){if(e.redirects>=e.maxRedirects)throw new v({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[I]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new v({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[I]:e.problemCode}})}n(C_,"assertRedirectAllowed");function I_(e,t){let r=new Headers(e);for(let o of y_)r.delete(o);for(let o of t)r.delete(o);return r}n(I_,"stripCrossOriginHeaders");function T_(e,t,r,o,i){let s={...e,method:t,redirect:"manual",signal:r};return o&&(s.headers=I_(e.headers,i)),s}n(T_,"buildRedirectInit");function k_(e,t,r){let o={...t,redirect:"manual",signal:r};return o.headers===void 0&&e instanceof Request&&(o.headers=e.headers),o}n(k_,"buildInitialRequestInit");function A_(e){let t=Rr(e.currentInput,e.currentInit);C_({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=Cp(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),o=new URL(e.currentUrl),i=r.origin!==o.origin,s=r.toString();return{currentInput:s,currentUrl:s,currentInit:T_(e.currentInit,t,e.signal,i,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}n(A_,"followRedirect");async function As(e,t,r){let o=r.problemCode??"invalid_request",i=r.maxRedirects??m_,s=r.maxResponseBytes??h_,a=r.timeoutMs??f_,c=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],p=r.context,h=new AbortController,g=vp(h,t.signal),S=!1,y=setTimeout(()=>{S=!0,h.abort()},a),k=e,w=k_(e,t,h.signal),C;try{C=Cp(ks(e),{problemCode:o,validateUrl:r.validateUrl}).toString()}catch(O){throw Vn(p,{event:"outbound_url_blocked",problemCode:o,method:Rr(e,t),host:ee(ks(e)),error:O}),clearTimeout(y),g?.(),O}let U=0;try{for(;;){let O=await v_(p,c,k,w,o,C,()=>S?`timeout_after_${a}ms`:void 0),L=R_(O,C);if(L!==void 0)try{let F=A_({currentInput:k,currentInit:w,currentUrl:C,redirectUrl:L,redirects:U,maxRedirects:i,problemCode:o,validateUrl:r.validateUrl,signal:h.signal,additionalCrossOriginStrippedHeaders:u});k=F.currentInput,w=F.currentInit,C=F.currentUrl,U=F.redirects;continue}catch(F){throw Vn(p,{event:"outbound_redirect_blocked",problemCode:o,method:Rr(k,w),host:ee(C),error:F,extra:{redirects:U,maxRedirects:i,redirectTargetHost:ee(L)}}),F}try{return w_(O,await __(O,s,o))}catch(F){throw Vn(p,{event:"outbound_response_size_exceeded",problemCode:o,method:Rr(k,w),host:ee(C),error:F,extra:{maxResponseBytes:s,status:O.status}}),F}}}finally{clearTimeout(y),g?.()}}n(As,"runSafeOutboundExchange");async function Kn(e,t,r){let o=await As(e,t,r);try{return{response:o,json:await o.clone().json()}}catch(i){throw Vn(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Rr(e,t),host:ee(ks(e)),error:i,extra:{status:o.status,contentType:o.headers.get("content-type")??void 0}}),new v({message:"Outbound JSON response could not be parsed.",extensionMembers:{[I]:r.problemCode??"invalid_request"}},{cause:i})}}n(Kn,"runSafeOutboundJsonExchange");function Ip(e,t={},r={}){return As(e,t,{...r,validateUrl:jn})}n(Ip,"fetchConfiguredOutbound");function Tp(e,t={},r={}){return Kn(e,t,{...r,validateUrl:jn})}n(Tp,"fetchConfiguredOutboundJson");function ti(e,t={},r={}){return Kn(e,t,{...r,validateUrl:Ku})}n(ti,"fetchIdentityProviderJson");function kp(e,t={},r={}){return Kn(e,t,{...r,validateUrl:jo})}n(kp,"fetchCimdClientMetadataJson");function Ap(e,t={},r={}){return Kn(e,t,{...r,validateUrl:Nn})}n(Ap,"fetchCimdClientJwksJson");import{errors as qp,jwtVerify as zp,SignJWT as Mp}from"jose";var Se="zuplo-mcp-gateway",ve=Se,Ce="HS256";import{base64url as P_}from"jose";var E_=new TextEncoder,x_="MCP gateway could not initialize secure key material.",U_=32,Pp=new Map,Ep=new Map,O_;function q_(){return O_??wa.instance.authPrivateKey}n(q_,"readAuthPrivateKey");function xp(e){return new ke(x_,e===void 0?void 0:{cause:e})}n(xp,"createGeneratedKeyMaterialError");function Up(e,t){let r=P_.decode(t);if(r.byteLength!==U_)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}n(Up,"decodeJwkKeyField");function z_(e){let t=q_();if(!t)throw xp();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let o=Up("d",r.d);Up("x",r.x);let i=E_.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),s=new Uint8Array(i.byteLength+o.byteLength);return s.set(i),s.set(o,i.byteLength),s}catch(r){throw xp(r)}}n(z_,"decodeGeneratedKeyMaterial");function M_(e){let t=Pp.get(e);return t||(t=z_(e),Pp.set(e,t)),t}n(M_,"getMasterKeyMaterial");async function $e(e){let t=Ep.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(M_(e.keyMaterialPurpose));return Ep.set(e.purpose,r),r}n($e,"readCachedDerivedKey");var j_="SHA-256",N_=32,$_="zuplo-mcp-gateway:",D_=new TextEncoder,Op=new WeakMap;async function gt(e,t){let r=Op.get(e);r||(r=new Map,Op.set(e,r));let o=r.get(t);if(o)return o;let i=await L_(e,t);return r.set(t,i),i}n(gt,"deriveGatewaySigningKey");async function L_(e,t){let r=me(e),o=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),i=D_.encode(`${$_}${t}`),s=await crypto.subtle.deriveBits({name:"HKDF",hash:j_,salt:new Uint8Array,info:me(i)},o,N_*8);return new Uint8Array(s)}n(L_,"hkdfExpand");var jp=900,H_=900,B_=Eu.extend({id:Qu}),F_=B_.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),Np=Mi.extend({id:el,purpose:l.literal("browser_connect")}),J_=Mi.extend({purpose:l.literal("browser_connect")}),G_=Np.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),$p=jp*1e3;async function Dp(){return $e({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>gt(e,"oauth-state"),"derive")})}n(Dp,"getOAuthStateKey");async function Lp(){return $e({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>gt(e,"browser-connect"),"derive")})}n(Lp,"getBrowserConnectKey");async function Hp(e){let t=Math.floor(Date.now()/1e3)+jp;return new Mp(e).setProtectedHeader({alg:Ce,typ:"JWT"}).setIssuer(Se).setAudience(ve).setIssuedAt().setExpirationTime(t).sign(await Dp())}n(Hp,"signOAuthState");async function ri(e){try{let{payload:t}=await zp(e,await Dp(),{algorithms:[Ce],issuer:Se,audience:ve});return F_.parse(t)}catch(t){throw t instanceof qp.JWTExpired?new v({message:"OAuth state has expired",extensionMembers:{[I]:"oauth_state_expired"}},{cause:t}):new v({message:"OAuth state could not be verified",extensionMembers:{[I]:"oauth_state_invalid"}},{cause:t})}}n(ri,"verifyOAuthState");async function Bp(e){let t=Math.floor(Date.now()/1e3)+H_,r=J_.parse(e),o=Np.parse({...r,id:ol()});return new Mp(o).setProtectedHeader({alg:Ce,typ:"JWT"}).setIssuer(Se).setAudience(ve).setIssuedAt().setExpirationTime(t).sign(await Lp())}n(Bp,"signBrowserConnectTicket");async function Fp(e){try{let{payload:t}=await zp(e,await Lp(),{algorithms:[Ce],issuer:Se,audience:ve});return G_.parse(t)}catch(t){throw t instanceof qp.JWTExpired?new v({message:"Browser connect ticket has expired",extensionMembers:{[I]:"oauth_state_expired"}},{cause:t}):new v({message:"Browser connect ticket could not be verified",extensionMembers:{[I]:"oauth_state_invalid"}},{cause:t})}}n(Fp,"verifyBrowserConnectTicket");async function Jp(e){if((await j().consumeBrowserConnectTicket({id:e.id,expiresAt:$(new Date(e.exp*1e3)),now:$(new Date)})).kind==="consumed")throw new v({message:"Browser connect ticket has already been used",extensionMembers:{[I]:"oauth_state_reused"}})}n(Jp,"consumeBrowserConnectTicket");function V_(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}n(V_,"buildConnectRequiredMessage");async function K_(e){let t=re(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await Bp({...zn(e),purpose:"browser_connect"})),r.toString()}n(K_,"buildGatewayBrowserTicketUrl");function W_(e){return de().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}n(W_,"buildGatewayConnectPath");async function Ps(e){return K_({...e,path:W_(e.upstreamServerId),redirect:!0})}n(Ps,"buildGatewayConnectUrl");async function ni(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await Ps(t),message:V_(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}n(ni,"buildRedirectConnectRequiredResponse");function Gp(e){return Z_({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}n(Gp,"buildAdminConnectRequiredResponse");function Z_(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}n(Z_,"buildAdminSetupRequiredResponse");var Vp=12;async function Kp(e){let t=await crypto.subtle.digest("SHA-256",me(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}n(Kp,"sha256Hex");async function Dt(e){if(e)return(await Kp(e)).slice(0,Vp)}n(Dt,"fingerprintSecret");async function br(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await Kp(t)).slice(0,Vp)}n(br,"fingerprintConnectionIdentity");var Y_=6e4;function vr(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,o)=>t.scopes[o]!==r)}n(vr,"credentialGenerationChanged");function he(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+Y_)return"near_expiry"}return"usable"}n(he,"describeAccessTokenState");var Wp=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function X_(e,t){return e&&e.length>0?e.join(t):void 0}n(X_,"joinOAuthScopes");function Q_(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of Wp)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}n(Q_,"sanitizeAuthorizationServerMetadata");function Zp(e){let t=Q_(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}n(Zp,"sanitizeOAuthDiscoveryState");function Yp(e){let t=new URL(e);for(let r of Wp){let o=t.searchParams.getAll(r);o.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,o.at(-1)??""))}return t}n(Yp,"dedupeSingletonAuthorizationRequestParams");function oi(e){let t=new URL(e);return Re(t)&&Su(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}n(oi,"normalizeLoopbackOAuthRedirectUri");function Xp(e){return X_(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}n(Xp,"readProtectedResourceMetadataScope");function ew(e){return`Zuplo MCP Gateway - ${e}`}n(ew,"buildGatewayOAuthClientName");function tw(e,t){return e&&e.length>0?e.join(t):void 0}n(tw,"joinOAuthScopeList");function rw(e){if(e.clientRegistration.mode!=="auto")return tw(e.scopes,e.scopeDelimiter)}n(rw,"readPublicClientMetadataScope");function Es(e){return new URL(de().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}n(Es,"buildOAuthClientMetadataDocumentUrl");function xs(e){let t=ft(e.upstreamServerId);return{client_name:ew(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}n(xs,"buildGatewayOAuthClientMetadata");function Qp(e,t,r){let o=wr(t,r),i=rw(o);return{client_id:Es({origin:e,upstreamServerId:t}),...xs({origin:e,upstreamServerId:t,redirectUri:oi(new URL(o.redirectPath,e)).toString(),scope:i})}}n(Qp,"buildOAuthClientMetadataDocument");import{base64url as yt}from"jose";var nw="SHA-256",Cr="AES-GCM",ow=12,Os="zuplo-secret",qs=1,em="generated:auth_private_key:token-encryption",iw=l.object({version:l.literal(qs),keyId:l.literal(em),algorithm:l.literal(Cr),iv:l.string().min(1),ciphertext:l.string().min(1)}).strict();async function Us(){return $e({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:n(async e=>{let t=await crypto.subtle.digest(nw,me(e));return crypto.subtle.importKey("raw",t,{name:Cr},!1,["encrypt","decrypt"])},"derive")})}n(Us,"getEncryptionKey");function tm(e){return me(new TextEncoder().encode(`${Os}:v${e.version}:${e.keyId}`))}n(tm,"getAssociatedData");function sw(e){return`${Os}:v${e.version}:${yt.encode(new TextEncoder().encode(JSON.stringify(e)))}`}n(sw,"encodeEnvelope");function aw(e){let t=`${Os}:v${qs}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),o=new TextDecoder().decode(yt.decode(r));return iw.parse(JSON.parse(o))}n(aw,"decodeEnvelope");async function We(e){let t=await Us(),r=crypto.getRandomValues(new Uint8Array(ow)),o={version:qs,keyId:em},i=await crypto.subtle.encrypt({name:Cr,iv:r,additionalData:tm(o)},t,new TextEncoder().encode(e));return sw({...o,algorithm:Cr,iv:yt.encode(r),ciphertext:yt.encode(new Uint8Array(i))})}n(We,"encryptSecret");async function Ze(e){let t=aw(e);if(t){let a=await Us(),c=await crypto.subtle.decrypt({name:Cr,iv:me(yt.decode(t.iv)),additionalData:tm(t)},a,me(yt.decode(t.ciphertext)));return new TextDecoder().decode(c)}let[r,o]=e.split(".");if(!r||!o)throw new ke("Encrypted payload is malformed");let i=await Us(),s=await crypto.subtle.decrypt({name:Cr,iv:me(yt.decode(r))},i,me(yt.decode(o)));return new TextDecoder().decode(s)}n(Ze,"decryptSecret");var rm={issuer:l.string().min(1).optional()},cw=l.union([jt.extend(rm),On.extend(rm)]),nm=l.object({authorizationServerUrl:l.url(),resourceMetadataUrl:l.url().optional(),resourceMetadata:ur.optional(),authorizationServerMetadata:l.union([lr,pr]).optional()}).passthrough(),dw="Bearer",uw="__zuplo_refresh_only_upstream_access_token__";function zs(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}n(zs,"splitScopes");function Ms(e,t){let r=new Set(e);return t.every(o=>r.has(o))}n(Ms,"scopesCover");function lw(e){return hr.parse(e)}n(lw,"parsePkceCodeVerifier");function pw(e){if(typeof e.expires_in=="number")return $(new Date(Date.now()+e.expires_in*1e3))}n(pw,"readTokenExpiry");async function om(e){if(e!==void 0)return We(JSON.stringify(e))}n(om,"encryptJson");async function im(e,t){if(!e)return;let r=await Ze(e);try{return t.parse(JSON.parse(r))}catch(o){throw new v({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[I]:"oauth_state_invalid"}},{cause:o})}}n(im,"decryptJson");function mw(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}n(mw,"clientInformationAllowsRedirectUri");function hw(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}n(hw,"clientInformationMatchesCurrentClientMetadataUrl");function fw(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}n(fw,"isUrlBasedClientInformation");function gw(e,t){return t===void 0?e:{...e,scope:t}}n(gw,"applyOAuthClientMetadataScope");function yw(e,t){return Xp({state:e,delimiter:t})}n(yw,"readResourceMetadataScope");function Sw(e,t){return e&&e.length>0?e.join(t):void 0}n(Sw,"joinOAuthScopeList");function _w(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new K(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return jt.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}n(_w,"buildManualOAuthClientInformation");function ww(e,t){let r=Es({origin:new URL(t).origin,upstreamServerId:e});return ws(r)?r:void 0}n(ww,"buildClientMetadataUrl");function Rw(e){for(let t of e)if(t!==void 0)return t}n(Rw,"firstDefined");function bw(e){let t=wr(e.target.upstreamServerId,e.target.authProfileId),r=Sw(t.scopes,t.scopeDelimiter),o=xs({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,configuredClientInformation:_w({clientMetadata:o,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let i=ww(e.target.upstreamServerId,e.redirectUri);return i===void 0?{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt}:{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,clientMetadataUrl:i}}n(bw,"buildInitialOAuthClientSetup");function vw(e,t){if(t===void 0)return Rw([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}n(vw,"readEncryptedClientInformation");function Cw(e){return e.pendingState?.encryptedDiscoveryState}n(Cw,"readEncryptedDiscoveryState");function js(e,t){return t===void 0?e:{...e,issuer:t}}n(js,"applyIssuerStamp");var St=class{static{n(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;encryptedDiscoveryState;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=bw({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=vw(t,this.configuredClientInformation),this.encryptedDiscoveryState=Cw(t)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let o=zs(this.configuredScope??r??this.readEffectiveScope());return Ms(t.scopes,o)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&he(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let o=W();o&&o.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await br({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await Dt(await Ze(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await j().conditionalUpsertUpstreamConnection(t,r)}catch(o){let i=W();if(i){let s=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:o}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});i.error(s,"Upstream OAuth conditional storage write failed")}throw o}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return gw(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return Hp({id:t.id,...zn({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(t){return this.configuredClientInformation?js(this.configuredClientInformation,t?.issuer):this.loadPersistedClientInformation(t)}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,W()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!fw({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await om(t),await this.syncPendingState(!1)))}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=Zp(nm.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=await om(r),await this.syncPendingState(!1),W()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:ee(r.authorizationServerUrl),resourceMetadataHost:ee(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=yw(r,this.scopeDelimiter);let o=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&o!==void 0){let i=zs(this.configuredScope).filter(s=>!o.includes(s));i.length>0&&W()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:i,scopesSupported:o},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(t){let r=await this.loadStoredTokens();if(r!==void 0)return js(r,t?.issuer)}async saveTokens(t){let r=st.parse(t),o=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,i=this.credentialState.sourceConnection,s=!r.refresh_token&&!!i?.encryptedRefreshToken,a=r.refresh_token?await We(r.refresh_token):i?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!i?.encryptedRefreshToken?r:st.parse({...r,refresh_token:await Ze(i.encryptedRefreshToken)}),this.tokensLoaded=!0;let c={id:i?.id??No(),ownerMode:this.target.owner.mode,subjectId:o,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await We(r.access_token),encryptedRefreshToken:a,scopes:zs(r.scope??this.readEffectiveScope()),expiresAt:pw(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=i?{expectedUpdatedAt:i.updatedAt}:{expectAbsent:!0},p=await this.conditionalUpsertCredential(c,u),h=!1;if(p.kind==="precondition_failed"&&p.connection!==void 0&&(he(p.connection)!=="usable"||!Ms(p.connection.scopes,c.scopes)||!vr(i,p.connection))){h=!0;let S=p.connection,y={id:S.id,ownerMode:S.ownerMode,subjectId:S.subjectId,upstreamServerId:S.upstreamServerId,authProfileId:S.authProfileId,status:"active",encryptedAccessToken:c.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?S.encryptedRefreshToken:c.encryptedRefreshToken,scopes:c.scopes,expiresAt:c.expiresAt,metadata:S.metadata};W()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:S.id,sourceUpdatedAt:i?.updatedAt,winnerUpdatedAt:S.updatedAt,sourceScopeCount:i?.scopes.length,winnerScopeCount:S.scopes.length,resultingScopeCount:y.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),p=await this.conditionalUpsertCredential(y,{expectedUpdatedAt:S.updatedAt})}if(p.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=p.kind,p.kind==="persisted"?(this.credentialState.currentConnection=p.connection,this.credentialState.peerAdoption=void 0):p.kind==="precondition_failed"&&p.connection!==void 0?(this.credentialState.currentConnection=p.connection,vr(i,p.connection)&&he(p.connection)==="usable"&&Ms(p.connection.scopes,c.scopes)?this.adoptPeerConnection(p.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),h){let S=p.kind==="persisted"?"succeeded":p.kind==="precondition_failed"?"lost":"exhausted";W()?.info({event:`upstream_oauth_bounded_rebase_${S}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:i?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:i?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${S}`)}let g=p.kind==="persisted"?p.connection:void 0;W()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:g?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!a,sourceScopeCount:i?.scopes.length,priorStatus:i?.status,priorUpdatedAt:i?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await Dt(r.refresh_token),reusedSnapshotRefreshToken:s,scopeCount:c.scopes.length,expiresAt:c.expiresAt,outcome:p.kind,rebaseAttempted:h,resultingUpdatedAt:g?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:g?.scopes.length??this.credentialState.currentConnection?.scopes.length},g?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Yp(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:lw(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new v({message:"OAuth code verifier is missing",extensionMembers:{[I]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",o=t==="all"||t==="client",i=t==="all"||t==="discovery",s=t==="all"||t==="verifier";o&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),i&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=void 0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(s),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:nl(),...zn({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:$(new Date(Date.now()+$p)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await j().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState})}async loadPersistedClientInformation(t){if(this.clientInformationLoaded)return this.cachedClientInformation;let r;try{r=await im(this.encryptedClientInformation,cw)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(r&&(!mw(r,this.redirectUriValue)||!hw({clientInformation:r,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return r===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(r=js(On.parse({client_id:this.clientMetadataUrl}),t?.issuer)),this.cachedClientInformation=r,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0;try{this.cachedDiscoveryState=await im(this.encryptedDiscoveryState,nm)}catch{this.encryptedDiscoveryState=void 0,this.cachedDiscoveryState=void 0}return this.cachedDiscoveryState}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){W()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await Ze(t.encryptedAccessToken):void 0,o=t.encryptedRefreshToken?await Ze(t.encryptedRefreshToken):void 0;if(!r&&!o)return;let i=W();this.usedRefreshTokenFingerprintValue=i?await Dt(o):void 0,i?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!o,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let s=st.parse({access_token:r??uw,token_type:dw,refresh_token:o,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=s,s}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let o=r.status,i=r.updatedAt,s={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(s.status="reconsent_required",s.encryptedAccessToken=void 0,s.encryptedRefreshToken=void 0,s.scopes=[],s.expiresAt=void 0),s.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let a=await this.conditionalUpsertCredential(s,{expectedUpdatedAt:r.updatedAt});a.kind==="persisted"?(this.credentialState.currentConnection=a.connection,this.credentialState.peerAdoption=void 0):a.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):a.connection!==void 0&&(this.credentialState.currentConnection=a.connection,vr(r,a.connection)&&he(a.connection)==="usable"&&this.connectionSatisfiesRequestedScope(a.connection)?this.adoptPeerConnection(a.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let c=W();if(c){let u=a.kind==="missing"?void 0:a.connection,p={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:o,newStatus:u?.status,priorUpdatedAt:i,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:a.kind};a.kind==="precondition_failed"?c.warn({...p,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?c.warn(p,"Upstream OAuth credentials invalidated; connection now requires reconsent"):c.debug(p,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var Iw=3e4,Tw=256*1024,kw=2,Aw="does not support dynamic client registration",Pw=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],Ew=["HTTP 403 Forbidden","Access Denied","permission to access"],xw=new Set([ue.AccessDenied,ue.InvalidClient,ue.InvalidGrant,ue.InvalidRequest,ue.InvalidScope,ue.InvalidTarget,ue.UnauthorizedClient,ue.UnsupportedGrantType]);function Uw(e){return e instanceof Error&&e.message.includes(Aw)}n(Uw,"isDynamicClientRegistrationUnsupported");function Ow(e){return e instanceof Error&&Pw.some(t=>e.message.includes(t))}n(Ow,"isProtectedResourceMetadataUnavailable");function qw(e){return e instanceof Error&&Ew.some(t=>e.message.includes(t))}n(qw,"isUpstreamProviderAccessDenied");function zw(e){return e instanceof pt&&xw.has(e.code)}n(zw,"isStoredConnectionReconsentError");function Mw(e){if(e.error instanceof v&&e.error.extensionMembers?.[I]!==void 0)return e.error;if(Uw(e.error))return new v({message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`,extensionMembers:{[I]:"upstream_client_registration_required"}},{cause:e.error});if(Ow(e.error))return new v({message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`,extensionMembers:{[I]:"upstream_oauth_discovery_unavailable"}},{cause:e.error});if(qw(e.error))return new v({message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`,extensionMembers:{[I]:"upstream_provider_access_denied"}},{cause:e.error})}n(Mw,"mapUpstreamOAuthSetupError");function jw(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}n(jw,"readOAuthFetchRequest");function Nw(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}n(Nw,"responseLooksJson");function $w(e,t){let r=e.headers.get("content-type")??"",o=t.trimStart().toLowerCase();return r.includes("html")||o.startsWith("<!doctype html")||o.startsWith("<html")}n($w,"responseLooksHtml");function Dw(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new v({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[I]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[at]:e.response.status,[fr]:r,[ct]:e.request.url.toString(),[gr]:e.body}})}n(Dw,"throwUpstreamHtmlError");function Lw(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}n(Lw,"readUpstreamOAuthErrorBody");function Hw(e){let{error:t,errorDescription:r}=Lw(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.request.method??"GET",host:ee(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}n(Hw,"logUpstreamOAuthHttpError");function am(e){return async(t,r)=>{let o=jw(t),i=W(),s=Date.now(),a=await Ip(t,r,{maxRedirects:kw,maxResponseBytes:Tw,problemCode:"upstream_token_exchange_failed",timeoutMs:Iw}),c=await a.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:o.method??"GET",host:ee(o.url),path:o.url.pathname,status:a.status,durationMs:Date.now()-s,responseChars:c.length},"Upstream OAuth HTTP request completed"),a.ok||Hw({log:i,upstreamServerId:e,request:o,response:a,body:c}),!a.ok&&$w(a,c)&&Dw({upstreamServerId:e,request:o,response:a,body:c}),!Nw(a,c))return a;try{JSON.parse(c)}catch(u){throw new v({message:`Upstream OAuth fetch ${o.url.origin}${o.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[I]:"upstream_token_exchange_failed"}},{cause:u})}return a}}n(am,"createUpstreamOAuthFetch");function cm(e){W()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:ee(e.serverUrl),resourceMetadataHost:ee(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}n(cm,"logUpstreamOAuthFlowStarted");function dm(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=ee(e.serverUrl);r!==void 0&&(t.serverHost=r);let o=e.error instanceof v?e.error.extensionMembers?.[I]:void 0;typeof o=="string"&&(t.code=o),pe(t,"error",e.error),W()?.warn(t,"Upstream OAuth flow failed before a connection was established")}n(dm,"logUpstreamOAuthFlowFailed");function um(e,t){return e.configuredAuthorizationScope??t.requestedScope}n(um,"readAuthorizationRequestScope");async function lm(e,t){e.applyChallengeScope(t.requestedScope),cm({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:am(t.upstreamServerId)},o=um(e,t);return o!==void 0&&(r.scope=o),await _s(e,r)}catch(r){dm({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let o=Mw({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw o!==void 0?o:r}}n(lm,"runUpstreamOAuth");async function Bw(e,t){e.applyChallengeScope(t.requestedScope),cm({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:am(t.upstreamServerId)};t.iss!==void 0&&(r.iss=t.iss);let o=um(e,t);o!==void 0&&(r.scope=o);try{return await _s(e,r)}catch(i){throw dm({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:i}),i}}n(Bw,"exchangeUpstreamAuthorizationCode");async function sm(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await j().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||he(r)!=="usable"||!vr(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}n(sm,"adoptPeerCredentialAtResolutionBoundary");async function pm(e,t){let r=await lm(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new v({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}}):new v({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}})}n(pm,"requireUpstreamAuthorizationRedirect");async function mm(e){let t=he(e.connection),r=!!e.forceRefresh,o=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),i=W(),s=i?await br({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(i?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:s,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!o,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},o?"Reusing stored upstream access token":"Refreshing upstream credential"),o)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let a;try{a=await lm(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(c){if(e.connection===void 0||!zw(c))throw c;return i?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:c.code,connectionFingerprint:s,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await sm({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await Ns({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(a==="AUTHORIZED"){let c=e.provider.readUsablePeerAdoption(e.requestedScope);return c!==void 0&&await e.provider.adoptConnectionForDirectResolution(c,"cas_loss"),!e.provider.tokenWriteWasPersisted&&c===void 0?{kind:"connect_required",payload:await Ns({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(a!=="REDIRECT")throw new v({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${a}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new v({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}});return await sm({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await Ns({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}n(mm,"authorizeUpstreamOAuthSession");async function Fw(e){let t=await ri(e.stateToken),r=await j().consumeUpstreamOAuthState({id:t.id,now:$(new Date)}),o=Jw(r);return Gw({storedState:o,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),Vw(o),o}n(Fw,"consumeStoredCallbackState");function Jw(e){switch(e.kind){case"consumed":throw new v({message:"OAuth state has already been used",extensionMembers:{[I]:"oauth_state_reused"}});case"missing":throw new v({message:"OAuth state is missing or expired",extensionMembers:{[I]:"oauth_state_expired"}});case"available":return e.record}}n(Jw,"readConsumedCallbackState");function Gw(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new v({message:"OAuth callback did not match the initiating request",extensionMembers:{[I]:"oauth_callback_mismatch"}})}n(Gw,"assertStoredCallbackStateMatches");function Vw(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new v({message:"OAuth state has expired",extensionMembers:{[I]:"oauth_state_expired"}})}n(Vw,"assertStoredCallbackStateFresh");async function Ns(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),Gp(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),ni(t)}n(Ns,"buildOAuthConnectRequiredResponse");async function hm(e){let t=await Fw({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Oo(t),[o]=await j().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),i={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};o!==void 0&&(i.connection=o);let s=new St(i),a=await Bw(s,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,...e.iss===void 0?{}:{iss:e.iss},resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(a==="AUTHORIZED"){let c=s.readUsablePeerAdoption();if(c!==void 0&&await s.adoptConnectionForDirectResolution(c,"cas_loss"),!s.tokenWriteWasPersisted&&c===void 0)throw new v({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[I]:"upstream_token_exchange_failed"}});return t}throw a!=="REDIRECT"?new v({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${a}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}}):new v({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[I]:"upstream_token_exchange_failed"}})}n(hm,"finishUpstreamOAuthCallback");import{importPKCS8 as Kw,SignJWT as Ww}from"jose";var gm=1e4,ym=64*1024,Sm=2,Zw=300,qe=l.string().min(1),Yw=l.object({access_token:qe,issued_token_type:l.literal(Ni),token_type:l.string().optional(),expires_in:l.number().int().positive().optional(),scope:qe.optional()}).passthrough(),Xw=l.object({id_token:qe,token_type:qe.optional(),expires_in:l.number().int().positive().optional(),refresh_token:qe.optional(),scope:qe.optional()}).passthrough(),Qw=l.object({access_token:qe,token_type:qe,expires_in:l.number().int().positive().optional(),scope:qe.optional(),resource:qe.optional(),refresh_token:qe.optional()}).passthrough();function fm(e){return encodeURIComponent(e).replace(/%20/g,"+")}n(fm,"formEncodeClientCredential");function eR(e){return e.replaceAll("\\n",`
+`)}n(eR,"normalizePem");async function tR(e){let t=e.clientAuth.algorithm??"RS256",r=e.clientAuth.expiresInSeconds??Zw,o=await Kw(eR(e.clientAuth.privateKeyPem),t),i={alg:t,typ:"JWT",...e.clientAuth.keyId===void 0?{}:{kid:e.clientAuth.keyId}};return new Ww({jti:crypto.randomUUID()}).setProtectedHeader(i).setIssuer(e.clientAuth.clientId).setSubject(e.clientAuth.clientId).setAudience(e.clientAuth.audience??e.tokenUrl).setIssuedAt().setExpirationTime(`${r}s`).sign(o)}n(tR,"createPrivateKeyJwtClientAssertion");async function rR(e){switch(e.clientAuth.method){case"client_secret_post":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_secret",e.clientAuth.clientSecret);return;case"client_secret_basic":{let t=fm(e.clientAuth.clientId),r=fm(e.clientAuth.clientSecret);e.headers.authorization=`Basic ${btoa(`${t}:${r}`)}`;return}case"private_key_jwt":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_assertion_type",zo),e.form.set("client_assertion",await tR({clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}));return}}n(rR,"appendClientAuthentication");async function $s(e){let t={"Content-Type":"application/x-www-form-urlencoded"};return await rR({form:e.form,headers:t,clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}),{method:"POST",headers:t,body:e.form.toString()}}n($s,"buildFormRequest");function _m(e){return(t,r)=>ti(t,r,{context:e,maxRedirects:Sm,maxResponseBytes:ym,problemCode:"upstream_token_exchange_failed",timeoutMs:gm})}n(_m,"defaultIdpFetchJson");function nR(e){return(t,r)=>Tp(t,r,{context:e,maxRedirects:Sm,maxResponseBytes:ym,problemCode:"upstream_token_exchange_failed",timeoutMs:gm})}n(nR,"defaultResourceAsFetchJson");function ii(e){let t={[I]:e.code,[ct]:e.tokenUrl};return e.response!==void 0&&(t[at]=e.response.status),new v({message:e.message,extensionMembers:t},e.cause===void 0?void 0:{cause:e.cause})}n(ii,"runtimeError");function Ds(e){if(!e.response.ok)throw ii({code:"upstream_token_exchange_failed",message:(()=>{switch(e.stage){case"idp_refresh_token":return"IdP refresh-token grant failed while renewing the upstream ID-JAG subject token.";case"idp_token_exchange":return"IdP token exchange failed while requesting an upstream ID-JAG.";case"resource_as_jwt_bearer":return"Upstream Resource AS rejected the ID-JAG JWT-bearer exchange."}})(),tokenUrl:e.tokenUrl,response:e.response})}n(Ds,"assertTokenEndpointSucceeded");function oR(e){let t=Xw.safeParse(e.json);if(!t.success)throw ii({code:"upstream_token_response_invalid",message:"IdP refresh-token grant returned an invalid subject-token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={idToken:t.data.id_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),t.data.scope!==void 0&&(r.scope=t.data.scope),r}n(oR,"parseIdpRefreshTokenResponse");function iR(e){let t=Yw.safeParse(e.json);if(!t.success)throw ii({code:"upstream_token_response_invalid",message:"IdP token exchange returned an invalid ID-JAG response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={assertion:t.data.access_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),r}n(iR,"parseIdJagTokenExchangeResponse");function sR(e){let t=Qw.safeParse(e.json);if(!t.success)throw ii({code:"upstream_token_response_invalid",message:"Upstream Resource AS returned an invalid JWT-bearer token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={accessToken:t.data.access_token,tokenType:t.data.token_type};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),t.data.resource!==void 0&&(r.resource=t.data.resource),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),r}n(sR,"parseAccessTokenResponse");async function wm(e){let t=new URLSearchParams({grant_type:qo,requested_token_type:Ni,subject_token:e.subjectToken,subject_token_type:e.subjectTokenType,audience:e.audience});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope),e.authorizationDetails!==void 0&&t.set("authorization_details",JSON.stringify(e.authorizationDetails));let r=e.fetchJson??_m(e.context),{response:o,json:i}=await r(e.idp.tokenUrl,await $s({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return Ds({response:o,tokenUrl:e.idp.tokenUrl,stage:"idp_token_exchange"}),iR({json:i,response:o,tokenUrl:e.idp.tokenUrl})}n(wm,"requestIdJag");async function Rm(e){let t=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken}),r=e.fetchJson??_m(e.context),{response:o,json:i}=await r(e.idp.tokenUrl,await $s({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return Ds({response:o,tokenUrl:e.idp.tokenUrl,stage:"idp_refresh_token"}),oR({json:i,response:o,tokenUrl:e.idp.tokenUrl})}n(Rm,"refreshIdpSubjectToken");async function bm(e){let t=new URLSearchParams({grant_type:ut,assertion:e.assertion});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope);let r=e.fetchJson??nR(e.context),{response:o,json:i}=await r(e.resourceAs.tokenUrl,await $s({form:t,clientAuth:e.clientAuth,tokenUrl:e.resourceAs.tokenUrl}));return Ds({response:o,tokenUrl:e.resourceAs.tokenUrl,stage:"resource_as_jwt_bearer"}),sR({json:i,response:o,tokenUrl:e.resourceAs.tokenUrl})}n(bm,"exchangeIdJagForAccessToken");function aR(e){return he(e)==="usable"}n(aR,"hasUsableAccessToken");function cR(e){if(e.tokenType.toLowerCase()!=="bearer")throw new v({message:"Upstream Resource AS returned a token type the MCP gateway cannot send as a bearer token.",extensionMembers:{[I]:"upstream_token_response_invalid"}})}n(cR,"assertBearerToken");function vm(e,t){if(t===_r)return!1;let r=e?.metadata?.idpSubjectTokenExpiresAt;return r!==void 0&&new Date(r).getTime()<=Date.now()}n(vm,"hasExpiredSubjectToken");async function dR(e){let t=await Ze(e.encryptedSubjectToken);if(e.subjectTokenType!==_r)return{connection:e.connection,subjectToken:t,subjectTokenType:e.subjectTokenType};let r=await Rm({idp:e.idp,refreshToken:t,clientAuth:e.clientAuth,context:e.context});if(r.refreshToken===void 0)return{connection:e.connection,subjectToken:r.idToken,subjectTokenType:Mn};let o=await j().upsertUpstreamConnection({id:e.connection.id,ownerMode:e.connection.ownerMode,subjectId:e.connection.subjectId,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,status:"active",encryptedAccessToken:e.connection.encryptedAccessToken,encryptedRefreshToken:e.connection.encryptedRefreshToken,scopes:e.connection.scopes,expiresAt:e.connection.expiresAt,metadata:{...e.connection.metadata??{},encryptedIdpSubjectToken:await We(r.refreshToken),idpSubjectTokenType:_r,idpSubjectTokenExpiresAt:void 0}});return W()?.info({event:"upstream_id_jag_subject_token_rotated",upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,connectionFingerprint:e.connectionFingerprint,connectionId:o.id,priorStatus:e.connection.status,priorUpdatedAt:e.connection.updatedAt,usedSubjectRefreshTokenFingerprint:await Dt(t),newSubjectRefreshTokenFingerprint:await Dt(r.refreshToken)},"Upstream ID-JAG IdP subject refresh token rotated and persisted"),{connection:o,subjectToken:r.idToken,subjectTokenType:Mn}}n(dR,"resolveIdJagSubjectToken");async function Cm(e){let t="preloadedConnection"in e?e.preloadedConnection:(await j().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0],r=he(t),o=!!e.forceRefresh,i=!o&&r==="usable",s=W(),a=s?await br({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}):void 0;if(s?.debug({event:"upstream_id_jag_auth_decision",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode,connectionFingerprint:a,connectionId:t?.id,accessTokenState:r,forceRefresh:o,willMint:!i,expiresAt:t?.expiresAt,connectionUpdatedAt:t?.updatedAt},i?"Reusing stored upstream ID-JAG access token":"Minting upstream ID-JAG access token"),!e.forceRefresh&&aR(t))return{kind:"authorized",credential:{type:"bearer_token",token:await Ze(t.encryptedAccessToken)}};let c=t?.metadata?.encryptedIdpSubjectToken,u=t?.metadata?.idpSubjectTokenType;if(t?.status!=="active"||c===void 0||u===void 0||vm(t,u))return s?.debug({event:"upstream_id_jag_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:a,connectionId:t?.id,status:t?.status??"not_connected",hasSubjectToken:c!==void 0,subjectTokenType:u,subjectTokenExpired:u!==void 0&&vm(t,u)},"Upstream ID-JAG requires an admin subject-token binding"),{kind:"connect_required",payload:{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,message:`An IdP subject-token binding is required for ${e.upstreamDisplayName} before this tool can use XAA / ID-JAG.`,nextAction:"admin_setup_required"}};let p=ft(e.upstreamServerId),h=bp(e.upstreamServerId,e.authProfileId),g=h.resourceAs.resource??p.transport.baseUrl,S=e.requestedScope??(h.scopes.length===0?void 0:h.scopes.join(h.scopeDelimiter)),y=await dR({connection:t,connectionFingerprint:a,encryptedSubjectToken:c,subjectTokenType:u,idp:{tokenUrl:h.idp.tokenUrl},clientAuth:h.idp.clientAuth,context:e.context}),k=await wm({idp:{tokenUrl:h.idp.tokenUrl},subjectToken:y.subjectToken,subjectTokenType:y.subjectTokenType,audience:h.resourceAs.audience,resource:g,scope:S,clientAuth:h.idp.clientAuth,context:e.context}),w=k.scope??S,C=await bm({resourceAs:{tokenUrl:h.resourceAs.tokenUrl},assertion:k.assertion,resource:g,scope:w,clientAuth:h.resourceAs.clientAuth,context:e.context});if(cR(C),t!==void 0){let O=(C.scope??w)?.split(/[,\s]+/).filter(Boolean)??[],L=C.expiresIn===void 0?void 0:$(new Date(Date.now()+C.expiresIn*1e3)),F=await j().upsertUpstreamConnection({id:y.connection.id,ownerMode:y.connection.ownerMode,subjectId:y.connection.subjectId,upstreamServerId:y.connection.upstreamServerId,authProfileId:y.connection.authProfileId,status:"active",encryptedAccessToken:await We(C.accessToken),encryptedRefreshToken:y.connection.encryptedRefreshToken,scopes:O,expiresAt:L,metadata:y.connection.metadata});s?.info({event:"upstream_id_jag_access_token_persisted",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:a,connectionId:F.id,priorStatus:y.connection.status,priorUpdatedAt:y.connection.updatedAt,scopeCount:O.length,expiresAt:L},"Upstream ID-JAG access token persisted; connection is active")}return{kind:"authorized",credential:{type:"bearer_token",token:C.accessToken}}}n(Cm,"authorizeUpstreamIdJagRequest");var si=new Map;function uR(e){return[...new Set(e?.split(/[,\s]+/).filter(Boolean)??[])].sort().join(" ")}n(uR,"normalizeRefreshFlightScope");function lR(e){return oi(new URL(e.callbackPath,re(e.requestUrl,e.requestHeaders))).toString()}n(lR,"buildGatewayOAuthRedirectUri");async function Ls(e){let t=ft(e.upstreamServerId),r=wr(e.upstreamServerId,e.authProfileId),o=lR({callbackPath:r.redirectPath,requestUrl:e.request.url,requestHeaders:e.request.headers}),i="preloadedConnection"in e?e.preloadedConnection:(await j().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0];return{upstreamServerConfig:t,connection:i,providerInput:{target:{owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,returnTo:e.returnTo},redirectUri:o,returnOrigin:re(e.request.url,e.request.headers)}}}n(Ls,"prepareUpstreamOAuthRequest");async function Im(e){let t=await Ls(e),r=new St({...t.providerInput,...t.connection?.metadata===void 0?{}:{connectionMetadata:t.connection.metadata}});return pm(r,{upstreamServerId:e.upstreamServerId,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl})}n(Im,"startUpstreamConnect");async function Tm(e){let t=await Ls(e),r=new St({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),o=n(()=>mm({target:e,provider:r,connection:t.connection,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,upstreamDisplayName:t.upstreamServerConfig.displayName,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl}),"runSession");if(!e.forceRefresh&&t.connection!==void 0&&he(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return o();let i=tl({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}),s=JSON.stringify([i,uR(r.configuredAuthorizationScope??e.requestedScope)]),a=si.get(s);if(a!==void 0){W()?.debug({event:"upstream_oauth_refresh_single_flight_coalesced",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode},"Upstream OAuth refresh joined an isolate-local single-flight");let p=await a;if(p.kind==="usable"&&r.connectionSatisfiesRequestedScope(p.connection,e.requestedScope))return await r.adoptConnectionForDirectResolution(p.connection,"single_flight"),{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:r}};let{preloadedConnection:h,...g}=e;if(t=await Ls(g),r=new St({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),!e.forceRefresh&&t.connection!==void 0&&he(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return o()}let c=o(),u;return u=c.then(()=>{let p=r.currentConnection;return p!==void 0&&he(p)==="usable"?{kind:"usable",connection:p}:{kind:"unresolved"}}).catch(()=>({kind:"unresolved"})).finally(()=>{si.get(s)===u&&si.delete(s)}),si.set(s,u),c}n(Tm,"authorizeUpstreamRequest");async function Ir(e){let{routeAuth:t}=e;switch(t.authMode){case"shared-oauth":case"user-oauth":return Tm({request:e.request,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo});case"id-jag":return Cm({request:e.request,context:e.context,authMode:t.authMode,ownerMode:t.ownerMode,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,upstreamDisplayName:t.upstreamDisplayName,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo})}let r=t;throw new ke(`Unsupported upstream auth route context ${JSON.stringify(r)}.`)}n(Ir,"resolveUpstreamCredentialForRoute");async function km(e){if(e.connectRequest.authMode==="id-jag")throw new ke(`Upstream server ${e.connectRequest.upstreamServerId} uses XAA / ID-JAG and does not support browser OAuth connection flows.`);let t=await Im({request:e.request,owner:e.connectRequest.owner,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,upstreamServerId:e.connectRequest.upstreamServerId,authProfileId:e.connectRequest.authProfileId,operationId:e.connectRequest.operationId,returnTo:e.connectRequest.returnTo});return{authProfileId:e.connectRequest.authProfileId,authUrl:t,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,owner:e.connectRequest.owner,upstreamDisplayName:e.connectRequest.upstreamDisplayName,operationId:e.connectRequest.operationId}}n(km,"startUpstreamConnectForRequest");async function Am(e){let r=(await ri(e.callbackRequest.state)).authProfileId;if(Qo({upstreamServerId:e.callbackRequest.upstreamServerId,authProfileId:r}).mode==="id-jag")throw new ke(`Upstream server ${e.callbackRequest.upstreamServerId} uses XAA / ID-JAG and does not support OAuth callbacks.`);return hm({request:e.request,upstreamServerId:e.callbackRequest.upstreamServerId,authorizationCode:e.callbackRequest.code,stateToken:e.callbackRequest.state,...e.callbackRequest.iss===void 0?{}:{iss:e.callbackRequest.iss},upstreamServerConfig:ft(e.callbackRequest.upstreamServerId)})}n(Am,"finishUpstreamCallbackForRequest");function pR(e){return{upstreamServerId:e.connection.upstreamServerId,operationId:e.operationId,authProfileId:e.connection.authProfileId,upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}n(pR,"buildRouteAuthBaseFromConnection");function Pm(e){return{upstreamServerId:e.connection.id,operationId:e.operationId,authProfileId:xu(e.connection.id,e.connection.authMode),upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}n(Pm,"buildRouteAuthBaseFromPolicyOptions");function ai(e,t){let o=Ae().byOperationId.get(t);if(!o)throw new K(`Unknown MCP route "${t}". Ensure routes.oas.json declares this operationId before starting an upstream connection flow.`);if(o.connection===void 0)throw new K(`MCP route "${t}" does not declare an MCP token exchange policy. Add one before starting an upstream connection flow.`);if(o.connection.upstreamServerId!==e)throw new K(`MCP route "${t}" does not bind upstream "${e}". Check the route's MCP upstream policies and bind the upstream before starting an upstream connection flow.`);return pR({connection:o.connection,operationId:t})}n(ai,"resolveRouteAuthBase");function Hs(e,t){switch(e){case"user":return yr(t);case"shared":return Pu()}}n(Hs,"buildOwnerForSubject");function Tr(e,t){switch(e.authMode){case"shared-oauth":return{...e,authMode:"shared-oauth",ownerMode:"shared",owner:Hs("shared",t),initiatedBySubjectId:t};case"user-oauth":return{...e,authMode:"user-oauth",ownerMode:"user",owner:Hs("user",t),initiatedBySubjectId:t};case"id-jag":return{...e,authMode:"id-jag",ownerMode:"user",owner:Hs("user",t),initiatedBySubjectId:t}}}n(Tr,"resolveRouteAuthForSubject");var mR=P.InvalidRequest,hR=new Set(["connection","keep-alive","proxy-connection","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade"]);function fR(e,t){return{credentialType:e.type,forceRefresh:t}}n(fR,"buildCredentialResolvedAttributes");function gR(e){switch(e){case"admin_connect_required":return"admin_connect_required";case"authenticating":return"connect_required"}}n(gR,"connectRequiredReasonCode");function Em(e){G(e.context,{eventType:H.MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED,outcome:"success",routeBinding:e.routeBinding,attributes:fR(e.credential,e.forceRefresh===!0)})}n(Em,"emitCredentialResolvedAnalyticsEvent");function xm(e){let t={forceRefresh:e.forceRefresh===!0,nextAction:e.payload.nextAction,state:e.payload.state};if(G(e.context,{eventType:H.MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"connect_required",reasonClass:"auth",attributes:t}),e.payload.state==="reconsent_required"){G(e.context,{eventType:H.MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"reconsent_required",reasonClass:"auth",attributes:t});return}G(e.context,{eventType:H.MCP_AUTH_UPSTREAM_CONNECT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:gR(e.payload.state),reasonClass:"auth",attributes:t})}n(xm,"emitCredentialMissingAnalyticsEvents");function yR(e){let t=e.route.raw();return Uo.parse(t?.operationId)}n(yR,"readOperationId");async function SR(e,t,r,o){let i=await Ir({request:e,context:o,routeAuth:t});if(i.kind==="connect_required")return xm({context:o,payload:i.payload,routeBinding:t}),o.log.info({event:"mcp_upstream_connect_required",upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId},"MCP upstream proxy: upstream connection required"),{kind:"connect_required",payload:i.payload};let s=i.credential;if(Em({context:o,credential:s,routeBinding:t}),s.type==="bearer_token")return{kind:"headers",headers:[["authorization",`Bearer ${s.token}`]]};let a=await s.provider.tokens();return a?{kind:"headers",headers:[["authorization",`${a.token_type??"Bearer"} ${a.access_token}`]]}:(o.log.warn({event:"mcp_upstream_no_tokens",upstreamServerId:t.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens"),Response.json({error:"no_upstream_tokens"},{status:401}))}n(SR,"buildCredentialHeaders");var _R=new Set(["authorization","cookie","cookie2"]);function wR(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return t&&typeof t=="object"&&!Array.isArray(t)&&"method"in t&&typeof t.method=="string"?t.method:void 0}catch{return}}n(wR,"readJsonRequestMethod");function RR(e){let t=e.headers.get("content-type")??"";return/\bapplication\/(?:[\w.+-]+\+)?json\b/i.test(t)}n(RR,"isJsonResponse");function Bs(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Bs,"isRecord");function bR(e){return Array.isArray(e)&&e.length>0}n(bR,"hasIconList");function vR(e){if(e.connection.serverInfo?.icons!==void 0&&e.connection.serverInfo.icons.length>0)return e.connection.serverInfo.icons;try{let t=Xo(Iu(e.context.route.handler));return t===void 0?void 0:[t]}catch{return}}n(vR,"readFallbackServerIcons");function CR(e){if(!Bs(e.body))return e.body;let t=e.body.result;if(!Bs(t))return e.body;let r=t.serverInfo;return!Bs(r)||bR(r.icons)?e.body:{...e.body,result:{...t,serverInfo:{...r,icons:e.icons}}}}n(CR,"addMissingServerIcons");function IR(e,t){let r=Um(e);for(let o of _R)r.delete(o);for(let[o,i]of t)r.set(o,i);return new ba(e,{headers:r})}n(IR,"applyUpstreamHeaders");var TR=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;function kR(e){let t=e.get("connection");return t===null?[]:t.split(",").map(r=>r.trim()).filter(r=>TR.test(r))}n(kR,"connectionNominatedHeaderNames");function Um(e){let t=new Headers(e.headers);for(let r of kR(t))t.delete(r);for(let r of hR)t.delete(r);return t}n(Um,"buildProxyHeaders");async function AR(e){if(!(e.method==="GET"||e.method==="HEAD"))return e.clone().arrayBuffer()}n(AR,"readRetryBody");function Om(e,t){let r=t.authUrl===void 0?void 0:hp({message:t.message,elicitationId:["connect",t.operationId,t.upstreamServerId,t.authProfileId].join(":"),url:t.authUrl});return Response.json(Ko({id:mp(e),error:{code:r?.code??mR,message:t.message,data:{...r?.data??{},connectRequired:t}}}))}n(Om,"connectRequiredJsonRpcResponse");async function PR(e){let{scope:t}=cp(e.upstreamResponse),r=await Ir({request:e.request,context:e.context,routeAuth:e.routeAuth,forceRefresh:!0,requestedScope:t});if(r.kind==="connect_required")return xm({context:e.context,payload:r.payload,routeBinding:e.routeAuth,forceRefresh:!0}),{kind:"connect_required",payload:r.payload};let o=new Headers(e.headers),i=r.credential;if(Em({context:e.context,credential:i,routeBinding:e.routeAuth,forceRefresh:!0}),i.type==="bearer_token")return o.set("authorization",`Bearer ${i.token}`),{kind:"headers",headers:o};let s=await i.provider.tokens();return s?(o.set("authorization",`${s.token_type??"Bearer"} ${s.access_token}`),{kind:"headers",headers:o}):(e.context.log.warn({event:"mcp_upstream_no_tokens_after_refresh",upstreamServerId:e.routeAuth.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens after refresh"),{kind:"response",response:Response.json({error:"no_upstream_tokens"},{status:401})})}n(PR,"applyRefreshedCredentialHeaders");function ER(e){e.context.addResponseSendingHook(async(t,r)=>{if(t.status!==401)return t;let o=await PR({request:e.request,context:e.context,headers:Um(r),routeAuth:e.routeAuth,upstreamResponse:t});if(o.kind==="connect_required")return Om(e.requestBody,o.payload);if(o.kind==="response")return o.response;let i=Tu({handler:e.context.route.handler,request:r,body:e.requestBody,headers:o.headers});return wo.fetch(i.url,i.init)})}n(ER,"installUpstreamAuthRetryHook");function xR(e){if(wR(e.requestBody)!=="initialize")return;let t=vR({connection:e.connection,context:e.context});t===void 0||t.length===0||e.context.addResponseSendingHook(async r=>{if(!RR(r))return r;let o;try{o=await r.clone().json()}catch{return r}let i=CR({body:o,icons:t});if(i===o)return r;let s=new Headers(r.headers);return s.delete("content-length"),new Response(JSON.stringify(i),{status:r.status,statusText:r.statusText,headers:s})})}n(xR,"installInitializeIconHook");async function Fs(e,t,r){let o=yR(t),i=await AR(e),s=Pm({connection:r,operationId:o}),a=Nt(e.user,e.url,e.headers);t.log.setLogProperties?.({requestId:t.requestId}),ju(t,a);let c=Tr(s,a.subjectId),u=await SR(e,c,r,t);if(!(u instanceof Response)&&u.kind==="connect_required")return Om(i,u.payload);if(u instanceof Response)return u;let p=IR(e,u.headers);return ER({request:p,context:t,requestBody:i,routeAuth:c}),xR({context:t,requestBody:i,connection:r}),p}n(Fs,"mcpTokenExchangePolicy");var Js=class extends Ro{static{n(this,"McpTokenExchangeInboundPolicy")}static policyType="mcp-token-exchange";#e;constructor(t,r){let o=Uu(t,r);super(o,r),this.#e=o}async handler(t,r){return Fs(t,r,this.#e)}};var qm=Symbol("Html");function UR(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}n(UR,"escapeHtml");function OR(e){return e===null||typeof e!="object"?!1:e[qm]===!0}n(OR,"isHtml");function zm(e){return e==null||e===!1?"":Array.isArray(e)?e.map(zm).join(""):OR(e)?e.value:UR(String(e))}n(zm,"renderValue");function Ye(e){return{[qm]:!0,value:e}}n(Ye,"trustedHtml");var Pe=Ye("");function B(e,...t){let r=e[0]??"";for(let o=0;o<t.length;o+=1)r+=zm(t[o]),r+=e[o+1]??"";return Ye(r)}n(B,"html");function kr(e){return e.value}n(kr,"renderHtml");function Mm(e){return B`<p class="card__description">${e.detail}</p>${e.guidance} ${e.technicalDetails} ${e.action}`}n(Mm,"renderBrowserErrorPage");var Ar=Ye('*,:before,:after{box-sizing:border-box}:root{--bg:#f5f6f8;--surface:#fff;--surface-2:#f8fafc;--border:#e5e7eb;--border-strong:#d1d5db;--text:#0f172a;--text-2:#475569;--text-3:#64748b;--text-muted:#94a3b8;--accent:#0f172a;--accent-hover:#1e293b;--accent-text:#fff;--focus-ring:#0f172a29;--danger:#b91c1c;--danger-bg:#b91c1c0f;--danger-border:#b91c1c38;--warning:#92400e;--warning-bg:#fffbeb;--warning-border:#fde68a;--success:#15803d;--success-bg:#f0fdf4;--success-border:#bbf7d0;--radius-sm:4px;--radius:8px;--radius-lg:12px;--radius-pill:9999px;--shadow-sm:0 1px 2px #0f172a0d;--shadow:0 1px 2px #0f172a0a,0 6px 16px #0f172a0f;--font-sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;--font-mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Monaco,Consolas,monospace}@media (prefers-color-scheme:dark){:root{--bg:#0a0c10;--surface:#15171c;--surface-2:#1e2128;--border:#262932;--border-strong:#3a3e48;--text:#fafafa;--text-2:#cbd5e1;--text-3:#94a3b8;--text-muted:#71717a;--accent:#fafafa;--accent-hover:#e4e4e7;--accent-text:#0a0c10;--focus-ring:#fafafa2e;--danger:#f87171;--danger-bg:#f8717114;--danger-border:#f871714d;--warning:#fbbf24;--warning-bg:#fbbf2414;--warning-border:#fbbf2447;--success:#34d399;--success-bg:#34d39914;--success-border:#34d3994d;--shadow-sm:0 1px 2px #0006;--shadow:0 1px 2px #0006,0 8px 24px #0006}}html,body{margin:0;padding:0}body{font-family:var(--font-sans);background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;flex-direction:column;justify-content:center;align-items:center;min-height:100dvh;padding:48px 20px;font-size:14px;line-height:1.5;display:flex}.card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius-lg);width:100%;max-width:480px;box-shadow:var(--shadow);overflow:hidden}.card__head{text-align:center;padding:32px 32px 24px}.card__icon{border-radius:var(--radius);background:var(--surface-2);object-fit:contain;border:1px solid var(--border);width:48px;height:48px;margin:0 auto 16px;display:block}.card__title{letter-spacing:-.01em;color:var(--text);margin:0;font-size:20px;font-weight:600;line-height:1.3}.card__subtitle{color:var(--text-2);margin:8px 0 0;font-size:14px;line-height:1.55}.card__subtitle strong{color:var(--text);font-weight:600}.card__description{color:var(--text-3);margin:12px 0 0;font-size:13px;line-height:1.55}.card__principal{color:var(--text-3);background:var(--surface-2);border-radius:var(--radius-pill);text-overflow:ellipsis;white-space:nowrap;align-items:center;gap:6px;max-width:100%;margin:16px 0 0;padding:4px 12px;font-size:12.5px;display:inline-flex;overflow:hidden}.card__body{flex-direction:column;gap:20px;padding:8px 32px 24px;display:flex}.card__head+.card__body{border-top:1px solid var(--border);padding-top:24px}.card__footer{border-top:1px solid var(--border);background:var(--surface-2);flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:8px;padding:16px 24px;display:flex}.card__fineprint{color:var(--text-3);text-align:center;margin:0;font-size:12.5px;line-height:1.5}.card__fineprint strong{color:var(--text-2);font-weight:600}.section-label{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);align-items:baseline;gap:6px;margin:0;font-size:11px;font-weight:600;display:flex}.section-label__count{color:var(--text-3);letter-spacing:0;font-weight:500}.banner{border-radius:var(--radius);border:1px solid;align-items:flex-start;gap:10px;padding:12px 14px;font-size:13px;display:flex}.banner__icon{flex-shrink:0;justify-content:center;align-items:center;width:16px;height:16px;margin-top:1px;display:inline-flex}.banner__body{flex-direction:column;flex:1;gap:2px;min-width:0;display:flex}.banner__title{color:var(--text);margin:0;font-size:13px;font-weight:600}.banner__message{color:var(--text-2);margin:0;font-size:13px;line-height:1.5}.banner--warning{background:var(--warning-bg);border-color:var(--warning-border)}.banner--warning .banner__icon{color:var(--warning)}.banner--alert{background:var(--danger-bg);border-color:var(--danger-border)}.banner--alert .banner__icon,.banner--alert .banner__title{color:var(--danger)}.upstream-list{flex-direction:column;gap:8px;margin:0;padding:0;list-style:none;display:flex}.upstream-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);flex-direction:column;gap:10px;padding:14px;display:flex}.upstream-card--needs-action{border-color:var(--warning-border);background:var(--warning-bg)}.upstream-card__head{align-items:flex-start;gap:10px;display:flex}.icon-frame{border-radius:var(--radius-sm);border:1px solid var(--border);background:var(--surface-2);width:32px;height:32px;color:var(--text-3);flex-shrink:0;justify-content:center;align-items:center;display:inline-flex;overflow:hidden}.icon-frame img{object-fit:contain;max-width:100%;max-height:100%}.icon-frame--fallback svg{width:18px;height:18px}.inline-icon{object-fit:contain;vertical-align:-2px;border-radius:2px;width:14px;height:14px;margin-right:4px}.upstream-card__main{flex-direction:column;flex:1;gap:3px;min-width:0;display:flex}.upstream-card__title-row{justify-content:space-between;align-items:center;gap:10px;min-width:0;display:flex}.upstream-card__title{color:var(--text);letter-spacing:-.005em;text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;margin:0;font-size:14px;font-weight:600;line-height:1.3;overflow:hidden}.upstream-card__meta{color:var(--text-3);flex-wrap:wrap;align-items:center;gap:6px;font-size:12px;display:flex}.upstream-card__host{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);padding:1px 6px;font-size:11.5px}.upstream-card__sep{color:var(--border-strong)}.upstream-card__description{color:var(--text-2);margin:4px 0 0;font-size:12.5px;line-height:1.5}.status-badge{border-radius:var(--radius-pill);white-space:nowrap;border:1px solid #0000;flex-shrink:0;align-items:center;gap:6px;padding:2px 8px;font-size:11.5px;font-weight:600;display:inline-flex}.status-badge:before{content:"";background:currentColor;border-radius:50%;flex-shrink:0;width:5px;height:5px}.status-badge--success{background:var(--success-bg);color:var(--success);border-color:var(--success-border)}.status-badge--warning{background:var(--warning-bg);color:var(--warning);border-color:var(--warning-border)}.status-badge--neutral{background:var(--surface-2);color:var(--text-2);border-color:var(--border)}.upstream-card__capabilities,.upstream-card__scopes{border-top:1px solid var(--border);margin-top:2px;padding-top:10px}.upstream-card__capabilities--empty{color:var(--text-3);font-size:12px;font-style:italic}.capabilities-summary,.scopes-summary{cursor:pointer;user-select:none;color:var(--text-2);justify-content:space-between;align-items:center;gap:12px;padding:2px 0;font-size:12.5px;list-style:none;display:flex}.capabilities-summary::-webkit-details-marker,.scopes-summary::-webkit-details-marker{display:none}.capabilities-summary:hover,.scopes-summary:hover{color:var(--text)}.capabilities-summary:focus-visible,.scopes-summary:focus-visible{outline:2px solid var(--accent);outline-offset:2px;border-radius:var(--radius-sm)}.capabilities-summary__counts{flex-wrap:wrap;align-items:center;gap:12px;display:flex}.count-pill{color:var(--text-2);align-items:baseline;gap:4px;font-size:12.5px;display:inline-flex}.count-pill__num{font-variant-numeric:tabular-nums;color:var(--text);font-size:13px;font-weight:600}.count-pill--destructive .count-pill__num,.count-pill--destructive .count-pill__label{color:var(--danger)}.capabilities-summary__chevron{color:var(--text-3);flex-shrink:0;transition:transform .15s;display:inline-flex}details[open]>.capabilities-summary .capabilities-summary__chevron,details[open]>.scopes-summary .capabilities-summary__chevron{transform:rotate(180deg)}.capabilities-detail{margin-top:10px}.capability-section{margin-top:14px}.capability-section:first-child{margin-top:6px}.capability-section__title{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);margin:0 0 6px;font-size:11px;font-weight:600}.capability-list{flex-direction:column;gap:5px;margin:0;padding:0;font-size:12.5px;list-style:none;display:flex}.capability-row{flex-wrap:wrap;align-items:baseline;gap:6px;padding:2px 0;display:flex}.capability-row__name{font-weight:500;font-family:var(--font-mono);color:var(--text);font-size:12.5px}.capability-row__description{color:var(--text-3);flex-basis:100%;font-size:12px;line-height:1.45}.capability-row__description code{font-family:var(--font-mono);background:var(--surface-2);border-radius:var(--radius-sm);color:var(--text-2);padding:1px 4px}.capability-row--more{color:var(--text-3);font-size:12px;font-style:italic}.scopes-list{flex-wrap:wrap;gap:4px;margin-top:8px;display:flex}.scope-chip{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);border:1px solid var(--border);padding:2px 7px;font-size:11.5px}.badge{border-radius:var(--radius-sm);letter-spacing:.04em;text-transform:uppercase;align-items:center;padding:1px 5px;font-size:10px;font-weight:600;display:inline-flex}.badge--destructive{background:var(--danger-bg);color:var(--danger)}.badge--muted{background:var(--surface-2);color:var(--text-3)}.badge-row{flex-wrap:wrap;gap:4px;display:inline-flex}.muted{color:var(--text-3)}.button{font:inherit;border-radius:var(--radius);cursor:pointer;white-space:nowrap;border:1px solid #0000;justify-content:center;align-items:center;gap:6px;min-height:40px;padding:8px 16px;font-size:14px;font-weight:500;text-decoration:none;transition:background .12s,border-color .12s,color .12s,box-shadow .12s,transform 40ms;display:inline-flex}.button:active{transform:translateY(1px)}.button:focus-visible{box-shadow:0 0 0 3px var(--focus-ring);outline:0}.button--small{padding:5px 10px;font-size:12.5px}.button--primary{background:var(--accent);color:var(--accent-text);border-color:var(--accent)}.button--primary:hover:not(:disabled):not([aria-disabled=true]){background:var(--accent-hover);border-color:var(--accent-hover)}.button:disabled,.button[aria-disabled=true]{cursor:not-allowed;opacity:.55}.button:disabled:hover,.button[aria-disabled=true]:hover{background:var(--accent);border-color:var(--accent)}.button--secondary{background:var(--surface);color:var(--text);border-color:var(--border-strong)}.button--secondary:hover{background:var(--surface-2);border-color:var(--border-strong)}.button--block{width:100%}.reconnect-action{align-items:center;margin-right:auto;display:inline-flex;position:relative}.reconnect-button{gap:7px}.tooltip{width:16px;height:16px;color:var(--accent);background:color-mix(in srgb,var(--accent)8%,transparent);cursor:help;border:1.5px solid;border-radius:50%;justify-content:center;align-items:center;font-size:10.5px;font-weight:700;line-height:1;display:inline-flex;position:relative}.tooltip:after{content:attr(aria-label);z-index:10;border-radius:var(--radius-sm);background:var(--accent);width:280px;max-width:min(280px,100vw - 48px);color:var(--accent-text);box-shadow:var(--shadow);text-align:left;white-space:normal;opacity:0;pointer-events:none;padding:12px 14px;font-size:13px;font-weight:600;line-height:1.45;transition:opacity .12s;position:absolute;bottom:calc(100% + 12px);left:50%;transform:translate(-50%)}.tooltip:before{content:"";z-index:11;border-left:7px solid #0000;border-right:7px solid #0000;border-top:8px solid var(--accent);opacity:0;pointer-events:none;transition:opacity .12s;position:absolute;bottom:calc(100% + 5px);left:50%;transform:translate(-50%)}.tooltip:hover:after,.tooltip:hover:before,.tooltip:focus-visible:after,.tooltip:focus-visible:before{opacity:1}.form{flex-direction:column;gap:6px;display:flex}.form__label{color:var(--text);margin:8px 0 0;font-size:13px;font-weight:600;display:block}.form__label:first-child{margin-top:0}.form__input{box-sizing:border-box;border:1px solid var(--border-strong);border-radius:var(--radius);width:100%;font:inherit;background:var(--surface);color:var(--text);padding:9px 12px;font-size:14px;transition:border-color .12s,box-shadow .12s}.form__input:focus{border-color:var(--accent);box-shadow:0 0 0 3px var(--focus-ring);outline:0}.form__note{color:var(--text-3);margin:4px 0 0;font-size:12.5px;line-height:1.5}.form__submit{margin-top:8px}.empty{text-align:center;color:var(--text-3);border:1px dashed var(--border);border-radius:var(--radius);background:var(--surface);padding:24px 16px;font-size:13px}.actions{gap:8px;margin:0;display:flex}@media (width<=480px){body{padding:0}.card{box-shadow:none;border-left:0;border-right:0;border-radius:0;min-height:100dvh}.card__head{padding:24px 20px 16px}.card__body{padding:16px 20px}.card__footer{flex-direction:column-reverse;align-items:stretch;padding:14px 20px}.card__footer .button{width:100%}.reconnect-action{justify-content:center;width:100%;margin-right:0}.reconnect-action .button{flex:1}.tooltip:after{left:auto;right:0;transform:none}}@media (prefers-reduced-motion:reduce){*{transition:none!important}}');function Pr(e){return B`<!doctype html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name="referrer" content="no-referrer" /><meta name="robots" content="noindex" /><title>${e.title}</title><link rel="icon" href="${e.iconHref}" /><style>
       ${e.styles}
-    </style></head><body><main class="card"><header class="card__head">${e.headerIcon}<h1 class="card__title">${e.heading}</h1>${e.subhead}</header><div class="card__body">${e.body}</div>${e.footer}</main></body></html>`}o(it,"renderShell");var gp="text/html; charset=utf-8";function at(e){try{return new URL(e).host}catch{return""}}o(at,"safeHostFromUrl");function ie(e){let t=_p(e.kind??"authorization_failed"),r=yp(e);return new Response(nt(it({title:e.title??t.title,iconHref:"",styles:ot,headerIcon:te,heading:e.title??t.title,subhead:"",body:Aa({detail:e.detail,guidance:v`<p class="card__description">${t.guidance}</p>`,technicalDetails:Sp({diagnostic:r,upstreamHtml:e.upstreamHtml}),action:Rp(e.action)}),footer:""})),{status:e.status??400,headers:{"content-type":gp,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}o(ie,"browserErrorPageResponse");function yp(e){let t=e.diagnostic?.code??e.code??"unknown";return{code:t,stage:e.diagnostic?.stage??wp(t),timestamp:e.diagnostic?.timestamp??new Date().toISOString(),...e.requestId===void 0&&e.diagnostic?.requestId===void 0?{}:{requestId:e.diagnostic?.requestId??e.requestId},...e.diagnostic?.operationId===void 0?{}:{operationId:e.diagnostic.operationId},...e.diagnostic?.routePath===void 0?{}:{routePath:e.diagnostic.routePath},...e.diagnostic?.upstreamServerId===void 0?{}:{upstreamServerId:e.diagnostic.upstreamServerId},...e.diagnostic?.authProfileId===void 0?{}:{authProfileId:e.diagnostic.authProfileId},...e.diagnostic?.upstreamUrl===void 0?{}:{upstreamUrl:e.diagnostic.upstreamUrl},...e.diagnostic?.metadataUrl===void 0?{}:{metadataUrl:e.diagnostic.metadataUrl},...e.diagnostic?.httpStatus===void 0?{}:{httpStatus:e.diagnostic.httpStatus},...e.diagnostic?.contentType===void 0?{}:{contentType:e.diagnostic.contentType},...e.diagnostic?.providerError===void 0?{}:{providerError:e.diagnostic.providerError},...e.diagnostic?.providerErrorDescription===void 0?{}:{providerErrorDescription:e.diagnostic.providerErrorDescription},suggestedFix:e.diagnostic?.suggestedFix??bp(t),underlyingError:e.diagnostic?.underlyingError??e.developerDetail}}o(yp,"buildBrowserErrorDiagnostic");function _p(e){switch(e){case"session_expired":return{title:"Authorization expired",guidance:"Return to your MCP client and reconnect. Expired authorization requests cannot be resumed."};case"access_denied":return{title:"Authorization canceled",guidance:"Return to your MCP client to retry if you want to grant access."};case"configuration_error":return{title:"Configuration needs attention",guidance:"Contact your workspace admin with this error code. The gateway or upstream configuration must be fixed before retrying."};case"connection_failed":return{title:"Connection failed",guidance:"Return to your MCP client and reconnect this upstream. If this keeps happening, contact your gateway administrator with this error code."};case"invalid_request":return{title:"Authorization request invalid",guidance:"Return to your MCP client and try connecting again. If this keeps happening, the client request may need to be fixed."};case"admin_required":return{title:"Admin setup required",guidance:"Contact your workspace admin with this error code. This connection cannot be completed until setup is finished."};case"internal_error":return{title:"Gateway error",guidance:"Try again later from your MCP client. If this keeps happening, contact your gateway administrator with this error code."};case"authorization_failed":return{title:"Authorization failed",guidance:"Return to your MCP client and start authorization again. If this keeps happening, contact your gateway administrator with this error code."}}}o(_p,"readBrowserErrorPagePresentation");function wp(e){switch(e){case"upstream_oauth_discovery_unavailable":return"upstream_oauth_discovery";case"upstream_client_registration_required":return"upstream_oauth_client_registration";case"upstream_provider_access_denied":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"upstream_token_exchange";case"provider_access_denied":return"upstream_oauth_callback";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"upstream_oauth_state";case"browser_login_verification_failed":return"downstream_browser_login";case"authentication_required":case"identity_context_missing":return"downstream_auth";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"gateway_configuration";case"server_error":case"internal_server_error":return"gateway_internal";default:return"gateway_request"}}o(wp,"readBrowserErrorStage");function bp(e){switch(e){case"upstream_oauth_discovery_unavailable":return"Confirm the upstream MCP URL and OAuth protected resource metadata. If the provider requires approval, configure the provider app or contact the provider.";case"upstream_client_registration_required":return"Register an OAuth client with the upstream provider, then configure the gateway to use that client before retrying.";case"upstream_provider_access_denied":return"Confirm the provider allows this gateway, OAuth client, and upstream MCP URL, then retry the connection.";case"upstream_token_exchange_failed":return"Retry the connection. If it repeats, verify the upstream OAuth client, redirect URI, token endpoint, and provider allowlist.";case"upstream_token_response_invalid":return"Verify the upstream token endpoint returns a valid OAuth token response for this gateway client.";case"provider_access_denied":return"Start the connection again if access was denied by mistake. Otherwise, grant the requested upstream provider access.";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"Start a new connection from the MCP client. The previous browser authorization request cannot be resumed.";case"browser_login_verification_failed":return"Retry the browser login flow. If it repeats, verify the downstream login callback configuration.";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"Check the MCP route, upstream server, and auth profile entries in the gateway configuration.";case"authentication_required":case"identity_context_missing":return"Verify the normal Zuplo auth policy runs before the MCP gateway policy and sets request.user.";case"server_error":case"internal_server_error":return"Retry later and check gateway logs with the request ID.";default:return"Check the gateway configuration and request details associated with this error code."}}o(bp,"readBrowserErrorSuggestedFix");function Rp(e){return e===void 0?te:v`<a class="button button--primary button--block" href="${e.href}">${e.label}</a>`}o(Rp,"renderAction");function Cp(e){let t=[["Error code",e.code],["Stage",e.stage],["Request ID",e.requestId],["Time",e.timestamp],["Gateway route",e.routePath],["Operation ID",e.operationId],["Upstream",e.upstreamServerId],["Auth profile",e.authProfileId],["Upstream URL",e.upstreamUrl],["Metadata URL",e.metadataUrl],["HTTP status",e.httpStatus],["Content type",e.contentType],["Provider error",e.providerError],["Provider error description",e.providerErrorDescription],["Suggested fix",e.suggestedFix],["Underlying error",e.underlyingError]].filter(r=>r[1]!==void 0).map(([r,n])=>`${r}: ${n}`).join(`
-`);return v`<pre class="banner__message" style="white-space: pre-wrap; overflow-wrap: anywhere; margin-top: 8px;"><code>${t}</code></pre>`}o(Cp,"renderTechnicalPre");function _r(e){return e.value===void 0||e.value===""?te:v`<p class="banner__message"><strong>${e.label}:</strong> <code>${e.value}</code></p>`}o(_r,"renderOptionalTechnicalRow");function Sp(e){return v`<section class="banner banner--warning" aria-label="Developer details">
+    </style></head><body><main class="card"><header class="card__head">${e.headerIcon}<h1 class="card__title">${e.heading}</h1>${e.subhead}</header><div class="card__body">${e.body}</div>${e.footer}</main></body></html>`}n(Pr,"renderShell");var qR="text/html; charset=utf-8";function Er(e){try{return new URL(e).host}catch{return""}}n(Er,"safeHostFromUrl");function De(e){let t=MR(e.kind??"authorization_failed"),r=zR(e);return new Response(kr(Pr({title:e.title??t.title,iconHref:"",styles:Ar,headerIcon:Pe,heading:e.title??t.title,subhead:"",body:Mm({detail:e.detail,guidance:B`<p class="card__description">${t.guidance}</p>`,technicalDetails:LR({diagnostic:r,upstreamHtml:e.upstreamHtml}),action:$R(e.action)}),footer:""})),{status:e.status??400,headers:{"content-type":qR,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}n(De,"browserErrorPageResponse");function zR(e){let t=e.diagnostic?.code??e.code??"unknown";return{code:t,stage:e.diagnostic?.stage??jR(t),timestamp:e.diagnostic?.timestamp??new Date().toISOString(),...e.requestId===void 0&&e.diagnostic?.requestId===void 0?{}:{requestId:e.diagnostic?.requestId??e.requestId},...e.diagnostic?.operationId===void 0?{}:{operationId:e.diagnostic.operationId},...e.diagnostic?.routePath===void 0?{}:{routePath:e.diagnostic.routePath},...e.diagnostic?.upstreamServerId===void 0?{}:{upstreamServerId:e.diagnostic.upstreamServerId},...e.diagnostic?.authProfileId===void 0?{}:{authProfileId:e.diagnostic.authProfileId},...e.diagnostic?.upstreamUrl===void 0?{}:{upstreamUrl:e.diagnostic.upstreamUrl},...e.diagnostic?.metadataUrl===void 0?{}:{metadataUrl:e.diagnostic.metadataUrl},...e.diagnostic?.httpStatus===void 0?{}:{httpStatus:e.diagnostic.httpStatus},...e.diagnostic?.contentType===void 0?{}:{contentType:e.diagnostic.contentType},...e.diagnostic?.providerError===void 0?{}:{providerError:e.diagnostic.providerError},...e.diagnostic?.providerErrorDescription===void 0?{}:{providerErrorDescription:e.diagnostic.providerErrorDescription},suggestedFix:e.diagnostic?.suggestedFix??NR(t),underlyingError:e.diagnostic?.underlyingError??e.developerDetail}}n(zR,"buildBrowserErrorDiagnostic");function MR(e){switch(e){case"session_expired":return{title:"Authorization expired",guidance:"Return to your MCP client and reconnect. Expired authorization requests cannot be resumed."};case"access_denied":return{title:"Authorization canceled",guidance:"Return to your MCP client to retry if you want to grant access."};case"configuration_error":return{title:"Configuration needs attention",guidance:"Contact your workspace admin with this error code. The gateway or upstream configuration must be fixed before retrying."};case"connection_failed":return{title:"Connection failed",guidance:"Return to your MCP client and reconnect this upstream. If this keeps happening, contact your gateway administrator with this error code."};case"invalid_request":return{title:"Authorization request invalid",guidance:"Return to your MCP client and try connecting again. If this keeps happening, the client request may need to be fixed."};case"admin_required":return{title:"Admin setup required",guidance:"Contact your workspace admin with this error code. This connection cannot be completed until setup is finished."};case"internal_error":return{title:"Gateway error",guidance:"Try again later from your MCP client. If this keeps happening, contact your gateway administrator with this error code."};case"authorization_failed":return{title:"Authorization failed",guidance:"Return to your MCP client and start authorization again. If this keeps happening, contact your gateway administrator with this error code."}}}n(MR,"readBrowserErrorPagePresentation");function jR(e){switch(e){case"upstream_oauth_discovery_unavailable":return"upstream_oauth_discovery";case"upstream_client_registration_required":return"upstream_oauth_client_registration";case"upstream_provider_access_denied":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"upstream_token_exchange";case"provider_access_denied":return"upstream_oauth_callback";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"upstream_oauth_state";case"browser_login_verification_failed":return"downstream_browser_login";case"authentication_required":case"identity_context_missing":return"downstream_auth";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"gateway_configuration";case"server_error":case"internal_server_error":return"gateway_internal";default:return"gateway_request"}}n(jR,"readBrowserErrorStage");function NR(e){switch(e){case"upstream_oauth_discovery_unavailable":return"Confirm the upstream MCP URL and OAuth protected resource metadata. If the provider requires approval, configure the provider app or contact the provider.";case"upstream_client_registration_required":return"Register an OAuth client with the upstream provider, then configure the gateway to use that client before retrying.";case"upstream_provider_access_denied":return"Confirm the provider allows this gateway, OAuth client, and upstream MCP URL, then retry the connection.";case"upstream_token_exchange_failed":return"Retry the connection. If it repeats, verify the upstream OAuth client, redirect URI, token endpoint, and provider allowlist.";case"upstream_token_response_invalid":return"Verify the upstream token endpoint returns a valid OAuth token response for this gateway client.";case"provider_access_denied":return"Start the connection again if access was denied by mistake. Otherwise, grant the requested upstream provider access.";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"Start a new connection from the MCP client. The previous browser authorization request cannot be resumed.";case"browser_login_verification_failed":return"Retry the browser login flow. If it repeats, verify the downstream login callback configuration.";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"Check the MCP route, upstream server, and auth profile entries in the gateway configuration.";case"authentication_required":case"identity_context_missing":return"Verify the normal Zuplo auth policy runs before the MCP gateway policy and sets request.user.";case"server_error":case"internal_server_error":return"Retry later and check gateway logs with the request ID.";default:return"Check the gateway configuration and request details associated with this error code."}}n(NR,"readBrowserErrorSuggestedFix");function $R(e){return e===void 0?Pe:B`<a class="button button--primary button--block" href="${e.href}">${e.label}</a>`}n($R,"renderAction");function DR(e){let t=[["Error code",e.code],["Stage",e.stage],["Request ID",e.requestId],["Time",e.timestamp],["Gateway route",e.routePath],["Operation ID",e.operationId],["Upstream",e.upstreamServerId],["Auth profile",e.authProfileId],["Upstream URL",e.upstreamUrl],["Metadata URL",e.metadataUrl],["HTTP status",e.httpStatus],["Content type",e.contentType],["Provider error",e.providerError],["Provider error description",e.providerErrorDescription],["Suggested fix",e.suggestedFix],["Underlying error",e.underlyingError]].filter(r=>r[1]!==void 0).map(([r,o])=>`${r}: ${o}`).join(`
+`);return B`<pre class="banner__message" style="white-space: pre-wrap; overflow-wrap: anywhere; margin-top: 8px;"><code>${t}</code></pre>`}n(DR,"renderTechnicalPre");function ci(e){return e.value===void 0||e.value===""?Pe:B`<p class="banner__message"><strong>${e.label}:</strong> <code>${e.value}</code></p>`}n(ci,"renderOptionalTechnicalRow");function LR(e){return B`<section class="banner banner--warning" aria-label="Developer details">
     <span class="banner__icon" aria-hidden="true">!</span>
     <div class="banner__body">
       <p class="banner__title">Developer details</p>
       <p class="banner__message" data-gateway-error-code="${e.diagnostic.code}">
         <strong>Error code:</strong> <code>${e.diagnostic.code}</code>
       </p>
-      ${_r({label:"Stage",value:e.diagnostic.stage})}
-      ${_r({label:"Request ID",value:e.diagnostic.requestId})}
-      ${_r({label:"Suggested fix",value:e.diagnostic.suggestedFix})}
-      ${_r({label:"Reason",value:e.diagnostic.underlyingError})}
-      ${Cp(e.diagnostic)}
-      ${Ip(e.upstreamHtml)}
+      ${ci({label:"Stage",value:e.diagnostic.stage})}
+      ${ci({label:"Request ID",value:e.diagnostic.requestId})}
+      ${ci({label:"Suggested fix",value:e.diagnostic.suggestedFix})}
+      ${ci({label:"Reason",value:e.diagnostic.underlyingError})}
+      ${DR(e.diagnostic)}
+      ${HR(e.upstreamHtml)}
     </div>
-  </section>`}o(Sp,"renderTechnicalDetails");function Ip(e){return e===void 0?te:v`<iframe
+  </section>`}n(LR,"renderTechnicalDetails");function HR(e){return e===void 0?Pe:B`<iframe
     title="Upstream HTML error response"
     sandbox
     srcdoc="${e}"
     style="border: 1px solid var(--warning-border); border-radius: var(--radius-sm); background: white; width: 100%; min-height: 220px; margin-top: 8px;"
-  ></iframe>`}o(Ip,"renderUpstreamHtml");var ka="application/json",vp="application/x-www-form-urlencoded";function wr(e,t){return new h({message:e,extensionMembers:{[y]:"invalid_request"}},t===void 0?void 0:{cause:t})}o(wr,"invalidRequestError");function Ap(e){return(e??"").split(";")[0]?.trim().toLowerCase()??""}o(Ap,"normalizeContentType");function kp(e,t){return e===t?!0:t===ka&&e.endsWith("+json")}o(kp,"contentTypeMatches");function xp(e,t){if(!t||t.length===0)return;let r=Ap(e.headers.get("content-type"));if(!t.some(n=>kp(r,n)))throw wr(`Request body must be ${t.join(" or ")}.`)}o(xp,"assertExpectedContentType");function Up(e,t,r){let n=e.headers.get("content-length");if(!n)return;let i=Number.parseInt(n,10);if(Number.isFinite(i)&&i>t)throw wr(`${r} exceeded the maximum allowed size.`)}o(Up,"assertContentLengthWithinLimit");async function xa(e,t){let r=t.label??"Request body";xp(e,t.expectedContentTypes),Up(e,t.maxBytes,r);let n=await ur(e.body,{maxBytes:t.maxBytes,createLimitError:o(()=>wr(`${r} exceeded the maximum allowed size.`),"createLimitError")});return new TextDecoder().decode(n)}o(xa,"readBoundedTextBody");async function Ua(e,t){let r=await xa(e,{...t,expectedContentTypes:[ka]});try{return JSON.parse(r)}catch(n){throw wr("Request body must be valid JSON.",n)}}o(Ua,"readBoundedJsonBody");async function Ta(e,t){let r=await xa(e,{...t,expectedContentTypes:[vp]});return new URLSearchParams(r)}o(Ta,"readBoundedFormUrlEncodedBody");import{errors as Ea,jwtVerify as Oa,SignJWT as Ma}from"jose";import{base64url as Tp}from"jose";var Pp="mcp-browser-login-pkce:",Ep=new TextEncoder;async function Op(e){return crypto.subtle.importKey("raw",J(e),{name:"HMAC",hash:"SHA-256"},!1,["sign"])}o(Op,"importHmacKey");async function wn(e){let t=await Op(e.signingKey),r=Ep.encode(`${Pp}${e.stateId}`),n=await crypto.subtle.sign("HMAC",t,J(r));return Ge.parse(Tp.encode(new Uint8Array(n)))}o(wn,"deriveBrowserLoginPkceVerifier");async function Pa(e){let t=await wn(e),r=await er(t);return{codeVerifier:t,codeChallenge:r,codeChallengeMethod:Ne}}o(Pa,"deriveBrowserLoginPkceParams");var Mp={invalid_request:400,invalid_client:401,invalid_grant:400,invalid_target:400,unsupported_grant_type:400,server_error:500,invalid_redirect_uri:400,invalid_client_metadata:400},f=class extends Error{static{o(this,"OAuthProtocolError")}errorCode;status;constructor(t,r,n=Mp[t],i){super(r,i),this.name="OAuthProtocolError",this.errorCode=t,this.status=n}};var qp=300,Dp=d.object({purpose:d.literal("gateway_browser_login"),transactionId:Or,stateId:Mr,exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),zp=d.object({purpose:d.literal("gateway_authorization_setup"),transactionId:Or,stateId:Mr,exp:d.number().int().positive(),iat:d.number().int().positive().optional()});async function Ot(){return oe({purpose:"browser-login",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"browser-login"),"derive")})}o(Ot,"getBrowserLoginKey");async function qa(){return oe({purpose:"authorization-csrf",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"authorization-csrf"),"derive")})}o(qa,"getCsrfKey");function Da(e){return{now:e.now??new Date,ttlSeconds:za()}}o(Da,"readPendingTransactionDependencies");function za(){return N().browserLogin.stateTtlSeconds}o(za,"readBrowserLoginStateTtlSeconds");function jp(e){let t=L();return K(e)&&t.isActionPath(e.pathname,"/oauth/dev-login")}o(jp,"isLoopbackDevLoginUrl");async function Hp(e){let t=N().browserLogin,r=L(),n=new URL(Re("url")),i=new URL(r.actionPath("/oauth/callback"),Ze(e.requestUrl,e.requestHeaders));if(jp(n))return n.searchParams.set("redirect_uri",i.toString()),n.searchParams.set("state",e.state),n;if(n.searchParams.set("response_type","code"),n.searchParams.set("client_id",Re("clientId")),n.searchParams.set("redirect_uri",i.toString()),n.searchParams.set("scope",t.scope),n.searchParams.set("state",e.state),n.searchParams.set("nonce",e.nonce),t.audience&&n.searchParams.set("audience",t.audience),t.pkce===Ne){let a=await Pa({stateId:e.stateId,signingKey:await Ot()});n.searchParams.set("code_challenge",a.codeChallenge),n.searchParams.set("code_challenge_method",a.codeChallengeMethod)}return n}o(Hp,"buildBrowserLoginUrl");function Bp(e,t){return e.subjectId===t.subjectId}o(Bp,"principalsMatch");function ja(e){return{subjectId:e.subjectId,...e.roles===void 0?{}:{roles:e.roles}}}o(ja,"toPendingPrincipal");function Ha(e){let t={id:e.id,currentStateHash:e.currentStateHash,clientId:e.transaction.clientId,redirectUri:e.transaction.redirectUri,resource:e.transaction.resource,operationId:e.transaction.operationId,scope:e.transaction.scope,codeChallenge:e.transaction.codeChallenge,codeChallengeMethod:e.transaction.codeChallengeMethod,createdAt:S(e.now),expiresAt:S(de(e.now,e.ttlSeconds)),...e.transaction.clientState===void 0?{}:{clientState:e.transaction.clientState}};if(e.phase==="awaiting_login")return{...t,phase:"awaiting_login"};if(!e.principal)throw b("identity_context_missing","Authorization setup requires a principal.");return{...t,phase:"awaiting_setup",principal:ja(e.principal)}}o(Ha,"createTransactionRecord");async function Ba(e){let{id:t,...r}=e.record,n=await C().startAuthorization({...r,transactionId:t,...e.client===void 0?{}:{client:e.client}});switch(n.kind){case"started":return n.transaction;case"already_exists":throw b("oauth_state_reused","Authorization transaction state already exists.");case"invalid_client":throw new f("invalid_client","OAuth client is not registered.");case"redirect_uri_mismatch":throw new f("invalid_request","redirect_uri is not registered for the client.")}}o(Ba,"startPendingTransaction");async function Lp(e){return new Ma({purpose:"gateway_browser_login",transactionId:e.transactionId,stateId:e.stateId}).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await Ot())}o(Lp,"signBrowserLoginState");async function La(e){return new Ma({purpose:"gateway_authorization_setup",transactionId:e.transactionId,stateId:Dr()}).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await qa())}o(La,"signCsrfToken");async function bn(e){try{let{payload:t}=await Oa(e,await Ot(),{algorithms:[V],issuer:Z,audience:W}),r=Dp.parse(t);return{transactionId:r.transactionId,stateId:r.stateId}}catch(t){throw t instanceof Ea.JWTExpired?b("oauth_state_expired","Browser login state has expired.",t):b("oauth_state_invalid","Browser login state could not be verified.",t)}}o(bn,"verifyBrowserLoginStateToken");async function br(e){try{let{payload:t}=await Oa(e,await qa(),{algorithms:[V],issuer:Z,audience:W});return{transactionId:zp.parse(t).transactionId}}catch(t){throw t instanceof Ea.JWTExpired?b("oauth_state_expired","Authorization setup state has expired.",t):b("oauth_state_invalid","Authorization setup state could not be verified.",t)}}o(br,"verifyCsrfToken");function Rn(e){return e==="consumed"||e==="consumed_already"||e==="stale_hash"?"oauth_state_reused":e==="expired"?"oauth_state_expired":"oauth_state_invalid"}o(Rn,"pendingStateErrorCode");function Np(e){return e.kind==="available"?{kind:"available",record:e.transaction}:e}o(Np,"toPendingAuthorizationGetResult");function Gp(e){return e.kind==="advanced"?{kind:"advanced",record:e.transaction}:e}o(Gp,"toPendingAuthorizationAdvanceResult");function Cn(e){return e==="principal_mismatch"?"oauth_callback_mismatch":Rn(e==="consumed_already"?"consumed_already":e)}o(Cn,"setupDecisionErrorCode");async function Na(e){let t=e.now??new Date,r=await br(e.csrfToken),n=await C().markAuthorizationSetupApproved({transactionId:r.transactionId,currentStateHash:await P(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:S(t)});if(n.kind!=="marked")throw b(Cn(n.kind),"Authorization setup state is invalid, expired, or already used.");return Ga({kind:"available",record:n.transaction})}o(Na,"markSetupApproved");function Ga(e){if(e.kind!=="available")throw b(Rn(e.kind),"Authorization setup state is invalid, expired, or already used.");if(e.record.phase!=="awaiting_setup")throw b("oauth_state_invalid","Authorization setup state is not in the setup phase.");return e.record}o(Ga,"requireAwaitingSetup");function Jp(e){if(!Bp(e.currentBrowserPrincipal,e.transaction.principal))throw b("oauth_callback_mismatch","Authorization setup state does not match the current browser session.")}o(Jp,"requireCurrentPrincipalMatches");async function Ja(e){let t=e.now??new Date,r=za(),n=qr(),i=Dr(),a=await Lp({transactionId:n,stateId:i,ttlSeconds:r}),s=Ha({id:n,transaction:e.transaction,currentStateHash:await P(a),phase:"awaiting_login",now:t,ttlSeconds:r});if(s.phase!=="awaiting_login")throw b("oauth_state_invalid","Authorization transaction did not start in login phase.");let c=await Ba({record:s,client:e.transaction.client});if(c.phase!=="awaiting_login")throw b("oauth_state_invalid","Authorization transaction did not start in login phase.");let u=await Hp({state:a,nonce:i,stateId:i,requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders}});return{transaction:c,browserLoginStateToken:a,browserLoginUrl:u}}o(Ja,"startAwaitingLogin");async function Fa(e){let{now:t,ttlSeconds:r}=Da(e),n=qr(),i=await La({transactionId:n,ttlSeconds:r}),a=Ha({id:n,transaction:e.transaction,currentStateHash:await P(i),phase:"awaiting_setup",principal:e.principal,now:t,ttlSeconds:r});if(a.phase!=="awaiting_setup")throw b("oauth_state_invalid","Authorization transaction did not start in setup phase.");let s=await Ba({record:a,client:e.transaction.client});if(s.phase!=="awaiting_setup")throw b("oauth_state_invalid","Authorization transaction did not start in setup phase.");return{transaction:s,csrfToken:i}}o(Fa,"startAwaitingSetup");async function $a(e){let{now:t,ttlSeconds:r}=Da(e),n=await bn(e.browserLoginStateToken),i=await La({transactionId:n.transactionId,ttlSeconds:r}),a=Gp(await C().advancePendingAuthorization({transactionId:n.transactionId,expectedPhase:"awaiting_login",currentStateHash:await P(e.browserLoginStateToken),nextStateHash:await P(i),nextPhase:"awaiting_setup",principal:ja(e.principal),now:S(t)}));if(a.kind!=="advanced")throw b(Rn(a.kind),"Browser login state is invalid, expired, or already used.");if(a.record.phase!=="awaiting_setup")throw b("oauth_state_invalid","Browser login did not advance to setup.");return{transaction:a.record,csrfToken:i}}o($a,"completeLogin");async function Za(e){let t=await Sn(e);return Jp({transaction:t,currentBrowserPrincipal:e.currentBrowserPrincipal}),t}o(Za,"getSetup");async function Sn(e){let t=e.now??new Date,r=await br(e.csrfToken);return Ga(Np(await C().readPendingAuthorization({transactionId:r.transactionId,currentStateHash:await P(e.csrfToken),now:S(t)})))}o(Sn,"getSetupTransaction");async function Fp(e){let t=await br(e.csrfToken),r=le(),n=S(de(e.now,qp)),i=await C().decideAuthorizationSetup({decision:"approve",transactionId:t.transactionId,currentStateHash:await P(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},authorizationCodeHash:await P(r),authorizationCodeExpiresAt:n,grantId:Po(),now:S(e.now)});if(i.kind!=="approved")throw b(i.kind==="cancelled"?"oauth_state_invalid":Cn(i.kind),"Authorization setup state is invalid, expired, or already used.");let a=new URL(i.transaction.redirectUri);return a.searchParams.set("code",r),i.transaction.clientState&&a.searchParams.set("state",i.transaction.clientState),a}o(Fp,"createAuthorizationCodeRedirectWithDecision");async function $p(e){let t=await br(e.csrfToken),r=await C().decideAuthorizationSetup({decision:"cancel",transactionId:t.transactionId,currentStateHash:await P(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:S(e.now)});if(r.kind!=="cancelled")throw b(r.kind==="approved"?"oauth_state_invalid":Cn(r.kind),"Authorization setup state is invalid, expired, or already used.");return Zp({redirectUri:r.transaction.redirectUri,clientState:r.transaction.clientState})}o($p,"createCancelRedirectWithDecision");function Zp(e){let t=new URL(e.redirectUri);return t.searchParams.set("error","access_denied"),t.searchParams.set("error_description","The user cancelled the MCP authorization request."),e.clientState!==void 0&&t.searchParams.set("state",e.clientState),t}o(Zp,"buildClientCancelRedirect");async function Ka(e){let t=e.now??new Date;return Fp({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}o(Ka,"approve");async function Wa(e){let t=e.now??new Date;return $p({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}o(Wa,"cancel");import{createRemoteJWKSet as Kp,errors as st,jwtVerify as Va,SignJWT as Wp}from"jose";var An="zuplo_mcp_session",Vp=d.object({purpose:d.literal("gateway_browser_session"),sub:lt,browserLoginOrigin:d.string().min(1),roles:d.array(d.string().min(1)).optional(),exp:d.number().int().positive(),iat:d.number().int().positive().optional()}),Yp=d.object({id_token:d.string().min(1),token_type:d.string().min(1).optional(),expires_in:d.number().optional(),access_token:d.string().min(1).optional(),refresh_token:d.string().min(1).optional(),scope:d.string().min(1).optional()}),Xp=d.object({error:d.string().min(1).optional(),error_description:d.string().min(1).optional(),error_uri:d.string().min(1).optional()}),Qp=d.object({sub:lt,nonce:d.string().min(1)}).catchall(d.unknown()),In;function em(e){let t=new Map;if(!e)return t;for(let r of e.split(";")){let n=r.indexOf("=");if(n<0)continue;let i=r.slice(0,n).trim(),a=r.slice(n+1).trim();if(i)try{t.set(i,decodeURIComponent(a))}catch{t.set(i,a)}}return t}o(em,"parseCookieHeader");async function Ya(){return oe({purpose:"browser-session",keyMaterialPurpose:"oauth-state-signing",derive:o(e=>Ae(e,"browser-session"),"derive")})}o(Ya,"getBrowserSessionKey");function vn(e,t){let r=new URL(D(e,t)),n=[`${An}=`,"Path=/","HttpOnly","SameSite=Lax","Max-Age=0"];return r.protocol==="https:"&&n.push("Secure"),n.join("; ")}o(vn,"buildBrowserSessionEvictionCookie");function tm(e){let t=new URL(D(e.requestUrl,e.requestHeaders)),r=[`${An}=${encodeURIComponent(e.value)}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${e.ttlSeconds}`];return t.protocol==="https:"&&r.push("Secure"),r.join("; ")}o(tm,"serializeSessionCookie");function Xa(){return new URL(Re("url")).origin}o(Xa,"readBrowserLoginOrigin");function rm(e){let t=Xp.safeParse(e);if(!t.success)return{};let r={};return t.data.error!==void 0&&(r.idpError=t.data.error),t.data.error_description!==void 0&&(r.idpErrorDescription=t.data.error_description.slice(0,256)),t.data.error_uri!==void 0&&(r.idpErrorUri=t.data.error_uri.slice(0,256)),r}o(rm,"readIdpErrorFields");function nm(e){return e instanceof st.JWTExpired?"expired":e instanceof st.JWTClaimValidationFailed?"claim":e instanceof st.JWSSignatureVerificationFailed?"signature":e instanceof st.JWKSNoMatchingKey?"jwks_no_match":e instanceof st.JWTInvalid?"invalid":e instanceof d.ZodError?"schema":"other"}o(nm,"readJwtFailureKind");function om(e){return e instanceof Error&&"cause"in e?e.cause:e}o(om,"readErrorCause");function im(e){if(e!==null&&typeof e=="object"&&"extensionMembers"in e)return e.extensionMembers?.gatewayCode}o(im,"readRuntimeGatewayCode");function am(){if(!In){let e=N();In=Kp(new URL(e.oidc.jwksUrl),{timeoutDuration:e.browserLogin.remoteTimeoutMs})}return In}o(am,"readFederatedJwks");function Qa(e){if(!e.user)throw b("authentication_required","The browser login callback did not include an authenticated Zuplo principal.");return Ee(e.user,e.url)}o(Qa,"resolveCurrentRequestPrincipal");async function Rr(e,t={}){let r=em(e.headers.get("cookie")).get(An);if(!r)return{};try{let{payload:n}=await Va(r,await Ya(),{algorithms:[V],issuer:Z,audience:W}),i=Vp.parse(n);if(i.browserLoginOrigin!==Xa())return{evictCookie:vn(e.url,e.headers)};let a={subjectId:i.sub};return i.roles&&i.roles.length>0&&(a.roles=i.roles),{principal:a}}catch(n){return n instanceof st.JWTExpired?{evictCookie:vn(e.url,e.headers)}:(t.context?.log.warn({event:"browser_session_verification_failed",errorName:n instanceof Error?n.name:"unknown",errorMessage:n instanceof Error?n.message:"verification failed"},"Browser session JWT verification failed"),{evictCookie:vn(e.url,e.headers)})}}o(Rr,"readBrowserSession");async function Cr(e){let t=N().browserLogin.sessionTtlSeconds,r={purpose:"gateway_browser_session",sub:e.principal.subjectId,browserLoginOrigin:Xa()};e.principal.roles&&(r.roles=e.principal.roles);let n=await new Wp(r).setProtectedHeader({alg:V,typ:"JWT"}).setIssuer(Z).setAudience(W).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+t).sign(await Ya());return tm({value:n,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,ttlSeconds:t})}o(Cr,"createBrowserSessionCookie");async function sm(e){let t=N(),r=Re("tokenUrl"),n=Re("clientId"),i=Re("clientSecret"),a=new URL(L().actionPath("/oauth/callback"),Ze(e.requestUrl,e.requestHeaders)).toString(),s=new URLSearchParams({grant_type:"authorization_code",code:e.code,redirect_uri:a,client_id:n,client_secret:i});if(t.browserLogin.pkce===Ne){let c=await wn({stateId:e.stateId,signingKey:await Ot()});s.set("code_verifier",c)}try{let{response:c,json:u}=await lr(r,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:s},{maxResponseBytes:32768,problemCode:"browser_login_verification_failed",timeoutMs:t.browserLogin.remoteTimeoutMs,context:e.context});if(!c.ok){let _=rm(u);throw e.context?.log.warn({event:"federated_token_exchange_failed",code:"provider_access_denied",idpHost:q(r),idpStatus:c.status,..._},"Federated browser login token exchange returned non-2xx from the identity provider"),b({code:"provider_access_denied",privateDetail:"Federated browser login token exchange failed.",cause:new Error(`IdP token exchange failed (status=${c.status}${_.idpError?` idp_error=${_.idpError}`:""}${_.idpErrorDescription?` idp_error_description=${_.idpErrorDescription}`:""})`)})}let l=Yp.parse(u),p;try{({payload:p}=await Va(l.id_token,am(),{issuer:t.oidc.issuer,audience:n}))}catch(_){let O={};throw G(O,"error",_),e.context?.log.warn({event:"federated_id_token_verification_failed",code:"browser_login_verification_failed",failureKind:nm(_),idpHost:q(r),expectedIssuer:t.oidc.issuer,...O},"Federated id_token failed jose verification"),_}if(p.nonce!==e.nonce)throw e.context?.log.warn({event:"federated_nonce_mismatch",code:"oauth_callback_mismatch",idpHost:q(r),nonceMissingFromIdToken:p.nonce===void 0},"Federated id_token nonce did not match the signed gateway state"),b("oauth_callback_mismatch","Federated browser login nonce did not match the signed gateway state.");let g=Qp.parse(p);return{principal:Ee({sub:g.sub,data:g},e.requestUrl),subjectToken:{token:l.id_token,tokenType:mt,expiresAt:typeof p.exp=="number"?S(new Date(p.exp*1e3)):void 0}}}catch(c){let u=ce(c)??im(c);throw u!==void 0&&u!=="browser_login_verification_failed"?c:b("browser_login_verification_failed","Federated browser login callback could not be verified.",om(c))}}o(sm,"exchangeFederatedAuthorizationCode");async function es(e){let t=typeof e.request.query.code=="string"?e.request.query.code:void 0;if(t)return sm({code:t,nonce:e.stateId,stateId:e.stateId,requestUrl:e.request.url,requestHeaders:e.request.headers,context:e.context});let r=await Rr(e.request,{context:e.context});if(r.principal)return{principal:r.principal};throw b("oauth_callback_mismatch","Federated browser login callback is missing an authorization code.")}o(es,"resolveBrowserLoginCallbackIdentity");var cm=new Set(["about","blob","data","file","ftp","ftps","javascript","mailto","urn","ws","wss"]);function dm(e){return e.protocol.replace(/:$/u,"").toLowerCase()}o(dm,"readScheme");function um(e){return e.protocol==="https:"}o(um,"isSpecCompliantRedirectUri");function lm(e){let t=dm(e);return t.length>0&&t!=="http"&&t!=="https"&&!cm.has(t)}o(lm,"isNativeAppCustomSchemeRedirectUri");var rs=[{id:"oauth.redirect_uri.https",mode:"strict",accepts:o(e=>um(e),"accepts")},{id:"oauth.redirect_uri.loopback_http",mode:"native_app",accepts:o(e=>K(e),"accepts"),matches:o((e,t)=>K(e)&&K(t)&&e.pathname===t.pathname&&e.search===t.search,"matches")},{id:"oauth.redirect_uri.custom_scheme",mode:"native_app",accepts:o(e=>lm(e),"accepts")}];function ns(e){let t=rs.find(r=>r.accepts(e.url));return t===void 0?{kind:"rejected"}:{kind:"allowed",ruleId:t.id,mode:t.mode}}o(ns,"evaluateBuiltInRedirectUriCompatibility");function ts(e){try{return new URL(e)}catch{return}}o(ts,"parseUrl");function os(e){if(e.registeredRedirectUri===e.requestedRedirectUri)return!0;let t=ts(e.registeredRedirectUri),r=ts(e.requestedRedirectUri);return t===void 0||r===void 0?!1:rs.some(n=>n.matches?.(t,r))}o(os,"redirectUriMatchesBuiltInCompatibility");var pm=1e4,mm=5*1024,fm=0,hm=2160*60*60,is=["authorization_code","refresh_token",Wt,Ce],gm=["authorization_code","refresh_token"],as=[xo],ym=["code"],_m=d.object({client_name:d.string().min(1).optional(),redirect_uris:d.array(d.string().min(1)).min(1),grant_types:d.array(d.enum(is)).min(1).max(is.length).optional(),authorization_grant_profiles_supported:d.array(d.enum(as)).min(1).max(as.length).optional(),response_types:d.array(d.enum(ym)).min(1).max(1).optional(),scope:d.literal(z).optional(),token_endpoint_auth_method:To.optional(),jwks_uri:d.string().min(1).optional()});function wm(e){try{let t=new URL(e);return(t.protocol==="https:"||t.protocol==="http:"&&K(t))&&t.pathname!=="/"}catch{return!1}}o(wm,"isCimdClientIdCandidate");function ss(e,t){throw new f("invalid_client",Ho({clientId:e})??"OAuth client is not registered.",void 0,t===void 0?void 0:{cause:t})}o(ss,"invalidCimdClientError");function ct(e,t="invalid_request"){if(bm(e))throw new f(t,"redirect_uris must not include raw whitespace or control characters.");let r;try{r=new URL(e)}catch{throw new f(t,"redirect_uris must be absolute URIs.")}if(r.hash||r.username||r.password)throw new f(t,"redirect_uris must not include credentials or fragments.");if(ns({url:r}).kind==="rejected")throw new f(t,"redirect_uris must use HTTPS, loopback HTTP, or a native-app private-use URI scheme.")}o(ct,"assertValidRedirectUri");function bm(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<=32||r>=127&&r<=159)return!0}return!1}o(bm,"hasForbiddenRawRedirectUriCharacter");async function Rm(e){let{response:t,json:r}=await Ri(e.initialUrl,{headers:{accept:"application/json"}},{maxRedirects:fm,maxResponseBytes:mm,timeoutMs:pm});if(!t.ok)throw b("invalid_request","CIMD metadata could not be fetched.");let n=Yt(r);for(let i of n.redirect_uris)ct(i,"invalid_request");if(n.jwks_uri!==void 0&&ht(n.jwks_uri),n.client_id!==e.clientId)throw b("invalid_request","Fetched CIMD client_id must exactly match the requested client_id.");return n}o(Rm,"fetchCimdMetadata");async function Cm(e){let t=Xt(e),r=await Rm({clientId:e,initialUrl:t});return{kind:"cimd",clientId:e,metadata:r}}o(Cm,"resolveCimdClient");async function Sr(e,t){let r=ue.parse(e);if(wm(r)){N().gateway.downstreamCimdEnabled||ss(r);try{return await Cm(r)}catch(i){ss(r,i)}}let n=await C().readClient({clientId:r});if(n.kind==="found"){let i=n.client,a=Lo(i.clientId),s=a===void 0?i.tokenEndpointAuthMethod:"private_key_jwt",c=i.jwksUri??a;if(s==="private_key_jwt"&&c===void 0)throw new f("invalid_client","Dynamic private_key_jwt client is missing JWKS metadata. Re-run client registration before authorization.");let u=Yt({client_id:i.clientId,client_name:i.clientName,redirect_uris:i.redirectUris,token_endpoint_auth_method:s,...c===void 0?{}:{jwks_uri:c}}),l={kind:"dcr",clientId:r,metadata:u};return i.hashedClientSecret&&(l.hashedClientSecret=i.hashedClientSecret),l}throw new f("invalid_client",r.startsWith("dcr:")?"Dynamic client is not registered. Re-run client registration before authorization.":"OAuth client is not registered.")}o(Sr,"resolveClient");function cs(e,t){if(!e.metadata.redirect_uris.some(r=>os({registeredRedirectUri:r,requestedRedirectUri:t})))throw b("invalid_request","redirect_uri is not registered for the client.")}o(cs,"assertRedirectRegistered");function Sm(e){return e===void 0?[...gm]:Array.from(new Set(e))}o(Sm,"normalizeGrantTypes");function Im(e){try{ht(e)}catch(t){throw new f("invalid_client_metadata","jwks_uri must be an HTTPS URL with a path, no credentials or fragment, and must not point at a blocked host.",void 0,{cause:t})}}o(Im,"assertValidDcrJwksUri");function vm(e){return e.tokenEndpointAuthMethod==="private_key_jwt"&&e.jwksUri!==void 0?ue.parse(Bo({clientId:crypto.randomUUID(),jwksUri:e.jwksUri})):ue.parse(`dcr:${crypto.randomUUID()}`)}o(vm,"createDcrClientId");function dt(e){if(e===void 0||e===z)return z;throw new f("invalid_request",`Only the ${z} scope is supported.`)}o(dt,"assertSupportedOAuthScope");function je(e,t,r){let n;try{n=new URL(t)}catch{throw new f("invalid_target","resource must be an absolute URI.")}if(n.hash)throw new f("invalid_target","resource must not include a fragment.");if(n.protocol!=="https:"&&!K(n))throw new f("invalid_target","resource must use HTTPS except loopback HTTP resources in local development.");let i=D(e,r),a=Ao(),s=a?[...a.byOperationId.values()].find(c=>new URL(c.routePath,i).toString()===t):void 0;if(!s)throw new f("invalid_target","resource must match a published MCP route.");return s}o(je,"resolveResource");async function ds(e){let t;try{t=_m.parse(e)}catch(_){if(_ instanceof d.ZodError){let O=_.issues.some(T=>T.path[0]==="redirect_uris");throw new f(O?"invalid_redirect_uri":"invalid_client_metadata",_.issues[0]?.message??"Client metadata is invalid.",void 0,{cause:_})}throw _}for(let _ of t.redirect_uris)ct(_,"invalid_redirect_uri");if(t.token_endpoint_auth_method==="private_key_jwt"&&t.jwks_uri===void 0)throw new f("invalid_client_metadata","jwks_uri is required for private_key_jwt clients.");t.jwks_uri!==void 0&&Im(t.jwks_uri);let r=new Date,n=t.token_endpoint_auth_method??"none",i=n==="private_key_jwt"?"none":n,a=vm({tokenEndpointAuthMethod:n,jwksUri:t.jwks_uri}),s=Yt({client_id:a,client_name:t.client_name??"Dynamically registered MCP client",redirect_uris:t.redirect_uris,token_endpoint_auth_method:n,...t.jwks_uri===void 0?{}:{jwks_uri:t.jwks_uri}}),c=de(r,hm),u=Math.floor(r.getTime()/1e3),l=Math.floor(c.getTime()/1e3),p={client_id:s.client_id,client_name:s.client_name,redirect_uris:s.redirect_uris,grant_types:Sm(t.grant_types),authorization_grant_profiles_supported:t.authorization_grant_profiles_supported,response_types:["code"],scope:z,token_endpoint_auth_method:s.token_endpoint_auth_method,client_id_issued_at:u,jwks_uri:s.jwks_uri},g={clientId:s.client_id,clientName:s.client_name,redirectUris:s.redirect_uris,tokenEndpointAuthMethod:i,createdAt:S(r),clientExpiresAt:S(c)};if(n==="client_secret_basic"||n==="client_secret_post"){let _=le();g.hashedClientSecret=await P(_),g.clientSecretExpiresAt=S(c),p.client_secret=_,p.client_secret_expires_at=l,p.client_secret_issued_at=u}if((await C().registerClient(g)).kind==="already_exists")throw b("invalid_request","OAuth client is already registered.");return p}o(ds,"registerDownstreamClient");function Am(e){return e?.metadata?.idpSubjectTokenType!==Ke&&e?.metadata?.idpSubjectTokenExpiresAt!==void 0&&new Date(e.metadata.idpSubjectTokenExpiresAt).getTime()<=Date.now()?!1:e?.status==="active"&&e.metadata?.encryptedIdpSubjectToken!==void 0&&e.metadata.idpSubjectTokenType!==void 0}o(Am,"hasStoredIdJagSubjectTokenBinding");async function us(e){let t=$e(e.principal.subjectId);return(await C().batchGetUpstreamConnections([{owner:t,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId}]))[0]}o(us,"readIdJagSubjectConnection");async function kn(e){let t=ee().byOperationId.get(e.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag")return!1;let r=await us({connection:t.connection,principal:e.principal});return!Am(r)}o(kn,"requiresIdJagSubjectTokenBinding");async function ls(e){if(e.subjectToken===void 0)return;let t=ee().byOperationId.get(e.transaction.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag"||e.principal.subjectId!==e.transaction.principal.subjectId)return;let r=await us({connection:t.connection,principal:e.principal});return C().upsertUpstreamConnection({id:r?.id??Qt(),ownerMode:"user",subjectId:e.transaction.principal.subjectId,upstreamServerId:t.connection.upstreamServerId,authProfileId:t.connection.authProfileId,status:"active",encryptedAccessToken:r?.encryptedAccessToken,encryptedRefreshToken:r?.encryptedRefreshToken,scopes:r?.scopes??[],expiresAt:r?.expiresAt,metadata:{...r?.metadata??{},encryptedIdpSubjectToken:await me(e.subjectToken.token),idpSubjectTokenType:e.subjectToken.tokenType,idpSubjectTokenExpiresAt:e.subjectToken.expiresAt}})}o(ls,"bindIdJagSubjectTokenForAuthorizationTransaction");function Ir(e){return v`<img class="card__icon" src="${e.iconHref}" alt="" width="48" height="48" referrerpolicy="no-referrer" onerror=" this.onerror = null; this.src = '${e.fallbackIconHref}'; " />`}o(Ir,"renderShellIcon");function ps(e){return v`<form class="actions" method="post" action="${e.setupAction}" ${e.submitOnceAttrs}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate >Cancel</button><button class="button button--primary" type="submit" name="decision" value="approve" ${e.authorizeAttrs} >Authorize</button></form>`}o(ps,"renderActions");var ms=he('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="6.5"/><line x1="8" y1="4.6" x2="8" y2="8.4"/><circle cx="8" cy="11" r=".7" fill="currentColor" stroke="none"/></svg>');function fs(e){return v`<div class="banner banner--warning" role="status"><span class="banner__icon" aria-hidden="true">${e.icon}</span><div class="banner__body"><p class="banner__title">Setup required</p><p class="banner__message">${e.message}</p></div></div>`}o(fs,"renderBannerWarning");var RR=he('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 6.5l4 4 4-4"/></svg>'),CR=he('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="4" width="18" height="7" rx="1.5"/><rect x="3" y="13" width="18" height="7" rx="1.5"/><circle cx="7" cy="7.5" r=".75" fill="currentColor" stroke="none"/><circle cx="7" cy="16.5" r=".75" fill="currentColor" stroke="none"/></svg>');var SR=he('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7.13 2.46 1.39 12.5a1 1 0 0 0 .87 1.5h11.48a1 1 0 0 0 .87-1.5L8.87 2.46a1 1 0 0 0-1.74 0Z"/><line x1="8" y1="6" x2="8" y2="9.4"/><circle cx="8" cy="11.4" r=".7" fill="currentColor" stroke="none"/></svg>');var km="data:,",hs=v`data-submit-once="true" onsubmit="if (this.dataset.submitted === 'true') return false; this.dataset.submitted = 'true'; setTimeout(() => this.querySelectorAll('button').forEach((button) => { button.disabled = true; }), 0);"`,gs=v`data-activate-once="true" onclick="if (this.dataset.activated === 'true') return false; this.dataset.activated = 'true'; this.setAttribute('aria-disabled', 'true'); this.style.pointerEvents = 'none';"`;function xm(e,t,r){if(e)try{let n=new URL(t).origin,i=new URL(e,n);return i.origin!==n||!i.pathname.startsWith(r.actionPath("/auth/connections/"))?void 0:i.toString()}catch{return}}o(xm,"safeGatewayConnectHref");function Um(e){return e.some(r=>r.ownerMode==="user"&&r.status!=="active")?"setup":"grant"}o(Um,"deriveMode");function Tm(e){return ps({state:e.state,setupAction:e.gateway.actionPath("/oauth/setup"),submitOnceAttrs:hs,authorizeAttrs:te})}o(Tm,"renderActions");function xn(e,t,r,n){for(let i of e){if(i.ownerMode!=="user"||i.status!==r)continue;let a=xm(i.connectUrl,t,n);if(a)return a}}o(xn,"firstUserConnectHref");function Pm(e){let t=e.connectHref===void 0?te:v`<a class="button button--primary" href="${e.connectHref}" ${gs}>Connect</a>`;return v`<form class="actions" method="post" action="${e.gateway.actionPath("/oauth/setup")}" ${hs}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate>Cancel</button>${t}</form>`}o(Pm,"renderSetupActions");function Em(e){return e?v`<span class="reconnect-action"><a class="button button--secondary reconnect-button" href="${e}" ${gs}>Re-connect<span class="tooltip" tabindex="0" aria-label="Reset or change how the gateway connects to the upstream service, including changing scopes.">?</span></a></span>`:te}o(Em,"renderReconnectAction");function Om(e){try{let t=new URL(e);return t.protocol==="https:"||t.protocol==="http:"?!0:t.protocol==="data:"&&/^data:image\/(?:png|jpe?g|webp|svg\+xml);/i.test(e)}catch{return!1}}o(Om,"isRenderableIconHref");function ys(e){return e?.find(t=>Om(t.src))?.src}o(ys,"readIconHref");function Mm(e){return ys(e.serverIcons)??(e.transportHost===void 0?void 0:Qr(e.transportHost).src)}o(Mm,"readUpstreamIconHref");function qm(e){let t=ys(e.routeIcons);if(t!==void 0)return t;for(let r of e.upstreams){let n=Mm(r);if(n!==void 0)return n}}o(qm,"readHeaderIconHref");function Dm(e){let t=e.setupMessage===void 0?te:fs({icon:ms,message:e.setupMessage});return v`<p class="card__subtitle">Authorize '<strong>${e.clientDisplayName}</strong>' to access '<strong>${e.routeDisplayName}</strong>' on your behalf?</p>${t}`}o(Dm,"renderBody");function Un(e){let t=Um(e.upstreams),r=xn(e.upstreams,e.gatewayOrigin,"not_connected",e.gateway),n=xn(e.upstreams,e.gatewayOrigin,"reconsent_required",e.gateway),i=xn(e.upstreams,e.gatewayOrigin,"active",e.gateway),a=t==="setup"?r??n:void 0,s=t==="setup"?e.upstreams.find(l=>l.ownerMode==="user"&&l.status!=="active"&&l.connectUrl===void 0&&l.setupMessage!==void 0)?.setupMessage:void 0,c=qm({routeIcons:e.routeIcons,upstreams:e.upstreams}),u=t==="setup"?v`<footer class="card__footer">${Pm({state:e.state,connectHref:a,gateway:e.gateway})}</footer>`:v`<footer class="card__footer">${Em(i)}${Tm({state:e.state,gateway:e.gateway})}</footer>`;return nt(it({title:`Authorize access \xB7 ${e.routeDisplayName}`,iconHref:c??km,styles:ot,headerIcon:c===void 0?te:Ir({iconHref:c,fallbackIconHref:sr}),heading:"Authorize access",subhead:te,body:Dm({routeDisplayName:e.routeDisplayName,clientDisplayName:e.clientDisplayName,setupMessage:s}),footer:u}))}o(Un,"renderConsentPage");var zm=1e4,_s="mcp-session-id",jm;function Ss(){return{tools:[],prompts:[],resources:[]}}o(Ss,"emptyCapabilities");function ws(){return new Headers({accept:"application/json, text/event-stream","content-type":"application/json","mcp-protocol-version":zr})}o(ws,"buildReadinessHeaders");async function bs(e){if(e.type==="bearer_token"){let n=ws();return n.set("authorization",`Bearer ${e.token}`),n}let t=await e.provider.tokens();if(!t)return;let r=ws();return r.set("authorization",`${t.token_type??"Bearer"} ${t.access_token}`),r}o(bs,"buildAsyncCredentialHeaders");function Rs(e){return new Request(e.upstreamUrl,{method:"POST",headers:e.headers,body:JSON.stringify(Zt.parse({jsonrpc:$t,id:1,method:"initialize",params:{protocolVersion:zr,capabilities:{},clientInfo:{name:"zuplo-mcp-gateway-readiness",version:"0.0.0"}}}))})}o(Rs,"buildInitializePreflight");async function Tn(e){ft(e.url);let t=new AbortController,r=setTimeout(()=>t.abort(),zm);try{let n=new Request(e,{redirect:"manual",signal:t.signal});return await Bt.fetch(n)}finally{clearTimeout(r)}}o(Tn,"runPreflight");function Pn(e){e.body?.cancel().catch(()=>{})}o(Pn,"releasePreflightBody");async function Hm(e){let t=e.response.headers.get(_s);if(!t)return;let r=new Headers(e.headers);r.set(_s,t),r.delete("content-type");try{let n=await Tn(new Request(e.upstreamUrl,{method:"DELETE",headers:r}));Pn(n)}catch{}}o(Hm,"terminatePreflightSession");async function Is(e){let{response:t}=e;return Pn(t),t.status>=200&&t.status<300?(await Hm(e),{kind:"ready",upstreamStatus:t.status,capabilities:Ss()}):t.status===401||t.status===403?{kind:"upstream_auth_rejected",status:t.status,message:"Upstream MCP server rejected the configured credential."}:{kind:"upstream_unavailable",status:t.status,message:"Upstream MCP server did not accept the readiness preflight."}}o(Is,"classifyResponse");function Cs(e){let t={status:e.state==="reconsent_required"?"reconsent_required":"not_connected",connected:!1};return e.nextAction==="admin_setup_required"?{kind:"admin_setup_required",payload:e,connectionStatus:t}:{kind:"connect_required",payload:e,connectionStatus:t}}o(Cs,"connectRequiredResult");async function Bm(e){try{return Is({response:await Tn(e.request),upstreamUrl:e.upstreamUrl,headers:e.headers})}catch(t){return{kind:"upstream_unavailable",message:t instanceof Error?t.message:"Upstream MCP server readiness preflight failed."}}}o(Bm,"classifyPreflight");async function Lm(e){let t=e.route.connection;if(t===void 0)return{kind:"ready",upstreamStatus:204,capabilities:Ss()};let r=yr(t.upstreamServerId,e.route.operationId),n=rt(r,e.subjectId),i=e.returnTo===void 0?n:{...n,returnTo:e.returnTo},a=new Request(e.requestUrl,{headers:e.requestHeaders}),s=await tt({request:a,routeAuth:i,preloadedConnection:e.preloadedConnection});if(s.kind==="connect_required")return Cs(s.payload);let c=await bs(s.credential);if(c===void 0)return{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens."};let u=Rs({upstreamUrl:t.mcpUrl,headers:c}),l;try{l=await Tn(u)}catch(R){return{kind:"upstream_unavailable",message:R instanceof Error?R.message:"Upstream MCP server readiness preflight failed."}}if(l.status!==401)return Is({response:l,upstreamUrl:t.mcpUrl,headers:c});Pn(l);let p=await tt({request:a,routeAuth:i,forceRefresh:!0});if(p.kind==="connect_required")return Cs(p.payload);let g=await bs(p.credential);return g===void 0?{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens after refresh."}:Bm({request:Rs({upstreamUrl:t.mcpUrl,headers:g}),upstreamUrl:t.mcpUrl,headers:g})}o(Lm,"checkUpstreamRouteReadinessImpl");function vs(e){return(jm??Lm)(e)}o(vs,"checkUpstreamRouteReadiness");function Nm(e){try{return new URL(e).host}catch{return}}o(Nm,"safeUrlHost");function As(e){return e!==void 0&&e.length>0}o(As,"hasItems");function Gm(e){let t=e.serverInfo?.icons;if(As(t))return t;let r=cr(e.mcpUrl);return r===void 0?void 0:[r]}o(Gm,"readServerIcons");async function Jm(e){let{authConfig:t,authMode:r,description:n,displayName:i,mcpUrl:a,ownerMode:s,upstreamServerId:c,authProfileId:u}=e.registeredConnection,l=s==="user",p=l&&r!=="id-jag",g=e.readiness??(l?$o(e.connection):{connected:!0,status:"active"}),R=p?e.readiness?.connectUrl??(e.returnTo!==void 0?await rn({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,owner:e.userOwner,initiatedBySubjectId:e.transaction.principal.subjectId,upstreamServerId:c,authProfileId:u,operationId:e.route.operationId,returnTo:e.returnTo}):void 0):void 0,_=t.mode==="id-jag"?t.idJag.scopes:t.oauth.scopes;return{upstreamServerId:c,authProfileId:u,authMode:r,ownerMode:s,upstreamDisplayName:i,description:n,transportHost:Nm(a),scopesRequested:As(_)?_:void 0,serverIcons:Gm(e.registeredConnection),status:g.status,connected:g.connected,capabilities:{tools:[],prompts:[],resources:[]},connectUrl:R,setupMessage:e.setupMessage,updatedAt:l&&"updatedAt"in g&&g.updatedAt!==void 0?g.updatedAt:void 0,expiresAt:e.readiness?.expiresAt??e.connection?.expiresAt}}o(Jm,"buildSetupRequirement");function ks(e){let t=ee().byOperationId.get(e);if(!t)throw b("unknown_mcp_route",`Unknown MCP route: ${e}`);return t}o(ks,"requireRoute");async function En(e){let t=ks(e.transaction.operationId),r=$e(e.transaction.principal.subjectId),n=t.connection;if(n===void 0)return[];let a=n.ownerMode==="user"?(await C().batchGetUpstreamConnections([{owner:r,upstreamServerId:n.upstreamServerId,authProfileId:n.authProfileId}]))[0]:void 0,s=await vs({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,route:t,subjectId:e.transaction.principal.subjectId,preloadedConnection:a,returnTo:e.returnTo}),c="connectionStatus"in s?s.connectionStatus:void 0,u=(s.kind==="connect_required"||s.kind==="admin_setup_required")&&s.payload.authUrl!==void 0?s.payload.authUrl:void 0,l=s.kind==="admin_setup_required"?s.payload.message:void 0;return[await Jm({connection:a,registeredConnection:n,route:t,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:e.returnTo,transaction:e.transaction,userOwner:r,setupMessage:l,readiness:c===void 0?void 0:{...c,connectUrl:u}})]}o(En,"requirementsForSetup");async function On(e){let t=ks(e.transaction.operationId),r=await C().readClient({clientId:e.transaction.clientId}),n=r.kind==="found"?r.client:void 0,i={gatewayOrigin:D(e.requestUrl,e.requestHeaders),routeDisplayName:t.connection?.displayName??t.operationId,clientDisplayName:n?.clientName??String(e.transaction.clientId),principalLabel:e.transaction.principal.subjectId},a=t.connection?.description;return a!==void 0&&(i.routeDescription=a),i}o(On,"consentContext");function Mn(e){return e.some(t=>t.ownerMode==="user"&&t.status!=="active")}o(Mn,"hasUnresolvedUserUpstream");var Fm=["mcp_user"],$m="dev-browser-user",Zm=["resource is required for /oauth/authorize.","MCP clients should start at the MCP server URL and follow its WWW-Authenticate resource_metadata link.","If your client reached this endpoint directly, use /oauth/authorize/{routePath} where {routePath} is the published MCP route path without a leading slash and each segment is URL-encoded as needed, for example /oauth/authorize/mcp/linear, or add resource={protected resource URI from protected-resource metadata}."].join(" "),Km=d.object({response_type:d.literal("code"),client_id:d.string().min(1),redirect_uri:d.string().min(1),resource:d.url(),code_challenge:d.string().min(43),code_challenge_method:co,state:d.string().min(1).optional(),scope:d.literal(z).default(z)}),Wm=d.enum(["continue","approve","cancel"]).default("continue"),Vm=d.object({state:d.string().min(1),decision:Wm}),Ue=class extends Error{static{o(this,"DownstreamAuthorizeRedirectError")}redirectUri;clientState;errorCode;errorDescription;constructor(t){super(t.errorDescription?`${t.errorCode}: ${t.errorDescription}`:t.errorCode,t.cause===void 0?void 0:{cause:t.cause}),this.name="DownstreamAuthorizeRedirectError",this.redirectUri=t.redirectUri,this.clientState=t.clientState,this.errorCode=t.errorCode,this.errorDescription=t.errorDescription}};function xs(e){return typeof e=="string"&&e.length>0?e:void 0}o(xs,"readQueryString");function Ym(e,t){let r=xs(e.query.resource);if(t===void 0){if(r!==void 0)return r;throw new f("invalid_target",Zm)}let n=qo(t,e.url,e.headers);if(r===void 0||r===n)return n;throw new f("invalid_target","resource must match the scoped OAuth authorization endpoint resource.")}o(Ym,"requireAuthorizeResource");async function Xm(e,t){let r={};t!==void 0&&(r.context=t);let n=await Rr(e,r);if(n.principal)return{principal:n.principal};if(!e.user)return n.evictCookie===void 0?{}:{setCookie:n.evictCookie};let i=Qa(e);return{principal:i,setCookie:await Cr({principal:i,requestUrl:e.url,requestHeaders:e.headers})}}o(Xm,"resolveBrowserPrincipal");async function Qm(e,t){let r={};t!==void 0&&(r.context=t);let n=await Rr(e,r);if(!n.principal)throw b("authentication_required","Authorization setup requires a current browser session.");return n.principal}o(Qm,"requireSetupPrincipal");function Us(e){return`${L().actionPath("/oauth/setup")}?state=${encodeURIComponent(e)}`}o(Us,"buildSetupReturnTo");async function Ts(e){let t=await En({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:Us(e.csrfToken)}),r=await On({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders}),n={kind:"setup_page",html:Un({state:e.csrfToken,operationId:e.transaction.operationId,gateway:L(),upstreams:t,...r})};return e.setCookie!==void 0&&(n.setCookie=e.setCookie),n}o(Ts,"renderSetup");function ef(e){if(e===void 0)return;let t=e.metadata.token_endpoint_auth_method;return{clientId:e.clientId,clientName:e.metadata.client_name,tokenEndpointAuthMethod:t}}o(ef,"toAuthorizationTransactionClient");async function qn(e,t={}){let r=Km.parse({...e.query,resource:Ym(e,t.operationId),state:xs(e.query.state)}),n=dt(r.scope);ct(r.redirect_uri,"invalid_request");let i=new Date,a=ue.parse(r.client_id),s=await Sr(r.client_id,i);cs(s,r.redirect_uri);try{let c=je(e.url,r.resource,e.headers),u=ef(s);t.context?.log.info({event:"oauth_authorize_request_parsed",clientId:a,operationId:c.operationId,scope:n,hasClientState:r.state!==void 0},"Downstream OAuth authorize: request parsed and client resolved"),t.context&&A(t.context,{eventType:I.MCP_OAUTH_AUTHORIZE_STARTED,outcome:"success",virtualServerName:c.operationId,attributes:{clientId:a,scope:n,responseType:r.response_type}});let l={clientId:s?.clientId??a,...u===void 0?{}:{client:u},redirectUri:r.redirect_uri,resource:r.resource,operationId:c.operationId,scope:n,codeChallenge:r.code_challenge,codeChallengeMethod:r.code_challenge_method,...r.state===void 0?{}:{clientState:r.state}},{principal:p,setCookie:g}=await Xm(e,t.context),R=p===void 0?!1:await kn({operationId:c.operationId,principal:p});if(!p||R){let O=await Ja({transaction:l,requestUrl:e.url,requestHeaders:e.headers,now:i});t.context?.log.info({event:"oauth_authorize_awaiting_login",clientId:a,operationId:c.operationId,reason:p?"id_jag_subject_binding_missing":"no_browser_session"},"Downstream OAuth authorize: redirecting to browser login");let T={kind:"redirect",location:O.browserLoginUrl};return g!==void 0&&(T.setCookie=g),T}let _=await Fa({transaction:l,principal:p,now:i});return t.context?.log.info({event:"oauth_authorize_awaiting_setup",clientId:a,operationId:c.operationId,subjectId:p.subjectId},"Downstream OAuth authorize: rendering consent/setup page"),t.context&&A(t.context,{eventType:I.MCP_OAUTH_AUTHORIZE_AWAITING_SETUP,outcome:"success",virtualServerName:c.operationId,attributes:{clientId:a,scope:n,responseType:r.response_type,subjectId:p.subjectId}}),Ts({transaction:_.transaction,csrfToken:_.csrfToken,requestUrl:e.url,requestHeaders:e.headers,setCookie:g})}catch(c){throw tf({redirectUri:r.redirect_uri,clientState:r.state,cause:c})}}o(qn,"authorizeDownstreamClient");function tf(e){if(e.cause instanceof Ue)return e.cause;let t=rf(e.cause);return t?new Ue({redirectUri:e.redirectUri,clientState:e.clientState,errorCode:t.errorCode,errorDescription:t.errorDescription,cause:e.cause}):e.cause}o(tf,"toDownstreamAuthorizeRedirectError");function rf(e){if(e instanceof f)return{errorCode:e.errorCode,errorDescription:e.message};if(e instanceof d.ZodError){let t=e.issues[0];return{errorCode:t?.path.includes("resource")?"invalid_target":"invalid_request",errorDescription:t?.message}}}o(rf,"mapToOAuthRedirectError");async function Ps(e,t={}){let r=typeof e.query.error=="string"?e.query.error:void 0;if(r){let l=typeof e.query.error_description=="string"?e.query.error_description.slice(0,256):void 0,p=typeof e.query.error_uri=="string"?e.query.error_uri.slice(0,256):void 0;throw t.context?.log.warn({event:"browser_login_callback_idp_error",code:"provider_access_denied",idpError:r,...l===void 0?{}:{idpErrorDescription:l},...p===void 0?{}:{idpErrorUri:p}},"Identity provider redirected browser-login callback with an error"),b("provider_access_denied",l??"The delegated browser login was not completed.")}let n=typeof e.query.state=="string"?e.query.state:void 0;if(!n)throw t.context?.log.warn({event:"browser_login_callback_state_missing",code:"oauth_state_invalid"},"Browser login callback was invoked without a state parameter"),b("oauth_state_invalid","Browser login callback is missing state.");let i=await bn(n),a={request:e,stateId:i.stateId};t.context!==void 0&&(a.context=t.context);let s=await es(a),c=await $a({browserLoginStateToken:n,principal:s.principal});if(await ls({transaction:c.transaction,principal:s.principal,subjectToken:s.subjectToken}),await kn({operationId:c.transaction.operationId,principal:s.principal}))throw b("browser_login_verification_failed","The identity provider did not return the subject token required for XAA / ID-JAG.");let u=await Ts({transaction:c.transaction,csrfToken:c.csrfToken,requestUrl:e.url,requestHeaders:e.headers});return u.setCookie=await Cr({principal:s.principal,requestUrl:e.url,requestHeaders:e.headers}),u}o(Ps,"completeBrowserLoginCallback");async function Es(e){let t=N(),r=new URL(e.url);if(!K(r))throw b("forbidden","Local browser login is only available on loopback HTTP origins.");let n=typeof e.query.state=="string"?e.query.state:void 0;if(!n)throw b("oauth_state_invalid","Local browser login is missing state.");let i=L().actionPath("/oauth/callback"),a=new URL(typeof e.query.redirect_uri=="string"?e.query.redirect_uri:i,D(e.url)),s=new URL(D(e.url)).origin;if(a.origin!==s||a.pathname!==i)throw b("oauth_callback_mismatch",`Local browser login redirect_uri must target this gateway's ${i} route.`);a.searchParams.set("state",n);let c={subjectId:lt.parse($m),roles:Fm};return{kind:"redirect",location:a,setCookie:await Cr({principal:c,requestUrl:e.url,requestHeaders:e.headers})}}o(Es,"completeLocalDevBrowserLogin");function nf(e){let t=e.method==="POST"?e.body:e.query;return Vm.parse(t)}o(nf,"readSetupContinueRequest");async function Os(e){let{state:t,decision:r}=nf({method:e.request.method,query:e.request.query,body:e.body}),n=new Date,i=await Sn({csrfToken:t,now:n}),a=await Qm(e.request,e.context);if(r==="cancel")return{kind:"redirect",location:await Wa({csrfToken:t,currentBrowserPrincipal:a,now:n})};let s=await Za({csrfToken:t,currentBrowserPrincipal:a,now:n}),c=await En({transaction:s,requestUrl:e.request.url,requestHeaders:e.request.headers,returnTo:Us(t)});if(r==="approve"&&Mn(c)&&await Na({csrfToken:t,currentBrowserPrincipal:a,now:n}),Mn(c)){let u=await On({transaction:s,requestUrl:e.request.url,requestHeaders:e.request.headers});return{kind:"setup_page",html:Un({state:t,operationId:s.operationId,gateway:L(),upstreams:c,...u})}}return{kind:"redirect",location:await Ka({csrfToken:t,currentBrowserPrincipal:a,now:n})}}o(Os,"continueDownstreamAuthorizeSetup");import{createLocalJWKSet as yf,decodeJwt as _f,errors as qt,jwtVerify as wf}from"jose";import{createRemoteJWKSet as of,decodeJwt as af,decodeProtectedHeader as sf,errors as Mt,jwtVerify as cf}from"jose";var js=30,E=d.string().min(1),df=d.union([E,d.array(E).min(1)]),uf=d.union([E,d.array(E).min(1)]),lf=d.object({type:E,locations:d.array(E).optional(),actions:d.array(E).optional(),datatypes:d.array(E).optional(),identifier:E.optional(),privileges:d.array(E).optional()}).passthrough(),pf=d.object({iss:d.url(),sub:E,aud:df,client_id:E,resource:uf.optional(),scope:E.optional(),authorization_details:d.array(lf).optional(),jti:E,iat:d.number().int(),nbf:d.number().int().optional(),exp:d.number().int(),tenant:E.optional(),aud_tenant:E.optional(),aud_sub:E.optional(),sub_id:E.optional(),act:d.unknown().optional(),email:E.optional(),auth_time:d.number().int().optional(),acr:E.optional(),amr:d.array(E).optional(),cnf:d.unknown().optional()}).passthrough();function Y(e){throw new f("invalid_grant",e)}o(Y,"throwInvalidGrant");function mf(e){return e instanceof Mt.JWTExpired?"expired":e instanceof Mt.JWTClaimValidationFailed?"claim":e instanceof Mt.JWSSignatureVerificationFailed?"signature":e instanceof Mt.JWKSNoMatchingKey?"jwks_no_match":e instanceof Mt.JWTInvalid?"invalid":e instanceof d.ZodError?"schema":"other"}o(mf,"readJwtFailureKind");function ff(e){return Array.isArray(e.aud)?(e.aud.length!==1&&Y("ID-JAG audience must contain exactly one value."),e.aud[0]):e.aud}o(ff,"readSingleAudience");function Ms(e){try{let t=pf.parse(e);return ff(t),t}catch(t){if(t instanceof f)throw t;Y("ID-JAG claims are invalid.")}}o(Ms,"parseIdJagClaims");function hf(e,t){e.idJag.enabled||Y("ID-JAG grant is not enabled.");let r=e.idJag.trustedIssuers.find(n=>n.issuer===t);return r===void 0&&Y("ID-JAG issuer is not trusted."),r}o(hf,"readTrustedIssuer");function gf(e){let t=e.authorizationDetails;if(t===void 0)return;if(e.allowedTypes===void 0)return t;let r=new Set(e.allowedTypes);return t.filter(n=>r.has(n.type))}o(gf,"readGrantedAuthorizationDetails");function qs(e){if(e.clientAuth.method==="none")throw new f("invalid_client","Client authentication failed.");e.claims.client_id!==e.authenticatedClientId&&Y("ID-JAG client_id must match the authenticated client."),e.trustedIssuer.expectedClientIds!==void 0&&!e.trustedIssuer.expectedClientIds.includes(e.claims.client_id)&&Y("ID-JAG client_id is not allowed for this issuer.")}o(qs,"assertClientBinding");function Ds(e){e.cnf!==void 0&&Y("ID-JAG cnf-bound assertions require DPoP support.")}o(Ds,"assertProofOfPossessionNotDeferred");function zs(e){let t=Math.floor(e.now.getTime()/1e3)+js;e.claims.iat>t&&Y("ID-JAG iat must not be in the future.")}o(zs,"assertIssuedAtNotInFuture");async function Hs(e){let t;try{t=sf(e.assertion)}catch{Y("ID-JAG assertion is malformed.")}t.typ!==Pr&&Y('ID-JAG header typ must be "oauth-id-jag+jwt".');let r;try{r=Ms(af(e.assertion))}catch(c){if(c instanceof f)throw c;Y("ID-JAG assertion is malformed.")}let n=Ze(e.requestUrl,e.requestHeaders),i=[n];e.requestedResource!==void 0&&e.requestedResource!==n&&i.push(e.requestedResource);let a=hf(e.config,r.iss);i.includes(r.iss)&&Y("ID-JAG issuer must be different from the gateway."),qs({claims:r,trustedIssuer:a,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Ds(r),zs({claims:r,now:e.now});let s;try{let c=of(new URL(a.jwksUrl)),{payload:u}=await cf(e.assertion,c,{issuer:a.issuer,audience:i,currentDate:e.now,clockTolerance:js,typ:Pr});s=Ms(u)}catch(c){e.context?.log.warn({event:"oauth_id_jag_verification_failed",issuer:a.issuer,failureKind:mf(c)},"OAuth ID-JAG assertion verification failed"),Y("ID-JAG assertion verification failed.")}return qs({claims:s,trustedIssuer:a,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Ds(s),zs({claims:s,now:e.now}),{claims:s,trustedIssuer:a,subjectId:Do({issuer:s.iss,subject:s.sub,gatewayIssuer:n,subjectMapping:a.subjectMapping,tenant:s.tenant}),grantedAuthorizationDetails:gf({authorizationDetails:s.authorization_details,allowedTypes:e.config.idJag.enabled?e.config.idJag.authorizationDetailsTypesAllowed:void 0})}}o(Hs,"verifyIdJagAssertion");var bf=new Set(["authorization_code","refresh_token",Ce]),Rf=1e4,Cf=32*1024,Sf=2,If=3600,Dn=d.object({client_id:d.string().min(1).optional(),client_secret:d.string().min(1).optional(),client_assertion_type:d.string().min(1).optional(),client_assertion:d.string().min(1).optional()}),vf=d.discriminatedUnion("grant_type",[Dn.extend({grant_type:d.literal("authorization_code"),code:d.string().min(1),redirect_uri:d.string().min(1),code_verifier:Ge,resource:d.url().optional(),scope:d.literal(z).optional()}),Dn.extend({grant_type:d.literal("refresh_token"),refresh_token:d.string().min(1),resource:d.url().optional(),scope:d.literal(z).optional()}),Dn.extend({grant_type:d.literal(Ce),assertion:d.string().min(1),resource:d.url().optional(),scope:d.literal(z).optional(),authorization_details:d.string().min(1).optional()})]);function Af(e){if(typeof e!="object"||e===null)return;let t=e.grant_type;if(t!==void 0&&(typeof t!="string"||!bf.has(t)))throw new f("unsupported_grant_type",`Grant type "${typeof t=="string"?t:""}" is not supported.`)}o(Af,"assertSupportedGrantType");var kf=d.object({token:d.string().min(1),client_id:d.string().min(1).optional(),token_type_hint:d.string().optional(),client_secret:d.string().min(1).optional(),client_assertion_type:d.string().min(1).optional(),client_assertion:d.string().min(1).optional()}),xf=d.object({keys:d.array(d.record(d.string(),d.unknown())).min(1)}).passthrough();function Ls(){return N().gateway.accessTokenTtlSeconds}o(Ls,"readAccessTokenTtlSeconds");function Uf(){return N().gateway.refreshTokenTtlSeconds}o(Uf,"readRefreshTokenTtlSeconds");function Bs(e,t){let r=Ls(),n=Math.max(1,Math.floor((new Date(t).getTime()-e.getTime())/1e3)),i=Math.min(r,n);return{expiresAt:S(de(e,i)),expiresIn:i}}o(Bs,"calculateAccessTokenExpiresAt");function Tf(e){let t=e.claimedResource===void 0?[]:Array.isArray(e.claimedResource)?e.claimedResource:[e.claimedResource];if(e.requestedResource!==void 0){if(t.length>0&&!t.includes(e.requestedResource))throw new f("invalid_target","Token request resource must match the ID-JAG resource.");return e.requestedResource}if(t.length===0)throw new f("invalid_target","resource is required for the ID-JAG JWT bearer grant.");if(t.length!==1)throw new f("invalid_target","ID-JAG resource arrays require a token request resource.");return t[0]}o(Tf,"readIdJagResource");function Pf(e){if(e.claimAuthorizationDetails===void 0)return;let t=(e.grantedAuthorizationDetails??[]).filter(r=>r.locations?.includes(e.resource)===!0);if(t.length===0)throw new f("invalid_grant","ID-JAG authorization_details must authorize the requested resource.");return t}o(Pf,"readIdJagGrantedAuthorizationDetails");function Ef(e){if(e.claimScope?.split(/\s+/).includes(z)===!0||(e.grantedAuthorizationDetails?.length??0)>0)return z;if(e.claimScope===void 0)throw new f("invalid_grant",`ID-JAG must include ${z} scope or matching authorization_details.`);if(!e.claimScope.split(/\s+/).includes(z))throw new f("invalid_grant",`ID-JAG scope must include ${z}.`);return z}o(Ef,"readIdJagGrantedScope");function Of(e){if(e!==void 0&&e.get("dpop")!==null)throw new f("invalid_request","DPoP proofs are not supported for the ID-JAG JWT bearer grant.")}o(Of,"assertNoDpopProofForIdJag");function Ns(e){if(!e?.startsWith("Basic "))return{};let t;try{t=atob(e.slice(6))}catch{throw new f("invalid_client","Malformed HTTP Basic client authentication.")}let r=t.indexOf(":");if(r<0)throw new f("invalid_client","Malformed HTTP Basic client authentication.");try{return{clientId:decodeURIComponent(t.slice(0,r)),clientSecret:decodeURIComponent(t.slice(r+1))}}catch{throw new f("invalid_client","Malformed HTTP Basic client authentication.")}}o(Ns,"readBasicClientSecret");function Gs(e){if(e.basicClientId!==void 0&&e.bodyClientId!==void 0&&e.basicClientId!==e.bodyClientId)throw new f("invalid_request","Authenticated client_id must match request client_id.");let t=e.basicClientId??e.bodyClientId;if(t!==void 0)return t;if(e.clientAssertion!==void 0){try{let r=_f(e.clientAssertion);if(typeof r.iss=="string"&&typeof r.sub=="string"&&r.iss===r.sub)return r.iss}catch{throw new f("invalid_client","Malformed private_key_jwt client assertion.")}throw new f("invalid_client","private_key_jwt client assertion must identify the client with matching iss and sub claims.")}throw new f("invalid_client","Client authentication or client_id is required.")}o(Gs,"resolveAuthenticatedClientId");function Mf(e){if(e.basicClientSecret!==void 0&&e.bodyClientSecret!==void 0)throw new f("invalid_request","Use only one client authentication method per request.");return e.basicClientSecret!==void 0?{clientSecret:e.basicClientSecret,clientSecretSource:"basic"}:e.bodyClientSecret!==void 0?{clientSecret:e.bodyClientSecret,clientSecretSource:"post"}:{}}o(Mf,"resolveClientSecretInput");function qf(e){return e.clientAssertion!==void 0||e.clientAssertionType!==void 0}o(qf,"hasClientAssertion");function Df(e){if(e.requestUrl===void 0)throw new f("invalid_request","Request URL is required for private_key_jwt client authentication.");let t=new URL(L().actionPath(e.pathname),D(e.requestUrl,e.requestHeaders));return t.search="",t.hash="",t.toString()}o(Df,"buildEndpointAudience");function zf(e){return e instanceof qt.JWTExpired?"expired":e instanceof qt.JWTClaimValidationFailed?"claim":e instanceof qt.JWSSignatureVerificationFailed?"signature":e instanceof qt.JWKSNoMatchingKey?"jwks_no_match":e instanceof qt.JWTInvalid?"invalid":e instanceof d.ZodError?"schema":"other"}o(zf,"readJwtFailureKind");async function jf(e){let{response:t,json:r}=await Ci(e.jwksUri,{headers:{accept:"application/json"}},{context:e.context,maxRedirects:Sf,maxResponseBytes:Cf,timeoutMs:Rf});if(!t.ok)throw new f("invalid_client","Client JWKS could not be fetched.");return xf.parse(r)}o(jf,"fetchClientJwks");async function Hf(e){if(e.clientAssertionType!==Vt||e.clientAssertion===void 0)throw new f("invalid_request","private_key_jwt client authentication requires a JWT bearer client_assertion and client_assertion_type.");let t=ue.parse(e.clientId),r=await Sr(t,e.now);if(r.metadata.token_endpoint_auth_method!=="private_key_jwt")throw new f("invalid_client","Client is not registered for private_key_jwt authentication.");let n=r.metadata.jwks_uri;if(n===void 0)throw new f("invalid_client","Client JWKS URI is required for private_key_jwt authentication.");let i=Df({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,pathname:e.endpointPathname});try{let a=await jf({jwksUri:n,context:e.context}),{payload:s}=await wf(e.clientAssertion,yf(a),{issuer:t,subject:t,audience:i,currentDate:e.now}),c=Math.floor(e.now.getTime()/1e3)+If;if(typeof s.exp!="number"||s.exp>c)throw new f("invalid_client","Client authentication failed.")}catch(a){throw e.context?.log.warn({event:"oauth_private_key_jwt_client_auth_failed",clientId:t,failureKind:zf(a)},"OAuth private_key_jwt client authentication failed"),new f("invalid_client","Client authentication failed.")}return{method:"private_key_jwt",clientId:t}}o(Hf,"verifyPrivateKeyJwtClientAssertion");async function Bf(e){let t=ue.parse(e.clientId);if(No(t))throw new f("invalid_client","Client is registered for private_key_jwt authentication.");return e.clientSecret===void 0?{method:"none",clientId:t}:{method:e.clientSecretSource==="post"?"client_secret_post":"client_secret_basic",clientId:t,clientSecretHashInput:await P(e.clientSecret)}}o(Bf,"buildRuntimeHttpClientAuth");async function Js(e){if(qf({clientAssertion:e.clientAssertion,clientAssertionType:e.clientAssertionType})){if(e.basicClientSecret!==void 0||e.bodyClientSecret!==void 0)throw new f("invalid_request","Use only one client authentication method per request.");return Hf(e)}let t=Mf({basicClientSecret:e.basicClientSecret,bodyClientSecret:e.bodyClientSecret});return Bf({clientId:e.clientId,...t})}o(Js,"resolveRuntimeHttpClientAuth");async function Fs(e){Af(e.body);let t=vf.parse(e.body),r=Ns(e.authorizationHeader),n=Gs({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),i=new Date,a=await Js({clientId:n,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/token",now:i,context:e.context});return Lf({parsed:t,clientId:n,clientAuth:a,now:i,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,context:e.context})}o(Fs,"exchangeDownstreamToken");async function Lf(e){if(e.parsed.grant_type==="authorization_code"){ct(e.parsed.redirect_uri,"invalid_request"),dt(e.parsed.scope),e.parsed.resource!==void 0&&je(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let c=le(),u=le(),l=S(de(e.now,Uf())),p=Bs(e.now,l),g=await C().exchangeAuthorizationCode({clientAuth:e.clientAuth,codeHash:await P(e.parsed.code),redirectUri:e.parsed.redirect_uri,resource:e.parsed.resource,codeChallenge:await er(e.parsed.code_verifier),currentRefreshTokenHash:await P(c),accessTokenHash:await P(u),grantExpiresAt:l,accessTokenExpiresAt:p.expiresAt,now:S(e.now)});if(g.kind==="invalid_client")throw new f("invalid_client","Client authentication failed.");if(g.kind==="resource_mismatch")throw new f("invalid_target","Token request resource must match the authorization code resource.");if(g.kind!=="exchanged")throw new f("invalid_grant","Authorization code is invalid, expired, already used, or failed binding validation.");return e.context&&A(e.context,{eventType:I.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"authorization_code"}}),{access_token:u,token_type:"Bearer",expires_in:p.expiresIn,refresh_token:c,scope:g.grant.scope,resource:g.grant.resource}}if(e.parsed.grant_type===Ce){dt(e.parsed.scope),Of(e.requestHeaders);let c=await Hs({assertion:e.parsed.assertion,authenticatedClientId:e.clientId,clientAuth:e.clientAuth,requestUrl:e.requestUrl??e.parsed.resource??"",requestHeaders:e.requestHeaders,requestedResource:e.parsed.resource,now:e.now,context:e.context,config:N()}),u=Tf({claimedResource:c.claims.resource,requestedResource:e.parsed.resource}),l=je(e.requestUrl??u,u,e.requestHeaders),p=Pf({claimAuthorizationDetails:c.claims.authorization_details,grantedAuthorizationDetails:c.grantedAuthorizationDetails,resource:u}),g=Ef({claimScope:c.claims.scope,grantedAuthorizationDetails:p}),R=le(),_=S(new Date(c.claims.exp*1e3)),O=Bs(e.now,_),T=await C().issueAccessTokenForIdJag({clientAuth:e.clientAuth,accessTokenHash:await P(R),subjectId:c.subjectId,resource:u,operationId:l.operationId,scope:g,authorizationDetails:p,accessTokenExpiresAt:O.expiresAt,now:S(e.now),idJag:{issuer:c.claims.iss,jti:c.claims.jti,tenant:c.claims.tenant,expiresAt:_}});if(T.kind==="invalid_client")throw new f("invalid_client","Client authentication failed.");if(T.kind==="resource_mismatch")throw new f("invalid_target","Token request resource must match the ID-JAG resource.");return e.context&&A(e.context,{eventType:I.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"jwt-bearer"}}),{access_token:R,token_type:"Bearer",expires_in:O.expiresIn,scope:T.grant.scope,resource:T.grant.resource,...p===void 0?{}:{authorization_details:p}}}dt(e.parsed.scope),e.parsed.resource!==void 0&&je(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let t=await P(e.parsed.refresh_token),r=e.parsed.refresh_token,n=le(),i=S(de(e.now,Ls())),a=await C().refreshToken({clientAuth:e.clientAuth,currentRefreshTokenHash:t,nextRefreshTokenHash:t,accessTokenHash:await P(n),resource:e.parsed.resource,accessTokenExpiresAt:i,now:S(e.now)});if(a.kind==="invalid_client")throw new f("invalid_client","Client authentication failed.");if(a.kind==="resource_mismatch")throw new f("invalid_target","Token request resource must match the refresh token grant resource.");if(a.kind!=="rotated")throw new f("invalid_grant","Refresh token is invalid, expired, or revoked.");je(e.requestUrl??a.grant.resource,a.grant.resource,e.requestHeaders);let s=a.accessToken.expiresAt;return e.context&&A(e.context,{eventType:I.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"refresh_token"}}),{access_token:n,token_type:"Bearer",expires_in:Math.max(1,Math.floor((new Date(s).getTime()-e.now.getTime())/1e3)),refresh_token:r,scope:a.grant.scope,resource:a.grant.resource}}o(Lf,"exchangeDownstreamTokenWithRuntimeHttp");async function $s(e){let t=kf.parse(e.body),r=Ns(e.authorizationHeader),n=Gs({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),i=new Date;if((await C().revokeOAuthToken({clientAuth:await Js({clientId:n,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/revoke",now:i,context:e.context}),tokenHash:await P(t.token),now:S(i)})).kind==="invalid_client")throw new f("invalid_client","Client authentication failed.");e.context?.log.info({event:"oauth_token_revoked",clientId:n,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}},"OAuth token revocation request processed"),e.context&&A(e.context,{eventType:I.MCP_OAUTH_TOKEN_REVOKED,outcome:"success",attributes:{clientId:n,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}}})}o($s,"revokeDownstreamToken");var Nf=64*1024,Gf=16*1024,Jf="text/html; charset=utf-8";function Ff(e){let t={};for(let[r,n]of e.entries())t[r]=n;return t}o(Ff,"formDataToObject");async function $f(e){return Ua(e,{maxBytes:Nf,label:"Request body"})}o($f,"readJsonBody");async function jn(e){return Ff(await Ta(e,{maxBytes:Gf,label:"Request body"}))}o(jn,"readFormBody");async function Ks(e,t,r){let n=ce(r),i=r instanceof d.ZodError?Te(r):void 0,a={code:n??(r instanceof d.ZodError?"invalid_request":"internal_server_error")};return i!==void 0&&(a.detail=i),Jt(e,t,a)}o(Ks,"handleProblem");function Ws(e){return e?.requestId}o(Ws,"readBrowserRequestId");function Vs(e){if(!(e instanceof h))return;let t=e.extensionMembers?.[Fe];return typeof t=="string"?t:void 0}o(Vs,"readUpstreamHtmlError");function Zs(e,t){let r=e.extensionMembers?.[t];return typeof r=="string"?r:void 0}o(Zs,"readRuntimeErrorExtensionString");function Zf(e,t){let r=e.extensionMembers?.[t];return typeof r=="number"?r:void 0}o(Zf,"readRuntimeErrorExtensionNumber");function Kf(e){try{return new URL(e.url).pathname}catch{return}}o(Kf,"readBrowserRequestPath");function He(e){let t={code:e.code,requestId:e.requestId,routePath:Kf(e.request),underlyingError:e.underlyingError};return e.error instanceof h&&(t.httpStatus=Zf(e.error,we),t.contentType=Zs(e.error,Je),t.upstreamUrl=Zs(e.error,be)),t}o(He,"buildBrowserErrorDiagnostic");function Dt(e){let t=new Headers(e.headers);t.set("cache-control","no-store"),t.set("pragma","no-cache");let r={error:e.error};return e.errorDescription!==void 0&&(r.error_description=e.errorDescription),Response.json(r,{status:e.status??400,headers:t})}o(Dt,"oauthErrorResponse");function Wf(e,t){return e.errorCode!=="invalid_client"?{}:t.includeInvalidClientChallenge===!1?{}:{"WWW-Authenticate":'Basic realm="OAuth"'}}o(Wf,"readOAuthProtocolHeaders");function Vf(e,t){let r=re("internal_server_error");return Dt({error:e.errorCode,errorDescription:e.errorCode==="server_error"?r.publicDetail:e.message,status:e.status,headers:Wf(e,t)})}o(Vf,"oauthProtocolErrorResponse");function zn(e){return e.issues[0]?.path.includes("resource")===!0?"invalid_target":"invalid_request"}o(zn,"readZodOAuthErrorCode");function Yf(e){let t={error:zn(e)},r=Te(e);return r!==void 0&&(t.errorDescription=r),Dt(t)}o(Yf,"oauthZodErrorResponse");function Xf(e){let t=ce(e);if(t===void 0)return;let r=re(t);if(r.oauthError===void 0)return;let n={error:r.oauthError,status:eh(r.oauthError)};return r.oauthError==="server_error"?n.errorDescription=r.publicDetail:e instanceof Error?n.errorDescription=e.message:n.errorDescription=r.publicDetail,Dt(n)}o(Xf,"oauthGatewayProblemResponse");function Qf(){let t={error:"server_error",status:500,errorDescription:re("internal_server_error").publicDetail};return Dt(t)}o(Qf,"oauthFallbackErrorResponse");function eh(e){switch(e){case"invalid_client":return 401;case"server_error":return 500;default:return 400}}o(eh,"readOAuthStatus");function Hn(e,t={}){return e instanceof Ue?Qs(e):e instanceof f?Vf(e,t):e instanceof d.ZodError?Yf(e):Xf(e)??Qf()}o(Hn,"oauthProblemResponse");function Bn(e,t,r){let n=at(e.url),i=Ws(t);if(r instanceof Ue)return Qs(r);if(r instanceof f){let c=re("internal_server_error");return ie({host:n,kind:th(r.errorCode),title:"Authorization failed",detail:r.errorCode==="server_error"?c.publicDetail:r.message,developerDetail:r.errorCode==="server_error"?c.publicDetail:r.message,code:r.errorCode,diagnostic:He({request:e,requestId:i,code:r.errorCode,underlyingError:r.errorCode==="server_error"?c.publicDetail:r.message,error:r}),requestId:i,status:r.status})}if(r instanceof d.ZodError)return ie({host:n,kind:"invalid_request",detail:Te(r)??"The authorization request was invalid.",developerDetail:Te(r)??"The authorization request was invalid.",code:zn(r),diagnostic:He({request:e,requestId:i,code:zn(r),underlyingError:Te(r)??"The authorization request was invalid.",error:r}),requestId:i});let a=ce(r);if(a!==void 0){let c=re(a);return ie({host:n,kind:Xs(a),detail:c.publicDetail,developerDetail:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,code:a,diagnostic:He({request:e,requestId:i,code:a,underlyingError:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,error:r}),requestId:i,upstreamHtml:Vs(r),status:c.status})}let s=re("internal_server_error");return ie({host:n,kind:"internal_error",detail:s.publicDetail,developerDetail:s.publicDetail,code:"server_error",diagnostic:He({request:e,requestId:i,code:"server_error",underlyingError:s.publicDetail,error:r}),requestId:i,status:s.status})}o(Bn,"browserOAuthProblemResponse");function Ys(e,t,r){let n=at(e.url),i=Ws(t),a=ce(r);if(a!==void 0){let c=re(a);return ie({host:n,kind:Xs(a),detail:c.publicDetail,developerDetail:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,code:a,diagnostic:He({request:e,requestId:i,code:a,underlyingError:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,error:r}),requestId:i,upstreamHtml:Vs(r),status:c.status})}if(r instanceof d.ZodError)return ie({host:n,kind:"invalid_request",detail:Te(r)??"The authorization request was invalid.",developerDetail:Te(r)??"The authorization request was invalid.",code:"invalid_request",diagnostic:He({request:e,requestId:i,code:"invalid_request",underlyingError:Te(r)??"The authorization request was invalid.",error:r}),requestId:i});let s=re("internal_server_error");return ie({host:n,kind:"internal_error",detail:s.publicDetail,developerDetail:s.publicDetail,code:"internal_server_error",diagnostic:He({request:e,requestId:i,code:"internal_server_error",underlyingError:s.publicDetail,error:r}),requestId:i,status:s.status})}o(Ys,"browserGatewayProblemResponse");function th(e){return e==="server_error"?"internal_error":"invalid_request"}o(th,"readOAuthBrowserErrorKind");function Xs(e){if(re(e).status>=500)return"internal_error";switch(e){case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"configuration_error";case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"upstream_oauth_discovery_unavailable":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"invalid_request":case"authentication_required":case"forbidden":case"not_found":case"too_many_requests":case"identity_context_missing":return"invalid_request";case"upstream_capability_invocation_failed":case"upstream_capability_unavailable":case"upstream_import_failed":return"connection_failed";case"internal_server_error":return"internal_error"}return"authorization_failed"}o(Xs,"readGatewayBrowserErrorKind");function ge(e,t,r){let n={event:t},i=!1;if(r instanceof f)n.oauthError=r.errorCode,n.status=r.status,G(n,"error",r);else if(r instanceof Ue)n.oauthError=r.errorCode,G(n,"error",r);else if(r instanceof d.ZodError){n.code="invalid_request",G(n,"error",r);let a=r.issues[0];a&&(n.zodPath=a.path.join("."))}else{let a=ce(r);if(a!==void 0){let s=re(a);n.code=a,n.status=s.status,s.oauthError!==void 0&&(n.oauthError=s.oauthError),i=s.status>=500||s.oauthError==="server_error",G(n,"error",r)}else i=!0,G(n,"error",r)}if(i){let a=r instanceof Error?r:new Error("Non-Error thrown from OAuth handler",{cause:r});e.log.error(n,a.message)}else e.log.warn(n,"OAuth handler rejected the request")}o(ge,"logUnexpectedOAuthHandlerError");function Qs(e){let t;try{t=new URL(e.redirectUri)}catch{return Dt({error:e.errorCode,...e.errorDescription===void 0?{}:{errorDescription:e.errorDescription}})}t.searchParams.set("error",e.errorCode),e.errorDescription!==void 0&&t.searchParams.set("error_description",e.errorDescription),e.clientState!==void 0&&t.searchParams.set("state",e.clientState);let r=new Headers({location:t.toString(),"cache-control":"no-store"});return new Response(null,{status:302,headers:r})}o(Qs,"downstreamAuthorizeRedirectErrorResponse");function Te(e){let t=e.issues[0];if(!t)return;let r=t.path.join(".");return r?`${r}: ${t.message}`:t.message}o(Te,"formatZodErrorDetail");function rh(e,t){let r={event:"browser_login_callback_failed",code:ce(t)??"invalid_request"};G(r,"error",t),e.log.warn(r,"Browser login callback failed; client received a connection-failure page")}o(rh,"logBrowserLoginCallbackFailure");function ec(e){e.location.hash||(e.location.hash="#");let t=new Headers({location:e.location.toString(),"cache-control":"no-store"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(null,{status:302,headers:t})}o(ec,"redirectResultResponse");function vr(e){if(e.kind==="setup_page"){let t=new Headers({"content-type":Jf,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(e.html,{status:200,headers:t})}return ec(e)}o(vr,"authorizeResultResponse");async function tc(e,t){try{return Response.json(Eo(e.url,e.headers))}catch(r){return ge(t,"oauth_authorization_server_metadata_failed",r),Ks(e,t,r)}}o(tc,"authorizationServerMetadataHandler");async function rc(e,t){try{let r=jr(e.params.routePath);return Response.json(Oo({operationId:r.operationId,requestUrl:e.url,requestHeaders:e.headers}))}catch(r){return ge(t,"oauth_authorization_server_metadata_failed",r),Ks(e,t,r)}}o(rc,"scopedAuthorizationServerMetadataHandler");async function nc(e,t){try{let r=await ds(await $f(e)),n=r.client_id,i=r.client_name,a=r.redirect_uris.length,s=r.token_endpoint_auth_method;return t.log.info({event:"oauth_dcr_client_registered",clientId:n,clientName:i,redirectUriCount:a,tokenEndpointAuthMethod:s},"OAuth Dynamic Client Registration completed"),A(t,{eventType:I.MCP_OAUTH_CLIENT_REGISTERED,outcome:"success",clientName:i,attributes:{clientId:n,redirectUriCount:a,tokenEndpointAuthMethod:s}}),Response.json(r,{status:201,headers:{"cache-control":"no-store"}})}catch(r){return ge(t,"oauth_register_failed",r),Hn(r)}}o(nc,"registerHandler");async function oc(e,t){try{return vr(await qn(e,{context:t}))}catch(r){return ge(t,"oauth_authorize_failed",r),Bn(e,t,r)}}o(oc,"authorizeHandler");async function ic(e,t){try{let r=jr(e.params.routePath);return vr(await qn(e,{operationId:r.operationId,context:t}))}catch(r){return ge(t,"oauth_authorize_scoped_failed",r),Bn(e,t,r)}}o(ic,"scopedAuthorizeHandler");async function ac(e,t){try{let r=await Ps(e,{context:t});return t.log.info({event:"browser_login_callback_completed",resultKind:r.kind},"Browser login callback completed; consent setup rendered"),vr(r)}catch(r){return rh(t,r),Ys(e,t,r)}}o(ac,"callbackHandler");async function sc(e,t){try{return ec(await Es(e))}catch(r){return ge(t,"oauth_dev_login_failed",r),Bn(e,t,r)}}o(sc,"devLoginHandler");async function cc(e,t){try{if(!["GET","POST"].includes(e.method))return new Response(null,{status:405,headers:{allow:"GET, POST"}});let r=await Os({request:e,body:e.method==="POST"?await jn(e):void 0,context:t});return vr(r)}catch(r){return ge(t,"oauth_setup_failed",r),Ys(e,t,r)}}o(cc,"setupHandler");async function dc(e,t){try{return Response.json(await Fs({body:await jn(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),{headers:{"cache-control":"no-store",pragma:"no-cache"}})}catch(r){return ge(t,"oauth_token_failed",r),Hn(r)}}o(dc,"tokenHandler");async function uc(e,t){try{return await $s({body:await jn(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),new Response(null,{status:200,headers:{"cache-control":"no-store"}})}catch(r){return ge(t,"oauth_revoke_failed",r),Hn(r)}}o(uc,"revokeHandler");function lc(e){return v`<p data-gateway-error-code="${e.code}">${e.body}</p>`}o(lc,"renderBrowserResult");var nh="text/html; charset=utf-8",oh="none";function ih(e){let t=Xr(e.host);return it({title:e.title,iconHref:t,styles:ot,headerIcon:Ir({iconHref:t,fallbackIconHref:sr}),heading:e.title,subhead:"",body:lc({body:e.body,code:e.code??oh}),footer:""})}o(ih,"browserResultHtml");function ah(e,t=200){return new Response(nt(e),{status:t,headers:{"content-type":nh,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}o(ah,"browserResultResponse");function pc(e){return ah(ih(e))}o(pc,"browserConnectionSuccessResponse");function Ar(e,t,r={}){let n=lo(t);return ie({host:e,kind:sh(t),detail:n.body,developerDetail:r.developerDetail,code:t,diagnostic:r.diagnostic,upstreamHtml:r.upstreamHtml})}o(Ar,"browserConnectionFailureResponse");function sh(e){switch(e){case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"upstream_oauth_discovery_unavailable":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required"}}o(sh,"readCallbackFailureBrowserErrorKind");var ch={connect:"Connect",callback_authorization_code:"Callback",callback_provider_error:"Callback",callback_invalid:"Callback",client_metadata:"Client metadata"},mc=Symbol("upstream-request");function zt(e,t){Object.defineProperty(e,mc,{configurable:!0,value:t})}o(zt,"setUpstreamRequestContext");function dh(e){let t=e[mc];if(!t)throw new Q("Upstream request context has not been set");return t}o(dh,"readUpstreamRequestContext");function uh(e,t){return t.some(r=>r===e)}o(uh,"requestContextMatchesKind");function lh(e){return typeof e=="string"?[e]:e}o(lh,"toExpectedKinds");function jt(e,t){let r=dh(e),n=lh(t);if(!uh(r.kind,n)){let i=ch[n[0]];throw new Q(`${i} request context has not been set`)}return r}o(jt,"requireUpstreamRequestContext");function Be(e){if(typeof e=="string"&&e.length!==0)return e}o(Be,"readOptionalQueryString");function ph(e,t){let r=e.params[t];if(typeof r!="string"||r.length===0)throw new Q(`Validated path parameter ${t} is missing`);return mh(r,t)}o(ph,"requirePathString");function mh(e,t){try{return decodeURIComponent(e)}catch(r){throw new h({message:`Path parameter "${t}" must be valid URL encoding.`,extensionMembers:{[y]:"invalid_request"}},{cause:r})}}o(mh,"decodePathString");function fh(e){let t=Be(e);return t?Ft.parse(t):void 0}o(fh,"readOptionalOperationId");function hh(e){let t=ee().connectionsById.get(e);if(t!==void 0)return t.authProfileId;throw new h({message:`No upstream connection is registered for ${e}.`,extensionMembers:{[y]:"unknown_upstream_server"}})}o(hh,"readRegisteredAuthProfileId");function gh(e){let t=fh(e);if(!t)throw new h({message:"operationId query parameter is required.",extensionMembers:{[y]:"invalid_request"}});return t}o(gh,"readRequiredOperationId");async function yh(e,t){let r=yr(t,gh(e.query.operationId));if(r.authMode==="id-jag")throw new h({message:"This upstream uses XAA / ID-JAG and does not support browser OAuth connection flows.",extensionMembers:{[y]:"invalid_request"}});let n=e.query.redirect==="true",i=Be(e.query.browserTicket);if(e.user){if(i)throw new h({message:"Use either an authenticated gateway request or a browser connect ticket, not both.",extensionMembers:{[y]:"invalid_request"}});let c=Ee(e.user,e.url),u={kind:"connect",...rt(r,c.subjectId),redirect:n},l=_o(Be(e.query.returnTo));return l!==void 0&&(u.returnTo=l),u}if(!i)throw new h({message:"Authentication is required to start the upstream connection flow.",extensionMembers:{[y]:"authentication_required"}});let a=await ji(i);if(a.ownerMode!==r.ownerMode||a.upstreamServerId!==r.upstreamServerId||a.authProfileId!==r.authProfileId||a.operationId!==r.operationId)throw new h({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[y]:"oauth_callback_mismatch"}});await Hi(a);let s=Kt(a);switch(r.authMode){case"shared-oauth":{if(s.mode!=="shared")throw new h({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[y]:"oauth_callback_mismatch"}});let c={kind:"connect",...r,authMode:"shared-oauth",ownerMode:"shared",owner:s,initiatedBySubjectId:a.initiatedBySubjectId,redirect:n};return a.returnTo!==void 0&&(c.returnTo=a.returnTo),c}case"user-oauth":{if(s.mode!=="user")throw new h({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[y]:"oauth_callback_mismatch"}});let c={kind:"connect",...r,authMode:"user-oauth",ownerMode:"user",owner:s,initiatedBySubjectId:a.initiatedBySubjectId,redirect:n};return a.returnTo!==void 0&&(c.returnTo=a.returnTo),c}}}o(yh,"resolveConnectContext");async function _h(e,t,r){let n=fo.parse(ph(e,"connection"));switch(r){case"connect":zt(e,await yh(e,n));return;case"callback":{let i=Be(e.query.error);if(i){let c={kind:"callback_provider_error",upstreamServerId:n,error:i},u=Be(e.query.error_description);u!==void 0&&(c.errorDescription=u),zt(e,c);return}let a=Be(e.query.code),s=Be(e.query.state);if(a&&s){zt(e,{kind:"callback_authorization_code",upstreamServerId:n,code:a,state:s});return}zt(e,{kind:"callback_invalid",upstreamServerId:n});return}case"client_metadata":zt(e,{kind:"client_metadata",upstreamServerId:n,authProfileId:hh(n)});return}}o(_h,"resolveUpstreamRequestInbound");async function wh(e,t,r){try{await _h(e,t,r);return}catch(n){let i=n instanceof h?n.extensionMembers?.[y]:void 0,a=n instanceof Error?n.message:void 0;switch(i){case"invalid_request":case"unknown_upstream_server":case"oauth_callback_mismatch":return Pe.badRequest(e,t,{code:i,detail:a});case"authentication_required":return Pe.unauthorized(e,t,{code:i,detail:a});default:throw n}}}o(wh,"applyUpstreamRequestContext");function kr(e,t){return o(async(n,i)=>{let a=await wh(n,i,e);return a||t(n,i)},"wrapped")}o(kr,"withUpstreamRequestContext");var bh=["callback_authorization_code","callback_provider_error","callback_invalid"];function Ln(e){try{return new URL(e.url).pathname}catch{return}}o(Ln,"readBrowserRequestPath");function Rh(e){return"cause"in e?e.cause:void 0}o(Rh,"readErrorCause");function Ch(e){return e.stack?.split(`
-`).slice(1,4).map(t=>t.trim()).join(" | ")}o(Ch,"readFirstStackFrame");function fc(e,t,r){r instanceof Error&&(e[`${t}Name`]=r.name,e[`${t}Message`]=r.message,e[`${t}StackFrame`]=Ch(r))}o(fc,"addErrorAttributes");function Nn(e){if(!(e instanceof h))return;let t=e.extensionMembers?.[y];return Gt(t)?t:void 0}o(Nn,"readRuntimeGatewayCode");function hc(e,t){let r=e.extensionMembers?.[t];return typeof r=="string"?r:void 0}o(hc,"readRuntimeErrorExtensionString");function Sh(e,t){let r=e.extensionMembers?.[t];return typeof r=="number"?r:void 0}o(Sh,"readRuntimeErrorExtensionNumber");function Ih(e,t,r,n){switch(r.kind){case"callback_provider_error":return t.log.warn({event:"upstream_oauth_provider_error",code:"provider_access_denied",upstreamServerId:r.upstreamServerId,providerError:r.error,...r.errorDescription===void 0?{}:{providerErrorDescription:r.errorDescription.slice(0,256)}},"Upstream identity provider returned an error to the OAuth callback"),A(t,{eventType:I.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED,outcome:"failure",upstreamServerName:r.upstreamServerId,reasonCode:"provider_access_denied",reasonClass:"auth",attributes:{error:r.error,errorDescription:r.errorDescription}}),Ar(n,"provider_access_denied",{developerDetail:r.errorDescription??r.error,diagnostic:{code:"provider_access_denied",requestId:t.requestId,routePath:Ln(e),upstreamServerId:r.upstreamServerId,providerError:r.error,providerErrorDescription:r.errorDescription,underlyingError:r.errorDescription??r.error}});case"callback_invalid":return t.log.warn({event:"upstream_oauth_callback_invalid",code:"oauth_state_invalid",upstreamServerId:r.upstreamServerId},"Upstream OAuth callback request missing required code/state parameters"),Ar(n,"oauth_state_invalid",{diagnostic:{code:"oauth_state_invalid",requestId:t.requestId,routePath:Ln(e),upstreamServerId:r.upstreamServerId}});case"callback_authorization_code":return r}}o(Ih,"requireAuthorizationCallbackRequest");function vh(e,t){A(e,{eventType:I.MCP_AUTH_UPSTREAM_CALLBACK_RECEIVED,outcome:"success",upstreamServerName:t.upstreamServerId})}o(vh,"emitCallbackReceivedAnalyticsEvent");function Ah(e,t){A(e,{eventType:I.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED,outcome:"success",upstreamServerName:t.upstreamServerId,virtualServerName:t.operationId})}o(Ah,"emitTokenExchangeSucceededAnalyticsEvent");function kh(e,t){if(t.returnTo){let r=t.returnOrigin??e.url;return Response.redirect(new URL(t.returnTo,r).toString(),302)}return pc({host:at(e.url),title:"Connection complete",body:"The upstream authorization flow completed successfully. You can return to your MCP client."})}o(kh,"buildSuccessfulCallbackResponse");function xh(e){let t={detail:e instanceof Error?e.message:void 0};return fc(t,"error",e),e instanceof Error&&fc(t,"cause",Rh(e)),t}o(xh,"buildTokenExchangeFailureAttributes");function Uh(e){A(e.context,{eventType:I.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED,outcome:"failure",upstreamServerName:e.callbackRequest.upstreamServerId,reasonCode:Nn(e.error)??"token_exchange_failed",reasonClass:"auth",errorType:e.error instanceof Error?e.error.name:"unknown",attributes:xh(e.error)})}o(Uh,"emitTokenExchangeFailedAnalyticsEvent");function Th(e){let t=e.error,r=Nn(t),n=uo(r)?r:"upstream_token_exchange_failed",i={code:n,requestId:e.context.requestId,routePath:Ln(e.request),upstreamServerId:e.callbackRequest.upstreamServerId,underlyingError:t instanceof Error?t.message:void 0,...t instanceof h?{httpStatus:Sh(t,we),contentType:hc(t,Je),upstreamUrl:hc(t,be)}:{}};return Ar(e.host,n,{developerDetail:t instanceof Error?t.message:void 0,diagnostic:i,upstreamHtml:Ph(t)})}o(Th,"tokenExchangeFailureResponse");function Ph(e){if(!(e instanceof h))return;let t=e.extensionMembers?.[Fe];return typeof t=="string"?t:void 0}o(Ph,"readUpstreamHtmlError");async function Gn(e,t){let r=jt(e,bh),n=at(e.url),i=Ih(e,t,r,n);if(i instanceof Response)return i;vh(t,i);try{let a=await _a({request:e,callbackRequest:i});return Ah(t,a),t.log.info({event:"upstream_oauth_token_exchange_succeeded",upstreamServerId:a.upstreamServerId,operationId:a.operationId,authProfileId:a.authProfileId,ownerMode:a.ownerMode},"Upstream OAuth token exchange completed; user connection established"),kh(e,a)}catch(a){let s={event:"upstream_oauth_token_exchange_failed",code:Nn(a)??"upstream_token_exchange_failed",upstreamServerId:i.upstreamServerId};return G(s,"error",a),t.log.warn(s,"Upstream OAuth token exchange failed; user shown connection-failure page"),Uh({context:t,callbackRequest:i,error:a}),Th({request:e,context:t,host:n,callbackRequest:i,error:a})}}o(Gn,"callbackHandler");function Eh(e){return(e instanceof Error?e.message:void 0)??"The requested upstream client metadata document was not found."}o(Eh,"clientMetadataProblemDetail");async function gc(e,t){let r=jt(e,"connect"),n=await ya({request:e,connectRequest:r});if(A(t,{eventType:I.MCP_AUTH_UPSTREAM_CONNECT_STARTED,outcome:"success",upstreamServerName:r.upstreamServerId,virtualServerName:n.operationId,upstreamServerTitle:n.upstreamDisplayName}),t.log.info({event:"upstream_connect_started",upstreamServerId:r.upstreamServerId,authProfileId:n.authProfileId,operationId:n.operationId,ownerMode:r.ownerMode,redirect:r.redirect,hasReturnTo:r.returnTo!==void 0},"Upstream OAuth connect flow started"),r.redirect)return Response.redirect(n.authUrl,302);let i=await mr({requestUrl:e.url,requestHeaders:e.headers,owner:n.owner,initiatedBySubjectId:n.initiatedBySubjectId,upstreamServerId:r.upstreamServerId,authProfileId:n.authProfileId,upstreamDisplayName:n.upstreamDisplayName,operationId:n.operationId,subject:"MCP route",...r.returnTo===void 0?{}:{returnTo:r.returnTo}});return Response.json(i,{status:428})}o(gc,"connectHandler");async function yc(e,t){let r=jt(e,"client_metadata");try{let n=D(e.url,e.headers),i=Zi(n,r.upstreamServerId,r.authProfileId);return Response.json(i)}catch(n){if(!(n instanceof k))throw n;let i=n instanceof Error?n.message:String(n);return t.log.warn({event:"oauth_client_metadata_request_failed",upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,errorMessage:i},"Failed to serve OAuth client metadata document for upstream connection"),Pe.notFound(e,t,{code:"not_found",detail:Eh(n)})}}o(yc,"oauthClientMetadataHandler");function Oh(e,t){return e.mount==="root"?e.path:t.actionPath(e.path)}o(Oh,"resolveInternalRoutePath");var Mh={"access-control-allow-origin":"*","access-control-allow-methods":"GET, OPTIONS","access-control-allow-headers":"content-type, authorization","access-control-max-age":"86400"};function qh(){return new Response(null,{status:204,headers:Mh})}o(qh,"buildWellKnownPreflightResponse");function Dh(e){let t=new Headers(e.headers);return t.set("access-control-allow-origin","*"),new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}o(Dh,"withWellKnownCorsHeaders");function Jn(e){return async(t,r)=>t.method==="OPTIONS"?qh():Dh(await e(t,r))}o(Jn,"wrapWellKnownHandler");var bc=[{routeName:"oauth_as_metadata",mount:"root",path:"/.well-known/oauth-authorization-server",methods:["GET","OPTIONS"],handler:Jn(tc),corsPolicy:"anything-goes"},{routeName:"oauth_as_metadata_scoped",mount:"root",path:"/.well-known/oauth-authorization-server/:routePath*",methods:["GET","OPTIONS"],handler:Jn(rc),corsPolicy:"anything-goes"},{routeName:"oauth_protected_resource_metadata",mount:"root",path:"/.well-known/oauth-protected-resource/:routePath*",methods:["GET","OPTIONS"],handler:Jn(Mo),corsPolicy:"anything-goes"},{routeName:"oauth_register",mount:"action",path:"/oauth/register",methods:["POST"],handler:nc},{routeName:"oauth_authorize",mount:"action",path:"/oauth/authorize",methods:["GET"],handler:oc},{routeName:"oauth_authorize_scoped",mount:"action",path:"/oauth/authorize/:routePath*",methods:["GET"],handler:ic},{routeName:"oauth_callback",mount:"action",path:"/oauth/callback",methods:["GET"],handler:ac},{routeName:"oauth_dev_login",mount:"action",path:"/oauth/dev-login",methods:["GET"],handler:sc},{routeName:"oauth_setup",mount:"action",path:"/oauth/setup",methods:["GET","POST"],handler:cc},{routeName:"oauth_token",mount:"action",path:"/oauth/token",methods:["POST"],handler:dc},{routeName:"oauth_revoke",mount:"action",path:"/oauth/revoke",methods:["POST"],handler:uc},{routeName:"upstream_client_metadata",mount:"action",path:"/.well-known/oauth-client/:connection",methods:["GET"],handler:kr("client_metadata",yc)},{routeName:"upstream_connect",mount:"action",path:"/auth/connections/:connection/connect",methods:["GET"],handler:kr("connect",gc)},{routeName:"upstream_callback",mount:"action",path:"/auth/connections/:connection/callback",methods:["GET"],handler:kr("callback",Gn)}],zh=bc.filter(e=>!e.routeName.startsWith("upstream_")),jh=bc.filter(e=>e.routeName.startsWith("upstream_"));function Hh(e){let t=So({routes:e.routes,policies:e.policies,gateway:e.gateway});return Io(t),t}o(Hh,"initializeMcpGatewayConnectionRegistry");function Bh(e){return[...e.byOperationId.values()].some(t=>t.downstreamOAuth!==void 0)}o(Bh,"hasDownstreamOAuthRoutes");function Lh(e){return[...e.byOperationId.values()].some(t=>t.downstreamOAuth?.config.idJag.enabled===!0)}o(Lh,"hasIdJagDownstreamOAuth");function Nh(e){let t=new Map;for(let n of e.byOperationId.values())n.downstreamOAuth&&t.set(n.downstreamOAuth.policyName,n.downstreamOAuth.config);if(t.size===1)return[...t.values()][0];let r=[...t.keys()].map(n=>`"${n}"`).join(", ");throw new k(`MCP gateway found multiple attached OAuth policies: ${r}. Multiple downstream MCP OAuth configs in one gateway are not supported yet; use one MCP OAuth policy across MCP routes or split these routes into separate gateways.`)}o(Nh,"readSingletonDownstreamOAuthConfig");function Gh(e,t,r){let n=String(t.params.routePath??""),i=e.byRoutePath.get(Uo(n));if(i===void 0)return;let a=i?.downstreamOAuth?.config;return a===void 0?Jt(t,r,{code:"not_found",detail:"The requested MCP route does not expose downstream OAuth."}):a}o(Gh,"readScopedDownstreamOAuthConfig");function Jh(e){return e.path==="/.well-known/oauth-authorization-server/:routePath*"||e.path==="/.well-known/oauth-protected-resource/:routePath*"||e.path==="/oauth/authorize/:routePath*"}o(Jh,"routeUsesScopedOAuthConfig");function _c(e,t,r){return async(n,i)=>{if(i.log.setLogProperties?.({requestId:i.requestId}),r){let u=await r(n,i);if(u instanceof Response)return u;u&&ao(i,u)}let a=n.method==="OPTIONS",s=Date.now();a||i.log.info({event:`${e}_received`,method:n.method},`MCP gateway: ${e} received`);let c=await t(n,i);return a||i.log.info({event:`${e}_responded`,status:c.status,durationMs:Date.now()-s},`MCP gateway: ${e} responded`),c}}o(_c,"wrapInternalHandler");function wc(e,t,r,n){e.addPluginRoute({path:Oh(t,r),methods:t.methods,handler:n,processors:[Vn],corsPolicy:t.corsPolicy??"none"})}o(wc,"addInternalRoute");function Rc(e,t){let r=Hh(t),n=Bh(r),i=r.connectionsById.size>0,a,s=o(()=>(a===void 0&&(a=Nh(r)),a),"readSingletonOAuthConfig");if(n){ae("plugin.mcp-gateway.downstream-oauth"),Lh(r)&&ae("plugin.mcp-gateway.downstream-oauth.id-jag");for(let c of zh){let u=Jh(c)?(l,p)=>Gh(r,l,p):s;wc(e,c,r.gateway,_c(c.routeName,c.handler,u))}}if(i){ae("plugin.mcp-gateway.upstream-auth");for(let c of r.connectionsById.values())ae(`plugin.mcp-gateway.upstream-auth.${c.authMode}`);for(let c of jh)wc(e,c,r.gateway,_c(c.routeName,c.handler))}}o(Rc,"registerMcpGatewayInternalRoutes");var Fn=class extends Kn{static{o(this,"McpGatewayPlugin")}#e;constructor(t={}){super(),ae("plugin.mcp-gateway"),this.#e=so(t)}registerRoutes(t){let r=t.parsedRouteData;r&&Rc(t.router,{routes:r.routes,policies:r.policies,gateway:this.#e})}};var Fh=new TextDecoder;function $h(e){if(e)try{return JSON.parse(Fh.decode(e))}catch{return}}o($h,"readBodyJson");function ye(e){return e&&typeof e=="object"?e:void 0}o(ye,"readRecord");function Ht(e,t){let r=ye(e)?.[t];return typeof r=="string"?r:void 0}o(Ht,"readStringProperty");function Sc(e,t){let r=ye(e)?.[t];return typeof r=="number"?r:void 0}o(Sc,"readNumberProperty");function Cc(e,t){return Sc(e,"code")??(t.status>=400?t.status:void 0)}o(Cc,"readErrorCode");function Ic(e){return Array.isArray(e)?e.map(Ic).find(t=>t?.method):ye(e)}o(Ic,"readJsonRpcMessage");function vc(e){let t=Ic($h(e)),r=typeof t?.method=="string"?t.method:"",n=t?.params;switch(r){case"tools/list":return{mcpMethod:r,capabilityType:"tool"};case"tools/call":return{mcpMethod:r,capabilityType:"tool",capabilityName:Ht(n,"name")};case"prompts/list":return{mcpMethod:r,capabilityType:"prompt"};case"prompts/get":return{mcpMethod:r,capabilityType:"prompt",capabilityName:Ht(n,"name")};case"resources/list":case"resources/templates/list":return{mcpMethod:r,capabilityType:"resource"};case"resources/read":{let i=Ht(n,"uri");return{mcpMethod:r,capabilityType:"resource",capabilityName:i,resourceUri:i}}default:return null}}o(vc,"buildBaseCapabilityInput");function Ac(e){return e==="tools/list"||e==="prompts/list"||e==="resources/list"||e==="resources/templates/list"}o(Ac,"isCapabilityListMethod");function Zh(e,t,r){let a=ye(r)?.[e==="resources/templates/list"?"resourceTemplates":t==="tool"?"tools":t==="prompt"?"prompts":"resources"];return Array.isArray(a)?a.length:void 0}o(Zh,"readItemCount");async function Kh(e){try{return await e.clone().json()}catch{return}}o(Kh,"readResponseJson");function kc(e){let t=vc(e);return!t||Ac(t.mcpMethod)?null:{eventType:I.MCP_CAPABILITY_INVOKED,outcome:"success",...t}}o(kc,"buildCapabilityInvokedAnalyticsInput");async function xc(e,t){let r=vc(e);if(!r)return null;let n=ye(await Kh(t)),i=ye(n?.error),a=ye(i?.data),s=n?.result,c=r.mcpMethod==="tools/call"&&ye(s)?.isError===!0;if(ye(a?.connectRequired))return{eventType:I.MCP_CAPABILITY_CONNECT_REQUIRED,outcome:"connect_required",...r,httpStatusCode:t.status,reasonCode:"connect_required",reasonClass:"auth",errorType:"connect_required",errorCode:Sc(i,"code"),mcpErrorType:Ht(i,"message")};if(Ac(r.mcpMethod)){let u=t.status>=400?void 0:Zh(r.mcpMethod,r.capabilityType,s);return{eventType:I.MCP_CAPABILITY_LISTED,outcome:t.status>=400||i?"failure":"success",...r,httpStatusCode:t.status,...t.status>=400||i?{reasonCode:"upstream_capability_list_failed",reasonClass:"upstream",errorType:"capability_list_error",errorCode:Cc(i,t)}:{},...u===void 0?{}:{attributes:{itemCount:u}}}}return t.status>=400||i?{eventType:I.MCP_CAPABILITY_FAILED,outcome:"failure",...r,httpStatusCode:t.status,reasonCode:"upstream_capability_invocation_failed",reasonClass:"upstream",errorType:"capability_error",errorCode:Cc(i,t),mcpErrorType:Ht(i,"message")}:{eventType:I.MCP_CAPABILITY_COMPLETED,outcome:c?"application_error":"success",...r,httpStatusCode:t.status,toolResultIsError:c,applicationError:c}}o(xc,"buildCapabilityFinalAnalyticsInput");var Wh={Allow:"POST"};async function Vh(e){try{return await e.clone().arrayBuffer()}catch{return}}o(Vh,"readRequestBody");function Uc(e){try{let t=vo(e.route.path);return{virtualServerName:t.operationId,upstreamServerName:t.connection?.upstreamServerId,upstreamServerTitle:t.connection?.displayName,authProfileId:t.connection?.authProfileId,upstreamAuthMode:t.connection?.authMode}}catch{return{}}}o(Uc,"readRouteAnalyticsFields");function Tc(e){return zo(e.user,e.url,e.headers)?.subjectId}o(Tc,"readRequestSubjectId");function Yh(e){let t=kc(e.requestBody);t&&A(e.context,{...t,...Uc(e.context),httpMethod:e.request.method,subjectId:Tc(e.request),transport:"http"})}o(Yh,"emitCapabilityInvokedAnalytics");async function Xh(e){let t=await xc(e.requestBody,e.response);t&&A(e.context,{...t,...Uc(e.context),httpMethod:e.request.method,subjectId:Tc(e.request),transport:"http",latencyMs:Date.now()-e.startedAt})}o(Xh,"emitCapabilityFinalAnalytics");async function Qh(e,t){if(ae("handler.mcp-gateway-proxy"),e.method==="GET")return Pe.methodNotAllowed(e,t,{detail:"MCP Gateway routes support stateless Streamable HTTP requests over POST. Server-sent event GET streams are not supported."},Wh);let r=Date.now(),n=await Vh(e);Yh({context:t,request:e,requestBody:n});let i=await no(e,t);return await Xh({context:t,request:e,requestBody:n,response:i,startedAt:r}),i}o(Qh,"McpProxyHandler");export{Lc as McpAuth0OAuthInboundPolicy,Br as McpCapabilityFilterInboundPolicy,Pc as McpClerkOAuthInboundPolicy,Ec as McpCognitoOAuthInboundPolicy,Oc as McpEntraOAuthInboundPolicy,Fn as McpGatewayPlugin,Mc as McpGoogleOAuthInboundPolicy,qc as McpKeycloakOAuthInboundPolicy,Dc as McpLogtoOAuthInboundPolicy,Nc as McpOAuthInboundPolicy,zc as McpOktaOAuthInboundPolicy,jc as McpOneLoginOAuthInboundPolicy,Hc as McpPingOAuthInboundPolicy,Qh as McpProxyHandler,_n as McpTokenExchangeInboundPolicy,Bc as McpWorkosOAuthInboundPolicy,ni as claimsCapabilityResolver};
+  ></iframe>`}n(HR,"renderUpstreamHtml");var jm="application/json",BR="application/x-www-form-urlencoded";function di(e,t){return new v({message:e,extensionMembers:{[I]:"invalid_request"}},t===void 0?void 0:{cause:t})}n(di,"invalidRequestError");function FR(e){return(e??"").split(";")[0]?.trim().toLowerCase()??""}n(FR,"normalizeContentType");function JR(e,t){return e===t?!0:t===jm&&e.endsWith("+json")}n(JR,"contentTypeMatches");function GR(e,t){if(!t||t.length===0)return;let r=FR(e.headers.get("content-type"));if(!t.some(o=>JR(r,o)))throw di(`Request body must be ${t.join(" or ")}.`)}n(GR,"assertExpectedContentType");function VR(e,t,r){let o=e.headers.get("content-length");if(!o)return;let i=Number.parseInt(o,10);if(Number.isFinite(i)&&i>t)throw di(`${r} exceeded the maximum allowed size.`)}n(VR,"assertContentLengthWithinLimit");async function Nm(e,t){let r=t.label??"Request body";GR(e,t.expectedContentTypes),VR(e,t.maxBytes,r);let o=await ei(e.body,{maxBytes:t.maxBytes,createLimitError:n(()=>di(`${r} exceeded the maximum allowed size.`),"createLimitError")});return new TextDecoder().decode(o)}n(Nm,"readBoundedTextBody");async function $m(e,t){let r=await Nm(e,{...t,expectedContentTypes:[jm]});try{return JSON.parse(r)}catch(o){throw di("Request body must be valid JSON.",o)}}n($m,"readBoundedJsonBody");async function Dm(e,t){let r=await Nm(e,{...t,expectedContentTypes:[BR]});return new URLSearchParams(r)}n(Dm,"readBoundedFormUrlEncodedBody");import{errors as Hm,jwtVerify as Bm,SignJWT as Fm}from"jose";import{base64url as KR}from"jose";var WR="mcp-browser-login-pkce:",ZR=new TextEncoder;async function YR(e){return crypto.subtle.importKey("raw",me(e),{name:"HMAC",hash:"SHA-256"},!1,["sign"])}n(YR,"importHmacKey");async function Gs(e){let t=await YR(e.signingKey),r=ZR.encode(`${WR}${e.stateId}`),o=await crypto.subtle.sign("HMAC",t,me(r));return hr.parse(KR.encode(new Uint8Array(o)))}n(Gs,"deriveBrowserLoginPkceVerifier");async function Lm(e){let t=await Gs(e),r=await $o(t);return{codeVerifier:t,codeChallenge:r,codeChallengeMethod:mr}}n(Lm,"deriveBrowserLoginPkceParams");var XR={invalid_request:400,invalid_client:401,invalid_grant:400,invalid_target:400,unsupported_grant_type:400,server_error:500,invalid_redirect_uri:400,invalid_client_metadata:400},R=class extends Error{static{n(this,"OAuthProtocolError")}errorCode;status;constructor(t,r,o=XR[t],i){super(r,i),this.name="OAuthProtocolError",this.errorCode=t,this.status=o}};var QR=300,eb=l.object({purpose:l.literal("gateway_browser_login"),transactionId:$i,stateId:Di,exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),tb=l.object({purpose:l.literal("gateway_authorization_setup"),transactionId:$i,stateId:Di,exp:l.number().int().positive(),iat:l.number().int().positive().optional()});async function Wn(){return $e({purpose:"browser-login",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>gt(e,"browser-login"),"derive")})}n(Wn,"getBrowserLoginKey");async function Jm(){return $e({purpose:"authorization-csrf",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>gt(e,"authorization-csrf"),"derive")})}n(Jm,"getCsrfKey");function Gm(e){return{now:e.now??new Date,ttlSeconds:Vm()}}n(Gm,"readPendingTransactionDependencies");function Vm(){return le().browserLogin.stateTtlSeconds}n(Vm,"readBrowserLoginStateTtlSeconds");function rb(e){let t=de();return Re(e)&&t.isActionPath(e.pathname,"/oauth/dev-login")}n(rb,"isLoopbackDevLoginUrl");async function nb(e){let t=le().browserLogin,r=de(),o=new URL(dt("url")),i=new URL(r.actionPath("/oauth/callback"),Sr(e.requestUrl,e.requestHeaders));if(rb(o))return o.searchParams.set("redirect_uri",i.toString()),o.searchParams.set("state",e.state),o;if(o.searchParams.set("response_type","code"),o.searchParams.set("client_id",dt("clientId")),o.searchParams.set("redirect_uri",i.toString()),o.searchParams.set("scope",t.scope),o.searchParams.set("state",e.state),o.searchParams.set("nonce",e.nonce),t.audience&&o.searchParams.set("audience",t.audience),t.pkce===mr){let s=await Lm({stateId:e.stateId,signingKey:await Wn()});o.searchParams.set("code_challenge",s.codeChallenge),o.searchParams.set("code_challenge_method",s.codeChallengeMethod)}return o}n(nb,"buildBrowserLoginUrl");function ob(e,t){return e.subjectId===t.subjectId}n(ob,"principalsMatch");function Km(e){return{subjectId:e.subjectId,...e.roles===void 0?{}:{roles:e.roles}}}n(Km,"toPendingPrincipal");function Wm(e){let t={id:e.id,currentStateHash:e.currentStateHash,clientId:e.transaction.clientId,redirectUri:e.transaction.redirectUri,resource:e.transaction.resource,operationId:e.transaction.operationId,scope:e.transaction.scope,codeChallenge:e.transaction.codeChallenge,codeChallengeMethod:e.transaction.codeChallengeMethod,createdAt:$(e.now),expiresAt:$(Ge(e.now,e.ttlSeconds)),...e.transaction.clientState===void 0?{}:{clientState:e.transaction.clientState}};if(e.phase==="awaiting_login")return{...t,phase:"awaiting_login"};if(!e.principal)throw x("identity_context_missing","Authorization setup requires a principal.");return{...t,phase:"awaiting_setup",principal:Km(e.principal)}}n(Wm,"createTransactionRecord");async function Zm(e){let{id:t,...r}=e.record,o=await j().startAuthorization({...r,transactionId:t,...e.client===void 0?{}:{client:e.client}});switch(o.kind){case"started":return o.transaction;case"already_exists":throw x("oauth_state_reused","Authorization transaction state already exists.");case"invalid_client":throw new R("invalid_client","OAuth client is not registered.");case"redirect_uri_mismatch":throw new R("invalid_request","redirect_uri is not registered for the client.")}}n(Zm,"startPendingTransaction");async function ib(e){return new Fm({purpose:"gateway_browser_login",transactionId:e.transactionId,stateId:e.stateId}).setProtectedHeader({alg:Ce,typ:"JWT"}).setIssuer(Se).setAudience(ve).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await Wn())}n(ib,"signBrowserLoginState");async function Ym(e){return new Fm({purpose:"gateway_authorization_setup",transactionId:e.transactionId,stateId:Hi()}).setProtectedHeader({alg:Ce,typ:"JWT"}).setIssuer(Se).setAudience(ve).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await Jm())}n(Ym,"signCsrfToken");async function Vs(e){try{let{payload:t}=await Bm(e,await Wn(),{algorithms:[Ce],issuer:Se,audience:ve}),r=eb.parse(t);return{transactionId:r.transactionId,stateId:r.stateId}}catch(t){throw t instanceof Hm.JWTExpired?x("oauth_state_expired","Browser login state has expired.",t):x("oauth_state_invalid","Browser login state could not be verified.",t)}}n(Vs,"verifyBrowserLoginStateToken");async function ui(e){try{let{payload:t}=await Bm(e,await Jm(),{algorithms:[Ce],issuer:Se,audience:ve});return{transactionId:tb.parse(t).transactionId}}catch(t){throw t instanceof Hm.JWTExpired?x("oauth_state_expired","Authorization setup state has expired.",t):x("oauth_state_invalid","Authorization setup state could not be verified.",t)}}n(ui,"verifyCsrfToken");function Ks(e){return e==="consumed"||e==="consumed_already"||e==="stale_hash"?"oauth_state_reused":e==="expired"?"oauth_state_expired":"oauth_state_invalid"}n(Ks,"pendingStateErrorCode");function sb(e){return e.kind==="available"?{kind:"available",record:e.transaction}:e}n(sb,"toPendingAuthorizationGetResult");function ab(e){return e.kind==="advanced"?{kind:"advanced",record:e.transaction}:e}n(ab,"toPendingAuthorizationAdvanceResult");function Ws(e){return e==="principal_mismatch"?"oauth_callback_mismatch":Ks(e==="consumed_already"?"consumed_already":e)}n(Ws,"setupDecisionErrorCode");async function Xm(e){let t=e.now??new Date,r=await ui(e.csrfToken),o=await j().markAuthorizationSetupApproved({transactionId:r.transactionId,currentStateHash:await Y(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:$(t)});if(o.kind!=="marked")throw x(Ws(o.kind),"Authorization setup state is invalid, expired, or already used.");return Qm({kind:"available",record:o.transaction})}n(Xm,"markSetupApproved");function Qm(e){if(e.kind!=="available")throw x(Ks(e.kind),"Authorization setup state is invalid, expired, or already used.");if(e.record.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization setup state is not in the setup phase.");return e.record}n(Qm,"requireAwaitingSetup");function cb(e){if(!ob(e.currentBrowserPrincipal,e.transaction.principal))throw x("oauth_callback_mismatch","Authorization setup state does not match the current browser session.")}n(cb,"requireCurrentPrincipalMatches");async function eh(e){let t=e.now??new Date,r=Vm(),o=Li(),i=Hi(),s=await ib({transactionId:o,stateId:i,ttlSeconds:r}),a=Wm({id:o,transaction:e.transaction,currentStateHash:await Y(s),phase:"awaiting_login",now:t,ttlSeconds:r});if(a.phase!=="awaiting_login")throw x("oauth_state_invalid","Authorization transaction did not start in login phase.");let c=await Zm({record:a,client:e.transaction.client});if(c.phase!=="awaiting_login")throw x("oauth_state_invalid","Authorization transaction did not start in login phase.");let u=await nb({state:s,nonce:i,stateId:i,requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders}});return{transaction:c,browserLoginStateToken:s,browserLoginUrl:u}}n(eh,"startAwaitingLogin");async function th(e){let{now:t,ttlSeconds:r}=Gm(e),o=Li(),i=await Ym({transactionId:o,ttlSeconds:r}),s=Wm({id:o,transaction:e.transaction,currentStateHash:await Y(i),phase:"awaiting_setup",principal:e.principal,now:t,ttlSeconds:r});if(s.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization transaction did not start in setup phase.");let a=await Zm({record:s,client:e.transaction.client});if(a.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization transaction did not start in setup phase.");return{transaction:a,csrfToken:i}}n(th,"startAwaitingSetup");async function rh(e){let{now:t,ttlSeconds:r}=Gm(e),o=await Vs(e.browserLoginStateToken),i=await Ym({transactionId:o.transactionId,ttlSeconds:r}),s=ab(await j().advancePendingAuthorization({transactionId:o.transactionId,expectedPhase:"awaiting_login",currentStateHash:await Y(e.browserLoginStateToken),nextStateHash:await Y(i),nextPhase:"awaiting_setup",principal:Km(e.principal),now:$(t)}));if(s.kind!=="advanced")throw x(Ks(s.kind),"Browser login state is invalid, expired, or already used.");if(s.record.phase!=="awaiting_setup")throw x("oauth_state_invalid","Browser login did not advance to setup.");return{transaction:s.record,csrfToken:i}}n(rh,"completeLogin");async function nh(e){let t=await Zs(e);return cb({transaction:t,currentBrowserPrincipal:e.currentBrowserPrincipal}),t}n(nh,"getSetup");async function Zs(e){let t=e.now??new Date,r=await ui(e.csrfToken);return Qm(sb(await j().readPendingAuthorization({transactionId:r.transactionId,currentStateHash:await Y(e.csrfToken),now:$(t)})))}n(Zs,"getSetupTransaction");async function db(e){let t=await ui(e.csrfToken),r=Ke(),o=$(Ge(e.now,QR)),i=await j().decideAuthorizationSetup({decision:"approve",transactionId:t.transactionId,currentStateHash:await Y(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},authorizationCodeHash:await Y(r),authorizationCodeExpiresAt:o,grantId:Lu(),now:$(e.now)});if(i.kind!=="approved")throw x(i.kind==="cancelled"?"oauth_state_invalid":Ws(i.kind),"Authorization setup state is invalid, expired, or already used.");let s=new URL(i.transaction.redirectUri);return s.searchParams.set("code",r),i.transaction.clientState&&s.searchParams.set("state",i.transaction.clientState),s}n(db,"createAuthorizationCodeRedirectWithDecision");async function ub(e){let t=await ui(e.csrfToken),r=await j().decideAuthorizationSetup({decision:"cancel",transactionId:t.transactionId,currentStateHash:await Y(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:$(e.now)});if(r.kind!=="cancelled")throw x(r.kind==="approved"?"oauth_state_invalid":Ws(r.kind),"Authorization setup state is invalid, expired, or already used.");return lb({redirectUri:r.transaction.redirectUri,clientState:r.transaction.clientState})}n(ub,"createCancelRedirectWithDecision");function lb(e){let t=new URL(e.redirectUri);return t.searchParams.set("error","access_denied"),t.searchParams.set("error_description","The user cancelled the MCP authorization request."),e.clientState!==void 0&&t.searchParams.set("state",e.clientState),t}n(lb,"buildClientCancelRedirect");async function oh(e){let t=e.now??new Date;return db({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}n(oh,"approve");async function ih(e){let t=e.now??new Date;return ub({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}n(ih,"cancel");import{createRemoteJWKSet as pb,errors as xr,jwtVerify as sh,SignJWT as mb}from"jose";var Qs="zuplo_mcp_session",hb=l.object({purpose:l.literal("gateway_browser_session"),sub:qn,browserLoginOrigin:l.string().min(1),roles:l.array(l.string().min(1)).optional(),exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),fb=l.object({id_token:l.string().min(1),token_type:l.string().min(1).optional(),expires_in:l.number().optional(),access_token:l.string().min(1).optional(),refresh_token:l.string().min(1).optional(),scope:l.string().min(1).optional()}),gb=l.object({error:l.string().min(1).optional(),error_description:l.string().min(1).optional(),error_uri:l.string().min(1).optional()}),yb=l.object({sub:qn,nonce:l.string().min(1)}).catchall(l.unknown()),Ys;function Sb(e){let t=new Map;if(!e)return t;for(let r of e.split(";")){let o=r.indexOf("=");if(o<0)continue;let i=r.slice(0,o).trim(),s=r.slice(o+1).trim();if(i)try{t.set(i,decodeURIComponent(s))}catch{t.set(i,s)}}return t}n(Sb,"parseCookieHeader");async function ah(){return $e({purpose:"browser-session",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>gt(e,"browser-session"),"derive")})}n(ah,"getBrowserSessionKey");function Xs(e,t){let r=new URL(re(e,t)),o=[`${Qs}=`,"Path=/","HttpOnly","SameSite=Lax","Max-Age=0"];return r.protocol==="https:"&&o.push("Secure"),o.join("; ")}n(Xs,"buildBrowserSessionEvictionCookie");function _b(e){let t=new URL(re(e.requestUrl,e.requestHeaders)),r=[`${Qs}=${encodeURIComponent(e.value)}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${e.ttlSeconds}`];return t.protocol==="https:"&&r.push("Secure"),r.join("; ")}n(_b,"serializeSessionCookie");function ch(){return new URL(dt("url")).origin}n(ch,"readBrowserLoginOrigin");function wb(e){let t=gb.safeParse(e);if(!t.success)return{};let r={};return t.data.error!==void 0&&(r.idpError=t.data.error),t.data.error_description!==void 0&&(r.idpErrorDescription=t.data.error_description.slice(0,256)),t.data.error_uri!==void 0&&(r.idpErrorUri=t.data.error_uri.slice(0,256)),r}n(wb,"readIdpErrorFields");function Rb(e){return e instanceof xr.JWTExpired?"expired":e instanceof xr.JWTClaimValidationFailed?"claim":e instanceof xr.JWSSignatureVerificationFailed?"signature":e instanceof xr.JWKSNoMatchingKey?"jwks_no_match":e instanceof xr.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(Rb,"readJwtFailureKind");function bb(e){return e instanceof Error&&"cause"in e?e.cause:e}n(bb,"readErrorCause");function vb(e){if(e!==null&&typeof e=="object"&&"extensionMembers"in e)return e.extensionMembers?.gatewayCode}n(vb,"readRuntimeGatewayCode");function Cb(){if(!Ys){let e=le();Ys=pb(new URL(e.oidc.jwksUrl),{timeoutDuration:e.browserLogin.remoteTimeoutMs})}return Ys}n(Cb,"readFederatedJwks");function dh(e){if(!e.user)throw x("authentication_required","The browser login callback did not include an authenticated Zuplo principal.");return Nt(e.user,e.url)}n(dh,"resolveCurrentRequestPrincipal");async function li(e,t={}){let r=Sb(e.headers.get("cookie")).get(Qs);if(!r)return{};try{let{payload:o}=await sh(r,await ah(),{algorithms:[Ce],issuer:Se,audience:ve}),i=hb.parse(o);if(i.browserLoginOrigin!==ch())return{evictCookie:Xs(e.url,e.headers)};let s={subjectId:i.sub};return i.roles&&i.roles.length>0&&(s.roles=i.roles),{principal:s}}catch(o){return o instanceof xr.JWTExpired?{evictCookie:Xs(e.url,e.headers)}:(t.context?.log.warn({event:"browser_session_verification_failed",errorName:o instanceof Error?o.name:"unknown",errorMessage:o instanceof Error?o.message:"verification failed"},"Browser session JWT verification failed"),{evictCookie:Xs(e.url,e.headers)})}}n(li,"readBrowserSession");async function pi(e){let t=le().browserLogin.sessionTtlSeconds,r={purpose:"gateway_browser_session",sub:e.principal.subjectId,browserLoginOrigin:ch()};e.principal.roles&&(r.roles=e.principal.roles);let o=await new mb(r).setProtectedHeader({alg:Ce,typ:"JWT"}).setIssuer(Se).setAudience(ve).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+t).sign(await ah());return _b({value:o,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,ttlSeconds:t})}n(pi,"createBrowserSessionCookie");async function Ib(e){let t=le(),r=dt("tokenUrl"),o=dt("clientId"),i=dt("clientSecret"),s=new URL(de().actionPath("/oauth/callback"),Sr(e.requestUrl,e.requestHeaders)).toString(),a=new URLSearchParams({grant_type:"authorization_code",code:e.code,redirect_uri:s,client_id:o,client_secret:i});if(t.browserLogin.pkce===mr){let c=await Gs({stateId:e.stateId,signingKey:await Wn()});a.set("code_verifier",c)}try{let{response:c,json:u}=await ti(r,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:a},{maxResponseBytes:32768,problemCode:"browser_login_verification_failed",timeoutMs:t.browserLogin.remoteTimeoutMs,context:e.context});if(!c.ok){let y=wb(u);throw e.context?.log.warn({event:"federated_token_exchange_failed",code:"provider_access_denied",idpHost:ee(r),idpStatus:c.status,...y},"Federated browser login token exchange returned non-2xx from the identity provider"),x({code:"provider_access_denied",privateDetail:"Federated browser login token exchange failed.",cause:new Error(`IdP token exchange failed (status=${c.status}${y.idpError?` idp_error=${y.idpError}`:""}${y.idpErrorDescription?` idp_error_description=${y.idpErrorDescription}`:""})`)})}let p=fb.parse(u),h;try{({payload:h}=await sh(p.id_token,Cb(),{issuer:t.oidc.issuer,audience:o}))}catch(y){let k={};throw pe(k,"error",y),e.context?.log.warn({event:"federated_id_token_verification_failed",code:"browser_login_verification_failed",failureKind:Rb(y),idpHost:ee(r),expectedIssuer:t.oidc.issuer,...k},"Federated id_token failed jose verification"),y}if(h.nonce!==e.nonce)throw e.context?.log.warn({event:"federated_nonce_mismatch",code:"oauth_callback_mismatch",idpHost:ee(r),nonceMissingFromIdToken:h.nonce===void 0},"Federated id_token nonce did not match the signed gateway state"),x("oauth_callback_mismatch","Federated browser login nonce did not match the signed gateway state.");let g=yb.parse(h);return{principal:Nt({sub:g.sub,data:g},e.requestUrl),subjectToken:{token:p.id_token,tokenType:Mn,expiresAt:typeof h.exp=="number"?$(new Date(h.exp*1e3)):void 0}}}catch(c){let u=Je(c)??vb(c);throw u!==void 0&&u!=="browser_login_verification_failed"?c:x("browser_login_verification_failed","Federated browser login callback could not be verified.",bb(c))}}n(Ib,"exchangeFederatedAuthorizationCode");async function uh(e){let t=typeof e.request.query.code=="string"?e.request.query.code:void 0;if(t)return Ib({code:t,nonce:e.stateId,stateId:e.stateId,requestUrl:e.request.url,requestHeaders:e.request.headers,context:e.context});let r=await li(e.request,{context:e.context});if(r.principal)return{principal:r.principal};throw x("oauth_callback_mismatch","Federated browser login callback is missing an authorization code.")}n(uh,"resolveBrowserLoginCallbackIdentity");var Tb=new Set(["about","blob","data","file","ftp","ftps","javascript","mailto","urn","ws","wss"]);function kb(e){return e.protocol.replace(/:$/u,"").toLowerCase()}n(kb,"readScheme");function Ab(e){return e.protocol==="https:"}n(Ab,"isSpecCompliantRedirectUri");function Pb(e){let t=kb(e);return t.length>0&&t!=="http"&&t!=="https"&&!Tb.has(t)}n(Pb,"isNativeAppCustomSchemeRedirectUri");var ph=[{id:"oauth.redirect_uri.https",mode:"strict",accepts:n(e=>Ab(e),"accepts")},{id:"oauth.redirect_uri.loopback_http",mode:"native_app",accepts:n(e=>Re(e),"accepts"),matches:n((e,t)=>Re(e)&&Re(t)&&e.pathname===t.pathname&&e.search===t.search,"matches")},{id:"oauth.redirect_uri.custom_scheme",mode:"native_app",accepts:n(e=>Pb(e),"accepts")}];function mh(e){let t=ph.find(r=>r.accepts(e.url));return t===void 0?{kind:"rejected"}:{kind:"allowed",ruleId:t.id,mode:t.mode}}n(mh,"evaluateBuiltInRedirectUriCompatibility");function lh(e){try{return new URL(e)}catch{return}}n(lh,"parseUrl");function hh(e){if(e.registeredRedirectUri===e.requestedRedirectUri)return!0;let t=lh(e.registeredRedirectUri),r=lh(e.requestedRedirectUri);return t===void 0||r===void 0?!1:ph.some(o=>o.matches?.(t,r))}n(hh,"redirectUriMatchesBuiltInCompatibility");var Eb=1e4,xb=5*1024,Ub=0,Ob=2160*60*60,fh=["authorization_code","refresh_token",qo,ut],qb=["authorization_code","refresh_token"],gh=[Nu],zb=["code"],Mb=l.object({client_name:l.string().min(1).optional(),redirect_uris:l.array(l.string().min(1)).min(1),grant_types:l.array(l.enum(fh)).min(1).max(fh.length).optional(),authorization_grant_profiles_supported:l.array(l.enum(gh)).min(1).max(gh.length).optional(),response_types:l.array(l.enum(zb)).min(1).max(1).optional(),scope:l.literal(ne).optional(),token_endpoint_auth_method:Du.optional(),jwks_uri:l.string().min(1).optional()});function jb(e){try{let t=new URL(e);return(t.protocol==="https:"||t.protocol==="http:"&&Re(t))&&t.pathname!=="/"}catch{return!1}}n(jb,"isCimdClientIdCandidate");function yh(e,t){throw new R("invalid_client",Wu({clientId:e})??"OAuth client is not registered.",void 0,t===void 0?void 0:{cause:t})}n(yh,"invalidCimdClientError");function Ur(e,t="invalid_request"){if(Nb(e))throw new R(t,"redirect_uris must not include raw whitespace or control characters.");let r;try{r=new URL(e)}catch{throw new R(t,"redirect_uris must be absolute URIs.")}if(r.hash||r.username||r.password)throw new R(t,"redirect_uris must not include credentials or fragments.");if(mh({url:r}).kind==="rejected")throw new R(t,"redirect_uris must use HTTPS, loopback HTTP, or a native-app private-use URI scheme.")}n(Ur,"assertValidRedirectUri");function Nb(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<=32||r>=127&&r<=159)return!0}return!1}n(Nb,"hasForbiddenRawRedirectUriCharacter");async function $b(e){let{response:t,json:r}=await kp(e.initialUrl,{headers:{accept:"application/json"}},{maxRedirects:Ub,maxResponseBytes:xb,timeoutMs:Eb});if(!t.ok)throw x("invalid_request","CIMD metadata could not be fetched.");let o=Mo(r);for(let i of o.redirect_uris)Ur(i,"invalid_request");if(o.jwks_uri!==void 0&&Nn(o.jwks_uri),o.client_id!==e.clientId)throw x("invalid_request","Fetched CIMD client_id must exactly match the requested client_id.");return o}n($b,"fetchCimdMetadata");async function Db(e){let t=jo(e),r=await $b({clientId:e,initialUrl:t});return{kind:"cimd",clientId:e,metadata:r}}n(Db,"resolveCimdClient");async function mi(e,t){let r=Ve.parse(e);if(jb(r)){le().gateway.downstreamCimdEnabled||yh(r);try{return await Db(r)}catch(i){yh(r,i)}}let o=await j().readClient({clientId:r});if(o.kind==="found"){let i=o.client,s=Yu(i.clientId),a=s===void 0?i.tokenEndpointAuthMethod:"private_key_jwt",c=i.jwksUri??s;if(a==="private_key_jwt"&&c===void 0)throw new R("invalid_client","Dynamic private_key_jwt client is missing JWKS metadata. Re-run client registration before authorization.");let u=Mo({client_id:i.clientId,client_name:i.clientName,redirect_uris:i.redirectUris,token_endpoint_auth_method:a,...c===void 0?{}:{jwks_uri:c}}),p={kind:"dcr",clientId:r,metadata:u};return i.hashedClientSecret&&(p.hashedClientSecret=i.hashedClientSecret),p}throw new R("invalid_client",r.startsWith("dcr:")?"Dynamic client is not registered. Re-run client registration before authorization.":"OAuth client is not registered.")}n(mi,"resolveClient");function Sh(e,t){if(!e.metadata.redirect_uris.some(r=>hh({registeredRedirectUri:r,requestedRedirectUri:t})))throw x("invalid_request","redirect_uri is not registered for the client.")}n(Sh,"assertRedirectRegistered");function Lb(e){return e===void 0?[...qb]:Array.from(new Set(e))}n(Lb,"normalizeGrantTypes");function Hb(e){try{Nn(e)}catch(t){throw new R("invalid_client_metadata","jwks_uri must be an HTTPS URL with a path, no credentials or fragment, and must not point at a blocked host.",void 0,{cause:t})}}n(Hb,"assertValidDcrJwksUri");function Bb(e){return e.tokenEndpointAuthMethod==="private_key_jwt"&&e.jwksUri!==void 0?Ve.parse(Zu({clientId:crypto.randomUUID(),jwksUri:e.jwksUri})):Ve.parse(`dcr:${crypto.randomUUID()}`)}n(Bb,"createDcrClientId");function Or(e){if(e===void 0||e===ne)return ne;throw new R("invalid_request",`Only the ${ne} scope is supported.`)}n(Or,"assertSupportedOAuthScope");function Lt(e,t,r){let o;try{o=new URL(t)}catch{throw new R("invalid_target","resource must be an absolute URI.")}if(o.hash)throw new R("invalid_target","resource must not include a fragment.");if(o.protocol!=="https:"&&!Re(o))throw new R("invalid_target","resource must use HTTPS except loopback HTTP resources in local development.");let i=re(e,r),s=Mu(),a=s?[...s.byOperationId.values()].find(c=>new URL(c.routePath,i).toString()===t):void 0;if(!a)throw new R("invalid_target","resource must match a published MCP route.");return a}n(Lt,"resolveResource");async function _h(e){let t;try{t=Mb.parse(e)}catch(y){if(y instanceof l.ZodError){let k=y.issues.some(w=>w.path[0]==="redirect_uris");throw new R(k?"invalid_redirect_uri":"invalid_client_metadata",y.issues[0]?.message??"Client metadata is invalid.",void 0,{cause:y})}throw y}for(let y of t.redirect_uris)Ur(y,"invalid_redirect_uri");if(t.token_endpoint_auth_method==="private_key_jwt"&&t.jwks_uri===void 0)throw new R("invalid_client_metadata","jwks_uri is required for private_key_jwt clients.");t.jwks_uri!==void 0&&Hb(t.jwks_uri);let r=new Date,o=t.token_endpoint_auth_method??"none",i=o==="private_key_jwt"?"none":o,s=Bb({tokenEndpointAuthMethod:o,jwksUri:t.jwks_uri}),a=Mo({client_id:s,client_name:t.client_name??"Dynamically registered MCP client",redirect_uris:t.redirect_uris,token_endpoint_auth_method:o,...t.jwks_uri===void 0?{}:{jwks_uri:t.jwks_uri}}),c=Ge(r,Ob),u=Math.floor(r.getTime()/1e3),p=Math.floor(c.getTime()/1e3),h={client_id:a.client_id,client_name:a.client_name,redirect_uris:a.redirect_uris,grant_types:Lb(t.grant_types),authorization_grant_profiles_supported:t.authorization_grant_profiles_supported,response_types:["code"],scope:ne,token_endpoint_auth_method:a.token_endpoint_auth_method,client_id_issued_at:u,jwks_uri:a.jwks_uri},g={clientId:a.client_id,clientName:a.client_name,redirectUris:a.redirect_uris,tokenEndpointAuthMethod:i,createdAt:$(r),clientExpiresAt:$(c)};if(o==="client_secret_basic"||o==="client_secret_post"){let y=Ke();g.hashedClientSecret=await Y(y),g.clientSecretExpiresAt=$(c),h.client_secret=y,h.client_secret_expires_at=p,h.client_secret_issued_at=u}if((await j().registerClient(g)).kind==="already_exists")throw x("invalid_request","OAuth client is already registered.");return h}n(_h,"registerDownstreamClient");function Fb(e){return e?.metadata?.idpSubjectTokenType!==_r&&e?.metadata?.idpSubjectTokenExpiresAt!==void 0&&new Date(e.metadata.idpSubjectTokenExpiresAt).getTime()<=Date.now()?!1:e?.status==="active"&&e.metadata?.encryptedIdpSubjectToken!==void 0&&e.metadata.idpSubjectTokenType!==void 0}n(Fb,"hasStoredIdJagSubjectTokenBinding");async function wh(e){let t=yr(e.principal.subjectId);return(await j().batchGetUpstreamConnections([{owner:t,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId}]))[0]}n(wh,"readIdJagSubjectConnection");async function ea(e){let t=Ae().byOperationId.get(e.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag")return!1;let r=await wh({connection:t.connection,principal:e.principal});return!Fb(r)}n(ea,"requiresIdJagSubjectTokenBinding");async function Rh(e){if(e.subjectToken===void 0)return;let t=Ae().byOperationId.get(e.transaction.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag"||e.principal.subjectId!==e.transaction.principal.subjectId)return;let r=await wh({connection:t.connection,principal:e.principal});return j().upsertUpstreamConnection({id:r?.id??No(),ownerMode:"user",subjectId:e.transaction.principal.subjectId,upstreamServerId:t.connection.upstreamServerId,authProfileId:t.connection.authProfileId,status:"active",encryptedAccessToken:r?.encryptedAccessToken,encryptedRefreshToken:r?.encryptedRefreshToken,scopes:r?.scopes??[],expiresAt:r?.expiresAt,metadata:{...r?.metadata??{},encryptedIdpSubjectToken:await We(e.subjectToken.token),idpSubjectTokenType:e.subjectToken.tokenType,idpSubjectTokenExpiresAt:e.subjectToken.expiresAt}})}n(Rh,"bindIdJagSubjectTokenForAuthorizationTransaction");function hi(e){return B`<img class="card__icon" src="${e.iconHref}" alt="" width="48" height="48" referrerpolicy="no-referrer" onerror=" this.onerror = null; this.src = '${e.fallbackIconHref}'; " />`}n(hi,"renderShellIcon");function bh(e){return B`<form class="actions" method="post" action="${e.setupAction}" ${e.submitOnceAttrs}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate >Cancel</button><button class="button button--primary" type="submit" name="decision" value="approve" ${e.authorizeAttrs} >Authorize</button></form>`}n(bh,"renderActions");var vh=Ye('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="6.5"/><line x1="8" y1="4.6" x2="8" y2="8.4"/><circle cx="8" cy="11" r=".7" fill="currentColor" stroke="none"/></svg>');function Ch(e){return B`<div class="banner banner--warning" role="status"><span class="banner__icon" aria-hidden="true">${e.icon}</span><div class="banner__body"><p class="banner__title">Setup required</p><p class="banner__message">${e.message}</p></div></div>`}n(Ch,"renderBannerWarning");var Vx=Ye('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 6.5l4 4 4-4"/></svg>'),Kx=Ye('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="4" width="18" height="7" rx="1.5"/><rect x="3" y="13" width="18" height="7" rx="1.5"/><circle cx="7" cy="7.5" r=".75" fill="currentColor" stroke="none"/><circle cx="7" cy="16.5" r=".75" fill="currentColor" stroke="none"/></svg>');var Wx=Ye('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7.13 2.46 1.39 12.5a1 1 0 0 0 .87 1.5h11.48a1 1 0 0 0 .87-1.5L8.87 2.46a1 1 0 0 0-1.74 0Z"/><line x1="8" y1="6" x2="8" y2="9.4"/><circle cx="8" cy="11.4" r=".7" fill="currentColor" stroke="none"/></svg>');var Jb="data:,",Ih=B`data-submit-once="true" onsubmit="if (this.dataset.submitted === 'true') return false; this.dataset.submitted = 'true'; setTimeout(() => this.querySelectorAll('button').forEach((button) => { button.disabled = true; }), 0);"`,Th=B`data-activate-once="true" onclick="if (this.dataset.activated === 'true') return false; this.dataset.activated = 'true'; this.setAttribute('aria-disabled', 'true'); this.style.pointerEvents = 'none';"`;function Gb(e,t,r){if(e)try{let o=new URL(t).origin,i=new URL(e,o);return i.origin!==o||!i.pathname.startsWith(r.actionPath("/auth/connections/"))?void 0:i.toString()}catch{return}}n(Gb,"safeGatewayConnectHref");function Vb(e){return e.some(r=>r.ownerMode==="user"&&r.status!=="active")?"setup":"grant"}n(Vb,"deriveMode");function Kb(e){return bh({state:e.state,setupAction:e.gateway.actionPath("/oauth/setup"),submitOnceAttrs:Ih,authorizeAttrs:Pe})}n(Kb,"renderActions");function ta(e,t,r,o){for(let i of e){if(i.ownerMode!=="user"||i.status!==r)continue;let s=Gb(i.connectUrl,t,o);if(s)return s}}n(ta,"firstUserConnectHref");function Wb(e){let t=e.connectHref===void 0?Pe:B`<a class="button button--primary" href="${e.connectHref}" ${Th}>Connect</a>`;return B`<form class="actions" method="post" action="${e.gateway.actionPath("/oauth/setup")}" ${Ih}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate>Cancel</button>${t}</form>`}n(Wb,"renderSetupActions");function Zb(e){return e?B`<span class="reconnect-action"><a class="button button--secondary reconnect-button" href="${e}" ${Th}>Re-connect<span class="tooltip" tabindex="0" aria-label="Reset or change how the gateway connects to the upstream service, including changing scopes.">?</span></a></span>`:Pe}n(Zb,"renderReconnectAction");function Yb(e){try{let t=new URL(e);return t.protocol==="https:"||t.protocol==="http:"?!0:t.protocol==="data:"&&/^data:image\/(?:png|jpe?g|webp|svg\+xml);/i.test(e)}catch{return!1}}n(Yb,"isRenderableIconHref");function kh(e){return e?.find(t=>Yb(t.src))?.src}n(kh,"readIconHref");function Xb(e){return kh(e.serverIcons)??(e.transportHost===void 0?void 0:Ts(e.transportHost).src)}n(Xb,"readUpstreamIconHref");function Qb(e){let t=kh(e.routeIcons);if(t!==void 0)return t;for(let r of e.upstreams){let o=Xb(r);if(o!==void 0)return o}}n(Qb,"readHeaderIconHref");function ev(e){let t=e.setupMessage===void 0?Pe:Ch({icon:vh,message:e.setupMessage});return B`<p class="card__subtitle">Authorize '<strong>${e.clientDisplayName}</strong>' to access '<strong>${e.routeDisplayName}</strong>' on your behalf?</p>${t}`}n(ev,"renderBody");function ra(e){let t=Vb(e.upstreams),r=ta(e.upstreams,e.gatewayOrigin,"not_connected",e.gateway),o=ta(e.upstreams,e.gatewayOrigin,"reconsent_required",e.gateway),i=ta(e.upstreams,e.gatewayOrigin,"active",e.gateway),s=t==="setup"?r??o:void 0,a=t==="setup"?e.upstreams.find(p=>p.ownerMode==="user"&&p.status!=="active"&&p.connectUrl===void 0&&p.setupMessage!==void 0)?.setupMessage:void 0,c=Qb({routeIcons:e.routeIcons,upstreams:e.upstreams}),u=t==="setup"?B`<footer class="card__footer">${Wb({state:e.state,connectHref:s,gateway:e.gateway})}</footer>`:B`<footer class="card__footer">${Zb(i)}${Kb({state:e.state,gateway:e.gateway})}</footer>`;return kr(Pr({title:`Authorize access \xB7 ${e.routeDisplayName}`,iconHref:c??Jb,styles:Ar,headerIcon:c===void 0?Pe:hi({iconHref:c,fallbackIconHref:Yo}),heading:"Authorize access",subhead:Pe,body:ev({routeDisplayName:e.routeDisplayName,clientDisplayName:e.clientDisplayName,setupMessage:a}),footer:u}))}n(ra,"renderConsentPage");var tv=1e4,Ah="mcp-session-id",rv;function Oh(){return{tools:[],prompts:[],resources:[]}}n(Oh,"emptyCapabilities");function Ph(){return new Headers({accept:"application/json, text/event-stream","content-type":"application/json","mcp-protocol-version":Bi})}n(Ph,"buildReadinessHeaders");async function Eh(e){if(e.type==="bearer_token"){let o=Ph();return o.set("authorization",`Bearer ${e.token}`),o}let t=await e.provider.tokens();if(!t)return;let r=Ph();return r.set("authorization",`${t.token_type??"Bearer"} ${t.access_token}`),r}n(Eh,"buildAsyncCredentialHeaders");function xh(e){return new Request(e.upstreamUrl,{method:"POST",headers:e.headers,body:JSON.stringify(Mt.parse({jsonrpc:dr,id:1,method:"initialize",params:{protocolVersion:Bi,capabilities:{},clientInfo:{name:"zuplo-mcp-gateway-readiness",version:"0.0.0"}}}))})}n(xh,"buildInitializePreflight");async function na(e){jn(e.url);let t=new AbortController,r=setTimeout(()=>t.abort(),tv);try{let o=new Request(e,{redirect:"manual",signal:t.signal});return await wo.fetch(o)}finally{clearTimeout(r)}}n(na,"runPreflight");function oa(e){e.body?.cancel().catch(()=>{})}n(oa,"releasePreflightBody");async function nv(e){let t=e.response.headers.get(Ah);if(!t)return;let r=new Headers(e.headers);r.set(Ah,t),r.delete("content-type");try{let o=await na(new Request(e.upstreamUrl,{method:"DELETE",headers:r}));oa(o)}catch{}}n(nv,"terminatePreflightSession");async function qh(e){let{response:t}=e;return oa(t),t.status>=200&&t.status<300?(await nv(e),{kind:"ready",upstreamStatus:t.status,capabilities:Oh()}):t.status===401||t.status===403?{kind:"upstream_auth_rejected",status:t.status,message:"Upstream MCP server rejected the configured credential."}:{kind:"upstream_unavailable",status:t.status,message:"Upstream MCP server did not accept the readiness preflight."}}n(qh,"classifyResponse");function Uh(e){let t={status:e.state==="reconsent_required"?"reconsent_required":"not_connected",connected:!1};return e.nextAction==="admin_setup_required"?{kind:"admin_setup_required",payload:e,connectionStatus:t}:{kind:"connect_required",payload:e,connectionStatus:t}}n(Uh,"connectRequiredResult");async function ov(e){try{return qh({response:await na(e.request),upstreamUrl:e.upstreamUrl,headers:e.headers})}catch(t){return{kind:"upstream_unavailable",message:t instanceof Error?t.message:"Upstream MCP server readiness preflight failed."}}}n(ov,"classifyPreflight");async function iv(e){let t=e.route.connection;if(t===void 0)return{kind:"ready",upstreamStatus:204,capabilities:Oh()};let r=ai(t.upstreamServerId,e.route.operationId),o=Tr(r,e.subjectId),i=e.returnTo===void 0?o:{...o,returnTo:e.returnTo},s=new Request(e.requestUrl,{headers:e.requestHeaders}),a=await Ir({request:s,routeAuth:i,preloadedConnection:e.preloadedConnection});if(a.kind==="connect_required")return Uh(a.payload);let c=await Eh(a.credential);if(c===void 0)return{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens."};let u=xh({upstreamUrl:t.mcpUrl,headers:c}),p;try{p=await na(u)}catch(S){return{kind:"upstream_unavailable",message:S instanceof Error?S.message:"Upstream MCP server readiness preflight failed."}}if(p.status!==401)return qh({response:p,upstreamUrl:t.mcpUrl,headers:c});oa(p);let h=await Ir({request:s,routeAuth:i,forceRefresh:!0});if(h.kind==="connect_required")return Uh(h.payload);let g=await Eh(h.credential);return g===void 0?{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens after refresh."}:ov({request:xh({upstreamUrl:t.mcpUrl,headers:g}),upstreamUrl:t.mcpUrl,headers:g})}n(iv,"checkUpstreamRouteReadinessImpl");function zh(e){return(rv??iv)(e)}n(zh,"checkUpstreamRouteReadiness");function sv(e){try{return new URL(e).host}catch{return}}n(sv,"safeUrlHost");function Mh(e){return e!==void 0&&e.length>0}n(Mh,"hasItems");function av(e){let t=e.serverInfo?.icons;if(Mh(t))return t;let r=Xo(e.mcpUrl);return r===void 0?void 0:[r]}n(av,"readServerIcons");async function cv(e){let{authConfig:t,authMode:r,description:o,displayName:i,mcpUrl:s,ownerMode:a,upstreamServerId:c,authProfileId:u}=e.registeredConnection,p=a==="user",h=p&&r!=="id-jag",g=e.readiness??(p?rl(e.connection):{connected:!0,status:"active"}),S=h?e.readiness?.connectUrl??(e.returnTo!==void 0?await Ps({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,owner:e.userOwner,initiatedBySubjectId:e.transaction.principal.subjectId,upstreamServerId:c,authProfileId:u,operationId:e.route.operationId,returnTo:e.returnTo}):void 0):void 0,y=t.mode==="id-jag"?t.idJag.scopes:t.oauth.scopes;return{upstreamServerId:c,authProfileId:u,authMode:r,ownerMode:a,upstreamDisplayName:i,description:o,transportHost:sv(s),scopesRequested:Mh(y)?y:void 0,serverIcons:av(e.registeredConnection),status:g.status,connected:g.connected,capabilities:{tools:[],prompts:[],resources:[]},connectUrl:S,setupMessage:e.setupMessage,updatedAt:p&&"updatedAt"in g&&g.updatedAt!==void 0?g.updatedAt:void 0,expiresAt:e.readiness?.expiresAt??e.connection?.expiresAt}}n(cv,"buildSetupRequirement");function jh(e){let t=Ae().byOperationId.get(e);if(!t)throw x("unknown_mcp_route",`Unknown MCP route: ${e}`);return t}n(jh,"requireRoute");async function ia(e){let t=jh(e.transaction.operationId),r=yr(e.transaction.principal.subjectId),o=t.connection;if(o===void 0)return[];let s=o.ownerMode==="user"?(await j().batchGetUpstreamConnections([{owner:r,upstreamServerId:o.upstreamServerId,authProfileId:o.authProfileId}]))[0]:void 0,a=await zh({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,route:t,subjectId:e.transaction.principal.subjectId,preloadedConnection:s,returnTo:e.returnTo}),c="connectionStatus"in a?a.connectionStatus:void 0,u=(a.kind==="connect_required"||a.kind==="admin_setup_required")&&a.payload.authUrl!==void 0?a.payload.authUrl:void 0,p=a.kind==="admin_setup_required"?a.payload.message:void 0;return[await cv({connection:s,registeredConnection:o,route:t,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:e.returnTo,transaction:e.transaction,userOwner:r,setupMessage:p,readiness:c===void 0?void 0:{...c,connectUrl:u}})]}n(ia,"requirementsForSetup");async function sa(e){let t=jh(e.transaction.operationId),r=await j().readClient({clientId:e.transaction.clientId}),o=r.kind==="found"?r.client:void 0,i={gatewayOrigin:re(e.requestUrl,e.requestHeaders),routeDisplayName:t.connection?.displayName??t.operationId,clientDisplayName:o?.clientName??String(e.transaction.clientId),principalLabel:e.transaction.principal.subjectId},s=t.connection?.description;return s!==void 0&&(i.routeDescription=s),i}n(sa,"consentContext");function aa(e){return e.some(t=>t.ownerMode==="user"&&t.status!=="active")}n(aa,"hasUnresolvedUserUpstream");var dv=["mcp_user"],uv="dev-browser-user",lv=["resource is required for /oauth/authorize.","MCP clients should start at the MCP server URL and follow its WWW-Authenticate resource_metadata link.","If your client reached this endpoint directly, use /oauth/authorize/{routePath} where {routePath} is the published MCP route path without a leading slash and each segment is URL-encoded as needed, for example /oauth/authorize/mcp/linear, or add resource={protected resource URI from protected-resource metadata}."].join(" "),pv=l.object({response_type:l.literal("code"),client_id:l.string().min(1),redirect_uri:l.string().min(1),resource:l.url(),code_challenge:l.string().min(43),code_challenge_method:bu,state:l.string().min(1).optional(),scope:l.literal(ne).default(ne)}),mv=l.enum(["continue","approve","cancel"]).default("continue"),hv=l.object({state:l.string().min(1),decision:mv}),_t=class extends Error{static{n(this,"DownstreamAuthorizeRedirectError")}redirectUri;clientState;errorCode;errorDescription;constructor(t){super(t.errorDescription?`${t.errorCode}: ${t.errorDescription}`:t.errorCode,t.cause===void 0?void 0:{cause:t.cause}),this.name="DownstreamAuthorizeRedirectError",this.redirectUri=t.redirectUri,this.clientState=t.clientState,this.errorCode=t.errorCode,this.errorDescription=t.errorDescription}};function Nh(e){return typeof e=="string"&&e.length>0?e:void 0}n(Nh,"readQueryString");function fv(e,t){let r=Nh(e.query.resource);if(t===void 0){if(r!==void 0)return r;throw new R("invalid_target",lv)}let o=Ju(t,e.url,e.headers);if(r===void 0||r===o)return o;throw new R("invalid_target","resource must match the scoped OAuth authorization endpoint resource.")}n(fv,"requireAuthorizeResource");async function gv(e,t){let r={};t!==void 0&&(r.context=t);let o=await li(e,r);if(o.principal)return{principal:o.principal};if(!e.user)return o.evictCookie===void 0?{}:{setCookie:o.evictCookie};let i=dh(e);return{principal:i,setCookie:await pi({principal:i,requestUrl:e.url,requestHeaders:e.headers})}}n(gv,"resolveBrowserPrincipal");async function yv(e,t){let r={};t!==void 0&&(r.context=t);let o=await li(e,r);if(!o.principal)throw x("authentication_required","Authorization setup requires a current browser session.");return o.principal}n(yv,"requireSetupPrincipal");function $h(e){return`${de().actionPath("/oauth/setup")}?state=${encodeURIComponent(e)}`}n($h,"buildSetupReturnTo");async function Dh(e){let t=await ia({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:$h(e.csrfToken)}),r=await sa({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders}),o={kind:"setup_page",html:ra({state:e.csrfToken,operationId:e.transaction.operationId,gateway:de(),upstreams:t,...r})};return e.setCookie!==void 0&&(o.setCookie=e.setCookie),o}n(Dh,"renderSetup");function Sv(e){if(e===void 0)return;let t=e.metadata.token_endpoint_auth_method;return{clientId:e.clientId,clientName:e.metadata.client_name,tokenEndpointAuthMethod:t}}n(Sv,"toAuthorizationTransactionClient");async function ca(e,t={}){let r=pv.parse({...e.query,resource:fv(e,t.operationId),state:Nh(e.query.state)}),o=Or(r.scope);Ur(r.redirect_uri,"invalid_request");let i=new Date,s=Ve.parse(r.client_id),a=await mi(r.client_id,i);Sh(a,r.redirect_uri);try{let c=Lt(e.url,r.resource,e.headers),u=Sv(a);t.context?.log.info({event:"oauth_authorize_request_parsed",clientId:s,operationId:c.operationId,scope:o,hasClientState:r.state!==void 0},"Downstream OAuth authorize: request parsed and client resolved"),t.context&&G(t.context,{eventType:H.MCP_OAUTH_AUTHORIZE_STARTED,outcome:"success",virtualServerName:c.operationId,attributes:{clientId:s,scope:o,responseType:r.response_type}});let p={clientId:a?.clientId??s,...u===void 0?{}:{client:u},redirectUri:r.redirect_uri,resource:r.resource,operationId:c.operationId,scope:o,codeChallenge:r.code_challenge,codeChallengeMethod:r.code_challenge_method,...r.state===void 0?{}:{clientState:r.state}},{principal:h,setCookie:g}=await gv(e,t.context),S=h===void 0?!1:await ea({operationId:c.operationId,principal:h});if(!h||S){let k=await eh({transaction:p,requestUrl:e.url,requestHeaders:e.headers,now:i});t.context?.log.info({event:"oauth_authorize_awaiting_login",clientId:s,operationId:c.operationId,reason:h?"id_jag_subject_binding_missing":"no_browser_session"},"Downstream OAuth authorize: redirecting to browser login");let w={kind:"redirect",location:k.browserLoginUrl};return g!==void 0&&(w.setCookie=g),w}let y=await th({transaction:p,principal:h,now:i});return t.context?.log.info({event:"oauth_authorize_awaiting_setup",clientId:s,operationId:c.operationId,subjectId:h.subjectId},"Downstream OAuth authorize: rendering consent/setup page"),t.context&&G(t.context,{eventType:H.MCP_OAUTH_AUTHORIZE_AWAITING_SETUP,outcome:"success",virtualServerName:c.operationId,attributes:{clientId:s,scope:o,responseType:r.response_type,subjectId:h.subjectId}}),Dh({transaction:y.transaction,csrfToken:y.csrfToken,requestUrl:e.url,requestHeaders:e.headers,setCookie:g})}catch(c){throw _v({redirectUri:r.redirect_uri,clientState:r.state,cause:c})}}n(ca,"authorizeDownstreamClient");function _v(e){if(e.cause instanceof _t)return e.cause;let t=wv(e.cause);return t?new _t({redirectUri:e.redirectUri,clientState:e.clientState,errorCode:t.errorCode,errorDescription:t.errorDescription,cause:e.cause}):e.cause}n(_v,"toDownstreamAuthorizeRedirectError");function wv(e){if(e instanceof R)return{errorCode:e.errorCode,errorDescription:e.message};if(e instanceof l.ZodError){let t=e.issues[0];return{errorCode:t?.path.includes("resource")?"invalid_target":"invalid_request",errorDescription:t?.message}}}n(wv,"mapToOAuthRedirectError");async function Lh(e,t={}){let r=typeof e.query.error=="string"?e.query.error:void 0;if(r){let p=typeof e.query.error_description=="string"?e.query.error_description.slice(0,256):void 0,h=typeof e.query.error_uri=="string"?e.query.error_uri.slice(0,256):void 0;throw t.context?.log.warn({event:"browser_login_callback_idp_error",code:"provider_access_denied",idpError:r,...p===void 0?{}:{idpErrorDescription:p},...h===void 0?{}:{idpErrorUri:h}},"Identity provider redirected browser-login callback with an error"),x("provider_access_denied",p??"The delegated browser login was not completed.")}let o=typeof e.query.state=="string"?e.query.state:void 0;if(!o)throw t.context?.log.warn({event:"browser_login_callback_state_missing",code:"oauth_state_invalid"},"Browser login callback was invoked without a state parameter"),x("oauth_state_invalid","Browser login callback is missing state.");let i=await Vs(o),s={request:e,stateId:i.stateId};t.context!==void 0&&(s.context=t.context);let a=await uh(s),c=await rh({browserLoginStateToken:o,principal:a.principal});if(await Rh({transaction:c.transaction,principal:a.principal,subjectToken:a.subjectToken}),await ea({operationId:c.transaction.operationId,principal:a.principal}))throw x("browser_login_verification_failed","The identity provider did not return the subject token required for XAA / ID-JAG.");let u=await Dh({transaction:c.transaction,csrfToken:c.csrfToken,requestUrl:e.url,requestHeaders:e.headers});return u.setCookie=await pi({principal:a.principal,requestUrl:e.url,requestHeaders:e.headers}),u}n(Lh,"completeBrowserLoginCallback");async function Hh(e){let t=le(),r=new URL(e.url);if(!Re(r))throw x("forbidden","Local browser login is only available on loopback HTTP origins.");let o=typeof e.query.state=="string"?e.query.state:void 0;if(!o)throw x("oauth_state_invalid","Local browser login is missing state.");let i=de().actionPath("/oauth/callback"),s=new URL(typeof e.query.redirect_uri=="string"?e.query.redirect_uri:i,re(e.url)),a=new URL(re(e.url)).origin;if(s.origin!==a||s.pathname!==i)throw x("oauth_callback_mismatch",`Local browser login redirect_uri must target this gateway's ${i} route.`);s.searchParams.set("state",o);let c={subjectId:qn.parse(uv),roles:dv};return{kind:"redirect",location:s,setCookie:await pi({principal:c,requestUrl:e.url,requestHeaders:e.headers})}}n(Hh,"completeLocalDevBrowserLogin");function Rv(e){let t=e.method==="POST"?e.body:e.query;return hv.parse(t)}n(Rv,"readSetupContinueRequest");async function Bh(e){let{state:t,decision:r}=Rv({method:e.request.method,query:e.request.query,body:e.body}),o=new Date,i=await Zs({csrfToken:t,now:o}),s=await yv(e.request,e.context);if(r==="cancel")return{kind:"redirect",location:await ih({csrfToken:t,currentBrowserPrincipal:s,now:o})};let a=await nh({csrfToken:t,currentBrowserPrincipal:s,now:o}),c=await ia({transaction:a,requestUrl:e.request.url,requestHeaders:e.request.headers,returnTo:$h(t)});if(r==="approve"&&aa(c)&&await Xm({csrfToken:t,currentBrowserPrincipal:s,now:o}),aa(c)){let u=await sa({transaction:a,requestUrl:e.request.url,requestHeaders:e.request.headers});return{kind:"setup_page",html:ra({state:t,operationId:a.operationId,gateway:de(),upstreams:c,...u})}}return{kind:"redirect",location:await oh({csrfToken:t,currentBrowserPrincipal:s,now:o})}}n(Bh,"continueDownstreamAuthorizeSetup");import{createLocalJWKSet as qv,decodeJwt as zv,errors as Yn,jwtVerify as Mv}from"jose";import{createRemoteJWKSet as bv,decodeJwt as vv,decodeProtectedHeader as Cv,errors as Zn,jwtVerify as Iv}from"jose";var Kh=30,X=l.string().min(1),Tv=l.union([X,l.array(X).min(1)]),kv=l.union([X,l.array(X).min(1)]),Av=l.object({type:X,locations:l.array(X).optional(),actions:l.array(X).optional(),datatypes:l.array(X).optional(),identifier:X.optional(),privileges:l.array(X).optional()}).passthrough(),Pv=l.object({iss:l.url(),sub:X,aud:Tv,client_id:X,resource:kv.optional(),scope:X.optional(),authorization_details:l.array(Av).optional(),jti:X,iat:l.number().int(),nbf:l.number().int().optional(),exp:l.number().int(),tenant:X.optional(),aud_tenant:X.optional(),aud_sub:X.optional(),sub_id:X.optional(),act:l.unknown().optional(),email:X.optional(),auth_time:l.number().int().optional(),acr:X.optional(),amr:l.array(X).optional(),cnf:l.unknown().optional()}).passthrough();function Ie(e){throw new R("invalid_grant",e)}n(Ie,"throwInvalidGrant");function Ev(e){return e instanceof Zn.JWTExpired?"expired":e instanceof Zn.JWTClaimValidationFailed?"claim":e instanceof Zn.JWSSignatureVerificationFailed?"signature":e instanceof Zn.JWKSNoMatchingKey?"jwks_no_match":e instanceof Zn.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(Ev,"readJwtFailureKind");function xv(e){return Array.isArray(e.aud)?(e.aud.length!==1&&Ie("ID-JAG audience must contain exactly one value."),e.aud[0]):e.aud}n(xv,"readSingleAudience");function Fh(e){try{let t=Pv.parse(e);return xv(t),t}catch(t){if(t instanceof R)throw t;Ie("ID-JAG claims are invalid.")}}n(Fh,"parseIdJagClaims");function Uv(e,t){e.idJag.enabled||Ie("ID-JAG grant is not enabled.");let r=e.idJag.trustedIssuers.find(o=>o.issuer===t);return r===void 0&&Ie("ID-JAG issuer is not trusted."),r}n(Uv,"readTrustedIssuer");function Ov(e){let t=e.authorizationDetails;if(t===void 0)return;if(e.allowedTypes===void 0)return t;let r=new Set(e.allowedTypes);return t.filter(o=>r.has(o.type))}n(Ov,"readGrantedAuthorizationDetails");function Jh(e){if(e.clientAuth.method==="none")throw new R("invalid_client","Client authentication failed.");e.claims.client_id!==e.authenticatedClientId&&Ie("ID-JAG client_id must match the authenticated client."),e.trustedIssuer.expectedClientIds!==void 0&&!e.trustedIssuer.expectedClientIds.includes(e.claims.client_id)&&Ie("ID-JAG client_id is not allowed for this issuer.")}n(Jh,"assertClientBinding");function Gh(e){e.cnf!==void 0&&Ie("ID-JAG cnf-bound assertions require DPoP support.")}n(Gh,"assertProofOfPossessionNotDeferred");function Vh(e){let t=Math.floor(e.now.getTime()/1e3)+Kh;e.claims.iat>t&&Ie("ID-JAG iat must not be in the future.")}n(Vh,"assertIssuedAtNotInFuture");async function Wh(e){let t;try{t=Cv(e.assertion)}catch{Ie("ID-JAG assertion is malformed.")}t.typ!==ji&&Ie('ID-JAG header typ must be "oauth-id-jag+jwt".');let r;try{r=Fh(vv(e.assertion))}catch(c){if(c instanceof R)throw c;Ie("ID-JAG assertion is malformed.")}let o=Sr(e.requestUrl,e.requestHeaders),i=[o];e.requestedResource!==void 0&&e.requestedResource!==o&&i.push(e.requestedResource);let s=Uv(e.config,r.iss);i.includes(r.iss)&&Ie("ID-JAG issuer must be different from the gateway."),Jh({claims:r,trustedIssuer:s,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Gh(r),Vh({claims:r,now:e.now});let a;try{let c=bv(new URL(s.jwksUrl)),{payload:u}=await Iv(e.assertion,c,{issuer:s.issuer,audience:i,currentDate:e.now,clockTolerance:Kh,typ:ji});a=Fh(u)}catch(c){e.context?.log.warn({event:"oauth_id_jag_verification_failed",issuer:s.issuer,failureKind:Ev(c)},"OAuth ID-JAG assertion verification failed"),Ie("ID-JAG assertion verification failed.")}return Jh({claims:a,trustedIssuer:s,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Gh(a),Vh({claims:a,now:e.now}),{claims:a,trustedIssuer:s,subjectId:Gu({issuer:a.iss,subject:a.sub,gatewayIssuer:o,subjectMapping:s.subjectMapping,tenant:a.tenant}),grantedAuthorizationDetails:Ov({authorizationDetails:a.authorization_details,allowedTypes:e.config.idJag.enabled?e.config.idJag.authorizationDetailsTypesAllowed:void 0})}}n(Wh,"verifyIdJagAssertion");var jv=new Set(["authorization_code","refresh_token",ut]),Nv=1e4,$v=32*1024,Dv=2,Lv=3600,da=l.object({client_id:l.string().min(1).optional(),client_secret:l.string().min(1).optional(),client_assertion_type:l.string().min(1).optional(),client_assertion:l.string().min(1).optional()}),Hv=l.discriminatedUnion("grant_type",[da.extend({grant_type:l.literal("authorization_code"),code:l.string().min(1),redirect_uri:l.string().min(1),code_verifier:hr,resource:l.url().optional(),scope:l.literal(ne).optional()}),da.extend({grant_type:l.literal("refresh_token"),refresh_token:l.string().min(1),resource:l.url().optional(),scope:l.literal(ne).optional()}),da.extend({grant_type:l.literal(ut),assertion:l.string().min(1),resource:l.url().optional(),scope:l.literal(ne).optional(),authorization_details:l.string().min(1).optional()})]);function Bv(e){if(typeof e!="object"||e===null)return;let t=e.grant_type;if(t!==void 0&&(typeof t!="string"||!jv.has(t)))throw new R("unsupported_grant_type",`Grant type "${typeof t=="string"?t:""}" is not supported.`)}n(Bv,"assertSupportedGrantType");var Fv=l.object({token:l.string().min(1),client_id:l.string().min(1).optional(),token_type_hint:l.string().optional(),client_secret:l.string().min(1).optional(),client_assertion_type:l.string().min(1).optional(),client_assertion:l.string().min(1).optional()}),Jv=l.object({keys:l.array(l.record(l.string(),l.unknown())).min(1)}).passthrough();function Yh(){return le().gateway.accessTokenTtlSeconds}n(Yh,"readAccessTokenTtlSeconds");function Gv(){return le().gateway.refreshTokenTtlSeconds}n(Gv,"readRefreshTokenTtlSeconds");function Zh(e,t){let r=Yh(),o=Math.max(1,Math.floor((new Date(t).getTime()-e.getTime())/1e3)),i=Math.min(r,o);return{expiresAt:$(Ge(e,i)),expiresIn:i}}n(Zh,"calculateAccessTokenExpiresAt");function Vv(e){let t=e.claimedResource===void 0?[]:Array.isArray(e.claimedResource)?e.claimedResource:[e.claimedResource];if(e.requestedResource!==void 0){if(t.length>0&&!t.includes(e.requestedResource))throw new R("invalid_target","Token request resource must match the ID-JAG resource.");return e.requestedResource}if(t.length===0)throw new R("invalid_target","resource is required for the ID-JAG JWT bearer grant.");if(t.length!==1)throw new R("invalid_target","ID-JAG resource arrays require a token request resource.");return t[0]}n(Vv,"readIdJagResource");function Kv(e){if(e.claimAuthorizationDetails===void 0)return;let t=(e.grantedAuthorizationDetails??[]).filter(r=>r.locations?.includes(e.resource)===!0);if(t.length===0)throw new R("invalid_grant","ID-JAG authorization_details must authorize the requested resource.");return t}n(Kv,"readIdJagGrantedAuthorizationDetails");function Wv(e){if(e.claimScope?.split(/\s+/).includes(ne)===!0||(e.grantedAuthorizationDetails?.length??0)>0)return ne;if(e.claimScope===void 0)throw new R("invalid_grant",`ID-JAG must include ${ne} scope or matching authorization_details.`);if(!e.claimScope.split(/\s+/).includes(ne))throw new R("invalid_grant",`ID-JAG scope must include ${ne}.`);return ne}n(Wv,"readIdJagGrantedScope");function Zv(e){if(e!==void 0&&e.get("dpop")!==null)throw new R("invalid_request","DPoP proofs are not supported for the ID-JAG JWT bearer grant.")}n(Zv,"assertNoDpopProofForIdJag");function Xh(e){if(!e?.startsWith("Basic "))return{};let t;try{t=atob(e.slice(6))}catch{throw new R("invalid_client","Malformed HTTP Basic client authentication.")}let r=t.indexOf(":");if(r<0)throw new R("invalid_client","Malformed HTTP Basic client authentication.");try{return{clientId:decodeURIComponent(t.slice(0,r)),clientSecret:decodeURIComponent(t.slice(r+1))}}catch{throw new R("invalid_client","Malformed HTTP Basic client authentication.")}}n(Xh,"readBasicClientSecret");function Qh(e){if(e.basicClientId!==void 0&&e.bodyClientId!==void 0&&e.basicClientId!==e.bodyClientId)throw new R("invalid_request","Authenticated client_id must match request client_id.");let t=e.basicClientId??e.bodyClientId;if(t!==void 0)return t;if(e.clientAssertion!==void 0){try{let r=zv(e.clientAssertion);if(typeof r.iss=="string"&&typeof r.sub=="string"&&r.iss===r.sub)return r.iss}catch{throw new R("invalid_client","Malformed private_key_jwt client assertion.")}throw new R("invalid_client","private_key_jwt client assertion must identify the client with matching iss and sub claims.")}throw new R("invalid_client","Client authentication or client_id is required.")}n(Qh,"resolveAuthenticatedClientId");function Yv(e){if(e.basicClientSecret!==void 0&&e.bodyClientSecret!==void 0)throw new R("invalid_request","Use only one client authentication method per request.");return e.basicClientSecret!==void 0?{clientSecret:e.basicClientSecret,clientSecretSource:"basic"}:e.bodyClientSecret!==void 0?{clientSecret:e.bodyClientSecret,clientSecretSource:"post"}:{}}n(Yv,"resolveClientSecretInput");function Xv(e){return e.clientAssertion!==void 0||e.clientAssertionType!==void 0}n(Xv,"hasClientAssertion");function Qv(e){if(e.requestUrl===void 0)throw new R("invalid_request","Request URL is required for private_key_jwt client authentication.");let t=new URL(de().actionPath(e.pathname),re(e.requestUrl,e.requestHeaders));return t.search="",t.hash="",t.toString()}n(Qv,"buildEndpointAudience");function eC(e){return e instanceof Yn.JWTExpired?"expired":e instanceof Yn.JWTClaimValidationFailed?"claim":e instanceof Yn.JWSSignatureVerificationFailed?"signature":e instanceof Yn.JWKSNoMatchingKey?"jwks_no_match":e instanceof Yn.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(eC,"readJwtFailureKind");async function tC(e){let{response:t,json:r}=await Ap(e.jwksUri,{headers:{accept:"application/json"}},{context:e.context,maxRedirects:Dv,maxResponseBytes:$v,timeoutMs:Nv});if(!t.ok)throw new R("invalid_client","Client JWKS could not be fetched.");return Jv.parse(r)}n(tC,"fetchClientJwks");async function rC(e){if(e.clientAssertionType!==zo||e.clientAssertion===void 0)throw new R("invalid_request","private_key_jwt client authentication requires a JWT bearer client_assertion and client_assertion_type.");let t=Ve.parse(e.clientId),r=await mi(t,e.now);if(r.metadata.token_endpoint_auth_method!=="private_key_jwt")throw new R("invalid_client","Client is not registered for private_key_jwt authentication.");let o=r.metadata.jwks_uri;if(o===void 0)throw new R("invalid_client","Client JWKS URI is required for private_key_jwt authentication.");let i=Qv({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,pathname:e.endpointPathname});try{let s=await tC({jwksUri:o,context:e.context}),{payload:a}=await Mv(e.clientAssertion,qv(s),{issuer:t,subject:t,audience:i,currentDate:e.now}),c=Math.floor(e.now.getTime()/1e3)+Lv;if(typeof a.exp!="number"||a.exp>c)throw new R("invalid_client","Client authentication failed.")}catch(s){throw e.context?.log.warn({event:"oauth_private_key_jwt_client_auth_failed",clientId:t,failureKind:eC(s)},"OAuth private_key_jwt client authentication failed"),new R("invalid_client","Client authentication failed.")}return{method:"private_key_jwt",clientId:t}}n(rC,"verifyPrivateKeyJwtClientAssertion");async function nC(e){let t=Ve.parse(e.clientId);if(Xu(t))throw new R("invalid_client","Client is registered for private_key_jwt authentication.");return e.clientSecret===void 0?{method:"none",clientId:t}:{method:e.clientSecretSource==="post"?"client_secret_post":"client_secret_basic",clientId:t,clientSecretHashInput:await Y(e.clientSecret)}}n(nC,"buildRuntimeHttpClientAuth");async function ef(e){if(Xv({clientAssertion:e.clientAssertion,clientAssertionType:e.clientAssertionType})){if(e.basicClientSecret!==void 0||e.bodyClientSecret!==void 0)throw new R("invalid_request","Use only one client authentication method per request.");return rC(e)}let t=Yv({basicClientSecret:e.basicClientSecret,bodyClientSecret:e.bodyClientSecret});return nC({clientId:e.clientId,...t})}n(ef,"resolveRuntimeHttpClientAuth");async function tf(e){Bv(e.body);let t=Hv.parse(e.body),r=Xh(e.authorizationHeader),o=Qh({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),i=new Date,s=await ef({clientId:o,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/token",now:i,context:e.context});return oC({parsed:t,clientId:o,clientAuth:s,now:i,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,context:e.context})}n(tf,"exchangeDownstreamToken");async function oC(e){if(e.parsed.grant_type==="authorization_code"){Ur(e.parsed.redirect_uri,"invalid_request"),Or(e.parsed.scope),e.parsed.resource!==void 0&&Lt(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let c=Ke(),u=Ke(),p=$(Ge(e.now,Gv())),h=Zh(e.now,p),g=await j().exchangeAuthorizationCode({clientAuth:e.clientAuth,codeHash:await Y(e.parsed.code),redirectUri:e.parsed.redirect_uri,resource:e.parsed.resource,codeChallenge:await $o(e.parsed.code_verifier),currentRefreshTokenHash:await Y(c),accessTokenHash:await Y(u),grantExpiresAt:p,accessTokenExpiresAt:h.expiresAt,now:$(e.now)});if(g.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(g.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the authorization code resource.");if(g.kind!=="exchanged")throw new R("invalid_grant","Authorization code is invalid, expired, already used, or failed binding validation.");return e.context&&G(e.context,{eventType:H.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"authorization_code"}}),{access_token:u,token_type:"Bearer",expires_in:h.expiresIn,refresh_token:c,scope:g.grant.scope,resource:g.grant.resource}}if(e.parsed.grant_type===ut){Or(e.parsed.scope),Zv(e.requestHeaders);let c=await Wh({assertion:e.parsed.assertion,authenticatedClientId:e.clientId,clientAuth:e.clientAuth,requestUrl:e.requestUrl??e.parsed.resource??"",requestHeaders:e.requestHeaders,requestedResource:e.parsed.resource,now:e.now,context:e.context,config:le()}),u=Vv({claimedResource:c.claims.resource,requestedResource:e.parsed.resource}),p=Lt(e.requestUrl??u,u,e.requestHeaders),h=Kv({claimAuthorizationDetails:c.claims.authorization_details,grantedAuthorizationDetails:c.grantedAuthorizationDetails,resource:u}),g=Wv({claimScope:c.claims.scope,grantedAuthorizationDetails:h}),S=Ke(),y=$(new Date(c.claims.exp*1e3)),k=Zh(e.now,y),w=await j().issueAccessTokenForIdJag({clientAuth:e.clientAuth,accessTokenHash:await Y(S),subjectId:c.subjectId,resource:u,operationId:p.operationId,scope:g,authorizationDetails:h,accessTokenExpiresAt:k.expiresAt,now:$(e.now),idJag:{issuer:c.claims.iss,jti:c.claims.jti,tenant:c.claims.tenant,expiresAt:y}});if(w.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(w.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the ID-JAG resource.");return e.context&&G(e.context,{eventType:H.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"jwt-bearer"}}),{access_token:S,token_type:"Bearer",expires_in:k.expiresIn,scope:w.grant.scope,resource:w.grant.resource,...h===void 0?{}:{authorization_details:h}}}Or(e.parsed.scope),e.parsed.resource!==void 0&&Lt(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let t=await Y(e.parsed.refresh_token),r=e.parsed.refresh_token,o=Ke(),i=$(Ge(e.now,Yh())),s=await j().refreshToken({clientAuth:e.clientAuth,currentRefreshTokenHash:t,nextRefreshTokenHash:t,accessTokenHash:await Y(o),resource:e.parsed.resource,accessTokenExpiresAt:i,now:$(e.now)});if(s.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(s.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the refresh token grant resource.");if(s.kind!=="rotated")throw new R("invalid_grant","Refresh token is invalid, expired, or revoked.");Lt(e.requestUrl??s.grant.resource,s.grant.resource,e.requestHeaders);let a=s.accessToken.expiresAt;return e.context&&G(e.context,{eventType:H.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"refresh_token"}}),{access_token:o,token_type:"Bearer",expires_in:Math.max(1,Math.floor((new Date(a).getTime()-e.now.getTime())/1e3)),refresh_token:r,scope:s.grant.scope,resource:s.grant.resource}}n(oC,"exchangeDownstreamTokenWithRuntimeHttp");async function rf(e){let t=Fv.parse(e.body),r=Xh(e.authorizationHeader),o=Qh({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),i=new Date;if((await j().revokeOAuthToken({clientAuth:await ef({clientId:o,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/revoke",now:i,context:e.context}),tokenHash:await Y(t.token),now:$(i)})).kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");e.context?.log.info({event:"oauth_token_revoked",clientId:o,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}},"OAuth token revocation request processed"),e.context&&G(e.context,{eventType:H.MCP_OAUTH_TOKEN_REVOKED,outcome:"success",attributes:{clientId:o,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}}})}n(rf,"revokeDownstreamToken");var iC=64*1024,sC=16*1024,aC="text/html; charset=utf-8";function cC(e){let t={};for(let[r,o]of e.entries())t[r]=o;return t}n(cC,"formDataToObject");async function dC(e){return $m(e,{maxBytes:iC,label:"Request body"})}n(dC,"readJsonBody");async function la(e){return cC(await Dm(e,{maxBytes:sC,label:"Request body"}))}n(la,"readFormBody");async function of(e,t,r){let o=Je(r),i=r instanceof l.ZodError?wt(r):void 0,s={code:o??(r instanceof l.ZodError?"invalid_request":"internal_server_error")};return i!==void 0&&(s.detail=i),xo(e,t,s)}n(of,"handleProblem");function sf(e){return e?.requestId}n(sf,"readBrowserRequestId");function af(e){if(!(e instanceof v))return;let t=e.extensionMembers?.[gr];return typeof t=="string"?t:void 0}n(af,"readUpstreamHtmlError");function nf(e,t){let r=e.extensionMembers?.[t];return typeof r=="string"?r:void 0}n(nf,"readRuntimeErrorExtensionString");function uC(e,t){let r=e.extensionMembers?.[t];return typeof r=="number"?r:void 0}n(uC,"readRuntimeErrorExtensionNumber");function lC(e){try{return new URL(e.url).pathname}catch{return}}n(lC,"readBrowserRequestPath");function Ht(e){let t={code:e.code,requestId:e.requestId,routePath:lC(e.request),underlyingError:e.underlyingError};return e.error instanceof v&&(t.httpStatus=uC(e.error,at),t.contentType=nf(e.error,fr),t.upstreamUrl=nf(e.error,ct)),t}n(Ht,"buildBrowserErrorDiagnostic");function Xn(e){let t=new Headers(e.headers);t.set("cache-control","no-store"),t.set("pragma","no-cache");let r={error:e.error};return e.errorDescription!==void 0&&(r.error_description=e.errorDescription),Response.json(r,{status:e.status??400,headers:t})}n(Xn,"oauthErrorResponse");function pC(e,t){return e.errorCode!=="invalid_client"?{}:t.includeInvalidClientChallenge===!1?{}:{"WWW-Authenticate":'Basic realm="OAuth"'}}n(pC,"readOAuthProtocolHeaders");function mC(e,t){let r=Oe("internal_server_error");return Xn({error:e.errorCode,errorDescription:e.errorCode==="server_error"?r.publicDetail:e.message,status:e.status,headers:pC(e,t)})}n(mC,"oauthProtocolErrorResponse");function ua(e){return e.issues[0]?.path.includes("resource")===!0?"invalid_target":"invalid_request"}n(ua,"readZodOAuthErrorCode");function hC(e){let t={error:ua(e)},r=wt(e);return r!==void 0&&(t.errorDescription=r),Xn(t)}n(hC,"oauthZodErrorResponse");function fC(e){let t=Je(e);if(t===void 0)return;let r=Oe(t);if(r.oauthError===void 0)return;let o={error:r.oauthError,status:yC(r.oauthError)};return r.oauthError==="server_error"?o.errorDescription=r.publicDetail:e instanceof Error?o.errorDescription=e.message:o.errorDescription=r.publicDetail,Xn(o)}n(fC,"oauthGatewayProblemResponse");function gC(){let t={error:"server_error",status:500,errorDescription:Oe("internal_server_error").publicDetail};return Xn(t)}n(gC,"oauthFallbackErrorResponse");function yC(e){switch(e){case"invalid_client":return 401;case"server_error":return 500;default:return 400}}n(yC,"readOAuthStatus");function pa(e,t={}){return e instanceof _t?uf(e):e instanceof R?mC(e,t):e instanceof l.ZodError?hC(e):fC(e)??gC()}n(pa,"oauthProblemResponse");function ma(e,t,r){let o=Er(e.url),i=sf(t);if(r instanceof _t)return uf(r);if(r instanceof R){let c=Oe("internal_server_error");return De({host:o,kind:SC(r.errorCode),title:"Authorization failed",detail:r.errorCode==="server_error"?c.publicDetail:r.message,developerDetail:r.errorCode==="server_error"?c.publicDetail:r.message,code:r.errorCode,diagnostic:Ht({request:e,requestId:i,code:r.errorCode,underlyingError:r.errorCode==="server_error"?c.publicDetail:r.message,error:r}),requestId:i,status:r.status})}if(r instanceof l.ZodError)return De({host:o,kind:"invalid_request",detail:wt(r)??"The authorization request was invalid.",developerDetail:wt(r)??"The authorization request was invalid.",code:ua(r),diagnostic:Ht({request:e,requestId:i,code:ua(r),underlyingError:wt(r)??"The authorization request was invalid.",error:r}),requestId:i});let s=Je(r);if(s!==void 0){let c=Oe(s);return De({host:o,kind:df(s),detail:c.publicDetail,developerDetail:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,code:s,diagnostic:Ht({request:e,requestId:i,code:s,underlyingError:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,error:r}),requestId:i,upstreamHtml:af(r),status:c.status})}let a=Oe("internal_server_error");return De({host:o,kind:"internal_error",detail:a.publicDetail,developerDetail:a.publicDetail,code:"server_error",diagnostic:Ht({request:e,requestId:i,code:"server_error",underlyingError:a.publicDetail,error:r}),requestId:i,status:a.status})}n(ma,"browserOAuthProblemResponse");function cf(e,t,r){let o=Er(e.url),i=sf(t),s=Je(r);if(s!==void 0){let c=Oe(s);return De({host:o,kind:df(s),detail:c.publicDetail,developerDetail:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,code:s,diagnostic:Ht({request:e,requestId:i,code:s,underlyingError:c.status>=500||!(r instanceof Error)?c.publicDetail:r.message,error:r}),requestId:i,upstreamHtml:af(r),status:c.status})}if(r instanceof l.ZodError)return De({host:o,kind:"invalid_request",detail:wt(r)??"The authorization request was invalid.",developerDetail:wt(r)??"The authorization request was invalid.",code:"invalid_request",diagnostic:Ht({request:e,requestId:i,code:"invalid_request",underlyingError:wt(r)??"The authorization request was invalid.",error:r}),requestId:i});let a=Oe("internal_server_error");return De({host:o,kind:"internal_error",detail:a.publicDetail,developerDetail:a.publicDetail,code:"internal_server_error",diagnostic:Ht({request:e,requestId:i,code:"internal_server_error",underlyingError:a.publicDetail,error:r}),requestId:i,status:a.status})}n(cf,"browserGatewayProblemResponse");function SC(e){return e==="server_error"?"internal_error":"invalid_request"}n(SC,"readOAuthBrowserErrorKind");function df(e){if(Oe(e).status>=500)return"internal_error";switch(e){case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"configuration_error";case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"upstream_oauth_discovery_unavailable":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"invalid_request":case"authentication_required":case"forbidden":case"not_found":case"too_many_requests":case"identity_context_missing":return"invalid_request";case"upstream_capability_invocation_failed":case"upstream_capability_unavailable":case"upstream_import_failed":return"connection_failed";case"internal_server_error":return"internal_error"}return"authorization_failed"}n(df,"readGatewayBrowserErrorKind");function Xe(e,t,r){let o={event:t},i=!1;if(r instanceof R)o.oauthError=r.errorCode,o.status=r.status,pe(o,"error",r);else if(r instanceof _t)o.oauthError=r.errorCode,pe(o,"error",r);else if(r instanceof l.ZodError){o.code="invalid_request",pe(o,"error",r);let s=r.issues[0];s&&(o.zodPath=s.path.join("."))}else{let s=Je(r);if(s!==void 0){let a=Oe(s);o.code=s,o.status=a.status,a.oauthError!==void 0&&(o.oauthError=a.oauthError),i=a.status>=500||a.oauthError==="server_error",pe(o,"error",r)}else i=!0,pe(o,"error",r)}if(i){let s=r instanceof Error?r:new Error("Non-Error thrown from OAuth handler",{cause:r});e.log.error(o,s.message)}else e.log.warn(o,"OAuth handler rejected the request")}n(Xe,"logUnexpectedOAuthHandlerError");function uf(e){let t;try{t=new URL(e.redirectUri)}catch{return Xn({error:e.errorCode,...e.errorDescription===void 0?{}:{errorDescription:e.errorDescription}})}t.searchParams.set("error",e.errorCode),e.errorDescription!==void 0&&t.searchParams.set("error_description",e.errorDescription),e.clientState!==void 0&&t.searchParams.set("state",e.clientState);let r=new Headers({location:t.toString(),"cache-control":"no-store"});return new Response(null,{status:302,headers:r})}n(uf,"downstreamAuthorizeRedirectErrorResponse");function wt(e){let t=e.issues[0];if(!t)return;let r=t.path.join(".");return r?`${r}: ${t.message}`:t.message}n(wt,"formatZodErrorDetail");function _C(e,t){let r={event:"browser_login_callback_failed",code:Je(t)??"invalid_request"};pe(r,"error",t),e.log.warn(r,"Browser login callback failed; client received a connection-failure page")}n(_C,"logBrowserLoginCallbackFailure");function lf(e){e.location.hash||(e.location.hash="#");let t=new Headers({location:e.location.toString(),"cache-control":"no-store"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(null,{status:302,headers:t})}n(lf,"redirectResultResponse");function fi(e){if(e.kind==="setup_page"){let t=new Headers({"content-type":aC,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(e.html,{status:200,headers:t})}return lf(e)}n(fi,"authorizeResultResponse");async function pf(e,t){try{return Response.json(Hu(e.url,e.headers))}catch(r){return Xe(t,"oauth_authorization_server_metadata_failed",r),of(e,t,r)}}n(pf,"authorizationServerMetadataHandler");async function mf(e,t){try{let r=Fi(e.params.routePath);return Response.json(Bu({operationId:r.operationId,requestUrl:e.url,requestHeaders:e.headers}))}catch(r){return Xe(t,"oauth_authorization_server_metadata_failed",r),of(e,t,r)}}n(mf,"scopedAuthorizationServerMetadataHandler");async function hf(e,t){try{let r=await _h(await dC(e)),o=r.client_id,i=r.client_name,s=r.redirect_uris.length,a=r.token_endpoint_auth_method;return t.log.info({event:"oauth_dcr_client_registered",clientId:o,clientName:i,redirectUriCount:s,tokenEndpointAuthMethod:a},"OAuth Dynamic Client Registration completed"),G(t,{eventType:H.MCP_OAUTH_CLIENT_REGISTERED,outcome:"success",clientName:i,attributes:{clientId:o,redirectUriCount:s,tokenEndpointAuthMethod:a}}),Response.json(r,{status:201,headers:{"cache-control":"no-store"}})}catch(r){return Xe(t,"oauth_register_failed",r),pa(r)}}n(hf,"registerHandler");async function ff(e,t){try{return fi(await ca(e,{context:t}))}catch(r){return Xe(t,"oauth_authorize_failed",r),ma(e,t,r)}}n(ff,"authorizeHandler");async function gf(e,t){try{let r=Fi(e.params.routePath);return fi(await ca(e,{operationId:r.operationId,context:t}))}catch(r){return Xe(t,"oauth_authorize_scoped_failed",r),ma(e,t,r)}}n(gf,"scopedAuthorizeHandler");async function yf(e,t){try{let r=await Lh(e,{context:t});return t.log.info({event:"browser_login_callback_completed",resultKind:r.kind},"Browser login callback completed; consent setup rendered"),fi(r)}catch(r){return _C(t,r),cf(e,t,r)}}n(yf,"callbackHandler");async function Sf(e,t){try{return lf(await Hh(e))}catch(r){return Xe(t,"oauth_dev_login_failed",r),ma(e,t,r)}}n(Sf,"devLoginHandler");async function _f(e,t){try{if(!["GET","POST"].includes(e.method))return new Response(null,{status:405,headers:{allow:"GET, POST"}});let r=await Bh({request:e,body:e.method==="POST"?await la(e):void 0,context:t});return fi(r)}catch(r){return Xe(t,"oauth_setup_failed",r),cf(e,t,r)}}n(_f,"setupHandler");async function wf(e,t){try{return Response.json(await tf({body:await la(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),{headers:{"cache-control":"no-store",pragma:"no-cache"}})}catch(r){return Xe(t,"oauth_token_failed",r),pa(r)}}n(wf,"tokenHandler");async function Rf(e,t){try{return await rf({body:await la(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),new Response(null,{status:200,headers:{"cache-control":"no-store"}})}catch(r){return Xe(t,"oauth_revoke_failed",r),pa(r)}}n(Rf,"revokeHandler");function bf(e){return B`<p data-gateway-error-code="${e.code}">${e.body}</p>`}n(bf,"renderBrowserResult");var wC="text/html; charset=utf-8",RC="none";function bC(e){let t=Is(e.host);return Pr({title:e.title,iconHref:t,styles:Ar,headerIcon:hi({iconHref:t,fallbackIconHref:Yo}),heading:e.title,subhead:"",body:bf({body:e.body,code:e.code??RC}),footer:""})}n(bC,"browserResultHtml");function vC(e,t=200){return new Response(kr(e),{status:t,headers:{"content-type":wC,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}n(vC,"browserResultResponse");function vf(e){return vC(bC(e))}n(vf,"browserConnectionSuccessResponse");function gi(e,t,r={}){let o=Cu(t);return De({host:e,kind:CC(t),detail:o.body,developerDetail:r.developerDetail,code:t,diagnostic:r.diagnostic,upstreamHtml:r.upstreamHtml})}n(gi,"browserConnectionFailureResponse");function CC(e){switch(e){case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"upstream_oauth_discovery_unavailable":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required"}}n(CC,"readCallbackFailureBrowserErrorKind");var IC={connect:"Connect",callback_authorization_code:"Callback",callback_provider_error:"Callback",callback_invalid:"Callback",client_metadata:"Client metadata"},Cf=Symbol("upstream-request");function Qn(e,t){Object.defineProperty(e,Cf,{configurable:!0,value:t})}n(Qn,"setUpstreamRequestContext");function TC(e){let t=e[Cf];if(!t)throw new ke("Upstream request context has not been set");return t}n(TC,"readUpstreamRequestContext");function kC(e,t){return t.some(r=>r===e)}n(kC,"requestContextMatchesKind");function AC(e){return typeof e=="string"?[e]:e}n(AC,"toExpectedKinds");function eo(e,t){let r=TC(e),o=AC(t);if(!kC(r.kind,o)){let i=IC[o[0]];throw new ke(`${i} request context has not been set`)}return r}n(eo,"requireUpstreamRequestContext");function Rt(e){if(typeof e=="string"&&e.length!==0)return e}n(Rt,"readOptionalQueryString");function PC(e,t){let r=e.params[t];if(typeof r!="string"||r.length===0)throw new ke(`Validated path parameter ${t} is missing`);return EC(r,t)}n(PC,"requirePathString");function EC(e,t){try{return decodeURIComponent(e)}catch(r){throw new v({message:`Path parameter "${t}" must be valid URL encoding.`,extensionMembers:{[I]:"invalid_request"}},{cause:r})}}n(EC,"decodePathString");function xC(e){let t=Rt(e);return t?Uo.parse(t):void 0}n(xC,"readOptionalOperationId");function UC(e){let t=Ae().connectionsById.get(e);if(t!==void 0)return t.authProfileId;throw new v({message:`No upstream connection is registered for ${e}.`,extensionMembers:{[I]:"unknown_upstream_server"}})}n(UC,"readRegisteredAuthProfileId");function OC(e){let t=xC(e);if(!t)throw new v({message:"operationId query parameter is required.",extensionMembers:{[I]:"invalid_request"}});return t}n(OC,"readRequiredOperationId");async function qC(e,t){let r=ai(t,OC(e.query.operationId));if(r.authMode==="id-jag")throw new v({message:"This upstream uses XAA / ID-JAG and does not support browser OAuth connection flows.",extensionMembers:{[I]:"invalid_request"}});let o=e.query.redirect==="true",i=Rt(e.query.browserTicket);if(e.user){if(i)throw new v({message:"Use either an authenticated gateway request or a browser connect ticket, not both.",extensionMembers:{[I]:"invalid_request"}});let c=Nt(e.user,e.url),u={kind:"connect",...Tr(r,c.subjectId),redirect:o},p=Au(Rt(e.query.returnTo));return p!==void 0&&(u.returnTo=p),u}if(!i)throw new v({message:"Authentication is required to start the upstream connection flow.",extensionMembers:{[I]:"authentication_required"}});let s=await Fp(i);if(s.ownerMode!==r.ownerMode||s.upstreamServerId!==r.upstreamServerId||s.authProfileId!==r.authProfileId||s.operationId!==r.operationId)throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[I]:"oauth_callback_mismatch"}});await Jp(s);let a=Oo(s);switch(r.authMode){case"shared-oauth":{if(a.mode!=="shared")throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[I]:"oauth_callback_mismatch"}});let c={kind:"connect",...r,authMode:"shared-oauth",ownerMode:"shared",owner:a,initiatedBySubjectId:s.initiatedBySubjectId,redirect:o};return s.returnTo!==void 0&&(c.returnTo=s.returnTo),c}case"user-oauth":{if(a.mode!=="user")throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[I]:"oauth_callback_mismatch"}});let c={kind:"connect",...r,authMode:"user-oauth",ownerMode:"user",owner:a,initiatedBySubjectId:s.initiatedBySubjectId,redirect:o};return s.returnTo!==void 0&&(c.returnTo=s.returnTo),c}}}n(qC,"resolveConnectContext");async function zC(e,t,r){let o=ku.parse(PC(e,"connection"));switch(r){case"connect":Qn(e,await qC(e,o));return;case"callback":{let i=Rt(e.query.error);if(i){let c={kind:"callback_provider_error",upstreamServerId:o,error:i},u=Rt(e.query.error_description);u!==void 0&&(c.errorDescription=u),Qn(e,c);return}let s=Rt(e.query.code),a=Rt(e.query.state);if(s&&a){let c=Rt(e.query.iss);Qn(e,{kind:"callback_authorization_code",upstreamServerId:o,code:s,state:a,...c===void 0?{}:{iss:c}});return}Qn(e,{kind:"callback_invalid",upstreamServerId:o});return}case"client_metadata":Qn(e,{kind:"client_metadata",upstreamServerId:o,authProfileId:UC(o)});return}}n(zC,"resolveUpstreamRequestInbound");async function MC(e,t,r){try{await zC(e,t,r);return}catch(o){let i=o instanceof v?o.extensionMembers?.[I]:void 0,s=o instanceof Error?o.message:void 0;switch(i){case"invalid_request":case"unknown_upstream_server":case"oauth_callback_mismatch":return zt.badRequest(e,t,{code:i,detail:s});case"authentication_required":return zt.unauthorized(e,t,{code:i,detail:s});default:throw o}}}n(MC,"applyUpstreamRequestContext");function yi(e,t){return n(async(o,i)=>{let s=await MC(o,i,e);return s||t(o,i)},"wrapped")}n(yi,"withUpstreamRequestContext");var jC=["callback_authorization_code","callback_provider_error","callback_invalid"];function ha(e){try{return new URL(e.url).pathname}catch{return}}n(ha,"readBrowserRequestPath");function NC(e){return"cause"in e?e.cause:void 0}n(NC,"readErrorCause");function $C(e){return e.stack?.split(`
+`).slice(1,4).map(t=>t.trim()).join(" | ")}n($C,"readFirstStackFrame");function If(e,t,r){r instanceof Error&&(e[`${t}Name`]=r.name,e[`${t}Message`]=r.message,e[`${t}StackFrame`]=$C(r))}n(If,"addErrorAttributes");function fa(e){if(!(e instanceof v))return;let t=e.extensionMembers?.[I];return Eo(t)?t:void 0}n(fa,"readRuntimeGatewayCode");function Tf(e,t){let r=e.extensionMembers?.[t];return typeof r=="string"?r:void 0}n(Tf,"readRuntimeErrorExtensionString");function DC(e,t){let r=e.extensionMembers?.[t];return typeof r=="number"?r:void 0}n(DC,"readRuntimeErrorExtensionNumber");function LC(e,t,r,o){switch(r.kind){case"callback_provider_error":return t.log.warn({event:"upstream_oauth_provider_error",code:"provider_access_denied",upstreamServerId:r.upstreamServerId,providerError:r.error,...r.errorDescription===void 0?{}:{providerErrorDescription:r.errorDescription.slice(0,256)}},"Upstream identity provider returned an error to the OAuth callback"),G(t,{eventType:H.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED,outcome:"failure",upstreamServerName:r.upstreamServerId,reasonCode:"provider_access_denied",reasonClass:"auth",attributes:{error:r.error,errorDescription:r.errorDescription}}),gi(o,"provider_access_denied",{developerDetail:r.errorDescription??r.error,diagnostic:{code:"provider_access_denied",requestId:t.requestId,routePath:ha(e),upstreamServerId:r.upstreamServerId,providerError:r.error,providerErrorDescription:r.errorDescription,underlyingError:r.errorDescription??r.error}});case"callback_invalid":return t.log.warn({event:"upstream_oauth_callback_invalid",code:"oauth_state_invalid",upstreamServerId:r.upstreamServerId},"Upstream OAuth callback request missing required code/state parameters"),gi(o,"oauth_state_invalid",{diagnostic:{code:"oauth_state_invalid",requestId:t.requestId,routePath:ha(e),upstreamServerId:r.upstreamServerId}});case"callback_authorization_code":return r}}n(LC,"requireAuthorizationCallbackRequest");function HC(e,t){G(e,{eventType:H.MCP_AUTH_UPSTREAM_CALLBACK_RECEIVED,outcome:"success",upstreamServerName:t.upstreamServerId})}n(HC,"emitCallbackReceivedAnalyticsEvent");function BC(e,t){G(e,{eventType:H.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_SUCCEEDED,outcome:"success",upstreamServerName:t.upstreamServerId,virtualServerName:t.operationId})}n(BC,"emitTokenExchangeSucceededAnalyticsEvent");function FC(e,t){if(t.returnTo){let r=t.returnOrigin??e.url;return Response.redirect(new URL(t.returnTo,r).toString(),302)}return vf({host:Er(e.url),title:"Connection complete",body:"The upstream authorization flow completed successfully. You can return to your MCP client."})}n(FC,"buildSuccessfulCallbackResponse");function JC(e){let t={detail:e instanceof Error?e.message:void 0};return If(t,"error",e),e instanceof Error&&If(t,"cause",NC(e)),t}n(JC,"buildTokenExchangeFailureAttributes");function GC(e){G(e.context,{eventType:H.MCP_AUTH_UPSTREAM_TOKEN_EXCHANGE_FAILED,outcome:"failure",upstreamServerName:e.callbackRequest.upstreamServerId,reasonCode:fa(e.error)??"token_exchange_failed",reasonClass:"auth",errorType:e.error instanceof Error?e.error.name:"unknown",attributes:JC(e.error)})}n(GC,"emitTokenExchangeFailedAnalyticsEvent");function VC(e){let t=e.error,r=fa(t),o=vu(r)?r:"upstream_token_exchange_failed",i={code:o,requestId:e.context.requestId,routePath:ha(e.request),upstreamServerId:e.callbackRequest.upstreamServerId,underlyingError:t instanceof Error?t.message:void 0,...t instanceof v?{httpStatus:DC(t,at),contentType:Tf(t,fr),upstreamUrl:Tf(t,ct)}:{}};return gi(e.host,o,{developerDetail:t instanceof Error?t.message:void 0,diagnostic:i,upstreamHtml:KC(t)})}n(VC,"tokenExchangeFailureResponse");function KC(e){if(!(e instanceof v))return;let t=e.extensionMembers?.[gr];return typeof t=="string"?t:void 0}n(KC,"readUpstreamHtmlError");async function ga(e,t){let r=eo(e,jC),o=Er(e.url),i=LC(e,t,r,o);if(i instanceof Response)return i;HC(t,i);try{let s=await Am({request:e,callbackRequest:i});return BC(t,s),t.log.info({event:"upstream_oauth_token_exchange_succeeded",upstreamServerId:s.upstreamServerId,operationId:s.operationId,authProfileId:s.authProfileId,ownerMode:s.ownerMode},"Upstream OAuth token exchange completed; user connection established"),FC(e,s)}catch(s){let a={event:"upstream_oauth_token_exchange_failed",code:fa(s)??"upstream_token_exchange_failed",upstreamServerId:i.upstreamServerId};return pe(a,"error",s),t.log.warn(a,"Upstream OAuth token exchange failed; user shown connection-failure page"),GC({context:t,callbackRequest:i,error:s}),VC({request:e,context:t,host:o,callbackRequest:i,error:s})}}n(ga,"callbackHandler");function WC(e){return(e instanceof Error?e.message:void 0)??"The requested upstream client metadata document was not found."}n(WC,"clientMetadataProblemDetail");async function kf(e,t){let r=eo(e,"connect"),o=await km({request:e,connectRequest:r});if(G(t,{eventType:H.MCP_AUTH_UPSTREAM_CONNECT_STARTED,outcome:"success",upstreamServerName:r.upstreamServerId,virtualServerName:o.operationId,upstreamServerTitle:o.upstreamDisplayName}),t.log.info({event:"upstream_connect_started",upstreamServerId:r.upstreamServerId,authProfileId:o.authProfileId,operationId:o.operationId,ownerMode:r.ownerMode,redirect:r.redirect,hasReturnTo:r.returnTo!==void 0},"Upstream OAuth connect flow started"),r.redirect)return Response.redirect(o.authUrl,302);let i=await ni({requestUrl:e.url,requestHeaders:e.headers,owner:o.owner,initiatedBySubjectId:o.initiatedBySubjectId,upstreamServerId:r.upstreamServerId,authProfileId:o.authProfileId,upstreamDisplayName:o.upstreamDisplayName,operationId:o.operationId,subject:"MCP route",...r.returnTo===void 0?{}:{returnTo:r.returnTo}});return Response.json(i,{status:428})}n(kf,"connectHandler");async function Af(e,t){let r=eo(e,"client_metadata");try{let o=re(e.url,e.headers),i=Qp(o,r.upstreamServerId,r.authProfileId);return Response.json(i)}catch(o){if(!(o instanceof K))throw o;let i=o instanceof Error?o.message:String(o);return t.log.warn({event:"oauth_client_metadata_request_failed",upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,errorMessage:i},"Failed to serve OAuth client metadata document for upstream connection"),zt.notFound(e,t,{code:"not_found",detail:WC(o)})}}n(Af,"oauthClientMetadataHandler");function ZC(e,t){return e.mount==="root"?e.path:t.actionPath(e.path)}n(ZC,"resolveInternalRoutePath");var YC={"access-control-allow-origin":"*","access-control-allow-methods":"GET, OPTIONS","access-control-allow-headers":"content-type, authorization","access-control-max-age":"86400"};function XC(){return new Response(null,{status:204,headers:YC})}n(XC,"buildWellKnownPreflightResponse");function QC(e){let t=new Headers(e.headers);return t.set("access-control-allow-origin","*"),new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}n(QC,"withWellKnownCorsHeaders");function ya(e){return async(t,r)=>t.method==="OPTIONS"?XC():QC(await e(t,r))}n(ya,"wrapWellKnownHandler");var xf=[{routeName:"oauth_as_metadata",mount:"root",path:"/.well-known/oauth-authorization-server",methods:["GET","OPTIONS"],handler:ya(pf),corsPolicy:"anything-goes"},{routeName:"oauth_as_metadata_scoped",mount:"root",path:"/.well-known/oauth-authorization-server/:routePath*",methods:["GET","OPTIONS"],handler:ya(mf),corsPolicy:"anything-goes"},{routeName:"oauth_protected_resource_metadata",mount:"root",path:"/.well-known/oauth-protected-resource/:routePath*",methods:["GET","OPTIONS"],handler:ya(Fu),corsPolicy:"anything-goes"},{routeName:"oauth_register",mount:"action",path:"/oauth/register",methods:["POST"],handler:hf},{routeName:"oauth_authorize",mount:"action",path:"/oauth/authorize",methods:["GET"],handler:ff},{routeName:"oauth_authorize_scoped",mount:"action",path:"/oauth/authorize/:routePath*",methods:["GET"],handler:gf},{routeName:"oauth_callback",mount:"action",path:"/oauth/callback",methods:["GET"],handler:yf},{routeName:"oauth_dev_login",mount:"action",path:"/oauth/dev-login",methods:["GET"],handler:Sf},{routeName:"oauth_setup",mount:"action",path:"/oauth/setup",methods:["GET","POST"],handler:_f},{routeName:"oauth_token",mount:"action",path:"/oauth/token",methods:["POST"],handler:wf},{routeName:"oauth_revoke",mount:"action",path:"/oauth/revoke",methods:["POST"],handler:Rf},{routeName:"upstream_client_metadata",mount:"action",path:"/.well-known/oauth-client/:connection",methods:["GET"],handler:yi("client_metadata",Af)},{routeName:"upstream_connect",mount:"action",path:"/auth/connections/:connection/connect",methods:["GET"],handler:yi("connect",kf)},{routeName:"upstream_callback",mount:"action",path:"/auth/connections/:connection/callback",methods:["GET"],handler:yi("callback",ga)}],eI=xf.filter(e=>!e.routeName.startsWith("upstream_")),tI=xf.filter(e=>e.routeName.startsWith("upstream_"));function rI(e){let t=Ou({routes:e.routes,policies:e.policies,gateway:e.gateway});return qu(t),t}n(rI,"initializeMcpGatewayConnectionRegistry");function nI(e){return[...e.byOperationId.values()].some(t=>t.downstreamOAuth!==void 0)}n(nI,"hasDownstreamOAuthRoutes");function oI(e){return[...e.byOperationId.values()].some(t=>t.downstreamOAuth?.config.idJag.enabled===!0)}n(oI,"hasIdJagDownstreamOAuth");function iI(e){let t=new Map;for(let o of e.byOperationId.values())o.downstreamOAuth&&t.set(o.downstreamOAuth.policyName,o.downstreamOAuth.config);if(t.size===1)return[...t.values()][0];let r=[...t.keys()].map(o=>`"${o}"`).join(", ");throw new K(`MCP gateway found multiple attached OAuth policies: ${r}. Multiple downstream MCP OAuth configs in one gateway are not supported yet; use one MCP OAuth policy across MCP routes or split these routes into separate gateways.`)}n(iI,"readSingletonDownstreamOAuthConfig");function sI(e,t,r){let o=String(t.params.routePath??""),i=e.byRoutePath.get($u(o));if(i===void 0)return;let s=i?.downstreamOAuth?.config;return s===void 0?xo(t,r,{code:"not_found",detail:"The requested MCP route does not expose downstream OAuth."}):s}n(sI,"readScopedDownstreamOAuthConfig");function aI(e){return e.path==="/.well-known/oauth-authorization-server/:routePath*"||e.path==="/.well-known/oauth-protected-resource/:routePath*"||e.path==="/oauth/authorize/:routePath*"}n(aI,"routeUsesScopedOAuthConfig");function Pf(e,t,r){return async(o,i)=>{if(i.log.setLogProperties?.({requestId:i.requestId}),r){let u=await r(o,i);if(u instanceof Response)return u;u&&wu(i,u)}let s=o.method==="OPTIONS",a=Date.now();s||i.log.info({event:`${e}_received`,method:o.method},`MCP gateway: ${e} received`);let c=await t(o,i);return s||i.log.info({event:`${e}_responded`,status:c.status,durationMs:Date.now()-a},`MCP gateway: ${e} responded`),c}}n(Pf,"wrapInternalHandler");function Ef(e,t,r,o){e.addPluginRoute({path:ZC(t,r),methods:t.methods,handler:o,processors:[va],corsPolicy:t.corsPolicy??"none"})}n(Ef,"addInternalRoute");function Uf(e,t){let r=rI(t),o=nI(r),i=r.connectionsById.size>0,s,a=n(()=>(s===void 0&&(s=iI(r)),s),"readSingletonOAuthConfig");if(o){Fe("plugin.mcp-gateway.downstream-oauth"),oI(r)&&Fe("plugin.mcp-gateway.downstream-oauth.id-jag");for(let c of eI){let u=aI(c)?(p,h)=>sI(r,p,h):a;Ef(e,c,r.gateway,Pf(c.routeName,c.handler,u))}}if(i){Fe("plugin.mcp-gateway.upstream-auth");for(let c of r.connectionsById.values())Fe(`plugin.mcp-gateway.upstream-auth.${c.authMode}`);for(let c of tI)Ef(e,c,r.gateway,Pf(c.routeName,c.handler))}}n(Uf,"registerMcpGatewayInternalRoutes");var Sa=class extends Ra{static{n(this,"McpGatewayPlugin")}#e;constructor(t={}){super(),Fe("plugin.mcp-gateway"),this.#e=Ru(t)}registerRoutes(t){let r=t.parsedRouteData;r&&Uf(t.router,{routes:r.routes,policies:r.policies,gateway:this.#e})}};var cI=new TextDecoder;function dI(e){if(e)try{return JSON.parse(cI.decode(e))}catch{return}}n(dI,"readBodyJson");function Qe(e){return e&&typeof e=="object"?e:void 0}n(Qe,"readRecord");function to(e,t){let r=Qe(e)?.[t];return typeof r=="string"?r:void 0}n(to,"readStringProperty");function qf(e,t){let r=Qe(e)?.[t];return typeof r=="number"?r:void 0}n(qf,"readNumberProperty");function Of(e,t){return qf(e,"code")??(t.status>=400?t.status:void 0)}n(Of,"readErrorCode");function zf(e){return Array.isArray(e)?e.map(zf).find(t=>t?.method):Qe(e)}n(zf,"readJsonRpcMessage");function Mf(e){let t=zf(dI(e)),r=typeof t?.method=="string"?t.method:"",o=t?.params;switch(r){case"tools/list":return{mcpMethod:r,capabilityType:"tool"};case"tools/call":return{mcpMethod:r,capabilityType:"tool",capabilityName:to(o,"name")};case"prompts/list":return{mcpMethod:r,capabilityType:"prompt"};case"prompts/get":return{mcpMethod:r,capabilityType:"prompt",capabilityName:to(o,"name")};case"resources/list":case"resources/templates/list":return{mcpMethod:r,capabilityType:"resource"};case"resources/read":{let i=to(o,"uri");return{mcpMethod:r,capabilityType:"resource",capabilityName:i,resourceUri:i}}default:return null}}n(Mf,"buildBaseCapabilityInput");function jf(e){return e==="tools/list"||e==="prompts/list"||e==="resources/list"||e==="resources/templates/list"}n(jf,"isCapabilityListMethod");function uI(e,t,r){let s=Qe(r)?.[e==="resources/templates/list"?"resourceTemplates":t==="tool"?"tools":t==="prompt"?"prompts":"resources"];return Array.isArray(s)?s.length:void 0}n(uI,"readItemCount");async function lI(e){try{return await e.clone().json()}catch{return}}n(lI,"readResponseJson");function Nf(e){let t=Mf(e);return!t||jf(t.mcpMethod)?null:{eventType:H.MCP_CAPABILITY_INVOKED,outcome:"success",...t}}n(Nf,"buildCapabilityInvokedAnalyticsInput");async function $f(e,t){let r=Mf(e);if(!r)return null;let o=Qe(await lI(t)),i=Qe(o?.error),s=Qe(i?.data),a=o?.result,c=r.mcpMethod==="tools/call"&&Qe(a)?.isError===!0;if(Qe(s?.connectRequired))return{eventType:H.MCP_CAPABILITY_CONNECT_REQUIRED,outcome:"connect_required",...r,httpStatusCode:t.status,reasonCode:"connect_required",reasonClass:"auth",errorType:"connect_required",errorCode:qf(i,"code"),mcpErrorType:to(i,"message")};if(jf(r.mcpMethod)){let u=t.status>=400?void 0:uI(r.mcpMethod,r.capabilityType,a);return{eventType:H.MCP_CAPABILITY_LISTED,outcome:t.status>=400||i?"failure":"success",...r,httpStatusCode:t.status,...t.status>=400||i?{reasonCode:"upstream_capability_list_failed",reasonClass:"upstream",errorType:"capability_list_error",errorCode:Of(i,t)}:{},...u===void 0?{}:{attributes:{itemCount:u}}}}return t.status>=400||i?{eventType:H.MCP_CAPABILITY_FAILED,outcome:"failure",...r,httpStatusCode:t.status,reasonCode:"upstream_capability_invocation_failed",reasonClass:"upstream",errorType:"capability_error",errorCode:Of(i,t),mcpErrorType:to(i,"message")}:{eventType:H.MCP_CAPABILITY_COMPLETED,outcome:c?"application_error":"success",...r,httpStatusCode:t.status,toolResultIsError:c,applicationError:c}}n($f,"buildCapabilityFinalAnalyticsInput");var pI={Allow:"POST"};async function mI(e){try{return await e.clone().arrayBuffer()}catch{return}}n(mI,"readRequestBody");function Df(e){try{let t=zu(e.route.path);return{virtualServerName:t.operationId,upstreamServerName:t.connection?.upstreamServerId,upstreamServerTitle:t.connection?.displayName,authProfileId:t.connection?.authProfileId,upstreamAuthMode:t.connection?.authMode}}catch{return{}}}n(Df,"readRouteAnalyticsFields");function Lf(e){return Vu(e.user,e.url,e.headers)?.subjectId}n(Lf,"readRequestSubjectId");function hI(e){let t=Nf(e.requestBody);t&&G(e.context,{...t,...Df(e.context),httpMethod:e.request.method,subjectId:Lf(e.request),transport:"http"})}n(hI,"emitCapabilityInvokedAnalytics");async function fI(e){let t=await $f(e.requestBody,e.response);t&&G(e.context,{...t,...Df(e.context),httpMethod:e.request.method,subjectId:Lf(e.request),transport:"http",latencyMs:Date.now()-e.startedAt})}n(fI,"emitCapabilityFinalAnalytics");async function gI(e,t){if(Fe("handler.mcp-gateway-proxy"),e.method==="GET")return zt.methodNotAllowed(e,t,{detail:"MCP Gateway routes support stateless Streamable HTTP requests over POST. Server-sent event GET streams are not supported."},pI);let r=Date.now(),o=await mI(e);hI({context:t,request:e,requestBody:o});let i=await yu(e,t);return await fI({context:t,request:e,requestBody:o,response:i,startedAt:r}),i}n(gI,"McpProxyHandler");export{Qf as McpAuth0OAuthInboundPolicy,bs as McpCapabilityFilterInboundPolicy,Bf as McpClerkOAuthInboundPolicy,Ff as McpCognitoOAuthInboundPolicy,Jf as McpEntraOAuthInboundPolicy,Sa as McpGatewayPlugin,Gf as McpGoogleOAuthInboundPolicy,Vf as McpKeycloakOAuthInboundPolicy,Kf as McpLogtoOAuthInboundPolicy,eg as McpOAuthInboundPolicy,Wf as McpOktaOAuthInboundPolicy,Zf as McpOneLoginOAuthInboundPolicy,Yf as McpPingOAuthInboundPolicy,gI as McpProxyHandler,Js as McpTokenExchangeInboundPolicy,Xf as McpWorkosOAuthInboundPolicy,wp as claimsCapabilityResolver};
+/*! For license information please see index.js.LEGAL.txt */
 //# sourceMappingURL=index.js.map