@zuplo/runtime 7.9.6 → 7.9.8

package/out/esm/mcp-gateway/index.js

@@ -22,7 +22,7 @@
  *  DEALINGS IN THE SOFTWARE.
  *--------------------------------------------------------------------------------------------*/
     
-import{$ as pr,$a as $c,$b as Dd,$c as Eu,$e as Sr,$f as sl,A as Va,Aa as hc,Ab as md,Ac as tu,Af as Ug,Ag as Lt,Ba as fc,Bb as hd,Bc as ru,Bf as Og,Bg as fl,C as qo,Ca as gc,Cb as fd,Cc as nu,Cf as Vu,Cg as Jn,Da as yc,Db as gd,Dc as ou,Df as Ku,Dg as gl,Ea as Sc,Eb as yd,Ec as su,Ef as Wu,Eg as Yo,Fa as _c,Fb as Sd,Fc as iu,Ff as Jo,Fg as Vn,Ga as wc,Gb as _d,Gc as au,Gf as Bn,Gg as yl,Ha as Rc,Hb as wd,Hc as cu,Hf as Zu,Hg as Sl,Ia as bc,Ib as Rd,Ic as du,If as Ir,Ig as _l,Ja as vc,Jb as bd,Jc as uu,Jf as Yu,Jg as wl,Ka as Ic,Kb as vd,Kc as lu,Kf as Qs,Kg as Rl,La as Cc,Lb as Id,Lc as pu,Lf as Xu,Lg as bl,Ma as Tc,Mb as Cd,Mc as mu,Mf as Fn,Mg as vl,Na as kc,Nb as Td,Nc as hu,Nf as Vo,Ng as Il,Oa as Bs,Ob as kd,Oc as fu,Of as Qu,Og as Xo,P as Ka,Pa as Ec,Pb as Ed,Pc as gu,Pf as el,Pg as Cl,Qa as Pc,Qb as Pd,Qc as yu,Qf as tl,Qg as Tl,Ra as Ac,Rb as Ad,Rc as Su,Rf as rl,Rg as N,Sa as xc,Sb as xd,Sc as _u,Sf as Se,Sg as J,Ta as Uc,Tb as Ud,Tc as wu,Te as $u,Tf as de,Tg as me,Ua as Oc,Ub as Od,Uc as Ru,Ue as ve,Uf as nl,Ug as Qe,Va as Mc,Vb as Md,Vc as bu,Ve as Lu,Vf as ol,Vg as X,W as No,Wa as zc,Wb as zd,Wc as vu,We as Hu,Wf as D,Wg as Qo,X as Ds,Xa as qc,Xb as Fs,Xc as Iu,Xe as Y,Xf as Ye,Xg as Mg,Y as ur,Ya as Nc,Yb as qd,Yc as Cu,Ye as Bu,Yf as Cr,Yg as zg,Z as Dn,Za as jc,Zb as Nd,Zc as Tu,Ze as yr,Zf as pe,_ as lr,_a as Dc,_b as jd,_c as ku,_e as Fu,_f as te,aa as $n,ab as Lc,ac as $d,ad as Pu,af as C,ag as W,ba as mr,bb as Hc,bc as Ld,bd as Au,bf as _r,bg as il,ca as Wa,cb as Bc,cc as Hd,cd as xu,cf as wr,cg as mt,da as Za,db as Fc,dc as Bd,dd as Uu,df as Ke,dg as ei,ea as Ya,eb as Gc,ec as Fd,ed as Ou,ef as We,eg as Ko,fa as Xa,fb as Jc,fc as Gd,fd as Mu,ff as Bo,fg as ti,ga as Qa,gb as Vc,gc as Jd,gd as hr,gf as Rr,gg as Wo,ha as ec,hb as Kc,hc as Vd,hd as fr,hf as br,hg as Gn,ia as tc,ib as Wc,ic as Kd,id as zu,if as vr,ig as Tr,ja as rc,jb as Zc,jc as Wd,jd as gr,jf as Fo,jg as al,ka as nc,kb as Yc,kc as Zd,kd as lt,kf as Gu,kg as Xe,l as Le,la as oc,lb as Xc,lc as Yd,ld as Xs,lf as ze,lg as ri,ma as sc,mb as Qc,mc as Gs,md as Ho,mf as Ju,mg as ni,na as ic,nb as ed,nc as jo,nd as qu,nf as Ze,ng as cl,oa as ac,ob as td,oc as Do,od as Hn,of as x,og as Zo,pa as cc,pb as rd,pc as Js,pd as $t,pf as Go,pg as oi,qa as dc,qb as nd,qc as Vs,qd as Nu,qf as le,qg as si,ra as uc,rb as od,rc as Ks,rd as ju,rf as pt,rg as dl,s as jt,sa as Dt,sb as sd,sc as Xd,sf as Ig,sg as ne,t as Ga,ta as $s,tb as id,tc as Ws,tf as Cg,tg as ul,ua as Ls,ub as ad,uc as Zs,uf as Tg,ug as ll,v as B,va as Ln,vb as cd,vc as Qd,vf as kg,vg as ii,wa as Hs,wb as dd,wc as eu,wf as Eg,wg as pl,xa as lc,xb as ud,xc as Ys,xd as Du,xf as Pg,xg as ml,ya as pc,yb as ld,yc as $o,yf as Ag,yg as ai,za as mc,zb as pd,zc as Lo,zf as xg,zg as hl}from"../chunk-233GXONP.js";import"../chunk-54HRCPVQ.js";import{a as kl}from"../chunk-6SNZ4DOC.js";import{a as Ja}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as l,b as qs,c as Nn,d as Ha,e as d,f as Ba,g as Fa,h as b,i as A,j as Mo,l as M,m as _,n as m,o as q,p as E,q as Ns,r as jn,s as T,t as j,u as g,v as z,w as js,x as zo}from"../chunk-6O4OZCO6.js";import{$ as La,a as ye,aa as Oo,c as v,d as K}from"../chunk-MWIJG5KC.js";import{a as n}from"../chunk-TYV53J3B.js";var qg=Object.create,es=Object.defineProperty,Ng=Object.getOwnPropertyDescriptor,jg=Object.getOwnPropertyNames,Dg=Object.getPrototypeOf,$g=Object.prototype.hasOwnProperty,El=n((e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),"__commonJSMin"),Pl=n((e,t)=>{let r={};for(var o in e)es(r,o,{get:e[o],enumerable:!0});return t&&es(r,Symbol.toStringTag,{value:"Module"}),r},"__exportAll"),Lg=n((e,t,r,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(var s=jg(t),i=0,c=s.length,a;i<c;i++)a=s[i],!$g.call(e,a)&&a!==r&&es(e,a,{get:(u=>t[u]).bind(null,a),enumerable:!(o=Ng(t,a))||o.enumerable});return e},"__copyProps"),Al=n((e,t,r)=>(r=e!=null?qg(Dg(e)):{},Lg(t||!e||!e.__esModule?es(r,"default",{value:e,enumerable:!0}):r,e)),"__toESM");var Hg=new Set(["https://json-schema.org/draft/2019-09/schema","http://json-schema.org/draft/2019-09/schema"]);function xl(e){return typeof e=="string"&&Hg.has(e.replace(/#$/,""))}n(xl,"declares2019Dialect");var mi=Symbol.for("mcp.sdk.errorBrands");function Ht(e,t){let r=new Set,o=t;for(;typeof o=="function";){let s=o.mcpBrand;Object.prototype.hasOwnProperty.call(o,"mcpBrand")&&typeof s=="string"&&r.add(s),o=Object.getPrototypeOf(o)}r.size!==0&&Object.defineProperty(e,mi,{value:r,enumerable:!1,configurable:!0})}n(Ht,"stampErrorBrands");function Ie(e,t){try{if(typeof t=="object"&&t!==null&&Object.prototype.hasOwnProperty.call(e,"mcpBrand")&&typeof e.mcpBrand=="string"&&Object.prototype.hasOwnProperty.call(t,mi)){let r=t[mi];if(r&&typeof r.has=="function"&&r.has(e.mcpBrand))return!0}}catch{}return Function.prototype[Symbol.hasInstance].call(e,t)}n(Ie,"brandedHasInstance");var ue=(function(e){return e.InvalidRequest="invalid_request",e.InvalidClient="invalid_client",e.InvalidGrant="invalid_grant",e.UnauthorizedClient="unauthorized_client",e.UnsupportedGrantType="unsupported_grant_type",e.InvalidScope="invalid_scope",e.AccessDenied="access_denied",e.ServerError="server_error",e.TemporarilyUnavailable="temporarily_unavailable",e.UnsupportedResponseType="unsupported_response_type",e.UnsupportedTokenType="unsupported_token_type",e.InvalidToken="invalid_token",e.MethodNotAllowed="method_not_allowed",e.TooManyRequests="too_many_requests",e.InvalidClientMetadata="invalid_client_metadata",e.InvalidRedirectUri="invalid_redirect_uri",e.InsufficientScope="insufficient_scope",e.InvalidTarget="invalid_target",e})({}),ft=class Ll extends Error{static{n(this,"OAuthError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthError"})}static[Symbol.hasInstance](t){return Ie(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,t)}constructor(t,r,o){super(r),this.code=t,this.errorUri=o,this.name="OAuthError",Ht(this,new.target)}toResponseObject(){let t={error:this.code,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}static fromResponse(t){return new Ll(t.error,t.error_description??t.error,t.error_uri)}},se=(function(e){return e.NotConnected="NOT_CONNECTED",e.AlreadyConnected="ALREADY_CONNECTED",e.NotInitialized="NOT_INITIALIZED",e.CapabilityNotSupported="CAPABILITY_NOT_SUPPORTED",e.RequestTimeout="REQUEST_TIMEOUT",e.ConnectionClosed="CONNECTION_CLOSED",e.SendFailed="SEND_FAILED",e.InvalidResult="INVALID_RESULT",e.UnsupportedResultType="UNSUPPORTED_RESULT_TYPE",e.InputRequiredRoundsExceeded="INPUT_REQUIRED_ROUNDS_EXCEEDED",e.ListPaginationExceeded="LIST_PAGINATION_EXCEEDED",e.MethodNotSupportedByProtocolVersion="METHOD_NOT_SUPPORTED_BY_PROTOCOL_VERSION",e.EraNegotiationFailed="ERA_NEGOTIATION_FAILED",e.ClientHttpNotImplemented="CLIENT_HTTP_NOT_IMPLEMENTED",e.ClientHttpAuthentication="CLIENT_HTTP_AUTHENTICATION",e.ClientHttpForbidden="CLIENT_HTTP_FORBIDDEN",e.ClientHttpUnexpectedContent="CLIENT_HTTP_UNEXPECTED_CONTENT",e.ClientHttpFailedToOpenStream="CLIENT_HTTP_FAILED_TO_OPEN_STREAM",e.ClientHttpFailedToTerminateSession="CLIENT_HTTP_FAILED_TO_TERMINATE_SESSION",e})({}),re=class extends Error{static{n(this,"SdkError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e,t,r){super(t),this.code=e,this.data=r,this.name="SdkError",Ht(this,new.target)}},ey=class extends re{static{n(this,"SdkHttpError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkHttpError"})}constructor(e,t,r){super(e,t,r),this.name="SdkHttpError"}get status(){return this.data.status}get statusText(){return this.data.statusText}};function Hl(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}n(Hl,"resourceUrlFromServerUrl");function ss({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),o=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==o.origin||r.pathname.length<o.pathname.length)return!1;let s=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",i=o.pathname.endsWith("/")?o.pathname:o.pathname+"/";return s.startsWith(i)}n(ss,"checkResourceAllowed");var ty="2026-07-28";function Bl(e){return e>=ty}n(Bl,"isModernProtocolVersion");function Fl(e){let t=e.structuredContent;return t===void 0||!(typeof t!="object"||t===null||Array.isArray(t))||(e.content?.some(r=>r.type==="text")??!1)?e:{...e,content:[...e.content??[],{type:"text",text:JSON.stringify(t)}]}}n(Fl,"appendTextFallbackForNonObject");var Gl=["task","inputRequests","requestState"];function ry(e){return e===null||typeof e!="object"||Array.isArray(e)||e.content!==void 0||Gl.some(t=>t in e)?e:{...e,content:[]}}n(ry,"normalizeContentlessToolResult");function ny(){let e=js(()=>E([d(),b(),A(),Mo(),T(d(),e),_(e)])),t=T(d(),e),r=E([d(),b().int()]),o=d(),s=m({ttl:b().optional()}),i=m({taskId:d()}),c=q({progressToken:r.optional(),"io.modelcontextprotocol/related-task":i.optional()}),a=m({_meta:c.optional()}),u=a.extend({task:s.optional()}),p=m({method:d(),params:a.loose().optional()}),h=m({_meta:c.optional()}),f=m({method:d(),params:h.loose().optional()}),y=q({_meta:c.optional()}),S=E([d(),b().int()]),k=y.strict(),w=h.extend({requestId:S.optional(),reason:d().optional()}),I=f.extend({method:g("notifications/cancelled"),params:w}),U=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:j(["light","dark"]).optional()}),O=m({icons:_(U).optional()}),H=m({name:d(),title:d().optional()}),F=H.extend({...H.shape,...O.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),ee=jn(m({applyDefaults:A().optional()}),t),G=zo(ce=>ce&&typeof ce=="object"&&!Array.isArray(ce)&&Object.keys(ce).length===0?{form:{}}:ce,jn(m({form:ee.optional(),url:t.optional()}),t.optional())),V=q({list:t.optional(),cancel:t.optional(),requests:q({sampling:q({createMessage:t.optional()}).optional(),elicitation:q({create:t.optional()}).optional()}).optional()}),Ge=q({list:t.optional(),cancel:t.optional(),requests:q({tools:q({call:t.optional()}).optional()}).optional()}),oe=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:G.optional(),roots:m({listChanged:A().optional()}).optional(),tasks:V.optional(),extensions:T(d(),t).optional()}),je=a.extend({protocolVersion:d(),capabilities:oe,clientInfo:F}),L=p.extend({method:g("initialize"),params:je}),Ue=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:A().optional()}).optional(),resources:m({subscribe:A().optional(),listChanged:A().optional()}).optional(),tools:m({listChanged:A().optional()}).optional(),tasks:Ge.optional(),extensions:T(d(),t).optional()}),Br=y.extend({protocolVersion:d(),capabilities:Ue,serverInfo:F,instructions:d().optional()}),Vt=f.extend({method:g("notifications/initialized"),params:h.optional()}),st=p.extend({method:g("ping"),params:a.optional()}),Ct=m({progress:b(),total:z(b()),message:z(d())}),De=m({...h.shape,...Ct.shape,progressToken:r}),it=f.extend({method:g("notifications/progress"),params:De}),Kt=a.extend({cursor:o.optional()}),Je=p.extend({params:Kt.optional()}),Ve=y.extend({nextCursor:o.optional()}),Wt=m({uri:d(),mimeType:z(d()),_meta:T(d(),M()).optional()}),Zt=Wt.extend({text:d()}),Tt=d().refine(ce=>{try{return atob(ce),!0}catch{return!1}},{message:"Invalid Base64 string"}),Yt=Wt.extend({blob:Tt}),$e=j(["user","assistant"]),Oe=m({audience:_($e).optional(),priority:b().min(0).max(1).optional(),lastModified:Nn.datetime({offset:!0}).optional()}),kt=m({...H.shape,...O.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:Oe.optional(),_meta:z(q({}))}),Fr=m({...H.shape,...O.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:Oe.optional(),_meta:z(q({}))}),Gr=Je.extend({method:g("resources/list")}),Jr=Ve.extend({resources:_(kt)}),at=Je.extend({method:g("resources/templates/list")}),Xt=Ve.extend({resourceTemplates:_(Fr)}),Et=a.extend({uri:d()}),Vr=Et,Kr=p.extend({method:g("resources/read"),params:Vr}),Wr=y.extend({contents:_(E([Zt,Yt]))}),Zr=f.extend({method:g("notifications/resources/list_changed"),params:h.optional()}),Yr=Et,Xr=p.extend({method:g("resources/subscribe"),params:Yr}),Qr=Et,en=p.extend({method:g("resources/unsubscribe"),params:Qr}),tn=h.extend({uri:d()}),rn=f.extend({method:g("notifications/resources/updated"),params:tn}),nn=m({name:d(),description:z(d()),required:z(A())}),on=m({...H.shape,...O.shape,description:z(d()),arguments:z(_(nn)),_meta:z(q({}))}),sn=Je.extend({method:g("prompts/list")}),an=Ve.extend({prompts:_(on)}),cn=a.extend({name:d(),arguments:T(d(),d()).optional()}),dn=p.extend({method:g("prompts/get"),params:cn}),Pt=m({type:g("text"),text:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),At=m({type:g("image"),data:Tt,mimeType:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),xt=m({type:g("audio"),data:Tt,mimeType:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),un=m({type:g("tool_use"),name:d(),id:d(),input:T(d(),M()),_meta:T(d(),M()).optional()}),ct=m({type:g("resource"),resource:E([Zt,Yt]),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),ln=kt.extend({type:g("resource_link")}),Pe=E([Pt,At,xt,ln,ct]),Qt=m({role:$e,content:Pe}),er=y.extend({description:d().optional(),messages:_(Qt)}),Ut=f.extend({method:g("notifications/prompts/list_changed"),params:h.optional()}),pn=m({title:d().optional(),readOnlyHint:A().optional(),destructiveHint:A().optional(),idempotentHint:A().optional(),openWorldHint:A().optional()}),tr=m({taskSupport:j(["required","optional","forbidden"]).optional()}),Ot=m({...H.shape,...O.shape,description:d().optional(),inputSchema:m({type:g("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(M()),outputSchema:m({type:g("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(M()).optional(),annotations:pn.optional(),execution:tr.optional(),_meta:T(d(),M()).optional()}),rr=Je.extend({method:g("tools/list")}),nr=Ve.extend({tools:_(Ot)}),or=y.extend({content:_(Pe),structuredContent:T(d(),M()).optional(),isError:A().optional()}),ae=u.extend({name:d(),arguments:T(d(),M()).optional()}),mn=p.extend({method:g("tools/call"),params:ae}),go=f.extend({method:g("notifications/tools/list_changed"),params:h.optional()}),sr=j(["debug","info","notice","warning","error","critical","alert","emergency"]),hn=a.extend({level:sr}),fn=p.extend({method:g("logging/setLevel"),params:hn}),gn=h.extend({level:sr,logger:d().optional(),data:M()}),yn=f.extend({method:g("notifications/message"),params:gn}),Sn=m({name:d().optional()}),_n=m({hints:_(Sn).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),wn=m({mode:j(["auto","required","none"]).optional()}),yo=m({type:g("tool_result"),toolUseId:d().describe("The unique identifier for the corresponding tool call."),content:_(Pe),structuredContent:m({}).loose().optional(),isError:A().optional(),_meta:T(d(),M()).optional()}),Rn=Ns("type",[Pt,At,xt]),dt=Ns("type",[Pt,At,xt,un,yo]),bn=m({role:$e,content:E([dt,_(dt)]),_meta:T(d(),M()).optional()}),vn=u.extend({messages:_(bn),modelPreferences:_n.optional(),systemPrompt:d().optional(),includeContext:j(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Ot).optional(),toolChoice:wn.optional()}),In=p.extend({method:g("sampling/createMessage"),params:vn}),Cn=y.extend({model:d(),stopReason:z(j(["endTurn","stopSequence","maxTokens"]).or(d())),role:$e,content:Rn}),Tn=y.extend({model:d(),stopReason:z(j(["endTurn","stopSequence","maxTokens","toolUse"]).or(d())),role:$e,content:E([dt,_(dt)])}),kn=m({type:g("boolean"),title:d().optional(),description:d().optional(),default:A().optional()}),En=m({type:g("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:j(["email","uri","date","date-time"]).optional(),default:d().optional()}),Pn=m({type:j(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),An=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),xn=m({type:g("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),Un=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),On=E([An,xn]),Mt=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:g("string"),enum:_(d())}),default:_(d()).optional()}),zt=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),So=E([Mt,zt]),_o=E([Un,On,So]),Re=E([_o,kn,En,Pn]),be=u.extend({mode:g("form").optional(),message:d(),requestedSchema:m({type:g("object"),properties:T(d(),Re),required:_(d()).optional()}).catchall(M())}),Mn=u.extend({mode:g("url"),message:d(),elicitationId:d(),url:d().url()}),Me=E([be,Mn]),wo=p.extend({method:g("elicitation/create"),params:Me}),Ro=h.extend({elicitationId:d()}),bo=f.extend({method:g("notifications/elicitation/complete"),params:Ro}),vo=y.extend({action:j(["accept","decline","cancel"]),content:zo(ce=>ce===null?void 0:ce,T(d(),E([d(),b(),A(),_(d())])).optional())}),Io=m({type:g("ref/resource"),uri:d()}),Co=m({type:g("ref/prompt"),name:d()}),To=a.extend({ref:E([Co,Io]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()}),zn=p.extend({method:g("completion/complete"),params:To}),ko=y.extend({completion:q({values:_(d()).max(100),total:z(b().int()),hasMore:z(A())})}),Eo=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),M()).optional()}),ir=p.extend({method:g("roots/list"),params:a.optional()}),qn=y.extend({roots:_(Eo)}),Po=f.extend({method:g("notifications/roots/list_changed"),params:h.optional()}),Ao=q({ttl:b().optional(),pollInterval:b().optional()}),xo=j(["working","input_required","completed","failed","cancelled"]),ut=m({taskId:d(),status:xo,ttl:E([b(),Mo()]),createdAt:d(),lastUpdatedAt:d(),pollInterval:z(b()),statusMessage:z(d())}),fe=y.extend({task:ut}),Uo=h.merge(ut),qt=f.extend({method:g("notifications/tasks/status"),params:Uo}),ar=p.extend({method:g("tasks/get"),params:a.extend({taskId:d()})}),cr=y.merge(ut),dr=p.extend({method:g("tasks/result"),params:a.extend({taskId:d()})}),zs=y.loose(),ge=Je.extend({method:g("tasks/list")}),Z=Ve.extend({tasks:_(ut)}),Nt=p.extend({method:g("tasks/cancel"),params:a.extend({taskId:d()})});return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,TaskMetadataSchema:s,RelatedTaskMetadataSchema:i,RequestMetaSchema:c,BaseRequestParamsSchema:a,TaskAugmentedRequestParamsSchema:u,RequestSchema:p,NotificationsParamsSchema:h,NotificationSchema:f,ResultSchema:y,RequestIdSchema:S,EmptyResultSchema:k,CancelledNotificationParamsSchema:w,CancelledNotificationSchema:I,IconSchema:U,IconsSchema:O,BaseMetadataSchema:H,ImplementationSchema:F,ClientTasksCapabilitySchema:V,ServerTasksCapabilitySchema:Ge,ClientCapabilitiesSchema:oe,InitializeRequestParamsSchema:je,InitializeRequestSchema:L,ServerCapabilitiesSchema:Ue,InitializeResultSchema:Br,InitializedNotificationSchema:Vt,PingRequestSchema:st,ProgressSchema:Ct,ProgressNotificationParamsSchema:De,ProgressNotificationSchema:it,PaginatedRequestParamsSchema:Kt,PaginatedRequestSchema:Je,PaginatedResultSchema:Ve,ResourceContentsSchema:Wt,TextResourceContentsSchema:Zt,BlobResourceContentsSchema:Yt,RoleSchema:$e,AnnotationsSchema:Oe,ResourceSchema:kt,ResourceTemplateSchema:Fr,ListResourcesRequestSchema:Gr,ListResourcesResultSchema:Jr,ListResourceTemplatesRequestSchema:at,ListResourceTemplatesResultSchema:Xt,ResourceRequestParamsSchema:Et,ReadResourceRequestParamsSchema:Vr,ReadResourceRequestSchema:Kr,ReadResourceResultSchema:Wr,ResourceListChangedNotificationSchema:Zr,SubscribeRequestParamsSchema:Yr,SubscribeRequestSchema:Xr,UnsubscribeRequestParamsSchema:Qr,UnsubscribeRequestSchema:en,ResourceUpdatedNotificationParamsSchema:tn,ResourceUpdatedNotificationSchema:rn,PromptArgumentSchema:nn,PromptSchema:on,ListPromptsRequestSchema:sn,ListPromptsResultSchema:an,GetPromptRequestParamsSchema:cn,GetPromptRequestSchema:dn,TextContentSchema:Pt,ImageContentSchema:At,AudioContentSchema:xt,ToolUseContentSchema:un,EmbeddedResourceSchema:ct,ResourceLinkSchema:ln,ContentBlockSchema:Pe,PromptMessageSchema:Qt,GetPromptResultSchema:er,PromptListChangedNotificationSchema:Ut,ToolAnnotationsSchema:pn,ToolExecutionSchema:tr,ToolSchema:Ot,ListToolsRequestSchema:rr,ListToolsResultSchema:nr,CallToolResultSchema:or,CallToolRequestParamsSchema:ae,CallToolRequestSchema:mn,ToolListChangedNotificationSchema:go,LoggingLevelSchema:sr,SetLevelRequestParamsSchema:hn,SetLevelRequestSchema:fn,LoggingMessageNotificationParamsSchema:gn,LoggingMessageNotificationSchema:yn,ModelHintSchema:Sn,ModelPreferencesSchema:_n,ToolChoiceSchema:wn,ToolResultContentSchema:yo,SamplingContentSchema:Rn,SamplingMessageContentBlockSchema:dt,SamplingMessageSchema:bn,CreateMessageRequestParamsSchema:vn,CreateMessageRequestSchema:In,CreateMessageResultSchema:Cn,CreateMessageResultWithToolsSchema:Tn,BooleanSchemaSchema:kn,StringSchemaSchema:En,NumberSchemaSchema:Pn,UntitledSingleSelectEnumSchemaSchema:An,TitledSingleSelectEnumSchemaSchema:xn,LegacyTitledEnumSchemaSchema:Un,SingleSelectEnumSchemaSchema:On,UntitledMultiSelectEnumSchemaSchema:Mt,TitledMultiSelectEnumSchemaSchema:zt,MultiSelectEnumSchemaSchema:So,EnumSchemaSchema:_o,PrimitiveSchemaDefinitionSchema:Re,ElicitRequestFormParamsSchema:be,ElicitRequestURLParamsSchema:Mn,ElicitRequestParamsSchema:Me,ElicitRequestSchema:wo,ElicitationCompleteNotificationParamsSchema:Ro,ElicitationCompleteNotificationSchema:bo,ElicitResultSchema:vo,ResourceTemplateReferenceSchema:Io,PromptReferenceSchema:Co,CompleteRequestParamsSchema:To,CompleteRequestSchema:zn,CompleteResultSchema:ko,RootSchema:Eo,ListRootsRequestSchema:ir,ListRootsResultSchema:qn,RootsListChangedNotificationSchema:Po,TaskCreationParamsSchema:Ao,TaskStatusSchema:xo,TaskSchema:ut,CreateTaskResultSchema:fe,TaskStatusNotificationParamsSchema:Uo,TaskStatusNotificationSchema:qt,GetTaskRequestSchema:ar,GetTaskResultSchema:cr,GetTaskPayloadRequestSchema:dr,GetTaskPayloadResultSchema:zs,ListTasksRequestSchema:ge,ListTasksResultSchema:Z,CancelTaskRequestSchema:Nt,CancelTaskResultSchema:y.merge(ut),ClientRequestSchema:E([st,L,zn,fn,dn,sn,Gr,at,Kr,Xr,en,mn,rr,ar,dr,ge,Nt]),ClientNotificationSchema:E([I,it,Vt,Po,qt]),ClientResultSchema:E([k,Cn,Tn,vo,qn,cr,Z,fe]),ServerRequestSchema:E([st,In,wo,ir,ar,dr,ge,Nt]),ServerNotificationSchema:E([I,it,yn,rn,Zr,go,Ut,qt,bo]),ServerResultSchema:E([k,Br,ko,er,an,Jr,Xt,Wr,or,nr,cr,Z,fe]),CallToolResultWireSchema:M().superRefine((ce,vg)=>{if(!(typeof ce!="object"||ce===null||Array.isArray(ce)||ce.content!==void 0)){for(let $a of Gl)if($a in ce){vg.addIssue({code:"custom",message:`content is required when the body carries '${$a}' \u2014 another result family cannot default into an empty tools/call success`});return}}}).transform(ry).pipe(or)}}n(ny,"build$1");var oy;function _i(){return oy??=ny()}n(_i,"buildSchemas2025");function Jl(e){return e.type!=="object"}n(Jl,"isNonObjectJsonSchemaRoot");var sy=new Set(["const","enum","default","examples"]),iy=new Set(["properties","patternProperties","$defs","definitions","dependentSchemas","dependencies"]);function Ul(e){return e!==void 0&&!(typeof e=="string"&&e.startsWith("#"))}n(Ul,"establishesNewBase");function ay(e){let t=typeof e.$schema=="string"?e.$schema:void 0;if(Ul(e.$id))return{...t!==void 0&&{$schema:t},type:"object",properties:{result:e},required:["result"]};let r=xl(e.$schema)&&e.$recursiveAnchor!==!0,o=n((s,i)=>{if(Array.isArray(s))return s.map(u=>o(u,!1));if(s===null||typeof s!="object"||!i&&Ul(s.$id))return s;let c={},a=!1;for(let[u,p]of Object.entries(s))i?c[u]=o(p,!1):(u==="$ref"||u==="$dynamicRef")&&typeof p=="string"?c[u]=p==="#"?"#/properties/result":p.startsWith("#/")?`#/properties/result${p.slice(1)}`:p:u==="$recursiveRef"&&p==="#"&&r?a=!0:sy.has(u)?c[u]=p:iy.has(u)?c[u]=o(p,!0):c[u]=o(p,!1);return a&&("$ref"in c?c.allOf=[...Array.isArray(c.allOf)?c.allOf:[],{$ref:"#/properties/result"}]:c.$ref="#/properties/result"),c},"rewriteRefs");return{...t!==void 0&&{$schema:t},type:"object",properties:{result:o(e,!1)},required:["result"]}}n(ay,"wrapOutputSchemaForLegacy");var Vl={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"tasks/get":null,"tasks/result":null,"tasks/list":null,"tasks/cancel":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},Kl={"notifications/cancelled":null,"notifications/progress":null,"notifications/initialized":null,"notifications/roots/list_changed":null,"notifications/tasks/status":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/elicitation/complete":null},cy={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},ts;function is(){if(ts)return ts;let e=_i();return ts={requestSchemas:{ping:e.PingRequestSchema,initialize:e.InitializeRequestSchema,"completion/complete":e.CompleteRequestSchema,"logging/setLevel":e.SetLevelRequestSchema,"prompts/get":e.GetPromptRequestSchema,"prompts/list":e.ListPromptsRequestSchema,"resources/list":e.ListResourcesRequestSchema,"resources/templates/list":e.ListResourceTemplatesRequestSchema,"resources/read":e.ReadResourceRequestSchema,"resources/subscribe":e.SubscribeRequestSchema,"resources/unsubscribe":e.UnsubscribeRequestSchema,"tools/call":e.CallToolRequestSchema,"tools/list":e.ListToolsRequestSchema,"tasks/get":e.GetTaskRequestSchema,"tasks/result":e.GetTaskPayloadRequestSchema,"tasks/list":e.ListTasksRequestSchema,"tasks/cancel":e.CancelTaskRequestSchema,"sampling/createMessage":e.CreateMessageRequestSchema,"elicitation/create":e.ElicitRequestSchema,"roots/list":e.ListRootsRequestSchema},notificationSchemas:{"notifications/cancelled":e.CancelledNotificationSchema,"notifications/progress":e.ProgressNotificationSchema,"notifications/initialized":e.InitializedNotificationSchema,"notifications/roots/list_changed":e.RootsListChangedNotificationSchema,"notifications/tasks/status":e.TaskStatusNotificationSchema,"notifications/message":e.LoggingMessageNotificationSchema,"notifications/resources/updated":e.ResourceUpdatedNotificationSchema,"notifications/resources/list_changed":e.ResourceListChangedNotificationSchema,"notifications/tools/list_changed":e.ToolListChangedNotificationSchema,"notifications/prompts/list_changed":e.PromptListChangedNotificationSchema,"notifications/elicitation/complete":e.ElicitationCompleteNotificationSchema},resultSchemas:{ping:e.EmptyResultSchema,initialize:e.InitializeResultSchema,"completion/complete":e.CompleteResultSchema,"logging/setLevel":e.EmptyResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"resources/subscribe":e.EmptyResultSchema,"resources/unsubscribe":e.EmptyResultSchema,"tools/call":e.CallToolResultWireSchema,"tools/list":e.ListToolsResultSchema,"sampling/createMessage":e.CreateMessageResultWithToolsSchema,"elicitation/create":e.ElicitResultSchema,"roots/list":e.ListRootsResultSchema}},ts}n(is,"registryMaps");function dy(){is()}n(dy,"warmRegistryMaps2025");function Wl(e){return Object.prototype.hasOwnProperty.call(Vl,e)}n(Wl,"hasRequestMethod2025");function Zl(e){return Object.prototype.hasOwnProperty.call(Kl,e)}n(Zl,"hasNotificationMethod2025");function uy(e){return Object.prototype.hasOwnProperty.call(cy,e)}n(uy,"hasResultMethod");function ly(e){return uy(e)?is().resultSchemas[e]:void 0}n(ly,"getResultSchema");function py(e){return Wl(e)?is().requestSchemas[e]:void 0}n(py,"getRequestSchema");function my(e){return Zl(e)?is().notificationSchemas[e]:void 0}n(my,"getNotificationSchema");var UT=Object.keys(Vl),OT=Object.keys(Kl);function hi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(hi,"isPlainObject$4");function rs(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n(rs,"triState$1");var Ol={ok:!1,reason:"not-in-era"};function Ml(e){return hi(e)&&hi(e.outputSchema)&&Jl(e.outputSchema)}n(Ml,"toolNeedsLegacyWrap");var wi={era:"2025-11-25",hasRequestMethod:Wl,hasNotificationMethod:Zl,validateRequest:n((e,t)=>rs(py(e),t),"validateRequest"),validateResult:n((e,t)=>rs(ly(e),t),"validateResult"),validateNotification:n((e,t)=>rs(my(e),t),"validateNotification"),hasInputRequestMethod:n(()=>!1,"hasInputRequestMethod"),validateInputRequest:n(()=>Ol,"validateInputRequest"),validateInputResponse:n(()=>Ol,"validateInputResponse"),samplingResultVariant:n(((e,t)=>{let r=_i();return rs(e?r.CreateMessageResultWithToolsSchema:r.CreateMessageResultSchema,t)}),"samplingResultVariant"),outboundEnvelope:n(e=>{},"outboundEnvelope"),validateEnvelopeMeta:n(e=>[],"validateEnvelopeMeta"),projectCallToolResult(e,t){let r=Fl(e),o=r.structuredContent;if(o===void 0)return r;let s=typeof o!="object"||o===null||Array.isArray(o),i=t!==void 0&&Jl(t);return!s&&!i?r:{...r,structuredContent:{result:o}}},decodeResult(e,t){if(hi(t)&&"resultType"in t){let r={...t};return delete r.resultType,{kind:"complete",result:r}}return{kind:"complete",result:t}},encodeResult(e,t){if(e!=="tools/list")return t;let r=t.tools;return!Array.isArray(r)||!r.some(o=>Ml(o))?t:{...t,tools:r.map(o=>Ml(o)?{...o,outputSchema:ay(o.outputSchema)}:o)}},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope:n(e=>{},"checkInboundEnvelope")};function hy(){let e=js(()=>E([d(),b(),A(),Mo(),T(d(),e),_(e)])),t=T(d(),e),r=E([d(),b().int()]),o=d(),s=E([d(),b().int()]),i=j(["user","assistant"]),c=j(["debug","info","notice","warning","error","critical","alert","emergency"]),a=d().refine(Z=>{try{return atob(Z),!0}catch{return!1}},{message:"Invalid Base64 string"}),u=m({ttl:b().optional()}),p=m({taskId:d()}),h=q({progressToken:r.optional(),"io.modelcontextprotocol/related-task":p.optional()}),f=m({_meta:h.optional()}),y=f.extend({task:u.optional()}),S=m({_meta:h.optional()}),k=m({method:d(),params:S.loose().optional()}),w=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:j(["light","dark"]).optional()}),I=m({icons:_(w).optional()}),U=m({name:d(),title:d().optional()}),O=U.extend({...U.shape,...I.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),H=jn(m({applyDefaults:A().optional()}),t),F=zo(Z=>Z&&typeof Z=="object"&&!Array.isArray(Z)&&Object.keys(Z).length===0?{form:{}}:Z,jn(m({form:H.optional(),url:t.optional()}),t.optional())),ee=q({list:t.optional(),cancel:t.optional(),requests:q({sampling:q({createMessage:t.optional()}).optional(),elicitation:q({create:t.optional()}).optional()}).optional()}),G=q({list:t.optional(),cancel:t.optional(),requests:q({tools:q({call:t.optional()}).optional()}).optional()}),V=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:F.optional(),roots:m({listChanged:A().optional()}).optional(),tasks:ee.optional(),extensions:T(d(),t).optional()}),Ge=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:A().optional()}).optional(),resources:m({subscribe:A().optional(),listChanged:A().optional()}).optional(),tools:m({listChanged:A().optional()}).optional(),tasks:G.optional(),extensions:T(d(),t).optional()}),oe=m({progress:b(),total:z(b()),message:z(d())}),je=m({...S.shape,...oe.shape,progressToken:r}),L=k.extend({method:g("notifications/progress"),params:je}),Ue=S.extend({level:c,logger:d().optional(),data:M()}),Br=k.extend({method:g("notifications/message"),params:Ue}),Vt=m({uri:d(),mimeType:z(d()),_meta:T(d(),M()).optional()}),st=Vt.extend({text:d()}),Ct=Vt.extend({blob:a}),De=m({audience:_(i).optional(),priority:b().min(0).max(1).optional(),lastModified:Nn.datetime({offset:!0}).optional()}),it=m({...U.shape,...I.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:De.optional(),_meta:z(q({}))}),Kt=m({...U.shape,...I.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:De.optional(),_meta:z(q({}))}),Je=k.extend({method:g("notifications/resources/list_changed"),params:S.optional()}),Ve=S.extend({uri:d()}),Wt=k.extend({method:g("notifications/resources/updated"),params:Ve}),Zt=m({name:d(),description:z(d()),required:z(A())}),Tt=m({...U.shape,...I.shape,description:z(d()),arguments:z(_(Zt)),_meta:z(q({}))}),Yt=k.extend({method:g("notifications/prompts/list_changed"),params:S.optional()}),$e=m({type:g("text"),text:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),Oe=m({type:g("image"),data:a,mimeType:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),kt=m({type:g("audio"),data:a,mimeType:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),Fr=m({type:g("tool_use"),name:d(),id:d(),input:T(d(),M()),_meta:T(d(),M()).optional()}),Gr=m({type:g("resource"),resource:E([st,Ct]),annotations:De.optional(),_meta:T(d(),M()).optional()}),Jr=it.extend({type:g("resource_link")}),at=E([$e,Oe,kt,Jr,Gr]),Xt=m({role:i,content:at}),Et=m({title:d().optional(),readOnlyHint:A().optional(),destructiveHint:A().optional(),idempotentHint:A().optional(),openWorldHint:A().optional()}),Vr=k.extend({method:g("notifications/tools/list_changed"),params:S.optional()}),Kr=m({name:d().optional()}),Wr=m({hints:_(Kr).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),Zr=m({mode:j(["auto","required","none"]).optional()}),Yr=m({type:g("boolean"),title:d().optional(),description:d().optional(),default:A().optional()}),Xr=m({type:g("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:j(["email","uri","date","date-time"]).optional(),default:d().optional()}),Qr=m({type:j(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),en=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),tn=m({type:g("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),rn=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),nn=E([en,tn]),on=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:g("string"),enum:_(d())}),default:_(d()).optional()}),sn=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),an=E([on,sn]),cn=E([rn,nn,an]),dn=E([cn,Yr,Xr,Qr]),Pt=y.extend({mode:g("form").optional(),message:d(),requestedSchema:m({type:g("object"),properties:T(d(),dn),required:_(d()).optional()}).catchall(M())}),At=m({type:g("ref/resource"),uri:d()}),xt=m({type:g("ref/prompt"),name:d()}),un=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),M()).optional()}),ct=V.shape,ln=m({experimental:ct.experimental,sampling:ct.sampling,elicitation:ct.elicitation,roots:ct.roots,extensions:ct.extensions}),Pe=Ge.shape,Qt=m({experimental:Pe.experimental,logging:Pe.logging,completions:Pe.completions,prompts:Pe.prompts,resources:Pe.resources,tools:Pe.tools,extensions:Pe.extensions}),er=q({progressToken:r.optional(),[ur]:d(),[Dn]:O.optional(),[pr]:ln,[$n]:c.optional()}),Ut=m({...U.shape,...I.shape,description:d().optional(),inputSchema:q({$schema:d().optional(),type:g("object")}),outputSchema:q({$schema:d().optional()}).optional(),annotations:Et.optional(),_meta:T(d(),M()).optional()}),pn=m({type:g("tool_result"),toolUseId:d(),content:_(at),structuredContent:M().optional(),isError:A().optional(),_meta:T(d(),M()).optional()}),tr=E([$e,Oe,kt,Fr,pn]),Ot=m({role:i,content:E([tr,_(tr)]),_meta:T(d(),M()).optional()}),rr=d(),nr=q({[lr]:O.optional().catch(void 0)}),or=nr.optional();function ae(Z){return q({_meta:or,resultType:rr.default("complete"),...Z})}n(ae,"wireResult");let mn=ae({}),go=ae({nextCursor:o.optional()}),sr=ae({content:_(at),structuredContent:M().optional(),isError:A().optional()}),hn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),tools:_(Ut),nextCursor:o.optional()}),fn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),prompts:_(Tt),nextCursor:o.optional()}),gn=ae({description:d().optional(),messages:_(Xt)}),yn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resources:_(it),nextCursor:o.optional()}),Sn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resourceTemplates:_(Kt),nextCursor:o.optional()}),_n=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),contents:_(E([st,Ct]))}),wn=ae({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:A().optional()}).loose()}),yo=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"])}),Rn=ae({ttlMs:b().int().min(0).catch(0),cacheScope:j(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Qt,instructions:d().optional()}),dt=m({messages:_(Ot),modelPreferences:Wr.optional(),systemPrompt:d().optional(),includeContext:j(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Ut).optional(),toolChoice:Zr.optional()}),bn=m({method:g("sampling/createMessage"),params:dt}),vn=m({method:g("roots/list"),params:m({_meta:T(d(),M()).optional()}).optional()}),In=m({...Ot.shape,model:d(),stopReason:d().optional()}),Cn=m({roots:_(un)}),Tn=m({action:j(["accept","decline","cancel"]),content:T(d(),E([d(),b(),A(),_(d())])).optional()}),kn=m({mode:g("url"),message:d(),url:d().url()}),En=E([Pt,kn]),Pn=m({method:g("elicitation/create"),params:En}),An=E([bn,vn,Pn]),xn=E([In,Cn,Tn]),Un=T(d(),An),On=T(d(),xn),Mt=ae({inputRequests:Un.optional(),requestState:d().optional()}),zt={inputResponses:On.optional(),requestState:d().optional()},So=m({_meta:er,...zt}),_o=q({progressToken:r.optional()});function Re(Z,Nt){return m({method:g(Z),params:m({_meta:er,...Nt})})}n(Re,"wireRequest");function be(Z,Nt){return m({method:g(Z),params:m({_meta:_o.optional(),...Nt}).optional()})}n(be,"dispatchRequest");let Mn={name:d(),arguments:T(d(),M()).optional(),...zt},Me={cursor:o.optional()},wo=Re("tools/call",Mn),Ro=Re("tools/list",Me),bo=Re("prompts/list",Me),vo=Re("prompts/get",{name:d(),arguments:T(d(),d()).optional(),...zt}),Io=Re("resources/list",Me),Co=Re("resources/templates/list",Me),To=Re("resources/read",{uri:d(),...zt}),zn={ref:E([xt,At]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()},ko=Re("completion/complete",zn),Eo=Re("server/discover",{}),ir=m({toolsListChanged:A().optional(),promptsListChanged:A().optional(),resourcesListChanged:A().optional(),resourceSubscriptions:_(d()).optional()}),qn={notifications:ir},Po=Re("subscriptions/listen",qn),Ao=nr.extend({"io.modelcontextprotocol/subscriptionId":s}),xo=q({_meta:Ao,resultType:rr.default("complete")}),ut={"tools/call":be("tools/call",Mn),"tools/list":be("tools/list",Me),"prompts/get":be("prompts/get",{name:d(),arguments:T(d(),d()).optional()}),"prompts/list":be("prompts/list",Me),"resources/list":be("resources/list",Me),"resources/templates/list":be("resources/templates/list",Me),"resources/read":be("resources/read",{uri:d()}),"completion/complete":be("completion/complete",zn),"server/discover":be("server/discover",{}),"subscriptions/listen":be("subscriptions/listen",qn)};function fe(Z){return q({_meta:or,...Z})}n(fe,"liftedResult");let Uo={"tools/call":fe({content:_(at),structuredContent:M().optional(),isError:A().optional()}),"tools/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),tools:_(Ut),nextCursor:o.optional()}),"prompts/get":fe({description:d().optional(),messages:_(Xt)}),"prompts/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),prompts:_(Tt),nextCursor:o.optional()}),"resources/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resources:_(it),nextCursor:o.optional()}),"resources/templates/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resourceTemplates:_(Kt),nextCursor:o.optional()}),"resources/read":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),contents:_(E([st,Ct]))}),"completion/complete":fe({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:A().optional()}).loose()}),"server/discover":fe({ttlMs:b().int().min(0).catch(0),cacheScope:j(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Qt,instructions:d().optional()}),"subscriptions/listen":fe({})},qt=q({"io.modelcontextprotocol/subscriptionId":s.optional()}),ar=m({method:g("notifications/subscriptions/acknowledged"),params:m({_meta:qt.optional(),notifications:ir})}),cr=m({_meta:qt.optional(),requestId:s,reason:d().optional()}),dr=m({method:g("notifications/cancelled"),params:cr}),zs={"notifications/cancelled":dr,"notifications/progress":L,"notifications/message":Br,"notifications/resources/updated":Wt,"notifications/resources/list_changed":Je,"notifications/tools/list_changed":Vr,"notifications/prompts/list_changed":Yt,"notifications/subscriptions/acknowledged":ar},ge=n(Z=>m({jsonrpc:g("2.0"),id:E([d(),b().int()]),result:Z}).strict(),"wireResultResponse");return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,RequestIdSchema:s,RoleSchema:i,LoggingLevelSchema:c,TaskMetadataSchema:u,RelatedTaskMetadataSchema:p,RequestMetaSchema:h,BaseRequestParamsSchema:f,TaskAugmentedRequestParamsSchema:y,NotificationsParamsSchema:S,NotificationSchema:k,IconSchema:w,IconsSchema:I,BaseMetadataSchema:U,ImplementationSchema:O,ClientTasksCapabilitySchema:ee,ServerTasksCapabilitySchema:G,ClientCapabilitiesSchema:V,ServerCapabilitiesSchema:Ge,ProgressSchema:oe,ProgressNotificationParamsSchema:je,ProgressNotificationSchema:L,LoggingMessageNotificationParamsSchema:Ue,LoggingMessageNotificationSchema:Br,ResourceContentsSchema:Vt,TextResourceContentsSchema:st,BlobResourceContentsSchema:Ct,AnnotationsSchema:De,ResourceSchema:it,ResourceTemplateSchema:Kt,ResourceListChangedNotificationSchema:Je,ResourceUpdatedNotificationParamsSchema:Ve,ResourceUpdatedNotificationSchema:Wt,PromptArgumentSchema:Zt,PromptSchema:Tt,PromptListChangedNotificationSchema:Yt,TextContentSchema:$e,ImageContentSchema:Oe,AudioContentSchema:kt,ToolUseContentSchema:Fr,EmbeddedResourceSchema:Gr,ResourceLinkSchema:Jr,ContentBlockSchema:at,PromptMessageSchema:Xt,ToolAnnotationsSchema:Et,ToolListChangedNotificationSchema:Vr,ModelHintSchema:Kr,ModelPreferencesSchema:Wr,ToolChoiceSchema:Zr,BooleanSchemaSchema:Yr,StringSchemaSchema:Xr,NumberSchemaSchema:Qr,UntitledSingleSelectEnumSchemaSchema:en,TitledSingleSelectEnumSchemaSchema:tn,LegacyTitledEnumSchemaSchema:rn,SingleSelectEnumSchemaSchema:nn,UntitledMultiSelectEnumSchemaSchema:on,TitledMultiSelectEnumSchemaSchema:sn,MultiSelectEnumSchemaSchema:an,EnumSchemaSchema:cn,PrimitiveSchemaDefinitionSchema:dn,ElicitRequestFormParamsSchema:Pt,ResourceTemplateReferenceSchema:At,PromptReferenceSchema:xt,RootSchema:un,ClientCapabilities2026Schema:ln,ServerCapabilities2026Schema:Qt,RequestMetaEnvelopeSchema:er,ToolSchema:Ut,ToolResultContentSchema:pn,SamplingMessageContentBlockSchema:tr,SamplingMessageSchema:Ot,ResultTypeSchema:rr,ResultMetaSchema:nr,ResultSchema:mn,PaginatedResultSchema:go,CallToolResultSchema:sr,ListToolsResultSchema:hn,ListPromptsResultSchema:fn,GetPromptResultSchema:gn,ListResourcesResultSchema:yn,ListResourceTemplatesResultSchema:Sn,ReadResourceResultSchema:_n,CompleteResultSchema:wn,CacheableResultSchema:yo,DiscoverResultSchema:Rn,CreateMessageRequestParamsSchema:dt,CreateMessageRequestSchema:bn,ListRootsRequestSchema:vn,CreateMessageResultSchema:In,ListRootsResultSchema:Cn,ElicitResultSchema:Tn,ElicitRequestURLParamsSchema:kn,ElicitRequestParamsSchema:En,ElicitRequestSchema:Pn,InputRequestSchema:An,InputResponseSchema:xn,InputRequestsSchema:Un,InputResponsesSchema:On,InputRequiredResultSchema:Mt,InputResponseRequestParamsSchema:So,CallToolRequestSchema:wo,ListToolsRequestSchema:Ro,ListPromptsRequestSchema:bo,GetPromptRequestSchema:vo,ListResourcesRequestSchema:Io,ListResourceTemplatesRequestSchema:Co,ReadResourceRequestSchema:To,CompleteRequestSchema:ko,DiscoverRequestSchema:Eo,SubscriptionFilterSchema:ir,SubscriptionsListenRequestSchema:Po,SubscriptionsListenResultMetaSchema:Ao,SubscriptionsListenResultSchema:xo,dispatchRequestSchemas:ut,dispatchResultSchemas:Uo,NotificationMetaSchema:qt,SubscriptionsAcknowledgedNotificationSchema:ar,CancelledNotificationParamsSchema:cr,CancelledNotificationSchema:dr,notificationSchemas2026:zs,JSONRPCResultResponseSchema:ge(mn),CallToolResultResponseSchema:ge(E([sr,Mt])),ListToolsResultResponseSchema:ge(hn),ListPromptsResultResponseSchema:ge(fn),GetPromptResultResponseSchema:ge(E([gn,Mt])),ListResourcesResultResponseSchema:ge(yn),ListResourceTemplatesResultResponseSchema:ge(Sn),ReadResourceResultResponseSchema:ge(E([_n,Mt])),CompleteResultResponseSchema:ge(wn),DiscoverResultResponseSchema:ge(Rn)}}n(hy,"build");var fy;function ht(){return fy??=hy()}n(ht,"buildSchemas2026");var gy=["tools/list","prompts/list","resources/list","resources/templates/list","resources/read","server/discover"];function yy(e){return gy.includes(e)}n(yy,"isCacheableResultMethod");var Ri=Symbol("modelcontextprotocol.resultCacheHintFallback");function Sy(e){return e[Ri]}n(Sy,"cacheHintFallbackOf");function Yl(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}n(Yl,"isValidCacheTtlMs");function Xl(e){return e==="public"||e==="private"}n(Xl,"isValidCacheScope");var P=(function(e){return e[e.ParseError=-32700]="ParseError",e[e.InvalidRequest=-32600]="InvalidRequest",e[e.MethodNotFound=-32601]="MethodNotFound",e[e.InvalidParams=-32602]="InvalidParams",e[e.InternalError=-32603]="InternalError",e[e.ResourceNotFound=-32002]="ResourceNotFound",e[e.MissingRequiredClientCapability=-32021]="MissingRequiredClientCapability",e[e.UnsupportedProtocolVersion=-32022]="UnsupportedProtocolVersion",e[e.UrlElicitationRequired=-32042]="UrlElicitationRequired",e})({}),ie=class Ql extends Error{static{n(this,"ProtocolError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ProtocolError"})}static[Symbol.hasInstance](t){return Ie(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,t)}constructor(t,r,o){super(r),this.code=t,this.data=o,this.name="ProtocolError",Ht(this,new.target)}static fromError(t,r,o){if(t===P.UrlElicitationRequired&&o){let s=o;if(s.elicitations)return new as(s.elicitations,r)}if(t===P.UnsupportedProtocolVersion&&o){let s=o;if(Array.isArray(s.supported)&&typeof s.requested=="string")return new tp({supported:s.supported,requested:s.requested},r)}if(t===P.InvalidParams||t===P.ResourceNotFound){let s=o;if(typeof s?.uri=="string"&&(t===P.ResourceNotFound||Object.keys(s).length===1))return new ep(s.uri,r)}if(t===P.MissingRequiredClientCapability&&o){let s=o;if(s.requiredCapabilities!==null&&typeof s.requiredCapabilities=="object"&&!Array.isArray(s.requiredCapabilities))return new rp({requiredCapabilities:s.requiredCapabilities},r)}return new Ql(t,r,o)}},ep=class extends ie{static{n(this,"ResourceNotFoundError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ResourceNotFoundError"})}constructor(e,t=`Resource not found: ${e}`){super(P.InvalidParams,t,{uri:e})}get uri(){return this.data.uri}},as=class extends ie{static{n(this,"UrlElicitationRequiredError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UrlElicitationRequiredError"})}constructor(e,t=`URL elicitation${e.length>1?"s":""} required`){super(P.UrlElicitationRequired,t,{elicitations:e})}get elicitations(){return this.data?.elicitations??[]}},tp=class extends ie{static{n(this,"UnsupportedProtocolVersionError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnsupportedProtocolVersionError"})}constructor(e,t=`Unsupported protocol version: ${e.requested}`){super(P.UnsupportedProtocolVersion,t,e)}get supported(){return this.data.supported}get requested(){return this.data.requested}},rp=class extends ie{static{n(this,"MissingRequiredClientCapabilityError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.MissingRequiredClientCapabilityError"})}constructor(e,t=`Missing required client capabilities: ${Object.keys(e.requiredCapabilities).join(", ")}`){super(P.MissingRequiredClientCapability,t,e)}get requiredCapabilities(){return this.data.requiredCapabilities}},_y=0,wy="private",Ry=["tools/call","prompts/get","resources/read"];function by(e,t){let r=t.resultType;if(r===void 0)return{...t,resultType:"complete"};if(r==="complete"||Ry.includes(e))return t;throw new ie(P.InternalError,`Handler for ${e} returned resultType '${String(r)}', but results of ${e} only support 'complete' on protocol revision 2026-07-28`)}n(by,"stampResultType");function vy(e,t){let r=Sy(t);if(t.resultType!=="complete"||!yy(e))return r===void 0?t:Ey(t);let o=t,s=Yl(o.ttlMs)?o.ttlMs:Ty(r),i=Xl(o.cacheScope)?o.cacheScope:ky(r),c={...o,ttlMs:s,cacheScope:i};return delete c[Ri],c}n(vy,"fillCacheFields");function Iy(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Iy,"isPlainObject$3");function Cy(e,t){if(t===void 0)return e;let r=e._meta;return r===void 0?{...e,_meta:{[lr]:t}}:!Iy(r)||r[lr]!==void 0?e:{...e,_meta:{...r,[lr]:t}}}n(Cy,"stampServerInfoMeta");function Ty(e){return e!==void 0&&Yl(e.ttlMs)?e.ttlMs:_y}n(Ty,"resolveTtlMs");function ky(e){return e!==void 0&&Xl(e.cacheScope)?e.cacheScope:wy}n(ky,"resolveCacheScope");function Ey(e){let t={...e};return delete t[Ri],t}n(Ey,"stripCacheHintFallback");var Py=["elicitation/create","sampling/createMessage","roots/list"],ns;function bi(){if(ns)return ns;let e=ht();return ns={request:{"elicitation/create":m({method:g("elicitation/create"),params:e.ElicitRequestParamsSchema}),"sampling/createMessage":m({method:g("sampling/createMessage"),params:e.CreateMessageRequestParamsSchema}),"roots/list":m({method:g("roots/list"),params:q({}).optional()})},response:{"elicitation/create":e.ElicitResultSchema,"sampling/createMessage":e.CreateMessageResultSchema,"roots/list":e.ListRootsResultSchema}},ns}n(bi,"inputSchemaMaps");function Ay(){bi()}n(Ay,"warmInputSchemaMaps2026");function np(e){return Py.includes(e)}n(np,"isInputRequestMethod2026");function ci(e){return np(e)?bi().request[e]:void 0}n(ci,"getInputRequestSchema2026");function xy(e){return np(e)?bi().response[e]:void 0}n(xy,"getInputResponseSchema2026");var vi={"tools/call":null,"tools/list":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"completion/complete":null,"server/discover":null,"subscriptions/listen":null},op={"notifications/cancelled":null,"notifications/progress":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/subscriptions/acknowledged":null};function sp(e){return Object.prototype.hasOwnProperty.call(vi,e)}n(sp,"hasRequestMethod2026");function ip(e){return Object.prototype.hasOwnProperty.call(op,e)}n(ip,"hasNotificationMethod2026");function Uy(e){return Object.prototype.hasOwnProperty.call(vi,e)}n(Uy,"hasResultMethod2026");function Oy(e){return sp(e)?ht().dispatchRequestSchemas[e]:void 0}n(Oy,"getRequestSchema2026");function My(e){return Uy(e)?ht().dispatchResultSchemas[e]:void 0}n(My,"getResultSchema2026");function zy(e){return ip(e)?ht().notificationSchemas2026[e]:void 0}n(zy,"getNotificationSchema2026");var MT=Object.keys(vi),zT=Object.keys(op);function Zn(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Zn,"isPlainObject$2");function Kn(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n(Kn,"triState");var qy={ok:!1,reason:"not-in-era"},Ny=[ur,pr];function jy(e,t){let r=t,o=!1,s=n(()=>(o||(r={...r},o=!0),r),"copy"),i=t.tools;e==="tools/list"&&Array.isArray(i)&&i.some(a=>Zn(a)&&"execution"in a)&&(s().tools=i.map(a=>{if(!Zn(a)||!("execution"in a))return a;let u={...a};return delete u.execution,u}));let c=t.capabilities;if(Zn(c)&&"tasks"in c){let a={...c};delete a.tasks,s().capabilities=a}return r}n(jy,"enforceDeletedFields");var Ii={era:"2026-07-28",hasRequestMethod:sp,hasNotificationMethod:ip,hasInputRequestMethod:n(e=>ci(e)!==void 0,"hasInputRequestMethod"),validateRequest:n((e,t)=>Kn(Oy(e),t),"validateRequest"),validateResult:n((e,t)=>Kn(My(e),t),"validateResult"),validateNotification:n((e,t)=>Kn(zy(e),t),"validateNotification"),validateInputRequest:n((e,t)=>Kn(ci(e),t),"validateInputRequest"),validateInputResponse:n((e,t)=>Kn(xy(e),t),"validateInputResponse"),samplingResultVariant:n(()=>qy,"samplingResultVariant"),outboundEnvelope(e){return{[ur]:e.protocolVersion,[Dn]:e.clientInfo,[pr]:e.clientCapabilities,...e.logLevel!==void 0&&{[$n]:e.logLevel}}},validateEnvelopeMeta(e){let t=[];for(let o of Ny)o in e||t.push({key:o,problem:"missing"});let r=ht().RequestMetaEnvelopeSchema.safeParse(e);if(!r.success)for(let o of r.error.issues){let s=o.path.map(String),i=s.length>0?s.join("."):"_meta";s.length===1&&t.some(c=>c.key===i&&c.problem==="missing")||t.push({key:i,problem:o.message})}return t},projectCallToolResult:n(e=>Fl(e),"projectCallToolResult"),inputRequestSchema:ci,decodeResult(e,t){if(!Zn(t))return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: not an object`,{method:e})};let r=t.resultType;if(r===void 0)return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: missing required resultType \u2014 servers implementing protocol revision 2026-07-28 MUST include it (the absent-means-complete bridge applies only to earlier-revision servers)`,{method:e,violation:"missing-resultType"})};if(typeof r!="string")return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: non-string resultType`,{method:e,resultType:r})};if(r==="input_required"){let c=t.inputRequests,a=Zn(c)?c:{},u=t.requestState;return Object.keys(a).length===0&&typeof u!="string"?{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`,{method:e,violation:"input-required-missing-both"})}:{kind:"input_required",inputRequests:a,...typeof u=="string"&&{requestState:u}}}if(r!=="complete")return{kind:"invalid",error:new re(se.UnsupportedResultType,`Unsupported result type '${r}' for ${e}`,{resultType:r,method:e})};let o=ap(),s=Object.hasOwn(o,e)?o[e]:void 0;if(s!==void 0){let c=s.safeParse(t);if(!c.success)return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: ${c.error}`,{method:e})}}let i={...t};return delete i.resultType,{kind:"complete",result:i}},encodeResult(e,t,r){return Cy(vy(e,by(e,jy(e,t))),r)},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope(e){if(e.envelope===void 0)return"Request is missing the required _meta envelope for protocol revision 2026-07-28 (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities)";let t=ht().RequestMetaEnvelopeSchema.safeParse(e.envelope);if(!t.success)return`Invalid _meta envelope for protocol revision 2026-07-28: ${t.error.issues.map(r=>r.message).join("; ")}`}},os;function ap(){if(os)return os;let e=ht();return os={"tools/call":e.CallToolResultSchema,"tools/list":e.ListToolsResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"completion/complete":e.CompleteResultSchema,"server/discover":e.DiscoverResultSchema},os}n(ap,"getWireResultSchemas");function Dy(){ap()}n(Dy,"warmWireResultSchemas2026");var Ci="2026-07-28";function Xn(e){return e!==void 0&&Bl(e)?Ii:wi}n(Xn,"codecForVersion");function zl(e){return e.revision!==void 0?Xn(e.revision).era:e.era==="modern"?Ii.era:wi.era}n(zl,"classifiedWireEra");function di(e){return cp.some(t=>t.hasRequestMethod(e))}n(di,"isSpecRequestMethod");function ui(e){return cp.some(t=>t.hasNotificationMethod(e))}n(ui,"isSpecNotificationMethod");var cp=[wi,Ii],$y=Pl({AnnotationsSchema:n(()=>Dc,"AnnotationsSchema"),AudioContentSchema:n(()=>Sd,"AudioContentSchema"),BaseMetadataSchema:n(()=>yc,"BaseMetadataSchema"),BaseRequestParamsSchema:n(()=>nc,"BaseRequestParamsSchema"),BlobResourceContentsSchema:n(()=>Nc,"BlobResourceContentsSchema"),BooleanSchemaSchema:n(()=>Gs,"BooleanSchemaSchema"),CallToolRequestParamsSchema:n(()=>Od,"CallToolRequestParamsSchema"),CallToolRequestSchema:n(()=>Md,"CallToolRequestSchema"),CallToolResultSchema:n(()=>xd,"CallToolResultSchema"),CancelTaskRequestSchema:n(()=>ku,"CancelTaskRequestSchema"),CancelTaskResultSchema:n(()=>Eu,"CancelTaskResultSchema"),CancelledNotificationParamsSchema:n(()=>mc,"CancelledNotificationParamsSchema"),CancelledNotificationSchema:n(()=>hc,"CancelledNotificationSchema"),ClientCapabilitiesSchema:n(()=>Rc,"ClientCapabilitiesSchema"),ClientNotificationSchema:n(()=>Au,"ClientNotificationSchema"),ClientRequestSchema:n(()=>Pu,"ClientRequestSchema"),ClientResultSchema:n(()=>xu,"ClientResultSchema"),ClientTasksCapabilitySchema:n(()=>_c,"ClientTasksCapabilitySchema"),CompatibilityCallToolResultSchema:n(()=>Ud,"CompatibilityCallToolResultSchema"),CompleteRequestParamsSchema:n(()=>cu,"CompleteRequestParamsSchema"),CompleteRequestSchema:n(()=>du,"CompleteRequestSchema"),CompleteResultSchema:n(()=>uu,"CompleteResultSchema"),ContentBlockSchema:n(()=>bd,"ContentBlockSchema"),CreateMessageRequestParamsSchema:n(()=>Kd,"CreateMessageRequestParamsSchema"),CreateMessageRequestSchema:n(()=>Wd,"CreateMessageRequestSchema"),CreateMessageResultSchema:n(()=>Zd,"CreateMessageResultSchema"),CreateMessageResultWithToolsSchema:n(()=>Yd,"CreateMessageResultWithToolsSchema"),CreateTaskResultSchema:n(()=>Su,"CreateTaskResultSchema"),CursorSchema:n(()=>Qa,"CursorSchema"),DiscoverRequestSchema:n(()=>kc,"DiscoverRequestSchema"),DiscoverResultSchema:n(()=>Bs,"DiscoverResultSchema"),ElicitRequestFormParamsSchema:n(()=>$o,"ElicitRequestFormParamsSchema"),ElicitRequestParamsSchema:n(()=>tu,"ElicitRequestParamsSchema"),ElicitRequestSchema:n(()=>ru,"ElicitRequestSchema"),ElicitRequestURLParamsSchema:n(()=>Lo,"ElicitRequestURLParamsSchema"),ElicitResultSchema:n(()=>su,"ElicitResultSchema"),ElicitationCompleteNotificationParamsSchema:n(()=>nu,"ElicitationCompleteNotificationParamsSchema"),ElicitationCompleteNotificationSchema:n(()=>ou,"ElicitationCompleteNotificationSchema"),EmbeddedResourceSchema:n(()=>wd,"EmbeddedResourceSchema"),EmptyResultSchema:n(()=>pc,"EmptyResultSchema"),EnumSchemaSchema:n(()=>eu,"EnumSchemaSchema"),GetPromptRequestParamsSchema:n(()=>hd,"GetPromptRequestParamsSchema"),GetPromptRequestSchema:n(()=>fd,"GetPromptRequestSchema"),GetPromptResultSchema:n(()=>Id,"GetPromptResultSchema"),GetTaskPayloadRequestSchema:n(()=>vu,"GetTaskPayloadRequestSchema"),GetTaskPayloadResultSchema:n(()=>Iu,"GetTaskPayloadResultSchema"),GetTaskRequestSchema:n(()=>Ru,"GetTaskRequestSchema"),GetTaskResultSchema:n(()=>bu,"GetTaskResultSchema"),IconSchema:n(()=>fc,"IconSchema"),IconsSchema:n(()=>gc,"IconsSchema"),ImageContentSchema:n(()=>yd,"ImageContentSchema"),ImplementationSchema:n(()=>Sc,"ImplementationSchema"),InitializeRequestParamsSchema:n(()=>bc,"InitializeRequestParamsSchema"),InitializeRequestSchema:n(()=>vc,"InitializeRequestSchema"),InitializeResultSchema:n(()=>Cc,"InitializeResultSchema"),InitializedNotificationSchema:n(()=>Tc,"InitializedNotificationSchema"),JSONArraySchema:n(()=>Ya,"JSONArraySchema"),JSONObjectSchema:n(()=>Za,"JSONObjectSchema"),JSONRPCErrorResponseSchema:n(()=>Ln,"JSONRPCErrorResponseSchema"),JSONRPCMessageSchema:n(()=>Hs,"JSONRPCMessageSchema"),JSONRPCNotificationSchema:n(()=>$s,"JSONRPCNotificationSchema"),JSONRPCRequestSchema:n(()=>Dt,"JSONRPCRequestSchema"),JSONRPCResponseSchema:n(()=>lc,"JSONRPCResponseSchema"),JSONRPCResultResponseSchema:n(()=>Ls,"JSONRPCResultResponseSchema"),JSONValueSchema:n(()=>Wa,"JSONValueSchema"),LegacyTitledEnumSchemaSchema:n(()=>Ks,"LegacyTitledEnumSchemaSchema"),ListChangedOptionsBaseSchema:n(()=>Fs,"ListChangedOptionsBaseSchema"),ListPromptsRequestSchema:n(()=>pd,"ListPromptsRequestSchema"),ListPromptsResultSchema:n(()=>md,"ListPromptsResultSchema"),ListResourceTemplatesRequestSchema:n(()=>Fc,"ListResourceTemplatesRequestSchema"),ListResourceTemplatesResultSchema:n(()=>Gc,"ListResourceTemplatesResultSchema"),ListResourcesRequestSchema:n(()=>Hc,"ListResourcesRequestSchema"),ListResourcesResultSchema:n(()=>Bc,"ListResourcesResultSchema"),ListRootsRequestSchema:n(()=>pu,"ListRootsRequestSchema"),ListRootsResultSchema:n(()=>mu,"ListRootsResultSchema"),ListTasksRequestSchema:n(()=>Cu,"ListTasksRequestSchema"),ListTasksResultSchema:n(()=>Tu,"ListTasksResultSchema"),ListToolsRequestSchema:n(()=>Pd,"ListToolsRequestSchema"),ListToolsResultSchema:n(()=>Ad,"ListToolsResultSchema"),LoggingLevelSchema:n(()=>qd,"LoggingLevelSchema"),LoggingMessageNotificationParamsSchema:n(()=>Dd,"LoggingMessageNotificationParamsSchema"),LoggingMessageNotificationSchema:n(()=>$d,"LoggingMessageNotificationSchema"),ModelHintSchema:n(()=>Ld,"ModelHintSchema"),ModelPreferencesSchema:n(()=>Hd,"ModelPreferencesSchema"),MultiSelectEnumSchemaSchema:n(()=>Qd,"MultiSelectEnumSchemaSchema"),NotificationSchema:n(()=>ac,"NotificationSchema"),NotificationsParamsSchema:n(()=>ic,"NotificationsParamsSchema"),NumberSchemaSchema:n(()=>Do,"NumberSchemaSchema"),PaginatedRequestParamsSchema:n(()=>Uc,"PaginatedRequestParamsSchema"),PaginatedRequestSchema:n(()=>Oc,"PaginatedRequestSchema"),PaginatedResultSchema:n(()=>Mc,"PaginatedResultSchema"),PingRequestSchema:n(()=>Ec,"PingRequestSchema"),PrimitiveSchemaDefinitionSchema:n(()=>Ys,"PrimitiveSchemaDefinitionSchema"),ProgressNotificationParamsSchema:n(()=>Ac,"ProgressNotificationParamsSchema"),ProgressNotificationSchema:n(()=>xc,"ProgressNotificationSchema"),ProgressSchema:n(()=>Pc,"ProgressSchema"),ProgressTokenSchema:n(()=>Xa,"ProgressTokenSchema"),PromptArgumentSchema:n(()=>ud,"PromptArgumentSchema"),PromptListChangedNotificationSchema:n(()=>Cd,"PromptListChangedNotificationSchema"),PromptMessageSchema:n(()=>vd,"PromptMessageSchema"),PromptReferenceSchema:n(()=>au,"PromptReferenceSchema"),PromptSchema:n(()=>ld,"PromptSchema"),ReadResourceRequestParamsSchema:n(()=>Vc,"ReadResourceRequestParamsSchema"),ReadResourceRequestSchema:n(()=>Kc,"ReadResourceRequestSchema"),ReadResourceResultSchema:n(()=>Wc,"ReadResourceResultSchema"),RelatedTaskMetadataSchema:n(()=>tc,"RelatedTaskMetadataSchema"),RequestIdSchema:n(()=>uc,"RequestIdSchema"),RequestMetaSchema:n(()=>rc,"RequestMetaSchema"),RequestSchema:n(()=>sc,"RequestSchema"),ResourceContentsSchema:n(()=>zc,"ResourceContentsSchema"),ResourceLinkSchema:n(()=>Rd,"ResourceLinkSchema"),ResourceListChangedNotificationSchema:n(()=>Zc,"ResourceListChangedNotificationSchema"),ResourceRequestParamsSchema:n(()=>Jc,"ResourceRequestParamsSchema"),ResourceSchema:n(()=>$c,"ResourceSchema"),ResourceTemplateReferenceSchema:n(()=>iu,"ResourceTemplateReferenceSchema"),ResourceTemplateSchema:n(()=>Lc,"ResourceTemplateSchema"),ResourceUpdatedNotificationParamsSchema:n(()=>cd,"ResourceUpdatedNotificationParamsSchema"),ResourceUpdatedNotificationSchema:n(()=>dd,"ResourceUpdatedNotificationSchema"),ResultMetaObjectSchema:n(()=>cc,"ResultMetaObjectSchema"),ResultSchema:n(()=>dc,"ResultSchema"),RoleSchema:n(()=>jc,"RoleSchema"),RootSchema:n(()=>lu,"RootSchema"),RootsListChangedNotificationSchema:n(()=>hu,"RootsListChangedNotificationSchema"),SamplingContentSchema:n(()=>Gd,"SamplingContentSchema"),SamplingMessageContentBlockSchema:n(()=>Jd,"SamplingMessageContentBlockSchema"),SamplingMessageSchema:n(()=>Vd,"SamplingMessageSchema"),ServerCapabilitiesSchema:n(()=>Ic,"ServerCapabilitiesSchema"),ServerNotificationSchema:n(()=>Ou,"ServerNotificationSchema"),ServerRequestSchema:n(()=>Uu,"ServerRequestSchema"),ServerResultSchema:n(()=>Mu,"ServerResultSchema"),ServerTasksCapabilitySchema:n(()=>wc,"ServerTasksCapabilitySchema"),SetLevelRequestParamsSchema:n(()=>Nd,"SetLevelRequestParamsSchema"),SetLevelRequestSchema:n(()=>jd,"SetLevelRequestSchema"),SingleSelectEnumSchemaSchema:n(()=>Xd,"SingleSelectEnumSchemaSchema"),StringSchemaSchema:n(()=>jo,"StringSchemaSchema"),SubscribeRequestParamsSchema:n(()=>Yc,"SubscribeRequestParamsSchema"),SubscribeRequestSchema:n(()=>Xc,"SubscribeRequestSchema"),SubscriptionFilterSchema:n(()=>td,"SubscriptionFilterSchema"),SubscriptionsAcknowledgedNotificationParamsSchema:n(()=>od,"SubscriptionsAcknowledgedNotificationParamsSchema"),SubscriptionsAcknowledgedNotificationSchema:n(()=>sd,"SubscriptionsAcknowledgedNotificationSchema"),SubscriptionsListenRequestParamsSchema:n(()=>rd,"SubscriptionsListenRequestParamsSchema"),SubscriptionsListenRequestSchema:n(()=>nd,"SubscriptionsListenRequestSchema"),SubscriptionsListenResultMetaSchema:n(()=>id,"SubscriptionsListenResultMetaSchema"),SubscriptionsListenResultSchema:n(()=>ad,"SubscriptionsListenResultSchema"),TaskAugmentedRequestParamsSchema:n(()=>oc,"TaskAugmentedRequestParamsSchema"),TaskCreationParamsSchema:n(()=>fu,"TaskCreationParamsSchema"),TaskMetadataSchema:n(()=>ec,"TaskMetadataSchema"),TaskSchema:n(()=>yu,"TaskSchema"),TaskStatusNotificationParamsSchema:n(()=>_u,"TaskStatusNotificationParamsSchema"),TaskStatusNotificationSchema:n(()=>wu,"TaskStatusNotificationSchema"),TaskStatusSchema:n(()=>gu,"TaskStatusSchema"),TextContentSchema:n(()=>gd,"TextContentSchema"),TextResourceContentsSchema:n(()=>qc,"TextResourceContentsSchema"),TitledMultiSelectEnumSchemaSchema:n(()=>Zs,"TitledMultiSelectEnumSchemaSchema"),TitledSingleSelectEnumSchemaSchema:n(()=>Vs,"TitledSingleSelectEnumSchemaSchema"),ToolAnnotationsSchema:n(()=>Td,"ToolAnnotationsSchema"),ToolChoiceSchema:n(()=>Bd,"ToolChoiceSchema"),ToolExecutionSchema:n(()=>kd,"ToolExecutionSchema"),ToolListChangedNotificationSchema:n(()=>zd,"ToolListChangedNotificationSchema"),ToolResultContentSchema:n(()=>Fd,"ToolResultContentSchema"),ToolSchema:n(()=>Ed,"ToolSchema"),ToolUseContentSchema:n(()=>_d,"ToolUseContentSchema"),UnsubscribeRequestParamsSchema:n(()=>Qc,"UnsubscribeRequestParamsSchema"),UnsubscribeRequestSchema:n(()=>ed,"UnsubscribeRequestSchema"),UntitledMultiSelectEnumSchemaSchema:n(()=>Ws,"UntitledMultiSelectEnumSchemaSchema"),UntitledSingleSelectEnumSchemaSchema:n(()=>Js,"UntitledSingleSelectEnumSchemaSchema")});var dp=n(e=>Dt.safeParse(e).success,"isJSONRPCRequest"),up=n(e=>$s.safeParse(e).success,"isJSONRPCNotification"),fi=n(e=>Ls.safeParse(e).success,"isJSONRPCResultResponse"),lp=n(e=>Ln.safeParse(e).success,"isJSONRPCErrorResponse");var Yn=-32020,qT=[{rung:"http-method",order:1,evaluatedAt:"edge",codes:[-32e3],conformance:[],rationale:"The modern era is POST-only; GET/DELETE are body-less 2025-era session operations and are method-routed to legacy serving (405 when legacy serving is not configured), before any body is read."},{rung:"jsonrpc-shape",order:2,evaluatedAt:"edge",codes:[P.InvalidRequest],conformance:["server-stateless"],rationale:"The body must be a JSON-RPC request or notification: posted responses and batch arrays containing a modern or invalid element are rejected before classification (element-wise batch rule); all-legacy arrays stay legacy traffic."},{rung:"era-classification",order:3,evaluatedAt:"edge",codes:[Yn,P.UnsupportedProtocolVersion],conformance:["server-stateless","http-header-validation","http-custom-header-server-validation"],rationale:"Body-primary era classification with the protocol-version header as a cross-check; a header/body disagreement is rejected with -32020 (HeaderMismatch), and an envelope-less request on a modern-only endpoint is answered with the unsupported-protocol-version error naming the supported revisions."},{rung:"envelope",order:4,evaluatedAt:"edge",codes:[P.InvalidParams],conformance:["server-stateless"],rationale:"A present envelope claim with a malformed envelope \u2014 and a missing envelope on a request whose protocol-version header names a modern revision \u2014 is an invalid-params rejection naming the offending or missing key(s); never a silent fall back to legacy handling. This is the only place an invalid-params rejection maps to HTTP 400."},{rung:"method-registry",order:5,evaluatedAt:"dispatch",codes:[P.MethodNotFound],conformance:["server-stateless"],rationale:"Method existence outranks parameter validity: a method absent from the negotiated revision\u2019s registry (or with no handler installed) answers method-not-found before params or capabilities are looked at."},{rung:"request-params",order:6,evaluatedAt:"dispatch",codes:[P.InvalidParams],conformance:[],rationale:"Per-method params validation; emitted in-band by the dispatch layer (HTTP 200), never via the ladder status table."},{rung:"standard-header-validation",order:7,evaluatedAt:"pre-dispatch",codes:[Yn],conformance:["http-header-validation"],rationale:"SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."},{rung:"client-capabilities",order:8,evaluatedAt:"pre-dispatch",codes:[P.MissingRequiredClientCapability],conformance:["server-stateless"],rationale:"The capability requirement is checked by the HTTP entry, pre-dispatch, against the validated envelope the classifier produced \u2014 pinning the spec-mandated HTTP 400 independently of how dispatch- and handler-produced errors are mapped. The documented order (after method resolution and params validation) is preserved observably only while the requirement table is empty: once a served method gains a requirement entry, a request that is missing the capability and would also fail a dispatch rung is answered by this gate first, so the entry must consult the method registry before the gate if the documented precedence is to stay observable."},{rung:"param-header-validation",order:9,evaluatedAt:"pre-dispatch",codes:[Yn],conformance:["http-custom-header-server-validation"],rationale:"SEP-2243 `Mcp-Param-*` headers are validated against the named tool\u2019s `x-mcp-header` declarations and the body `arguments` after the tool registry is known and before dispatch reaches the handler; a missing/disagreeing/malformed header is rejected 400 / -32020 with the same shape as the standard-header cross-checks. The documented order (after method resolution and params validation) is preserved observably only when the body `arguments` would otherwise validate: the check runs pre-dispatch, so a `tools/call` that fails BOTH this rung and a dispatch-time rung (e.g. order-6 `request-params`, -32602) is answered by this gate first with 400 / -32020, not by the earlier-ordered rung."}],NT={[P.ParseError]:400,[P.InvalidRequest]:400,[P.MethodNotFound]:404,[P.UnsupportedProtocolVersion]:400,[P.MissingRequiredClientCapability]:400,[Yn]:400};function Ti(e,t){return Ha(e,t)}n(Ti,"parseSchema");function Wn(e){return new Set(e.flatMap(t=>Object.keys(t.shape)))}n(Wn,"shapeKeys");function gi(e){if(e==null)return!1;let t=typeof e;return t!=="object"&&t!=="function"||!("~standard"in e)?!1:typeof e["~standard"]?.validate=="function"}n(gi,"isStandardSchema");var ql=!1,yi="draft-2020-12";function Ly(e,t="input"){let r=e["~standard"],o;if(r.jsonSchema)o=r.jsonSchema[t]({target:yi});else if(r.vendor==="zod"){if(!("_zod"in e))throw new Error("Schema appears to be from zod 3, which the SDK cannot convert to JSON Schema. Upgrade to zod >=4.2.0, or wrap your JSON Schema with fromJsonSchema().");ql||(ql=!0,console.warn("[mcp-sdk] Your zod version does not implement `~standard.jsonSchema` (added in zod 4.2.0). Falling back to z.toJSONSchema(). Upgrade to zod >=4.2.0 to silence this warning.")),o=qs(e,{target:yi,io:t})}else throw new Error(`Schema library "${r.vendor}" does not implement StandardJSONSchemaV1 (\`~standard.jsonSchema\`). Upgrade to a version that does, or wrap your JSON Schema with fromJsonSchema().`);if(t==="output")return o.type!==void 0?o:pp(o)?{type:"object",...o}:o;if(o.type!==void 0&&o.type!=="object")throw new Error(`MCP tool and prompt schemas must describe objects (got type: ${JSON.stringify(o.type)}). Wrap your schema in z.object({...}) or equivalent.`);return{type:"object",...o}}n(Ly,"standardSchemaToJsonSchema");function pp(e){if("properties"in e||"patternProperties"in e||"additionalProperties"in e||"required"in e)return!0;for(let t of["oneOf","anyOf","allOf"]){let r=e[t];if(Array.isArray(r)&&r.length>0)return r.every(o=>o!==null&&typeof o=="object"&&(o.type==="object"||pp(o)))}return!1}n(pp,"isProvablyObjectShapedRoot");function Hy(e){return e.path?.length?`${e.path.map(t=>String(typeof t=="object"?t.key:t)).join(".")}: ${e.message}`:e.message}n(Hy,"formatIssue");async function li(e,t){let r=await e["~standard"].validate(t);return r.issues&&r.issues.length>0?{success:!1,error:r.issues.map(o=>Hy(o)).join(", ")}:{success:!0,data:r.value}}n(li,"validateStandardSchema");function By(e){let t=qs(e,{target:yi,io:"input"});return typeof t.pattern=="string"?t.pattern:void 0}n(By,"zodEmittedPattern");var Fy=/\\\.\\d\{(\d+)\}/;function Gy(e){let t=Fy.exec(e),r=[void 0,-1,0];return t&&r.push(Number(t[1])),[!1,!0].flatMap(o=>[!1,!0].flatMap(s=>r.map(i=>Nn.datetime({local:o,offset:s,precision:i}))))}n(Gy,"datetimeReferenceSchemas");function Jy(e,t){let r;switch(e){case"email":r=[Ba()];break;case"uri":r=[Fa()];break;case"date":r=[Nn.date()];break;case"date-time":r=Gy(t);break}return new Set(r.map(o=>By(o)).filter(o=>o!==void 0))}n(Jy,"referencePatternsForFormat");function Vy(e,t,r){return r!=="zod"?!0:Jy(e,t).has(t)}n(Vy,"isLibraryFormatPattern");function Qn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n(Qn,"isJsonObject");function Ky(e){try{return Ly(e,"input")}catch(t){let r=t instanceof Error?t.message:String(t);throw new ie(P.InvalidParams,`Elicitation requestedSchema must describe an object with flat primitive properties: ${r}`)}}n(Ky,"convertStandardElicitationSchema");var Wy=new Set(["$comment","deprecated","description","examples","readOnly","title","writeOnly"]);function ki(e){return Wy.has(e)||e.startsWith("x-")}n(ki,"isAnnotationOnlyJsonSchemaKeyword");var Zy=new Set(["$schema",...Object.keys($o.shape.requestedSchema.shape)]),Nl={string:Wn([jo,Js,Vs,Ks]),number:Wn([Do]),integer:Wn([Do]),boolean:Wn([Gs]),array:Wn([Ws,Zs])},Yy=new Set(jo.shape.format.unwrap().options);function Xy(e,t,r,o){if(!Qn(e))return e;let s=typeof e.type=="string"&&Object.hasOwn(Nl,e.type)?Nl[e.type]:void 0;if(s===void 0)return e;let i={};for(let[c,a]of Object.entries(e))s.has(c)||ki(c)?i[c]=a:c==="pattern"&&e.type==="string"&&typeof e.format=="string"?Yy.has(e.format)?(typeof a!="string"||!Vy(e.format,a,r))&&o.push(`${t}.${c}`):i[c]=a:o.push(`${t}.${c}`);return i}n(Xy,"walkProperty");function Qy(e,t){let r={},o=[];for(let[s,i]of Object.entries(e))s==="properties"&&Qn(i)?r[s]=Object.fromEntries(Object.entries(i).map(([c,a])=>[c,Xy(a,`properties.${c}`,t,o)])):Zy.has(s)?r[s]=i:ki(s)||o.push(s);if(o.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${o.join(", ")}`);return r}n(Qy,"walkRequestedSchema");function eS(e,t){if(!Qn(e.properties))return t;let r=Object.entries(e.properties).filter(([,o])=>!Ti(Ys,o).success).map(([o])=>`properties.${o}`);return r.length>0?r.join(", "):t}n(eS,"describeUnsupportedProperties");function Si(e,t,r=""){return Array.isArray(e)&&Array.isArray(t)?e.flatMap((o,s)=>Si(o,t[s],`${r}[${s}]`)):!Qn(e)||!Qn(t)?[]:Object.entries(e).flatMap(([o,s])=>{let i=r?`${r}.${o}`:o;return Object.prototype.hasOwnProperty.call(t,o)?Si(s,t[o],i):ki(o)?[]:[i]})}n(Si,"findDroppedConstraintPaths");function tS(e){if(!gi(e.requestedSchema))return{...e,mode:"form",requestedSchema:e.requestedSchema};let t=e.requestedSchema["~standard"].vendor,r=Qy(Ky(e.requestedSchema),t),o=Ti($o.shape.requestedSchema,r);if(!o.success)throw new ie(P.InvalidParams,`Elicitation requestedSchema only supports flat primitive properties (string, number, integer, boolean, and string enums): ${eS(r,o.error.message)}`);let s=Si(r,o.data);if(s.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${s.join(", ")}`);let i=(o.data.required??[]).filter(c=>!Object.prototype.hasOwnProperty.call(o.data.properties,c));if(i.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema lists required properties that are not defined in properties: ${i.join(", ")}`);return{...e,mode:"form",requestedSchema:o.data}}n(tS,"normalizeElicitInputParams");function rS(e){let t=e.inputRequests!==void 0&&Object.keys(e.inputRequests).length>0,r=typeof e.requestState=="string";if(!t&&!r)throw new TypeError("inputRequired() requires at least one of inputRequests (with at least one entry) or requestState (spec: every InputRequiredResult MUST include at least one of the two)");return{resultType:"input_required",...e.inputRequests!==void 0&&{inputRequests:e.inputRequests},...e.requestState!==void 0&&{requestState:e.requestState}}}n(rS,"buildInputRequired");var jT=Object.assign(rS,{elicit(e){try{return{method:"elicitation/create",params:tS(e)}}catch(t){throw t instanceof ie?new TypeError(t.message,{cause:t}):t}},elicitUrl(e){return{method:"elicitation/create",params:{...e,mode:"url"}}},createMessage(e){return{method:"sampling/createMessage",params:e}},listRoots(){return{method:"roots/list"}}});var nS=["AnnotationsSchema","AudioContentSchema","BaseMetadataSchema","BlobResourceContentsSchema","BooleanSchemaSchema","CallToolRequestSchema","CallToolRequestParamsSchema","CallToolResultSchema","CancelledNotificationSchema","CancelledNotificationParamsSchema","CancelTaskRequestSchema","CancelTaskResultSchema","ClientCapabilitiesSchema","ClientNotificationSchema","ClientRequestSchema","ClientResultSchema","CompatibilityCallToolResultSchema","CompleteRequestSchema","CompleteRequestParamsSchema","CompleteResultSchema","ContentBlockSchema","CreateMessageRequestSchema","CreateMessageRequestParamsSchema","CreateMessageResultSchema","CreateMessageResultWithToolsSchema","CreateTaskResultSchema","CursorSchema","DiscoverRequestSchema","DiscoverResultSchema","ElicitationCompleteNotificationSchema","ElicitationCompleteNotificationParamsSchema","ElicitRequestSchema","ElicitRequestFormParamsSchema","ElicitRequestParamsSchema","ElicitRequestURLParamsSchema","ElicitResultSchema","EmbeddedResourceSchema","EmptyResultSchema","EnumSchemaSchema","GetPromptRequestSchema","GetPromptRequestParamsSchema","GetPromptResultSchema","GetTaskPayloadRequestSchema","GetTaskPayloadResultSchema","GetTaskRequestSchema","GetTaskResultSchema","IconSchema","IconsSchema","ImageContentSchema","ImplementationSchema","InitializedNotificationSchema","InitializeRequestSchema","InitializeRequestParamsSchema","InitializeResultSchema","JSONArraySchema","JSONObjectSchema","JSONRPCErrorResponseSchema","JSONRPCMessageSchema","JSONRPCNotificationSchema","JSONRPCRequestSchema","JSONRPCResponseSchema","JSONRPCResultResponseSchema","JSONValueSchema","LegacyTitledEnumSchemaSchema","ListPromptsRequestSchema","ListPromptsResultSchema","ListResourcesRequestSchema","ListResourcesResultSchema","ListResourceTemplatesRequestSchema","ListResourceTemplatesResultSchema","ListRootsRequestSchema","ListRootsResultSchema","ListTasksRequestSchema","ListTasksResultSchema","ListToolsRequestSchema","ListToolsResultSchema","LoggingLevelSchema","LoggingMessageNotificationSchema","LoggingMessageNotificationParamsSchema","ModelHintSchema","ModelPreferencesSchema","MultiSelectEnumSchemaSchema","NotificationSchema","NumberSchemaSchema","PaginatedRequestSchema","PaginatedRequestParamsSchema","PaginatedResultSchema","PingRequestSchema","PrimitiveSchemaDefinitionSchema","ProgressSchema","ProgressNotificationSchema","ProgressNotificationParamsSchema","ProgressTokenSchema","PromptSchema","PromptArgumentSchema","PromptListChangedNotificationSchema","PromptMessageSchema","PromptReferenceSchema","ReadResourceRequestSchema","ReadResourceRequestParamsSchema","ReadResourceResultSchema","RelatedTaskMetadataSchema","RequestSchema","RequestIdSchema","RequestMetaSchema","ResourceSchema","ResourceContentsSchema","ResourceLinkSchema","ResourceListChangedNotificationSchema","ResourceRequestParamsSchema","ResourceTemplateSchema","ResourceTemplateReferenceSchema","ResourceUpdatedNotificationSchema","ResourceUpdatedNotificationParamsSchema","ResultMetaObjectSchema","ResultSchema","RoleSchema","RootSchema","RootsListChangedNotificationSchema","SamplingContentSchema","SamplingMessageSchema","SamplingMessageContentBlockSchema","ServerCapabilitiesSchema","ServerNotificationSchema","ServerRequestSchema","ServerResultSchema","SetLevelRequestSchema","SetLevelRequestParamsSchema","SingleSelectEnumSchemaSchema","StringSchemaSchema","SubscribeRequestSchema","SubscribeRequestParamsSchema","SubscriptionFilterSchema","SubscriptionsAcknowledgedNotificationSchema","SubscriptionsAcknowledgedNotificationParamsSchema","SubscriptionsListenRequestSchema","SubscriptionsListenRequestParamsSchema","SubscriptionsListenResultSchema","SubscriptionsListenResultMetaSchema","TaskAugmentedRequestParamsSchema","TaskCreationParamsSchema","TaskMetadataSchema","TaskSchema","TaskStatusSchema","TaskStatusNotificationSchema","TaskStatusNotificationParamsSchema","TextContentSchema","TextResourceContentsSchema","TitledMultiSelectEnumSchemaSchema","TitledSingleSelectEnumSchemaSchema","ToolSchema","ToolAnnotationsSchema","ToolChoiceSchema","ToolExecutionSchema","ToolListChangedNotificationSchema","ToolResultContentSchema","ToolUseContentSchema","UnsubscribeRequestSchema","UnsubscribeRequestParamsSchema","UntitledMultiSelectEnumSchemaSchema","UntitledSingleSelectEnumSchemaSchema"],oS={IdJagTokenExchangeResponseSchema:Xs,OAuthClientInformationFullSchema:$t,OAuthClientInformationSchema:Hn,OAuthClientMetadataSchema:qu,OAuthClientRegistrationErrorSchema:Nu,OAuthErrorResponseSchema:Ho,OAuthMetadataSchema:fr,OAuthProtectedResourceMetadataSchema:hr,OAuthTokenRevocationRequestSchema:ju,OAuthTokensSchema:lt,OpenIdProviderDiscoveryMetadataSchema:gr,OpenIdProviderMetadataSchema:zu},mp={},hp={};function fp(e,t){let r=e.slice(0,-6);mp[r]=t,hp[r]=o=>t.safeParse(o).success}n(fp,"register");for(let e of nS)fp(e,$y[e]);for(let[e,t]of Object.entries(oS))fp(e,t);var sS=Object.freeze(mp),iS=Object.freeze(hp);function aS(e){switch(e){case"initialize":case"notifications/initialized":return Xn(void 0);case"server/discover":return Xn(Ci);default:return}}n(aS,"bootstrapOutboundCodec");var gp=6e4,cS=[ur,Dn,pr,$n],dS=["inputResponses","requestState"];function jl(e,t){let r=e.params;if(!pi(r))return{message:e,lifted:{}};let o=r._meta,s=pi(o)?cS.filter(u=>u in o):[],i=t==="request"?dS.filter(u=>u in r):[];if(s.length===0&&i.length===0)return{message:e,lifted:{}};let c={},a={...r};if(s.length>0&&pi(o)){let u={},p={...o};for(let h of s)u[h]=o[h],delete p[h];c.envelope=u,Object.keys(p).length>0?a._meta=p:delete a._meta}for(let u of i)u==="inputResponses"&&(c.inputResponses=a[u]),u==="requestState"&&(c.requestState=a[u]),delete a[u];return{message:{...e,params:a},lifted:c}}n(jl,"liftWireOnlyMaterial");function Dl(e,t){let r=e.validateResult(t,void 0);if(!(!r.ok&&r.reason==="not-in-era"))return{"~standard":{version:1,vendor:"mcp-wire-codec",validate(o){let s=e.validateResult(t,o);return s.ok?{value:s.value}:{issues:[{message:s.reason==="invalid"?s.message:`not-in-era: ${t}`}]}}}}}n(Dl,"codecResultValidator");function yp(e){return()=>e}n(yp,"requestStateAccessor");var uS=yp(void 0),lS,pS=class{static{n(this,"Protocol")}_transport;_requestMessageId=0;_requestHandlers=new Map;_requestHandlerAbortControllers=new Map;_notificationHandlers=new Map;_responseHandlers=new Map;_progressHandlers=new Map;_timeoutInfo=new Map;_pendingDebouncedNotifications=new Set;_negotiatedProtocolVersion;static{lS=n((e,t)=>{e._negotiatedProtocolVersion=t},"writeNegotiatedProtocolVersion")}_supportedProtocolVersions;onclose;onerror;fallbackRequestHandler;fallbackNotificationHandler;constructor(e){this._options=e,this._supportedProtocolVersions=e?.supportedProtocolVersions??Ds,this.setNotificationHandler("notifications/cancelled",t=>{this._oncancel(t)}),this.setNotificationHandler("notifications/progress",t=>{this._onprogress(t)}),this.setRequestHandler("ping",t=>({}))}_shouldDropInbound(e){}_outboundMetaEnvelope(){}_envelopeOutbound(e){let t=this._outboundMetaEnvelope();if(t===void 0)return e;let r=e.params??{};return{...e,params:{...r,_meta:{...t,...r._meta}}}}_resolveNonCompleteResult(e,t){return Promise.reject(new re(se.UnsupportedResultType,`Unsupported result type '${e.kind}' for ${t.request.method}`,{resultType:e.kind,method:t.request.method}))}_getRequestHandler(e){return this._requestHandlers.get(e)}async _oncancel(e){e.params.requestId&&this._requestHandlerAbortControllers.get(e.params.requestId)?.abort(e.params.reason)}_setupTimeout(e,t,r,o,s=!1){this._timeoutInfo.set(e,{timeoutId:setTimeout(o,t),startTime:Date.now(),timeout:t,maxTotalTimeout:r,resetTimeoutOnProgress:s,onTimeout:o})}_resetTimeout(e){let t=this._timeoutInfo.get(e);if(!t)return!1;let r=Date.now()-t.startTime;if(t.maxTotalTimeout&&r>=t.maxTotalTimeout)throw this._timeoutInfo.delete(e),new re(se.RequestTimeout,"Maximum total timeout exceeded",{maxTotalTimeout:t.maxTotalTimeout,totalElapsed:r});return clearTimeout(t.timeoutId),t.timeoutId=setTimeout(t.onTimeout,t.timeout),!0}_cleanupTimeout(e){let t=this._timeoutInfo.get(e);t&&(clearTimeout(t.timeoutId),this._timeoutInfo.delete(e))}async connect(e){this._transport=e;let t=this.transport?.onclose;this._transport.onclose=()=>{try{t?.()}finally{this._onclose()}};let r=this.transport?.onerror;this._transport.onerror=s=>{r?.(s),this._onerror(s)};let o=this._transport?.onmessage;this._transport.onmessage=(s,i)=>{o?.(s,i),fi(s)||lp(s)?this._onresponse(s):dp(s)?this._onrequest(s,i):up(s)?this._onnotification(s,i):this._onerror(new Error(`Unknown message type: ${JSON.stringify(s)}`))},e.setSupportedProtocolVersions?.(this._supportedProtocolVersions),await this._transport.start()}_onclose(){let e=this._responseHandlers;this._responseHandlers=new Map,this._progressHandlers.clear(),this._pendingDebouncedNotifications.clear();for(let o of this._timeoutInfo.values())clearTimeout(o.timeoutId);this._timeoutInfo.clear();let t=this._requestHandlerAbortControllers;this._requestHandlerAbortControllers=new Map;let r=new re(se.ConnectionClosed,"Connection closed");this._transport=void 0;try{this.onclose?.()}finally{for(let o of e.values())o(r);for(let o of t.values())o.abort(r)}}_onerror(e){this.onerror?.(e)}_onnotification(e,t){let{message:r}=jl(e,"notification"),o=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop")return;if(t?.classification!==void 0){let c=zl(t.classification);if(c!==o.era){this._onerror(new Error(`Era mismatch on inbound notification '${r.method}': classified as ${c} but this instance serves ${o.era}`));return}}if(ui(r.method)&&!o.hasNotificationMethod(r.method))return;let s=this._notificationHandlers.get(r.method),i=this.fallbackNotificationHandler;s===void 0&&i===void 0||Promise.resolve().then(()=>s===void 0?i(r):s(r,o)).catch(c=>this._onerror(new Error(`Uncaught error in notification handler: ${c}`)))}_onrequest(e,t){let{message:r,lifted:o}=jl(e,"request"),s=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop"){this._onerror(new Error(`Dropped inbound request '${e.method}': not servable on this connection's protocol era`));return}let i=this._transport,c=n((w,I,U)=>{let O={jsonrpc:"2.0",id:r.id,error:{code:w,message:I,...U!==void 0&&{data:U}}};i?.send(O).catch(H=>this._onerror(new Error(`Failed to send an error response: ${H}`)))},"sendErrorResponse");if(t?.classification!==void 0){let w=zl(t.classification);if(w!==s.era){this._onerror(new Error(`Era mismatch on inbound request '${r.method}': classified as ${w} but this instance serves ${s.era}`));let I=t.classification.revision??w;c(P.UnsupportedProtocolVersion,`Unsupported protocol version: ${I}`,{supported:this._supportedProtocolVersions,requested:I});return}}if(di(r.method)&&!s.hasRequestMethod(r.method)){c(P.MethodNotFound,"Method not found");return}let a=this._requestHandlers.get(r.method)??this.fallbackRequestHandler;if(a===void 0){c(P.MethodNotFound,"Method not found");return}let u=s.checkInboundEnvelope(o);if(u!==void 0){c(P.InvalidParams,u);return}let p=n((w,I)=>this._notificationViaCodec(this._resolveOutboundCodec(w.method),w,{...I,relatedRequestId:r.id}),"sendNotification"),h=n((w,I,U)=>this._requestWithSchemaViaCodec(this._resolveOutboundCodec(w.method),w,I,{...U,relatedRequestId:r.id}),"sendRequest"),f=new AbortController;this._requestHandlerAbortControllers.set(r.id,f);let y=o.inputResponses===void 0?void 0:mS(o.inputResponses),S={sessionId:i?.sessionId,mcpReq:{id:r.id,method:r.method,_meta:r.params?._meta,...o.envelope!==void 0&&{envelope:o.envelope},...y!==void 0&&{inputResponses:y.accepted},...y!==void 0&&y.droppedKeys.length>0&&{droppedInputResponseKeys:y.droppedKeys},requestState:o.requestState===void 0?uS:yp(o.requestState),signal:f.signal,send:n(((w,I,U)=>{let O=this._resolveOutboundCodec(w.method);if(this._assertOutboundRequestInEra(O,w.method),gi(I))return h(w,I,U);let H=Dl(O,w.method);if(H===void 0)throw new TypeError(`'${w.method}' is not a spec method; pass a result schema as the second argument to ctx.mcpReq.send().`);return h(w,H,I)}),"send"),notify:p},http:t?.authInfo?{authInfo:t.authInfo}:void 0},k=this.buildContext(S,t);Promise.resolve().then(()=>a(r,k)).then(async w=>{if(f.signal.aborted)return;let I;try{I=s.encodeResult(r.method,w,this._outboundServerInfo())}catch(O){this._onerror(new Error(`Failed to encode result for ${r.method}: ${O}`)),c(P.InternalError,"Internal error");return}let U={result:I,jsonrpc:"2.0",id:r.id};await i?.send(U)},async w=>{if(f.signal.aborted)return;let I=Number.isSafeInteger(w.code)?w.code:P.InternalError,U={jsonrpc:"2.0",id:r.id,error:{code:s.encodeErrorCode(I),message:w.message??"Internal error",...w.data!==void 0&&{data:w.data}}};await i?.send(U)}).catch(w=>this._onerror(new Error(`Failed to send response: ${w}`))).finally(()=>{this._requestHandlerAbortControllers.get(r.id)===f&&this._requestHandlerAbortControllers.delete(r.id)})}_onprogress(e){let{progressToken:t,...r}=e.params,o=Number(t),s=this._progressHandlers.get(o);if(!s){this._onerror(new Error(`Received a progress notification for an unknown token: ${JSON.stringify(e)}`));return}let i=this._responseHandlers.get(o),c=this._timeoutInfo.get(o);if(c&&i&&c.resetTimeoutOnProgress)try{this._resetTimeout(o)}catch(a){this._responseHandlers.delete(o),this._progressHandlers.delete(o),this._cleanupTimeout(o),i(a);return}s(r)}_onresponse(e){let t=Number(e.id),r=this._responseHandlers.get(t);if(r===void 0){this._onerror(new Error(`Received a response for an unknown message ID: ${JSON.stringify(e)}`));return}this._responseHandlers.delete(t),this._cleanupTimeout(t),this._progressHandlers.delete(t),fi(e)?r(e):r(ie.fromError(e.error.code,e.error.message,e.error.data))}get transport(){return this._transport}async close(){await this._transport?.close()}request(e,t,r){let o=this._resolveOutboundCodec(e.method);if(this._assertOutboundRequestInEra(o,e.method),gi(t))return this._requestWithSchemaViaCodec(o,e,t,r);let s=Dl(o,e.method);if(s===void 0)throw new TypeError(`'${e.method}' is not a spec method; pass a result schema as the second argument to request().`);return this._requestWithSchemaViaCodec(o,e,s,t)}_negotiatedWireCodec(){return Xn(this._negotiatedProtocolVersion)}_wireCodec(){return this._negotiatedWireCodec()}_resolveOutboundCodec(e){if(this._negotiatedProtocolVersion===void 0){let t=aS(e);if(t)return t}return this._negotiatedWireCodec()}_assertOutboundRequestInEra(e,t){if(di(t)&&!e.hasRequestMethod(t))throw new re(se.MethodNotSupportedByProtocolVersion,`Method '${t}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t,era:e.era})}_requestWithSchema(e,t,r){let o=this._resolveOutboundCodec(e.method);return this._assertOutboundRequestInEra(o,e.method),this._requestWithSchemaViaCodec(o,e,t,r)}_requestWithSchemaViaCodec(e,t,r,o){let{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c,headers:a}=o??{},u=Date.now(),p,h;return new Promise((f,y)=>{let S=n(G=>{y(G)},"earlyReject");if(!this._transport){S(new Error("Not connected"));return}if(this._options?.enforceStrictCapabilities===!0)try{this.assertCapabilityForMethod(t.method)}catch(G){S(G);return}if(o?.signal?.aborted){let G=o.signal.reason;throw G instanceof re?G:new re(se.RequestTimeout,String(G))}let k=e.era===Ci&&this._transport.hasPerRequestStream===!0?new AbortController:void 0,w=this._requestMessageId++;h=w;let I={...t,jsonrpc:"2.0",id:w};o?.onprogress&&(this._progressHandlers.set(w,o.onprogress),I.params={...t.params,_meta:{...t.params?._meta,progressToken:w}});let U=this._envelopeOutbound(I),O=!1,H=n(G=>{O||(this._progressHandlers.delete(w),k===void 0?this._transport?.send(this._envelopeOutbound({jsonrpc:"2.0",method:"notifications/cancelled",params:{requestId:w,reason:String(G)}}),{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c}).catch(V=>this._onerror(new Error(`Failed to send cancellation: ${V}`))):k.abort(),y(G instanceof re?G:new re(se.RequestTimeout,String(G))))},"cancel");this._responseHandlers.set(w,G=>{if(o?.signal?.aborted)return;if(O=!0,G instanceof Error)return y(G);let V;try{V=e.decodeResult(t.method,G.result)}catch(oe){return y(oe instanceof Error?oe:new Error(String(oe)))}if(V.kind==="invalid")return y(V.error);if(V.kind==="input_required"){if(o?.allowInputRequired===!0)return f(hS(V));let oe={codec:e,request:t,resultSchema:r,options:o,flowStartedAt:u,retry:n((je,L)=>this._requestWithSchemaViaCodec(e,je===void 0?{method:t.method}:{method:t.method,params:je},r,L),"retry")};return f(this._resolveNonCompleteResult(V,oe))}let Ge=V.result;li(r,Ge).then(oe=>{oe.success?f(oe.data):y(new re(se.InvalidResult,`Invalid result for ${t.method}: ${oe.error}`))},y)}),p=n(()=>H(o?.signal?.reason),"onAbort"),o?.signal?.addEventListener("abort",p,{once:!0});let F=o?.timeout??gp,ee=n(()=>H(new re(se.RequestTimeout,"Request timed out",{timeout:F})),"timeoutHandler");this._setupTimeout(w,F,o?.maxTotalTimeout,ee,o?.resetTimeoutOnProgress??!1),this._transport.send(U,{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c,headers:a,requestSignal:k?.signal}).catch(G=>{this._progressHandlers.delete(w),y(G)})}).finally(()=>{p&&o?.signal?.removeEventListener("abort",p),h!==void 0&&(this._responseHandlers.delete(h),this._cleanupTimeout(h))})}async notification(e,t){return this._notificationViaCodec(this._resolveOutboundCodec(e.method),e,t)}async _notificationViaCodec(e,t,r){if(!this._transport)throw new re(se.NotConnected,"Not connected");if(ui(t.method)&&!e.hasNotificationMethod(t.method))throw new re(se.MethodNotSupportedByProtocolVersion,`Notification '${t.method}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t.method,era:e.era});this.assertNotificationCapability(t.method);let o=this._envelopeOutbound({jsonrpc:"2.0",...t});if((this._options?.debouncedNotificationMethods??[]).includes(t.method)&&!t.params&&!r?.relatedRequestId){if(this._pendingDebouncedNotifications.has(t.method))return;this._pendingDebouncedNotifications.add(t.method),Promise.resolve().then(()=>{this._pendingDebouncedNotifications.delete(t.method),this._transport&&this._transport?.send(o,r).catch(s=>this._onerror(s))});return}await this._transport.send(o,r)}setRequestHandler(e,t,r){this.assertRequestHandlerCapability(e);let o;if(typeof t=="function"){if(!di(e))throw new TypeError(`'${e}' is not a spec request method; pass schemas as the second argument to setRequestHandler().`);o=n((s,i)=>{let c=this._negotiatedWireCodec(),a=c.validateRequest(e,s);if(!a.ok&&a.reason==="not-in-era"&&(a=c.validateInputRequest(e,s)),!a.ok)throw a.reason==="not-in-era"?new ie(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(a.message);return Promise.resolve(t(a.value,i))},"stored")}else if(r)o=n(async(s,i)=>{let c=await li(t.params,{...s.params});if(!c.success)throw new ie(P.InvalidParams,`Invalid params for ${e}: ${c.error}`);return r(c.data,i)},"stored");else throw new TypeError("setRequestHandler: handler is required");this._requestHandlers.set(e,this._wrapHandler(e,o))}_wrapHandler(e,t){return t}_outboundServerInfo(){}removeRequestHandler(e){this._requestHandlers.delete(e)}assertCanSetRequestHandler(e){if(this._requestHandlers.has(e))throw new Error(`A request handler for ${e} already exists, which would be overridden`)}setNotificationHandler(e,t,r){if(typeof t=="function"){if(!ui(e))throw new TypeError(`'${e}' is not a spec notification method; pass schemas as the second argument to setNotificationHandler().`);this._notificationHandlers.set(e,(o,s)=>{let i=s.validateNotification(e,o);if(!i.ok)throw i.reason==="not-in-era"?new ie(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(i.message);return Promise.resolve(t(i.value))});return}if(!r)throw new TypeError("setNotificationHandler: handler is required");this._notificationHandlers.set(e,async o=>{let s=await li(t.params,{...o.params});if(!s.success)throw new ie(P.InvalidParams,`Invalid params for notification ${e}: ${s.error}`);await r(s.data,o)})}removeNotificationHandler(e){this._notificationHandlers.delete(e)}};function pi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(pi,"isPlainObject$1");function $l(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n($l,"isPlainObject");function mS(e){let t={},r=[];if(!$l(e))return{accepted:t,droppedKeys:r};for(let[o,s]of Object.entries(e)){if(!$l(s)||"method"in s||"result"in s){r.push(o);continue}t[o]=s}return{accepted:t,droppedKeys:r}}n(mS,"partitionInputResponses");function hS(e){return{resultType:"input_required",inputRequests:e.inputRequests,...e.requestState!==void 0&&{requestState:e.requestState}}}n(hS,"manualInputRequiredValue");var fS=El((e=>{var t=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,r=/\\([\u000b\u0020-\u00ff])/g,o=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;e.parse=s;function s(a){if(!a)throw new TypeError("argument string is required");var u=typeof a=="object"?i(a):a;if(typeof u!="string")throw new TypeError("argument string is required to be a string");var p=u.indexOf(";"),h=p!==-1?u.slice(0,p).trim():u.trim();if(!o.test(h))throw new TypeError("invalid media type");var f=new c(h.toLowerCase());if(p!==-1){var y,S,k;for(t.lastIndex=p;S=t.exec(u);){if(S.index!==p)throw new TypeError("invalid parameter format");p+=S[0].length,y=S[1].toLowerCase(),k=S[2],k.charCodeAt(0)===34&&(k=k.slice(1,-1),k.indexOf("\\")!==-1&&(k=k.replace(r,"$1"))),f.parameters[y]=k}if(p!==u.length)throw new TypeError("invalid parameter format")}return f}n(s,"parse");function i(a){var u;if(typeof a.getHeader=="function"?u=a.getHeader("content-type"):typeof a.headers=="object"&&(u=a.headers&&a.headers["content-type"]),typeof u!="string")throw new TypeError("content-type header is missing from object");return u}n(i,"getcontenttype");function c(a){this.parameters=Object.create(null),this.type=a}n(c,"ContentType")})),DT=Al(fS(),1);var gS=10*1024*1024;function Ei(){_i(),ht(),dy(),Ay(),Dy()}n(Ei,"preloadSchemas");var YT=typeof self<"u"&&self.location&&self.location.origin!=="null"?new URL(self.location.origin+self.location.pathname+location.search):new URL("https://github.com/cfworker");var yS=/^(\d\d\d\d)-(\d\d)-(\d\d)$/,SS=[0,31,28,31,30,31,30,31,31,30,31,30,31],_S=/^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i,wS=/^(?=.{1,253}\.?$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*\.?$/i,RS=/^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,bS=/^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,vS=/^(?:(?:https?|ftp):\/\/)(?:\S+(?::\S*)?@)?(?:(?!10(?:\.\d{1,3}){3})(?!127(?:\.\d{1,3}){3})(?!169\.254(?:\.\d{1,3}){2})(?!192\.168(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)(?:\.(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu,IS=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,CS=/^(?:\/(?:[^~/]|~0|~1)*)*$/,TS=/^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,kS=/^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/,ES=n(e=>{if(e[0]==='"')return!1;let[t,r,...o]=e.split("@");return!t||!r||o.length!==0||t.length>64||r.length>253||t[0]==="."||t.endsWith(".")||t.includes("..")||!/^[a-z0-9.-]+$/i.test(r)||!/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+$/i.test(t)?!1:r.split(".").every(s=>/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i.test(s))},"EMAIL"),PS=/^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,AS=/^((([0-9a-f]{1,4}:){7}([0-9a-f]{1,4}|:))|(([0-9a-f]{1,4}:){6}(:[0-9a-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){5}(((:[0-9a-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){4}(((:[0-9a-f]{1,4}){1,3})|((:[0-9a-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){3}(((:[0-9a-f]{1,4}){1,4})|((:[0-9a-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){2}(((:[0-9a-f]{1,4}){1,5})|((:[0-9a-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){1}(((:[0-9a-f]{1,4}){1,6})|((:[0-9a-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9a-f]{1,4}){1,7})|((:[0-9a-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))$/i,xS=n(e=>e.length>1&&e.length<80&&(/^P\d+([.,]\d+)?W$/.test(e)||/^P[\dYMDTHS]*(\d[.,]\d+)?[YMDHS]$/.test(e)&&/^P([.,\d]+Y)?([.,\d]+M)?([.,\d]+D)?(T([.,\d]+H)?([.,\d]+M)?([.,\d]+S)?)?$/.test(e)),"DURATION");function He(e){return e.test.bind(e)}n(He,"bind");var XT={date:Sp,time:_p.bind(void 0,!1),"date-time":MS,duration:xS,uri:NS,"uri-reference":He(RS),"uri-template":He(bS),url:He(vS),email:ES,hostname:He(wS),ipv4:He(PS),ipv6:He(AS),regex:DS,uuid:He(IS),"json-pointer":He(CS),"json-pointer-uri-fragment":He(TS),"relative-json-pointer":He(kS)};function US(e){return e%4===0&&(e%100!==0||e%400===0)}n(US,"isLeapYear");function Sp(e){let t=e.match(yS);if(!t)return!1;let r=+t[1],o=+t[2],s=+t[3];return o>=1&&o<=12&&s>=1&&s<=(o==2&&US(r)?29:SS[o])}n(Sp,"date");function _p(e,t){let r=t.match(_S);if(!r)return!1;let o=+r[1],s=+r[2],i=+r[3],c=!!r[5];return(o<=23&&s<=59&&i<=59||o==23&&s==59&&i==60)&&(!e||c)}n(_p,"time");var OS=/t|\s/i;function MS(e){let t=e.split(OS);return t.length==2&&Sp(t[0])&&_p(!0,t[1])}n(MS,"date_time");var zS=/\/|:/,qS=/^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;function NS(e){return zS.test(e)&&qS.test(e)}n(NS,"uri");var jS=/[^\\]\\Z/;function DS(e){if(jS.test(e))return!1;try{return new RegExp(e,"u"),!0}catch{return!1}}n(DS,"regex");Ei();var wp=!1;var Pi;Pi=globalThis.crypto;async function LS(e){return(await Pi).getRandomValues(new Uint8Array(e))}n(LS,"getRandomValues");async function HS(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,o="";for(;o.length<e;){let s=await LS(e-o.length);for(let i of s)i<r&&(o+=t[i%t.length])}return o}n(HS,"random");async function BS(e){return await HS(e)}n(BS,"generateVerifier");async function FS(e){let t=await(await Pi).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}n(FS,"generateChallenge");async function Ai(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await BS(e),r=await FS(t);return{code_verifier:t,code_challenge:r}}n(Ai,"pkceChallenge");var to=class extends Error{static{n(this,"OAuthClientFlowError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthClientFlowError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e){super(e),this.name=new.target.name,Ht(this,new.target)}},eo=class extends to{static{n(this,"IssuerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.IssuerMismatchError"})}kind;expected;received;constructor(e,t,r){super(`Issuer mismatch in ${e==="metadata"?"authorization server metadata (RFC 8414 \xA73.3)":"authorization response (RFC 9207)"}: expected ${JSON.stringify(t)}, received ${JSON.stringify(r)}`),this.kind=e,this.expected=t,this.received=r}},zi=class extends to{static{n(this,"RegistrationRejectedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.RegistrationRejectedError"})}status;body;submittedMetadata;constructor(e){super(`Dynamic Client Registration rejected (HTTP ${e.status}): ${e.body}`),this.status=e.status,this.body=e.body,this.submittedMetadata=e.submittedMetadata}},ds=class extends to{static{n(this,"InsecureTokenEndpointError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsecureTokenEndpointError"})}tokenEndpoint;constructor(e){super(`Refusing to send credentials to non-https token endpoint '${e}'. OAuth token requests MUST use TLS (localhost / 127.0.0.1 / ::1 are exempt).`),this.tokenEndpoint=e}},xi=class extends to{static{n(this,"AuthorizationServerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.AuthorizationServerMismatchError"})}constructor(e,t){super(`Authorization server changed between redirect and callback (redirected to ${JSON.stringify(e)}, callback resolved ${JSON.stringify(t)}); refusing to send authorization_code/code_verifier to a different token endpoint`),this.recordedIssuer=e,this.currentIssuer=t}},Dk=class extends to{static{n(this,"InsufficientScopeError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsufficientScopeError"})}requiredScope;resourceMetadataUrl;errorDescription;constructor(e){super(`Insufficient scope${e.requiredScope?`: required "${e.requiredScope}"`:""}`),this.requiredScope=e.requiredScope,this.resourceMetadataUrl=e.resourceMetadataUrl,this.errorDescription=e.errorDescription}};function Rp(e,t,r){if(e!==void 0)return e.issuer===void 0?(r?.canPersistStamp!==!1&&console.warn("[mcp-sdk] SEP-2352: stored OAuth credential has no 'issuer' stamp (pre-upgrade storage or provider not round-tripping the value). SEP-2352 isolation is inactive for this read; ensure your provider round-trips the issuer field."),e):Ip(e.issuer,t)?e:void 0}n(Rp,"discardIfIssuerMismatch");function Ip(e,t){return e===t||e.endsWith("/")&&e.slice(0,-1)===t||t.endsWith("/")&&t.slice(0,-1)===e}n(Ip,"issuersMatch");var $k=class extends Error{static{n(this,"UnauthorizedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnauthorizedError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e){super(e??"Unauthorized"),this.name="UnauthorizedError",Ht(this,new.target)}};function Cp(e){return e?.authorization_response_iss_parameter_supported===!0}n(Cp,"isIssParameterSupported");function Tp({iss:e,expectedIssuer:t,issParameterSupported:r}){if(t!==void 0){if(e===void 0){if(r)throw new eo("authorization_response",t,void 0);return}if(e!==t)throw new eo("authorization_response",t,e)}}n(Tp,"validateAuthorizationResponseIssuer");function GS(e){return["client_secret_basic","client_secret_post","none"].includes(e)}n(GS,"isClientAuthMethod");var Ui="code",Oi="S256";function JS(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&GS(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}n(JS,"selectClientAuthMethod");function VS(e,t,r,o){let{client_id:s,client_secret:i}=t;switch(e){case"client_secret_basic":KS(s,i,r);return;case"client_secret_post":WS(s,i,o);return;case"none":ZS(s,o);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}n(VS,"applyClientAuthentication");function KS(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let o=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${o}`)}n(KS,"applyBasicAuth");function WS(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}n(WS,"applyPostAuth");function ZS(e,t){t.set("client_id",e)}n(ZS,"applyPublicAuth");function kp(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}n(kp,"isLoopbackHost");function YS(e){let t=new URL(String(e));if(t.protocol!=="https:"&&!kp(t.hostname))throw new ds(t.href);return t}n(YS,"assertSecureTokenEndpoint");function XS(e){for(let t of e??[]){let r;try{r=new URL(t)}catch{continue}if(r.protocol!=="http:"&&r.protocol!=="https:"||kp(r.hostname))return"native"}return"web"}n(XS,"deriveApplicationType");function QS(e){let t=e.clientMetadata;return{...t,grant_types:t.grant_types??(e.redirectUrl===void 0?void 0:["authorization_code","refresh_token"]),application_type:t.application_type??XS(t.redirect_uris)}}n(QS,"resolveClientMetadata");async function bp(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let o=Ho.parse(JSON.parse(r));return ft.fromResponse(o)}catch(o){let s=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${o}. Raw body: ${r}`;return new ft(ue.ServerError,s)}}n(bp,"parseErrorResponse");async function qi(e,t){try{return await Mi(e,t)}catch(r){if(r instanceof ft){if(r.code===ue.InvalidClient||r.code===ue.UnauthorizedClient)return await e.invalidateCredentials?.("client"),await e.invalidateCredentials?.("tokens"),await Mi(e,t);if(r.code===ue.InvalidGrant)return await e.invalidateCredentials?.("tokens"),await Mi(e,t)}throw r}}n(qi,"auth");function e_(e){let{requestedScope:t,resourceMetadata:r,authServerMetadata:o,clientMetadata:s}=e,i=t||r?.scopes_supported?.join(" ")||s.scope;return i&&o?.scopes_supported?.includes("offline_access")&&!i.split(" ").includes("offline_access")&&s.grant_types?.includes("refresh_token")&&(i=`${i} offline_access`),i}n(e_,"determineScope");async function Mi(e,{serverUrl:t,authorizationCode:r,iss:o,scope:s,resourceMetadataUrl:i,fetchFn:c,skipIssuerMetadataValidation:a,forceReauthorization:u}){let p=QS(e),h=await e.discoveryState?.(),f,y,S,k,w=i;if(!w&&h?.resourceMetadataUrl&&(w=new URL(h.resourceMetadataUrl)),h?.authorizationServerUrl){if(y=h.authorizationServerUrl,f=h.resourceMetadata,S=h.authorizationServerMetadata??await xp(y,{fetchFn:c,skipIssuerValidation:a}),!f)try{f=await Pp(t,{resourceMetadataUrl:w},c)}catch(L){if(L instanceof TypeError)throw L}(S!==h.authorizationServerMetadata||f!==h.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(y),resourceMetadataUrl:w?.toString(),resourceMetadata:f,authorizationServerMetadata:S})}else{let L=await i_(t,{resourceMetadataUrl:w,fetchFn:c,skipIssuerMetadataValidation:a});y=L.authorizationServerUrl,S=L.authorizationServerMetadata,f=L.resourceMetadata,k={authorizationServerUrl:String(y),resourceMetadataUrl:w?.toString(),resourceMetadata:f,authorizationServerMetadata:S}}let I=S?.issuer??String(y),U={issuer:I};if(await e.saveAuthorizationServerUrl?.(I),r!==void 0){let L=h?.authorizationServerMetadata?.issuer??h?.authorizationServerUrl;if(L===void 0){if(e.saveDiscoveryState!==void 0)throw new xi("discoveryState was not available on the callback leg; ensure your provider persists discoveryState alongside codeVerifier",I);console.warn("[mcp-sdk] OAuthClientProvider does not implement saveDiscoveryState()/discoveryState(); the SEP-2352 callback-leg authorization-server binding cannot be checked. Implement discoveryState (persist alongside codeVerifier) \u2014 see docs/migration/upgrade-to-v2.md \xA7SEP-2352.")}else if(!Ip(L,I))throw new xi(L,I)}k&&await e.saveDiscoveryState?.(k);let O=await t_(t,e,f);O&&await e.saveResourceUrl?.(String(O));let H=e_({requestedScope:s,resourceMetadata:f,authServerMetadata:S,clientMetadata:e.clientMetadata}),F=await Promise.resolve(e.clientInformation(U)),ee=Rp(F,I,{canPersistStamp:e.saveClientInformation!==void 0});if(ee===void 0&&F?.issuer&&e.saveClientInformation===void 0)throw new xi(F.issuer,I);if(ee&&ee.issuer===void 0&&(ee={...ee,issuer:I},await e.saveClientInformation?.(ee,U)),!ee){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let L=S?.client_id_metadata_document_supported===!0,Ue=e.clientMetadataUrl;if(Ue&&!Ni(Ue))throw new ft(ue.InvalidClientMetadata,`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${Ue}`);if(L&&Ue)ee={client_id:Ue,issuer:I},await e.saveClientInformation?.(ee,U);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");ee={...await l_(y,{metadata:S,clientMetadata:p,scope:H,fetchFn:c}),issuer:I},await e.saveClientInformation(ee,U)}}let G=!e.redirectUrl;if(r!==void 0||G){r!==void 0&&Tp({iss:o,expectedIssuer:S?.issuer,issParameterSupported:Cp(S)});let L=await u_(e,y,{metadata:S,resource:O,authorizationCode:r,iss:o,scope:H,fetchFn:c});return await e.saveTokens({...L,issuer:I},U),"AUTHORIZED"}let V=Rp(await e.tokens(U),I);if(V&&V.issuer===void 0&&(V={...V,issuer:I},await e.saveTokens(V,U)),V?.refresh_token&&!u)try{let L=await d_(y,{metadata:S,clientInformation:ee,refreshToken:V.refresh_token,resource:O,addClientAuthentication:e.addClientAuthentication,fetchFn:c});return await e.saveTokens({...L,issuer:I},U),"AUTHORIZED"}catch(L){if(L instanceof ds||!(!(L instanceof ft)||L.code===ue.ServerError))throw L}let Ge=e.state?await e.state():void 0,{authorizationUrl:oe,codeVerifier:je}=await a_(y,{metadata:S,clientInformation:ee,state:Ge,redirectUrl:e.redirectUrl,scope:H,resource:O});return await e.saveCodeVerifier(je),await e.redirectToAuthorization(oe),"REDIRECT"}n(Mi,"authInternal");function Ni(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}n(Ni,"isHttpsUrl");async function t_(e,t,r){let o=Hl(e);if(t.validateResourceURL)return await t.validateResourceURL(o,r?.resource);if(r){if(!ss({requestedResource:o,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${o} (or origin)`);return new URL(r.resource)}}n(t_,"selectResourceURL");function Ep(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,o]=t.split(" ");if(r?.toLowerCase()!=="bearer"||!o)return{};let s=cs(e,"resource_metadata")||void 0,i;if(s)try{i=new URL(s)}catch{}let c=cs(e,"scope")||void 0,a=cs(e,"error")||void 0,u=cs(e,"error_description")||void 0;return{resourceMetadataUrl:i,scope:c,error:a,errorDescription:u}}n(Ep,"extractWWWAuthenticateParams");function cs(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let o=new RegExp(String.raw`${t}=(?:"([^"]+)"|([^\s,]+))`),s=r.match(o);if(s){let i=s[1]||s[2];if(i)return i}return null}n(cs,"extractFieldFromWwwAuth");async function Pp(e,t,r=fetch){let o=await o_(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!o||o.status===404)throw await o?.text?.().catch(()=>{}),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!o.ok)throw await o.text?.().catch(()=>{}),new Error(`HTTP ${o.status} trying to load well-known OAuth protected resource metadata.`);return hr.parse(await o.json())}n(Pp,"discoverOAuthProtectedResourceMetadata");async function Ap(e,t,r=fetch){try{return await r(e,{headers:t})}catch(o){if(!(o instanceof TypeError)||!wp)throw o;if(t)try{return await r(e,{})}catch(s){if(!(s instanceof TypeError))throw s;return}return}}n(Ap,"fetchWithCorsRetry");function r_(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}n(r_,"buildWellKnownPath");async function vp(e,t,r=fetch){return await Ap(e,{"MCP-Protocol-Version":t},r)}n(vp,"tryMetadataDiscovery");function n_(e,t){return e?t==="/"?!1:e.status>=400&&e.status<500||e.status===502:!0}n(n_,"shouldAttemptFallback");async function o_(e,t,r,o){let s=new URL(e),i=o?.protocolVersion??No,c;if(o?.metadataUrl)c=new URL(o.metadataUrl);else{let u=r_(t,s.pathname);c=new URL(u,o?.metadataServerUrl??s),c.search=s.search}let a=await vp(c,i,r);return!o?.metadataUrl&&n_(a,s.pathname)&&(a=await vp(new URL(`/.well-known/${t}`,s),i,r)),a}n(o_,"discoverMetadataWithFallback");function s_(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",o=[];if(!r)return o.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"},{url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),o;let s=t.pathname;return s.endsWith("/")&&(s=s.slice(0,-1)),o.push({url:new URL(`/.well-known/oauth-authorization-server${s}`,t.origin),type:"oauth"},{url:new URL(`/.well-known/openid-configuration${s}`,t.origin),type:"oidc"},{url:new URL(`${s}/.well-known/openid-configuration`,t.origin),type:"oidc"}),o}n(s_,"buildDiscoveryUrls");async function xp(e,{fetchFn:t=fetch,protocolVersion:r=No,skipIssuerValidation:o=!1}={}){let s={"MCP-Protocol-Version":r,Accept:"application/json"},i=s_(e);for(let{url:c,type:a}of i){let u=await Ap(c,s,t);if(!u)continue;if(!u.ok){if(await u.text?.().catch(()=>{}),u.status>=400&&u.status<500||u.status===502)continue;throw new Error(`HTTP ${u.status} trying to load ${a==="oauth"?"OAuth":"OpenID provider"} metadata from ${c}`)}let p=a==="oauth"?fr.parse(await u.json()):gr.parse(await u.json());if(!o){let h=typeof e=="string"?e:e.href;if(!(p.issuer===h||h.endsWith("/")&&p.issuer===h.slice(0,-1)))throw new eo("metadata",h,p.issuer)}return p}}n(xp,"discoverAuthorizationServerMetadata");async function i_(e,t){let r,o;try{r=await Pp(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(o=r.authorization_servers[0])}catch(i){if(i instanceof TypeError)throw i}o||(o=String(new URL("/",e)));let s=await xp(o,{fetchFn:t?.fetchFn,skipIssuerValidation:t?.skipIssuerMetadataValidation});return{authorizationServerUrl:o,authorizationServerMetadata:s,resourceMetadata:r}}n(i_,"discoverOAuthServerInfo");async function a_(e,{metadata:t,clientInformation:r,redirectUrl:o,scope:s,state:i,resource:c}){let a;if(t){if(a=new URL(t.authorization_endpoint),!t.response_types_supported.includes(Ui))throw new Error(`Incompatible auth server: does not support response type ${Ui}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(Oi))throw new Error(`Incompatible auth server: does not support code challenge method ${Oi}`)}else a=new URL("/authorize",e);let u=await Ai(),p=u.code_verifier,h=u.code_challenge;return a.searchParams.set("response_type",Ui),a.searchParams.set("client_id",r.client_id),a.searchParams.set("code_challenge",h),a.searchParams.set("code_challenge_method",Oi),a.searchParams.set("redirect_uri",String(o)),i&&a.searchParams.set("state",i),s&&a.searchParams.set("scope",s),s?.split(" ").includes("offline_access")&&a.searchParams.append("prompt","consent"),c&&a.searchParams.set("resource",c.href),{authorizationUrl:a,codeVerifier:p}}n(a_,"startAuthorization");function c_(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}n(c_,"prepareAuthorizationCodeRequest");async function Up(e,{metadata:t,tokenRequestParams:r,clientInformation:o,addClientAuthentication:s,resource:i,fetchFn:c}){let a=YS(t?.token_endpoint??new URL("/token",e)),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});i&&r.set("resource",i.href),s?await s(u,r,a,t):o&&VS(JS(o,t?.token_endpoint_auth_methods_supported??[]),o,u,r);let p=await(c??fetch)(a,{method:"POST",headers:u,body:r});if(!p.ok)throw await bp(p);let h=await p.json();try{return lt.parse(h)}catch(f){throw typeof h=="object"&&h!==null&&"error"in h?await bp(JSON.stringify(h)):f}}n(Up,"executeTokenRequest");async function d_(e,{metadata:t,clientInformation:r,refreshToken:o,resource:s,addClientAuthentication:i,fetchFn:c}){return{refresh_token:o,...await Up(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:"refresh_token",refresh_token:o}),clientInformation:r,addClientAuthentication:i,resource:s,fetchFn:c})}}n(d_,"refreshAuthorization");async function u_(e,t,{metadata:r,resource:o,authorizationCode:s,iss:i,scope:c,fetchFn:a}={}){s!==void 0&&Tp({iss:i,expectedIssuer:r?.issuer,issParameterSupported:Cp(r)});let u=c??e.clientMetadata.scope,p;if(e.prepareTokenRequest&&(p=await e.prepareTokenRequest(u)),!p){if(!s)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");p=c_(s,await e.codeVerifier(),e.redirectUrl)}let h=await e.clientInformation({issuer:r?.issuer??String(t)});return Up(t,{metadata:r,tokenRequestParams:p,clientInformation:h??void 0,addClientAuthentication:e.addClientAuthentication,resource:o,fetchFn:a})}n(u_,"fetchToken");async function l_(e,{metadata:t,clientMetadata:r,scope:o,fetchFn:s}){let i;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");i=new URL(t.registration_endpoint)}else i=new URL("/register",e);let c={...r,...o===void 0?{}:{scope:o}},a=await(s??fetch)(i,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(c)});if(!a.ok)throw new zi({status:a.status,body:await a.text(),submittedMetadata:c});return $t.parse(await a.json())}n(l_,"registerClient");var Lk=class extends Error{static{n(this,"SseError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SseError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e,t,r){super(`SSE error: ${t}`),this.code=e,this.event=r,Ht(this,new.target)}};function p_(e){let t=Dt.safeParse(e);return t.success?t.data.id:void 0}n(p_,"parseJsonRpcRequestId");function Op(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return p_(t)}catch{return}}n(Op,"readJsonRpcRequestIdFromBody");function us(e){return Ln.parse({jsonrpc:mr,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}n(us,"jsonRpcErrorResponse");function Mp(e){return new as([Lo.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}n(Mp,"urlElicitationRequiredError");var ps=l.record(l.string(),l.unknown()),m_=l.record(l.string(),l.unknown()),yt=l.array(l.string().min(1)).min(1).optional(),h_=l.object({name:l.string().min(1),description:l.string().min(1).optional(),annotations:m_.optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),f_=l.object({name:l.string().min(1),description:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),g_=l.object({uri:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),y_=l.object({uriTemplate:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),S_=l.array(l.union([l.string(),h_])),__=l.array(l.union([l.string(),f_])),w_=l.array(l.union([l.string(),g_])),R_=l.array(l.union([l.string(),y_])),b_=l.object({module:l.unknown(),export:l.string().min(1)}).strict(),v_=l.object({mode:l.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:l.string().min(1).optional(),groupClaim:l.string().min(1).optional(),identifier:b_.optional()}).strict(),I_=l.object({tools:S_.optional(),prompts:__.optional(),resources:w_.optional(),resourceTemplates:R_.optional(),accessControl:v_.optional()}).strict(),gt=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function C_(e,t){return Lu(I_,e,`MCP capability filter policy "${t}"`)}n(C_,"parseMcpCapabilityFilterOptions");function _e(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(_e,"isRecord");function ro(e){return typeof e.method=="string"?e.method:void 0}n(ro,"messageMethod");function zp(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}n(zp,"correlationKey");function qp(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}n(qp,"asStringArray");function Np(e,t){if(!_e(e))return[];let r=t in e?e[t]:t.split(".").reduce((o,s)=>_e(o)?o[s]:void 0,e);return Array.isArray(r)?r.filter(o=>typeof o=="string"):typeof r=="string"?r.split(/\s+/).filter(o=>o.length>0):[]}n(Np,"readClaimValues");function $i(e,t){if(typeof e=="string")return{key:e,public:!1};if(!_e(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:qp(e.roles),groups:qp(e.groups),public:e.public===!0}}n($i,"normalizeEntry");function T_(e,t,r){if(e.public)return!0;let o=e.roles??[],s=e.groups??[];return o.length===0&&s.length===0?!1:o.some(i=>t.has(i))||s.some(i=>r.has(i))}n(T_,"isCallerAllowed");function ls(e,t,r,o){if(e===void 0)return;let s=[];for(let i of e){let c=$i(i,t);c!==void 0&&T_(c,r,o)&&s.push(c.key)}return s}n(ls,"allowedKeys");var $p=n((e,t,r)=>{let o=r.accessControl?.roleClaim??"roles",s=r.accessControl?.groupClaim??"groups",i=new Set(Np(e.user?.data,o)),c=new Set(Np(e.user?.data,s));return{tools:ls(r.tools,"name",i,c),prompts:ls(r.prompts,"name",i,c),resources:ls(r.resources,"uri",i,c),resourceTemplates:ls(r.resourceTemplates,"uriTemplate",i,c)}},"claimsCapabilityResolver");function k_(e,t){let r=[];for(let o of gt){let s=e[o.option];if(s!==void 0)for(let i of s){let c=$i(i,o.itemProperty);if(c===void 0)continue;let a=(c.roles?.length??0)>0||(c.groups?.length??0)>0;c.public&&a&&r.push(`${o.option} "${c.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}n(k_,"assertNoConflictingMarkup");function E_(e,t){let r=[];for(let o of gt){let s=e[o.option];if(s!==void 0)for(let i of s){let c=$i(i,o.itemProperty);c!==void 0&&((c.roles?.length??0)>0||(c.groups?.length??0)>0||c.public)&&r.push(`${o.option} "${c.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}n(E_,"assertNoMarkup");function P_(e,t){let r=e.identifier;if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let o=r.module[r.export];if(typeof o!="function")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let s=o;return async(i,c,a)=>{let u=await s(i,c,a);if(u==null)throw new v(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new v(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}n(P_,"buildCustomResolver");function A_(e,t){let r=e.accessControl,o=r?.mode??"allPublic";if(o==="function"){if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return P_(r,t)}if(o==="rolesAndGroups")return k_(e,t),$p;E_(e,t)}n(A_,"buildCapabilityResolver");function x_(e){let t={};for(let r of gt){let o=e[r.option];if(o===void 0)continue;let s=new Map;for(let i of o){let c=q_(i,r.itemProperty);c!==void 0&&s.set(c.key,c)}t[r.option]=s}return t}n(x_,"buildProjectionMaps");function ji(e){return e===void 0?void 0:gt.find(t=>t.listMethod===e)}n(ji,"findListRule");function U_(e){return e===void 0?void 0:gt.find(t=>t.directMethods.includes(e))}n(U_,"findDirectRule");function O_(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}n(O_,"directCapabilityAccess");function M_(e){let t=U_(ro(e));if(t===void 0||!_e(e.raw))return;let r=e.raw.params;if(!_e(r))return;let o=r[t.itemProperty==="uri"?"uri":"name"];return typeof o=="string"?{option:t.option,target:o}:void 0}n(M_,"rawDirectCapabilityAccess");function z_(e){return Response.json(us({...e==null?{}:{id:e},error:{code:P.MethodNotFound,message:"Method not found"}}))}n(z_,"methodNotFoundResponse");function q_(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!_e(e))return;let r=e[t];if(typeof r!="string")return;let o={...e};return delete o.roles,delete o.groups,delete o.public,{key:r,overlay:o}}n(q_,"buildProjection");function jp(e){let t=e.base[e.property],r=e.overlay[e.property];return _e(r)?_e(t)?{...t,...r}:r:t}n(jp,"mergeRecordProperty");function N_(e,t){let r={...e,...t.overlay},o=jp({base:e,overlay:t.overlay,property:"annotations"});o!==void 0&&(r.annotations=o);let s=jp({base:e,overlay:t.overlay,property:"_meta"});return s!==void 0&&(r._meta=s),r}n(N_,"applyProjection");function Dp(e,t,r,o){if(!_e(e))return e;let s=e.result;if(!_e(s))return e;let i=s[t.resultProperty];return!Array.isArray(i)||!i.every(c=>_e(c)&&typeof c[t.itemProperty]=="string")?e:{...e,result:{...s,[t.resultProperty]:i.flatMap(c=>{if(!_e(c))return[];let a=c[t.itemProperty];if(typeof a!="string")return[];if(o!==void 0&&!o.has(a))return[];let u=r.get(a);return u===void 0?[]:[N_(c,u)]})}}}n(Dp,"filterAndProjectItems");function j_(e){let{envelope:t,responseBody:r,projectionMaps:o,allowedSets:s}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let p of t.messages){let h=ji(ro(p)),f=h===void 0?void 0:zp(p.id);h!==void 0&&f!==void 0&&u.set(f,h)}return u.size===0?r:r.map(p=>{if(!_e(p)||"error"in p)return p;let h=zp(p.id),f=h===void 0?void 0:u.get(h),y=f===void 0?void 0:o[f.option];return f===void 0||y===void 0?p:Dp(p,f,y,s?.[f.option])})}if(t.shape!=="single"||!_e(r)||"error"in r)return r;let i=t.messages[0],c=ji(i===void 0?void 0:ro(i)),a=c===void 0?void 0:o[c.option];return c===void 0||a===void 0?r:Dp(r,c,a,s?.[c.option])}n(j_,"filterResponseBody");function D_(e){return e.headers.get("content-type")?.includes("json")??!1}n(D_,"isJsonResponse");var Di=class extends qo{static{n(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let o=C_(t,r);super(o,r),this.#r=r,this.#e=x_(o),this.#t=A_(o,r)}async handler(t,r){let o=await kl(t);if(o===null)return t;let s=this.#t!==void 0&&this.#n(o)?await this.#s(t,r):void 0;for(let c of o.messages){let a=c.type==="request"?O_(c):M_(c);if(a===void 0)continue;let u=this.#e[a.option];if(u===void 0)continue;let p=s?.[a.option];if(!u.has(a.target)||p!==void 0&&!p.has(a.target))return z_(c.type==="request"?c.id:c.id??void 0)}if(!this.#o(o))return t;let i=this.#e;return r.addResponseSendingHook(async c=>{if(!D_(c))return c;let a;try{a=await c.clone().json()}catch{return c}let u=j_({envelope:o,responseBody:a,projectionMaps:i,allowedSets:s});if(u===a)return c;let p=new Headers(c.headers);return p.delete("content-length"),new Response(JSON.stringify(u),{status:c.status,statusText:c.statusText,headers:p})}),t}#n(t){return t.messages.some(r=>{let o=ro(r);return o===void 0?!1:gt.some(s=>this.#e[s.option]===void 0?!1:s.listMethod===o||s.directMethods.includes(o))})}#o(t){return t.messages.some(r=>{let o=ji(ro(r));return o!==void 0&&this.#e[o.option]!==void 0})}async#s(t,r){let o=this.#t;if(o===void 0)return{};let s;try{s=await o(t,r,this.options)}catch(c){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,c);let a={};for(let u of gt)this.#e[u.option]!==void 0&&(a[u.option]=new Set);return a}let i={};for(let c of gt){let a=this.#e[c.option];if(a===void 0)continue;let u=s[c.option];if(u===void 0)continue;let p=new Set;if(Array.isArray(u))for(let h of u)typeof h=="string"&&a.has(h)&&p.add(h);i[c.option]=p}return i}};var Li="zuplo.com",$_=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),L_=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function Lp(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}n(Lp,"s2FaviconHref");function H_(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}n(H_,"strictFaviconHref");var Hp=Lp(Li);function Hi(e){let t=e.toLowerCase();return t===Li||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?Lp(Li):H_(e)}n(Hi,"resolveIconHref");function B_(e){try{return new URL(`http://${e}`).hostname}catch{return e}}n(B_,"hostnameFromHost");function F_(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}n(F_,"isLocalOrAddressHost");function G_(e){let t=B_(e).toLowerCase().replace(/\.$/,"");if(F_(t)||L_.some(i=>t===i.slice(1)||t.endsWith(i)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let o=r.slice(-2).join("."),s=$_.has(o)?3:2;return r.slice(-s).join(".")}n(G_,"inferFaviconDomain");function Bi(e){return{src:Hi(G_(e)),mimeType:"image/png",sizes:["128x128"]}}n(Bi,"resolveMcpFaviconIcon");function ms(e){try{return Bi(new URL(e).host)}catch{return}}n(ms,"resolveMcpFaviconIconFromUrl");function St(e){let t=Se().connectionsById.get(e);if(!t)throw new K(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}n(St,"getUpstreamServerConfig");function hs(e){let t=Se().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new K(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}n(hs,"getUpstreamAuthConfig");function kr(e,t){let r=hs({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new K(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}n(kr,"requireUpstreamOAuthConfig");function Bp(e,t){let r=hs({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new K(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}n(Bp,"requireUpstreamIdJagConfig");function Fp(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=n(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}n(Fp,"mergeAbortSignals");async function J_(e){try{await e.cancel()}catch{}}n(J_,"cancelReader");async function fs(e,t){if(!e)return new Uint8Array;let r=e.getReader(),o=[],s=0,i=await r.read();for(;!i.done;){let u=i.value;if(s+=u.byteLength,s>t.maxBytes)throw await J_(r),t.createLimitError();o.push(u),i=await r.read()}let c=new Uint8Array(s),a=0;for(let u of o)c.set(u,a),a+=u.byteLength;return c}n(fs,"readBoundedByteStream");var V_=2,K_=1024*1024,W_=1e4,Z_=new Set([301,302,303,307,308]),Y_=["authorization","proxy-authorization","cookie","cookie2"];function Fi(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}n(Fi,"readRequestUrl");function Er(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}n(Er,"readRequestMethod");function X_(e,t,r){let o=e.headers.get("content-length");if(!o)return;let s=Number.parseInt(o,10);if(Number.isFinite(s)&&s>t)throw new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[C]:r}})}n(X_,"assertContentLengthWithinLimit");async function Q_(e,t,r){return X_(e,t,r),fs(e.body,{maxBytes:t,createLimitError:n(()=>new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[C]:r}}),"createLimitError")})}n(Q_,"readBoundedResponseBody");function ew(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}n(ew,"responseFromBufferedBody");function tw(e,t){if(!Z_.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}n(tw,"resolveRedirectUrl");function Gp(e,t){try{return t.validateUrl(e)}catch(r){throw new v({message:"Outbound URL was not allowed.",extensionMembers:{[C]:t.problemCode}},{cause:r})}}n(Gp,"validateOutboundUrl");function rw(e,t){throw e instanceof v&&Fo(e.extensionMembers?.[C])?e:new v({message:"Outbound fetch failed.",extensionMembers:{[C]:t}},{cause:e})}n(rw,"normalizeFetchError");function no(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[o,s]of Object.entries(t.extra))s!==void 0&&(r[o]=s);t.error!==void 0&&pe(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}n(no,"logOutboundFailure");async function nw(e,t,r,o,s,i,c){let a=Er(r,o);try{return await t(r,o)}catch(u){let p=u instanceof DOMException&&u.name==="AbortError";no(e,{event:p?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:s,method:a,host:te(i),error:u,extra:{abortReason:c()}}),rw(u,s)}}n(nw,"fetchWithNormalizedError");function ow(e){if(e.redirects>=e.maxRedirects)throw new v({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[C]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new v({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[C]:e.problemCode}})}n(ow,"assertRedirectAllowed");function sw(e,t){let r=new Headers(e);for(let o of Y_)r.delete(o);for(let o of t)r.delete(o);return r}n(sw,"stripCrossOriginHeaders");function iw(e,t,r,o,s){let i={...e,method:t,redirect:"manual",signal:r};return o&&(i.headers=sw(e.headers,s)),i}n(iw,"buildRedirectInit");function aw(e,t,r){let o={...t,redirect:"manual",signal:r};return o.headers===void 0&&e instanceof Request&&(o.headers=e.headers),o}n(aw,"buildInitialRequestInit");function cw(e){let t=Er(e.currentInput,e.currentInit);ow({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=Gp(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),o=new URL(e.currentUrl),s=r.origin!==o.origin,i=r.toString();return{currentInput:i,currentUrl:i,currentInit:iw(e.currentInit,t,e.signal,s,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}n(cw,"followRedirect");async function Gi(e,t,r){let o=r.problemCode??"invalid_request",s=r.maxRedirects??V_,i=r.maxResponseBytes??K_,c=r.timeoutMs??W_,a=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],p=r.context,h=new AbortController,f=Fp(h,t.signal),y=!1,S=setTimeout(()=>{y=!0,h.abort()},c),k=e,w=aw(e,t,h.signal),I;try{I=Gp(Fi(e),{problemCode:o,validateUrl:r.validateUrl}).toString()}catch(O){throw no(p,{event:"outbound_url_blocked",problemCode:o,method:Er(e,t),host:te(Fi(e)),error:O}),clearTimeout(S),f?.(),O}let U=0;try{for(;;){let O=await nw(p,a,k,w,o,I,()=>y?`timeout_after_${c}ms`:void 0),H=tw(O,I);if(H!==void 0)try{let F=cw({currentInput:k,currentInit:w,currentUrl:I,redirectUrl:H,redirects:U,maxRedirects:s,problemCode:o,validateUrl:r.validateUrl,signal:h.signal,additionalCrossOriginStrippedHeaders:u});k=F.currentInput,w=F.currentInit,I=F.currentUrl,U=F.redirects;continue}catch(F){throw no(p,{event:"outbound_redirect_blocked",problemCode:o,method:Er(k,w),host:te(I),error:F,extra:{redirects:U,maxRedirects:s,redirectTargetHost:te(H)}}),F}try{return ew(O,await Q_(O,i,o))}catch(F){throw no(p,{event:"outbound_response_size_exceeded",problemCode:o,method:Er(k,w),host:te(I),error:F,extra:{maxResponseBytes:i,status:O.status}}),F}}}finally{clearTimeout(S),f?.()}}n(Gi,"runSafeOutboundExchange");async function oo(e,t,r){let o=await Gi(e,t,r);try{return{response:o,json:await o.clone().json()}}catch(s){throw no(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Er(e,t),host:te(Fi(e)),error:s,extra:{status:o.status,contentType:o.headers.get("content-type")??void 0}}),new v({message:"Outbound JSON response could not be parsed.",extensionMembers:{[C]:r.problemCode??"invalid_request"}},{cause:s})}}n(oo,"runSafeOutboundJsonExchange");function Jp(e,t={},r={}){return Gi(e,t,{...r,validateUrl:Jn})}n(Jp,"fetchConfiguredOutbound");function Vp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Jn})}n(Vp,"fetchConfiguredOutboundJson");function gs(e,t={},r={}){return oo(e,t,{...r,validateUrl:gl})}n(gs,"fetchIdentityProviderJson");function Kp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Yo})}n(Kp,"fetchCimdClientMetadataJson");function Wp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Vn})}n(Wp,"fetchCimdClientJwksJson");import{errors as tm,jwtVerify as rm,SignJWT as nm}from"jose";var we="zuplo-mcp-gateway",Ce=we,Te="HS256";import{base64url as dw}from"jose";var uw=new TextEncoder,lw="MCP gateway could not initialize secure key material.",pw=32,Zp=new Map,Yp=new Map,mw;function hw(){return mw??La.instance.authPrivateKey}n(hw,"readAuthPrivateKey");function Xp(e){return new ye(lw,e===void 0?void 0:{cause:e})}n(Xp,"createGeneratedKeyMaterialError");function Qp(e,t){let r=dw.decode(t);if(r.byteLength!==pw)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}n(Qp,"decodeJwkKeyField");function fw(e){let t=hw();if(!t)throw Xp();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let o=Qp("d",r.d);Qp("x",r.x);let s=uw.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),i=new Uint8Array(s.byteLength+o.byteLength);return i.set(s),i.set(o,s.byteLength),i}catch(r){throw Xp(r)}}n(fw,"decodeGeneratedKeyMaterial");function gw(e){let t=Zp.get(e);return t||(t=fw(e),Zp.set(e,t)),t}n(gw,"getMasterKeyMaterial");async function Be(e){let t=Yp.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(gw(e.keyMaterialPurpose));return Yp.set(e.purpose,r),r}n(Be,"readCachedDerivedKey");var yw="SHA-256",Sw=32,_w="zuplo-mcp-gateway:",ww=new TextEncoder,em=new WeakMap;async function _t(e,t){let r=em.get(e);r||(r=new Map,em.set(e,r));let o=r.get(t);if(o)return o;let s=await Rw(e,t);return r.set(t,s),s}n(_t,"deriveGatewaySigningKey");async function Rw(e,t){let r=me(e),o=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),s=ww.encode(`${_w}${t}`),i=await crypto.subtle.deriveBits({name:"HKDF",hash:yw,salt:new Uint8Array,info:me(s)},o,Sw*8);return new Uint8Array(i)}n(Rw,"hkdfExpand");var om=900,bw=900,vw=Xu.extend({id:Rl}),Iw=vw.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),sm=Qs.extend({id:bl,purpose:l.literal("browser_connect")}),Cw=Qs.extend({purpose:l.literal("browser_connect")}),Tw=sm.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),im=om*1e3;async function am(){return Be({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"oauth-state"),"derive")})}n(am,"getOAuthStateKey");async function cm(){return Be({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"browser-connect"),"derive")})}n(cm,"getBrowserConnectKey");async function dm(e){let t=Math.floor(Date.now()/1e3)+om;return new nm(e).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(t).sign(await am())}n(dm,"signOAuthState");async function ys(e){try{let{payload:t}=await rm(e,await am(),{algorithms:[Te],issuer:we,audience:Ce});return Iw.parse(t)}catch(t){throw t instanceof tm.JWTExpired?new v({message:"OAuth state has expired",extensionMembers:{[C]:"oauth_state_expired"}},{cause:t}):new v({message:"OAuth state could not be verified",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:t})}}n(ys,"verifyOAuthState");async function um(e){let t=Math.floor(Date.now()/1e3)+bw,r=Cw.parse(e),o=sm.parse({...r,id:Tl()});return new nm(o).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(t).sign(await cm())}n(um,"signBrowserConnectTicket");async function lm(e){try{let{payload:t}=await rm(e,await cm(),{algorithms:[Te],issuer:we,audience:Ce});return Tw.parse(t)}catch(t){throw t instanceof tm.JWTExpired?new v({message:"Browser connect ticket has expired",extensionMembers:{[C]:"oauth_state_expired"}},{cause:t}):new v({message:"Browser connect ticket could not be verified",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:t})}}n(lm,"verifyBrowserConnectTicket");async function pm(e){if((await N().consumeBrowserConnectTicket({id:e.id,expiresAt:D(new Date(e.exp*1e3)),now:D(new Date)})).kind==="consumed")throw new v({message:"Browser connect ticket has already been used",extensionMembers:{[C]:"oauth_state_reused"}})}n(pm,"consumeBrowserConnectTicket");function kw(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}n(kw,"buildConnectRequiredMessage");async function Ew(e){let t=Y(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await um({...Fn(e),purpose:"browser_connect"})),r.toString()}n(Ew,"buildGatewayBrowserTicketUrl");function Pw(e){return de().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}n(Pw,"buildGatewayConnectPath");async function Ji(e){return Ew({...e,path:Pw(e.upstreamServerId),redirect:!0})}n(Ji,"buildGatewayConnectUrl");async function Ss(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await Ji(t),message:kw(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}n(Ss,"buildRedirectConnectRequiredResponse");function mm(e){return Aw({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}n(mm,"buildAdminConnectRequiredResponse");function Aw(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}n(Aw,"buildAdminSetupRequiredResponse");var hm=12;async function fm(e){let t=await crypto.subtle.digest("SHA-256",me(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}n(fm,"sha256Hex");async function Bt(e){if(e)return(await fm(e)).slice(0,hm)}n(Bt,"fingerprintSecret");async function Pr(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await fm(t)).slice(0,hm)}n(Pr,"fingerprintConnectionIdentity");var xw=6e4;function Ar(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,o)=>t.scopes[o]!==r)}n(Ar,"credentialGenerationChanged");function he(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+xw)return"near_expiry"}return"usable"}n(he,"describeAccessTokenState");var gm=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function Uw(e,t){return e&&e.length>0?e.join(t):void 0}n(Uw,"joinOAuthScopes");function Ow(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of gm)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}n(Ow,"sanitizeAuthorizationServerMetadata");function ym(e){let t=Ow(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}n(ym,"sanitizeOAuthDiscoveryState");function Sm(e){let t=new URL(e);for(let r of gm){let o=t.searchParams.getAll(r);o.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,o.at(-1)??""))}return t}n(Sm,"dedupeSingletonAuthorizationRequestParams");function _s(e){let t=new URL(e);return ve(t)&&$u(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}n(_s,"normalizeLoopbackOAuthRedirectUri");function _m(e){return Uw(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}n(_m,"readProtectedResourceMetadataScope");function Mw(e){return`Zuplo MCP Gateway - ${e}`}n(Mw,"buildGatewayOAuthClientName");function zw(e,t){return e&&e.length>0?e.join(t):void 0}n(zw,"joinOAuthScopeList");function qw(e){if(e.clientRegistration.mode!=="auto")return zw(e.scopes,e.scopeDelimiter)}n(qw,"readPublicClientMetadataScope");function Vi(e){return new URL(de().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}n(Vi,"buildOAuthClientMetadataDocumentUrl");function Ki(e){let t=St(e.upstreamServerId);return{client_name:Mw(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}n(Ki,"buildGatewayOAuthClientMetadata");function wm(e,t,r){let o=kr(t,r),s=qw(o);return{client_id:Vi({origin:e,upstreamServerId:t}),...Ki({origin:e,upstreamServerId:t,redirectUri:_s(new URL(o.redirectPath,e)).toString(),scope:s})}}n(wm,"buildOAuthClientMetadataDocument");import{base64url as wt}from"jose";var Nw="SHA-256",xr="AES-GCM",jw=12,Zi="zuplo-secret",Yi=1,Rm="generated:auth_private_key:token-encryption",Dw=l.object({version:l.literal(Yi),keyId:l.literal(Rm),algorithm:l.literal(xr),iv:l.string().min(1),ciphertext:l.string().min(1)}).strict();async function Wi(){return Be({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:n(async e=>{let t=await crypto.subtle.digest(Nw,me(e));return crypto.subtle.importKey("raw",t,{name:xr},!1,["encrypt","decrypt"])},"derive")})}n(Wi,"getEncryptionKey");function bm(e){return me(new TextEncoder().encode(`${Zi}:v${e.version}:${e.keyId}`))}n(bm,"getAssociatedData");function $w(e){return`${Zi}:v${e.version}:${wt.encode(new TextEncoder().encode(JSON.stringify(e)))}`}n($w,"encodeEnvelope");function Lw(e){let t=`${Zi}:v${Yi}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),o=new TextDecoder().decode(wt.decode(r));return Dw.parse(JSON.parse(o))}n(Lw,"decodeEnvelope");async function et(e){let t=await Wi(),r=crypto.getRandomValues(new Uint8Array(jw)),o={version:Yi,keyId:Rm},s=await crypto.subtle.encrypt({name:xr,iv:r,additionalData:bm(o)},t,new TextEncoder().encode(e));return $w({...o,algorithm:xr,iv:wt.encode(r),ciphertext:wt.encode(new Uint8Array(s))})}n(et,"encryptSecret");async function tt(e){let t=Lw(e);if(t){let c=await Wi(),a=await crypto.subtle.decrypt({name:xr,iv:me(wt.decode(t.iv)),additionalData:bm(t)},c,me(wt.decode(t.ciphertext)));return new TextDecoder().decode(a)}let[r,o]=e.split(".");if(!r||!o)throw new ye("Encrypted payload is malformed");let s=await Wi(),i=await crypto.subtle.decrypt({name:xr,iv:me(wt.decode(r))},s,me(wt.decode(o)));return new TextDecoder().decode(i)}n(tt,"decryptSecret");var vm={issuer:l.string().min(1).optional()},Hw=l.union([$t.extend(vm),Hn.extend(vm)]),Im=l.object({authorizationServerUrl:l.url(),resourceMetadataUrl:l.url().optional(),resourceMetadata:hr.optional(),authorizationServerMetadata:l.union([fr,gr]).optional()}).passthrough(),Bw="Bearer",Fw="__zuplo_refresh_only_upstream_access_token__";function Xi(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}n(Xi,"splitScopes");function Qi(e,t){let r=new Set(e);return t.every(o=>r.has(o))}n(Qi,"scopesCover");function Gw(e){return Sr.parse(e)}n(Gw,"parsePkceCodeVerifier");function Jw(e){if(typeof e.expires_in=="number")return D(new Date(Date.now()+e.expires_in*1e3))}n(Jw,"readTokenExpiry");async function Cm(e){if(e!==void 0)return et(JSON.stringify(e))}n(Cm,"encryptJson");async function Tm(e,t){if(!e)return;let r=await tt(e);try{return t.parse(JSON.parse(r))}catch(o){throw new v({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:o})}}n(Tm,"decryptJson");function Vw(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}n(Vw,"clientInformationAllowsRedirectUri");function Kw(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}n(Kw,"clientInformationMatchesCurrentClientMetadataUrl");function Ww(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}n(Ww,"isUrlBasedClientInformation");function Zw(e,t){return t===void 0?e:{...e,scope:t}}n(Zw,"applyOAuthClientMetadataScope");function Yw(e,t){return _m({state:e,delimiter:t})}n(Yw,"readResourceMetadataScope");function Xw(e,t){return e&&e.length>0?e.join(t):void 0}n(Xw,"joinOAuthScopeList");function Qw(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new K(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return $t.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}n(Qw,"buildManualOAuthClientInformation");function eR(e,t){let r=Vi({origin:new URL(t).origin,upstreamServerId:e});return Ni(r)?r:void 0}n(eR,"buildClientMetadataUrl");function tR(e){for(let t of e)if(t!==void 0)return t}n(tR,"firstDefined");function rR(e){let t=kr(e.target.upstreamServerId,e.target.authProfileId),r=Xw(t.scopes,t.scopeDelimiter),o=Ki({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation,configuredClientInformation:Qw({clientMetadata:o,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let s=eR(e.target.upstreamServerId,e.redirectUri);return s===void 0?{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation}:{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation,clientMetadataUrl:s}}n(rR,"buildInitialOAuthClientSetup");function nR(e,t){if(t===void 0)return tR([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}n(nR,"readEncryptedClientInformation");function oR(e){return e.pendingState?.encryptedDiscoveryState}n(oR,"readEncryptedDiscoveryState");function ea(e,t){return t===void 0?e:{...e,issuer:t}}n(ea,"applyIssuerStamp");var Rt=class{static{n(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;skipIssuerMetadataValidationValue;skipResourceIndicatorValidationValue;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;encryptedDiscoveryState;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=rR({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.skipIssuerMetadataValidationValue=r.skipIssuerMetadataValidation,this.skipResourceIndicatorValidationValue=r.skipResourceIndicatorValidation,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=nR(t,this.configuredClientInformation),this.encryptedDiscoveryState=oR(t)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get skipIssuerMetadataValidation(){return this.skipIssuerMetadataValidationValue}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let o=Xi(this.configuredScope??r??this.readEffectiveScope());return Qi(t.scopes,o)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&he(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let o=W();o&&o.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await Pr({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await Bt(await tt(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await N().conditionalUpsertUpstreamConnection(t,r)}catch(o){let s=W();if(s){let i=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:o}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});s.error(i,"Upstream OAuth conditional storage write failed")}throw o}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return Zw(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return dm({id:t.id,...Fn({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(t){return this.configuredClientInformation?ea(this.configuredClientInformation,t?.issuer):this.loadPersistedClientInformation(t)}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,W()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!Ww({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await Cm(t),await this.syncPendingState(!1)))}async validateResourceURL(t,r){if(r!==void 0){if(this.skipResourceIndicatorValidationValue!==!0&&!ss({requestedResource:t,configuredResource:r}))throw new Error(`Protected resource ${r} does not match expected ${t} (or origin)`);return new URL(r)}}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=ym(Im.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=await Cm(r),await this.syncPendingState(!1),W()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:te(r.authorizationServerUrl),resourceMetadataHost:te(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=Yw(r,this.scopeDelimiter);let o=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&o!==void 0){let s=Xi(this.configuredScope).filter(i=>!o.includes(i));s.length>0&&W()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:s,scopesSupported:o},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(t){let r=await this.loadStoredTokens();if(r!==void 0)return ea(r,t?.issuer)}async saveTokens(t){let r=lt.parse(t),o=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,s=this.credentialState.sourceConnection,i=!r.refresh_token&&!!s?.encryptedRefreshToken,c=r.refresh_token?await et(r.refresh_token):s?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!s?.encryptedRefreshToken?r:lt.parse({...r,refresh_token:await tt(s.encryptedRefreshToken)}),this.tokensLoaded=!0;let a={id:s?.id??Xo(),ownerMode:this.target.owner.mode,subjectId:o,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await et(r.access_token),encryptedRefreshToken:c,scopes:Xi(r.scope??this.readEffectiveScope()),expiresAt:Jw(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=s?{expectedUpdatedAt:s.updatedAt}:{expectAbsent:!0},p=await this.conditionalUpsertCredential(a,u),h=!1;if(p.kind==="precondition_failed"&&p.connection!==void 0&&(he(p.connection)!=="usable"||!Qi(p.connection.scopes,a.scopes)||!Ar(s,p.connection))){h=!0;let y=p.connection,S={id:y.id,ownerMode:y.ownerMode,subjectId:y.subjectId,upstreamServerId:y.upstreamServerId,authProfileId:y.authProfileId,status:"active",encryptedAccessToken:a.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?y.encryptedRefreshToken:a.encryptedRefreshToken,scopes:a.scopes,expiresAt:a.expiresAt,metadata:y.metadata};W()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:y.id,sourceUpdatedAt:s?.updatedAt,winnerUpdatedAt:y.updatedAt,sourceScopeCount:s?.scopes.length,winnerScopeCount:y.scopes.length,resultingScopeCount:S.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),p=await this.conditionalUpsertCredential(S,{expectedUpdatedAt:y.updatedAt})}if(p.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=p.kind,p.kind==="persisted"?(this.credentialState.currentConnection=p.connection,this.credentialState.peerAdoption=void 0):p.kind==="precondition_failed"&&p.connection!==void 0?(this.credentialState.currentConnection=p.connection,Ar(s,p.connection)&&he(p.connection)==="usable"&&Qi(p.connection.scopes,a.scopes)?this.adoptPeerConnection(p.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),h){let y=p.kind==="persisted"?"succeeded":p.kind==="precondition_failed"?"lost":"exhausted";W()?.info({event:`upstream_oauth_bounded_rebase_${y}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:s?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:s?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${y}`)}let f=p.kind==="persisted"?p.connection:void 0;W()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:f?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!c,sourceScopeCount:s?.scopes.length,priorStatus:s?.status,priorUpdatedAt:s?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await Bt(r.refresh_token),reusedSnapshotRefreshToken:i,scopeCount:a.scopes.length,expiresAt:a.expiresAt,outcome:p.kind,rebaseAttempted:h,resultingUpdatedAt:f?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:f?.scopes.length??this.credentialState.currentConnection?.scopes.length},f?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Sm(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:Gw(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new v({message:"OAuth code verifier is missing",extensionMembers:{[C]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",o=t==="all"||t==="client",s=t==="all"||t==="discovery",i=t==="all"||t==="verifier";o&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),s&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=void 0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(i),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:Cl(),...Fn({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:D(new Date(Date.now()+im)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await N().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState})}async loadPersistedClientInformation(t){if(this.clientInformationLoaded)return this.cachedClientInformation;let r;try{r=await Tm(this.encryptedClientInformation,Hw)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(r&&(!Vw(r,this.redirectUriValue)||!Kw({clientInformation:r,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return r===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(r=ea(Hn.parse({client_id:this.clientMetadataUrl}),t?.issuer)),this.cachedClientInformation=r,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0;try{this.cachedDiscoveryState=await Tm(this.encryptedDiscoveryState,Im)}catch{this.encryptedDiscoveryState=void 0,this.cachedDiscoveryState=void 0}return this.cachedDiscoveryState}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){W()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await tt(t.encryptedAccessToken):void 0,o=t.encryptedRefreshToken?await tt(t.encryptedRefreshToken):void 0;if(!r&&!o)return;let s=W();this.usedRefreshTokenFingerprintValue=s?await Bt(o):void 0,s?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!o,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let i=lt.parse({access_token:r??Fw,token_type:Bw,refresh_token:o,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=i,i}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let o=r.status,s=r.updatedAt,i={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(i.status="reconsent_required",i.encryptedAccessToken=void 0,i.encryptedRefreshToken=void 0,i.scopes=[],i.expiresAt=void 0),i.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let c=await this.conditionalUpsertCredential(i,{expectedUpdatedAt:r.updatedAt});c.kind==="persisted"?(this.credentialState.currentConnection=c.connection,this.credentialState.peerAdoption=void 0):c.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):c.connection!==void 0&&(this.credentialState.currentConnection=c.connection,Ar(r,c.connection)&&he(c.connection)==="usable"&&this.connectionSatisfiesRequestedScope(c.connection)?this.adoptPeerConnection(c.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let a=W();if(a){let u=c.kind==="missing"?void 0:c.connection,p={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:o,newStatus:u?.status,priorUpdatedAt:s,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:c.kind};c.kind==="precondition_failed"?a.warn({...p,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?a.warn(p,"Upstream OAuth credentials invalidated; connection now requires reconsent"):a.debug(p,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var sR=3e4,iR=256*1024,aR=2,cR="does not support dynamic client registration",dR=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],uR=["trying to load OAuth metadata from","trying to load OpenID provider metadata from"],lR=["Incompatible auth server: does not support response type","Incompatible auth server: does not support code challenge method"],pR="Protected resource ",mR=" does not match expected ",hR=["HTTP 403 Forbidden","Access Denied","permission to access"],fR=new Set([ue.AccessDenied,ue.InvalidClient,ue.InvalidGrant,ue.InvalidRequest,ue.InvalidScope,ue.InvalidTarget,ue.UnauthorizedClient,ue.UnsupportedGrantType]);function gR(e){return e instanceof Error&&e.message.includes(cR)}n(gR,"isDynamicClientRegistrationUnsupported");function yR(e){return e instanceof Error&&dR.some(t=>e.message.includes(t))}n(yR,"isProtectedResourceMetadataUnavailable");function SR(e){return e instanceof Error&&uR.some(t=>e.message.includes(t))}n(SR,"isAuthorizationServerMetadataUnavailable");function _R(e){return e instanceof Error&&lR.some(t=>e.message.includes(t))}n(_R,"isAuthorizationServerIncompatible");function wR(e){return e instanceof Error&&e.message.includes(pR)&&e.message.includes(mR)}n(wR,"isProtectedResourceMismatch");function RR(e){return e instanceof Error&&hR.some(t=>e.message.includes(t))}n(RR,"isUpstreamProviderAccessDenied");function bR(e){return e instanceof ft&&fR.has(e.code)}n(bR,"isStoredConnectionReconsentError");function rt(e){let t=e.diagnostics??{};return new v({message:e.message,extensionMembers:{[C]:e.code,[Bo]:e.upstreamServerId,[Rr]:e.resourceMetadataUrl,...t.upstreamUrl===void 0?{}:{[We]:t.upstreamUrl},...t.httpStatus===void 0?{}:{[Ke]:t.httpStatus},...t.providerError===void 0?{}:{[br]:t.providerError},...t.providerErrorDescription===void 0?{}:{[vr]:t.providerErrorDescription}}},{cause:e.cause})}n(rt,"buildUpstreamSetupProblem");function vR(e,t){return`The authorization server for ${e} failed RFC 8414 \xA73.3 issuer validation: the gateway discovered it at "${t.expected}", but its metadata document declares issuer "${t.received}". Providers that publish a path-scoped authorization server whose metadata reports the root origin hit this; if that is the case here, set skipIssuerMetadataValidation on this upstream's OAuth config to accept it \u2014 that weakens the authorization-server mix-up defense, so scope it to this upstream. Otherwise correct the authorization server URL this upstream points at, or ask the provider to fix the published issuer.`}n(vR,"describeIssuerMetadataMismatch");var IR=128,CR=256;function km(e,t){if(e!==void 0)return e.length<=t?e:`${e.slice(0,t)}\u2026`}n(km,"truncateProviderDetail");function TR(e){let{error:t,errorDescription:r}=Pm(e.body),o=km(t,IR),s=km(r,CR);return{httpStatus:e.status,...o===void 0?{}:{providerError:o},...s===void 0?{}:{providerErrorDescription:s}}}n(TR,"readRegistrationRejectionDiagnostics");function kR(e){return e.providerError===void 0?`HTTP ${e.httpStatus}`:e.providerErrorDescription===void 0?`HTTP ${e.httpStatus}, ${e.providerError}`:`HTTP ${e.httpStatus}, ${e.providerError}: ${e.providerErrorDescription}`}n(kR,"describeRegistrationRejection");function ER(e){return/(https?:\/\/\S+)/.exec(e)?.[1]}n(ER,"readDiscoveryEndpointUrl");function PR(e){if(e.error instanceof v&&e.error.extensionMembers?.[C]!==void 0)return e.error;let t={upstreamServerId:e.upstreamServerId,resourceMetadataUrl:e.resourceMetadataUrl,cause:e.error};if(gR(e.error))return rt({...t,code:"upstream_client_registration_required",message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`});if(e.error instanceof zi){let r=TR(e.error);return rt({...t,code:"upstream_client_registration_required",message:`The authorization server for ${e.upstreamServerId} rejected the gateway's Dynamic Client Registration request (${kR(r)}). Register an OAuth client for the gateway manually and configure it on this upstream, or correct the registration metadata the provider objected to, before retrying.`,diagnostics:r})}if(e.error instanceof eo&&e.error.kind==="metadata")return rt({...t,code:"upstream_oauth_issuer_mismatch",message:vR(e.upstreamServerId,e.error),diagnostics:{upstreamUrl:e.error.expected}});if(e.error instanceof ds)return rt({...t,code:"upstream_oauth_server_incompatible",message:`The authorization server for ${e.upstreamServerId} publishes the non-HTTPS token endpoint "${e.error.tokenEndpoint}". The gateway will not send credentials to it. Ask the provider to serve the token endpoint over TLS before retrying.`,diagnostics:{upstreamUrl:e.error.tokenEndpoint}});if(_R(e.error))return rt({...t,code:"upstream_oauth_server_incompatible",message:`The authorization server for ${e.upstreamServerId} cannot run the OAuth flow the gateway requires: ${e.error.message}. Ask the provider to support the authorization code flow with PKCE (S256), or configure this upstream to use an authorization server that does.`});if(SR(e.error)){let r=ER(e.error.message);return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The gateway could not load OAuth authorization server metadata for the upstream MCP server "${e.upstreamServerId}": ${e.error.message}. Confirm the authorization server advertised by "${e.resourceMetadataUrl}" publishes RFC 8414 or OpenID Connect discovery metadata and is reachable from the gateway, then retry.`,diagnostics:r===void 0?{}:{upstreamUrl:r}})}if(wR(e.error))return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The protected resource metadata at "${e.resourceMetadataUrl}" names a resource that does not match the configured MCP URL for ${e.upstreamServerId}: ${e.error.message}. Point this upstream's MCP URL at the resource the provider publishes, or ask the provider to correct the advertised resource.`});if(yR(e.error))return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`});if(RR(e.error))return rt({...t,code:"upstream_provider_access_denied",message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`})}n(PR,"mapUpstreamOAuthSetupError");function AR(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}n(AR,"readOAuthFetchRequest");function xR(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}n(xR,"readOAuthFetchMethod");function UR(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}n(UR,"responseLooksJson");function OR(e,t){let r=e.headers.get("content-type")??"",o=t.trimStart().toLowerCase();return r.includes("html")||o.startsWith("<!doctype html")||o.startsWith("<html")}n(OR,"responseLooksHtml");var MR=["/.well-known/oauth-protected-resource","/.well-known/oauth-authorization-server","/.well-known/openid-configuration"];function zR(e){return MR.some(t=>e.pathname.endsWith(t)||e.pathname.startsWith(`${t}/`))}n(zR,"isMetadataDiscoveryRequest");function qR(e,t,r){return e!=="GET"||!zR(t)?!1:r>=400&&r<500||r===502}n(qR,"sdkRetriesDiscoveryCandidate");function NR(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new v({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[C]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[Ke]:e.response.status,[_r]:r,[We]:e.request.url.toString(),[wr]:e.body}})}n(NR,"throwUpstreamHtmlError");function Pm(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}n(Pm,"readUpstreamOAuthErrorBody");function jR(e){let{error:t,errorDescription:r}=Pm(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.method,host:te(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}n(jR,"logUpstreamOAuthHttpError");function Am(e){return async(t,r)=>{let o=AR(t),s=xR(t,r),i=W(),c=Date.now(),a=await Jp(t,r,{maxRedirects:aR,maxResponseBytes:iR,problemCode:"upstream_token_exchange_failed",timeoutMs:sR}),u=await a.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:s,host:te(o.url),path:o.url.pathname,status:a.status,durationMs:Date.now()-c,responseChars:u.length},"Upstream OAuth HTTP request completed"),a.ok||jR({log:i,upstreamServerId:e,method:s,request:o,response:a,body:u}),qR(s,o.url,a.status)||(!a.ok&&OR(a,u)&&NR({upstreamServerId:e,request:o,response:a,body:u}),!UR(a,u)))return a;try{JSON.parse(u)}catch(p){throw new v({message:`Upstream OAuth fetch ${o.url.origin}${o.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[C]:"upstream_token_exchange_failed"}},{cause:p})}return a}}n(Am,"createUpstreamOAuthFetch");function xm(e){W()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:te(e.serverUrl),resourceMetadataHost:te(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}n(xm,"logUpstreamOAuthFlowStarted");function Um(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=te(e.serverUrl);r!==void 0&&(t.serverHost=r);let o=e.error instanceof v?e.error.extensionMembers?.[C]:void 0;typeof o=="string"&&(t.code=o),pe(t,"error",e.error),W()?.warn(t,"Upstream OAuth flow failed before a connection was established")}n(Um,"logUpstreamOAuthFlowFailed");function Om(e,t){return e.configuredAuthorizationScope??t.requestedScope}n(Om,"readAuthorizationRequestScope");async function Mm(e,t){e.applyChallengeScope(t.requestedScope),xm({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Am(t.upstreamServerId)},o=Om(e,t);return o!==void 0&&(r.scope=o),e.skipIssuerMetadataValidation!==void 0&&(r.skipIssuerMetadataValidation=e.skipIssuerMetadataValidation),await qi(e,r)}catch(r){Um({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let o=PR({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw o!==void 0?o:r}}n(Mm,"runUpstreamOAuth");async function DR(e,t){e.applyChallengeScope(t.requestedScope),xm({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Am(t.upstreamServerId)};t.iss!==void 0&&(r.iss=t.iss);let o=Om(e,t);o!==void 0&&(r.scope=o),e.skipIssuerMetadataValidation!==void 0&&(r.skipIssuerMetadataValidation=e.skipIssuerMetadataValidation);try{return await qi(e,r)}catch(s){throw Um({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:s}),s}}n(DR,"exchangeUpstreamAuthorizationCode");async function Em(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await N().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||he(r)!=="usable"||!Ar(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}n(Em,"adoptPeerCredentialAtResolutionBoundary");async function zm(e,t){let r=await Mm(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new v({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}}):new v({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}})}n(zm,"requireUpstreamAuthorizationRedirect");async function qm(e){let t=he(e.connection),r=!!e.forceRefresh,o=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),s=W(),i=s?await Pr({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(s?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:i,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!o,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},o?"Reusing stored upstream access token":"Refreshing upstream credential"),o)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let c;try{c=await Mm(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(a){if(e.connection===void 0||!bR(a))throw a;return s?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:a.code,connectionFingerprint:i,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await Em({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(c==="AUTHORIZED"){let a=e.provider.readUsablePeerAdoption(e.requestedScope);return a!==void 0&&await e.provider.adoptConnectionForDirectResolution(a,"cas_loss"),!e.provider.tokenWriteWasPersisted&&a===void 0?{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(c!=="REDIRECT")throw new v({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${c}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new v({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});return await Em({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}n(qm,"authorizeUpstreamOAuthSession");async function $R(e){let t=await ys(e.stateToken),r=await N().consumeUpstreamOAuthState({id:t.id,now:D(new Date)}),o=LR(r);return HR({storedState:o,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),BR(o),o}n($R,"consumeStoredCallbackState");function LR(e){switch(e.kind){case"consumed":throw new v({message:"OAuth state has already been used",extensionMembers:{[C]:"oauth_state_reused"}});case"missing":throw new v({message:"OAuth state is missing or expired",extensionMembers:{[C]:"oauth_state_expired"}});case"available":return e.record}}n(LR,"readConsumedCallbackState");function HR(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new v({message:"OAuth callback did not match the initiating request",extensionMembers:{[C]:"oauth_callback_mismatch"}})}n(HR,"assertStoredCallbackStateMatches");function BR(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new v({message:"OAuth state has expired",extensionMembers:{[C]:"oauth_state_expired"}})}n(BR,"assertStoredCallbackStateFresh");async function ta(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),mm(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),Ss(t)}n(ta,"buildOAuthConnectRequiredResponse");async function Nm(e){let t=await $R({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Vo(t),[o]=await N().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),s={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};o!==void 0&&(s.connection=o);let i=new Rt(s),c=await DR(i,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,...e.iss===void 0?{}:{iss:e.iss},resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(c==="AUTHORIZED"){let a=i.readUsablePeerAdoption();if(a!==void 0&&await i.adoptConnectionForDirectResolution(a,"cas_loss"),!i.tokenWriteWasPersisted&&a===void 0)throw new v({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});return t}throw c!=="REDIRECT"?new v({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${c}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}}):new v({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}})}n(Nm,"finishUpstreamOAuthCallback");import{importPKCS8 as FR,SignJWT as GR}from"jose";var Dm=1e4,$m=64*1024,Lm=2,JR=300,qe=l.string().min(1),VR=l.object({access_token:qe,issued_token_type:l.literal(ti),token_type:l.string().optional(),expires_in:l.number().int().positive().optional(),scope:qe.optional()}).passthrough(),KR=l.object({id_token:qe,token_type:qe.optional(),expires_in:l.number().int().positive().optional(),refresh_token:qe.optional(),scope:qe.optional()}).passthrough(),WR=l.object({access_token:qe,token_type:qe,expires_in:l.number().int().positive().optional(),scope:qe.optional(),resource:qe.optional(),refresh_token:qe.optional()}).passthrough();function jm(e){return encodeURIComponent(e).replace(/%20/g,"+")}n(jm,"formEncodeClientCredential");function ZR(e){return e.replaceAll("\\n",`
+import{$ as pr,$a as $c,$b as Dd,$c as Eu,$e as Sr,$f as sl,A as Va,Aa as hc,Ab as md,Ac as tu,Af as Ug,Ag as Lt,Ba as fc,Bb as hd,Bc as ru,Bf as Og,Bg as fl,C as qo,Ca as gc,Cb as fd,Cc as nu,Cf as Vu,Cg as Jn,Da as yc,Db as gd,Dc as ou,Df as Ku,Dg as gl,Ea as Sc,Eb as yd,Ec as su,Ef as Wu,Eg as Yo,Fa as _c,Fb as Sd,Fc as iu,Ff as Jo,Fg as Vn,Ga as wc,Gb as _d,Gc as au,Gf as Bn,Gg as yl,Ha as Rc,Hb as wd,Hc as cu,Hf as Zu,Hg as Sl,Ia as bc,Ib as Rd,Ic as du,If as Ir,Ig as _l,Ja as vc,Jb as bd,Jc as uu,Jf as Yu,Jg as wl,Ka as Ic,Kb as vd,Kc as lu,Kf as Qs,Kg as Rl,La as Cc,Lb as Id,Lc as pu,Lf as Xu,Lg as bl,Ma as Tc,Mb as Cd,Mc as mu,Mf as Fn,Mg as vl,Na as kc,Nb as Td,Nc as hu,Nf as Vo,Ng as Il,Oa as Bs,Ob as kd,Oc as fu,Of as Qu,Og as Xo,P as Ka,Pa as Ec,Pb as Ed,Pc as gu,Pf as el,Pg as Cl,Qa as Pc,Qb as Pd,Qc as yu,Qf as tl,Qg as Tl,Ra as Ac,Rb as Ad,Rc as Su,Rf as rl,Rg as N,Sa as xc,Sb as xd,Sc as _u,Sf as Se,Sg as J,Ta as Uc,Tb as Ud,Tc as wu,Te as $u,Tf as de,Tg as me,Ua as Oc,Ub as Od,Uc as Ru,Ue as ve,Uf as nl,Ug as Qe,Va as Mc,Vb as Md,Vc as bu,Ve as Lu,Vf as ol,Vg as X,W as No,Wa as zc,Wb as zd,Wc as vu,We as Hu,Wf as D,Wg as Qo,X as Ds,Xa as qc,Xb as Fs,Xc as Iu,Xe as Y,Xf as Ye,Xg as Mg,Y as ur,Ya as Nc,Yb as qd,Yc as Cu,Ye as Bu,Yf as Cr,Yg as zg,Z as Dn,Za as jc,Zb as Nd,Zc as Tu,Ze as yr,Zf as pe,_ as lr,_a as Dc,_b as jd,_c as ku,_e as Fu,_f as te,aa as $n,ab as Lc,ac as $d,ad as Pu,af as C,ag as W,ba as mr,bb as Hc,bc as Ld,bd as Au,bf as _r,bg as il,ca as Wa,cb as Bc,cc as Hd,cd as xu,cf as wr,cg as mt,da as Za,db as Fc,dc as Bd,dd as Uu,df as Ke,dg as ei,ea as Ya,eb as Gc,ec as Fd,ed as Ou,ef as We,eg as Ko,fa as Xa,fb as Jc,fc as Gd,fd as Mu,ff as Bo,fg as ti,ga as Qa,gb as Vc,gc as Jd,gd as hr,gf as Rr,gg as Wo,ha as ec,hb as Kc,hc as Vd,hd as fr,hf as br,hg as Gn,ia as tc,ib as Wc,ic as Kd,id as zu,if as vr,ig as Tr,ja as rc,jb as Zc,jc as Wd,jd as gr,jf as Fo,jg as al,ka as nc,kb as Yc,kc as Zd,kd as lt,kf as Gu,kg as Xe,l as Le,la as oc,lb as Xc,lc as Yd,ld as Xs,lf as ze,lg as ri,ma as sc,mb as Qc,mc as Gs,md as Ho,mf as Ju,mg as ni,na as ic,nb as ed,nc as jo,nd as qu,nf as Ze,ng as cl,oa as ac,ob as td,oc as Do,od as Hn,of as x,og as Zo,pa as cc,pb as rd,pc as Js,pd as $t,pf as Go,pg as oi,qa as dc,qb as nd,qc as Vs,qd as Nu,qf as le,qg as si,ra as uc,rb as od,rc as Ks,rd as ju,rf as pt,rg as dl,s as jt,sa as Dt,sb as sd,sc as Xd,sf as Ig,sg as ne,t as Ga,ta as $s,tb as id,tc as Ws,tf as Cg,tg as ul,ua as Ls,ub as ad,uc as Zs,uf as Tg,ug as ll,v as B,va as Ln,vb as cd,vc as Qd,vf as kg,vg as ii,wa as Hs,wb as dd,wc as eu,wf as Eg,wg as pl,xa as lc,xb as ud,xc as Ys,xd as Du,xf as Pg,xg as ml,ya as pc,yb as ld,yc as $o,yf as Ag,yg as ai,za as mc,zb as pd,zc as Lo,zf as xg,zg as hl}from"../chunk-WFAFGL5Y.js";import"../chunk-54HRCPVQ.js";import{a as kl}from"../chunk-6SNZ4DOC.js";import{a as Ja}from"../chunk-QGAJTUPE.js";import"../chunk-A3QGJZO7.js";import{A as l,b as qs,c as Nn,d as Ha,e as d,f as Ba,g as Fa,h as b,i as A,j as Mo,l as M,m as _,n as m,o as q,p as E,q as Ns,r as jn,s as T,t as j,u as g,v as z,w as js,x as zo}from"../chunk-6O4OZCO6.js";import{$ as La,a as ye,aa as Oo,c as v,d as K}from"../chunk-MWIJG5KC.js";import{a as n}from"../chunk-TYV53J3B.js";var qg=Object.create,es=Object.defineProperty,Ng=Object.getOwnPropertyDescriptor,jg=Object.getOwnPropertyNames,Dg=Object.getPrototypeOf,$g=Object.prototype.hasOwnProperty,El=n((e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),"__commonJSMin"),Pl=n((e,t)=>{let r={};for(var o in e)es(r,o,{get:e[o],enumerable:!0});return t&&es(r,Symbol.toStringTag,{value:"Module"}),r},"__exportAll"),Lg=n((e,t,r,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(var s=jg(t),i=0,c=s.length,a;i<c;i++)a=s[i],!$g.call(e,a)&&a!==r&&es(e,a,{get:(u=>t[u]).bind(null,a),enumerable:!(o=Ng(t,a))||o.enumerable});return e},"__copyProps"),Al=n((e,t,r)=>(r=e!=null?qg(Dg(e)):{},Lg(t||!e||!e.__esModule?es(r,"default",{value:e,enumerable:!0}):r,e)),"__toESM");var Hg=new Set(["https://json-schema.org/draft/2019-09/schema","http://json-schema.org/draft/2019-09/schema"]);function xl(e){return typeof e=="string"&&Hg.has(e.replace(/#$/,""))}n(xl,"declares2019Dialect");var mi=Symbol.for("mcp.sdk.errorBrands");function Ht(e,t){let r=new Set,o=t;for(;typeof o=="function";){let s=o.mcpBrand;Object.prototype.hasOwnProperty.call(o,"mcpBrand")&&typeof s=="string"&&r.add(s),o=Object.getPrototypeOf(o)}r.size!==0&&Object.defineProperty(e,mi,{value:r,enumerable:!1,configurable:!0})}n(Ht,"stampErrorBrands");function Ie(e,t){try{if(typeof t=="object"&&t!==null&&Object.prototype.hasOwnProperty.call(e,"mcpBrand")&&typeof e.mcpBrand=="string"&&Object.prototype.hasOwnProperty.call(t,mi)){let r=t[mi];if(r&&typeof r.has=="function"&&r.has(e.mcpBrand))return!0}}catch{}return Function.prototype[Symbol.hasInstance].call(e,t)}n(Ie,"brandedHasInstance");var ue=(function(e){return e.InvalidRequest="invalid_request",e.InvalidClient="invalid_client",e.InvalidGrant="invalid_grant",e.UnauthorizedClient="unauthorized_client",e.UnsupportedGrantType="unsupported_grant_type",e.InvalidScope="invalid_scope",e.AccessDenied="access_denied",e.ServerError="server_error",e.TemporarilyUnavailable="temporarily_unavailable",e.UnsupportedResponseType="unsupported_response_type",e.UnsupportedTokenType="unsupported_token_type",e.InvalidToken="invalid_token",e.MethodNotAllowed="method_not_allowed",e.TooManyRequests="too_many_requests",e.InvalidClientMetadata="invalid_client_metadata",e.InvalidRedirectUri="invalid_redirect_uri",e.InsufficientScope="insufficient_scope",e.InvalidTarget="invalid_target",e})({}),ft=class Ll extends Error{static{n(this,"OAuthError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthError"})}static[Symbol.hasInstance](t){return Ie(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,t)}constructor(t,r,o){super(r),this.code=t,this.errorUri=o,this.name="OAuthError",Ht(this,new.target)}toResponseObject(){let t={error:this.code,error_description:this.message};return this.errorUri&&(t.error_uri=this.errorUri),t}static fromResponse(t){return new Ll(t.error,t.error_description??t.error,t.error_uri)}},se=(function(e){return e.NotConnected="NOT_CONNECTED",e.AlreadyConnected="ALREADY_CONNECTED",e.NotInitialized="NOT_INITIALIZED",e.CapabilityNotSupported="CAPABILITY_NOT_SUPPORTED",e.RequestTimeout="REQUEST_TIMEOUT",e.ConnectionClosed="CONNECTION_CLOSED",e.SendFailed="SEND_FAILED",e.InvalidResult="INVALID_RESULT",e.UnsupportedResultType="UNSUPPORTED_RESULT_TYPE",e.InputRequiredRoundsExceeded="INPUT_REQUIRED_ROUNDS_EXCEEDED",e.ListPaginationExceeded="LIST_PAGINATION_EXCEEDED",e.MethodNotSupportedByProtocolVersion="METHOD_NOT_SUPPORTED_BY_PROTOCOL_VERSION",e.EraNegotiationFailed="ERA_NEGOTIATION_FAILED",e.ClientHttpNotImplemented="CLIENT_HTTP_NOT_IMPLEMENTED",e.ClientHttpAuthentication="CLIENT_HTTP_AUTHENTICATION",e.ClientHttpForbidden="CLIENT_HTTP_FORBIDDEN",e.ClientHttpUnexpectedContent="CLIENT_HTTP_UNEXPECTED_CONTENT",e.ClientHttpFailedToOpenStream="CLIENT_HTTP_FAILED_TO_OPEN_STREAM",e.ClientHttpFailedToTerminateSession="CLIENT_HTTP_FAILED_TO_TERMINATE_SESSION",e})({}),re=class extends Error{static{n(this,"SdkError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e,t,r){super(t),this.code=e,this.data=r,this.name="SdkError",Ht(this,new.target)}},ey=class extends re{static{n(this,"SdkHttpError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SdkHttpError"})}constructor(e,t,r){super(e,t,r),this.name="SdkHttpError"}get status(){return this.data.status}get statusText(){return this.data.statusText}};function Hl(e){let t=typeof e=="string"?new URL(e):new URL(e.href);return t.hash="",t}n(Hl,"resourceUrlFromServerUrl");function ss({requestedResource:e,configuredResource:t}){let r=typeof e=="string"?new URL(e):new URL(e.href),o=typeof t=="string"?new URL(t):new URL(t.href);if(r.origin!==o.origin||r.pathname.length<o.pathname.length)return!1;let s=r.pathname.endsWith("/")?r.pathname:r.pathname+"/",i=o.pathname.endsWith("/")?o.pathname:o.pathname+"/";return s.startsWith(i)}n(ss,"checkResourceAllowed");var ty="2026-07-28";function Bl(e){return e>=ty}n(Bl,"isModernProtocolVersion");function Fl(e){let t=e.structuredContent;return t===void 0||!(typeof t!="object"||t===null||Array.isArray(t))||(e.content?.some(r=>r.type==="text")??!1)?e:{...e,content:[...e.content??[],{type:"text",text:JSON.stringify(t)}]}}n(Fl,"appendTextFallbackForNonObject");var Gl=["task","inputRequests","requestState"];function ry(e){return e===null||typeof e!="object"||Array.isArray(e)||e.content!==void 0||Gl.some(t=>t in e)?e:{...e,content:[]}}n(ry,"normalizeContentlessToolResult");function ny(){let e=js(()=>E([d(),b(),A(),Mo(),T(d(),e),_(e)])),t=T(d(),e),r=E([d(),b().int()]),o=d(),s=m({ttl:b().optional()}),i=m({taskId:d()}),c=q({progressToken:r.optional(),"io.modelcontextprotocol/related-task":i.optional()}),a=m({_meta:c.optional()}),u=a.extend({task:s.optional()}),p=m({method:d(),params:a.loose().optional()}),h=m({_meta:c.optional()}),f=m({method:d(),params:h.loose().optional()}),y=q({_meta:c.optional()}),S=E([d(),b().int()]),k=y.strict(),w=h.extend({requestId:S.optional(),reason:d().optional()}),I=f.extend({method:g("notifications/cancelled"),params:w}),U=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:j(["light","dark"]).optional()}),O=m({icons:_(U).optional()}),H=m({name:d(),title:d().optional()}),F=H.extend({...H.shape,...O.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),ee=jn(m({applyDefaults:A().optional()}),t),G=zo(ce=>ce&&typeof ce=="object"&&!Array.isArray(ce)&&Object.keys(ce).length===0?{form:{}}:ce,jn(m({form:ee.optional(),url:t.optional()}),t.optional())),V=q({list:t.optional(),cancel:t.optional(),requests:q({sampling:q({createMessage:t.optional()}).optional(),elicitation:q({create:t.optional()}).optional()}).optional()}),Ge=q({list:t.optional(),cancel:t.optional(),requests:q({tools:q({call:t.optional()}).optional()}).optional()}),oe=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:G.optional(),roots:m({listChanged:A().optional()}).optional(),tasks:V.optional(),extensions:T(d(),t).optional()}),je=a.extend({protocolVersion:d(),capabilities:oe,clientInfo:F}),L=p.extend({method:g("initialize"),params:je}),Ue=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:A().optional()}).optional(),resources:m({subscribe:A().optional(),listChanged:A().optional()}).optional(),tools:m({listChanged:A().optional()}).optional(),tasks:Ge.optional(),extensions:T(d(),t).optional()}),Br=y.extend({protocolVersion:d(),capabilities:Ue,serverInfo:F,instructions:d().optional()}),Vt=f.extend({method:g("notifications/initialized"),params:h.optional()}),st=p.extend({method:g("ping"),params:a.optional()}),Ct=m({progress:b(),total:z(b()),message:z(d())}),De=m({...h.shape,...Ct.shape,progressToken:r}),it=f.extend({method:g("notifications/progress"),params:De}),Kt=a.extend({cursor:o.optional()}),Je=p.extend({params:Kt.optional()}),Ve=y.extend({nextCursor:o.optional()}),Wt=m({uri:d(),mimeType:z(d()),_meta:T(d(),M()).optional()}),Zt=Wt.extend({text:d()}),Tt=d().refine(ce=>{try{return atob(ce),!0}catch{return!1}},{message:"Invalid Base64 string"}),Yt=Wt.extend({blob:Tt}),$e=j(["user","assistant"]),Oe=m({audience:_($e).optional(),priority:b().min(0).max(1).optional(),lastModified:Nn.datetime({offset:!0}).optional()}),kt=m({...H.shape,...O.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:Oe.optional(),_meta:z(q({}))}),Fr=m({...H.shape,...O.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:Oe.optional(),_meta:z(q({}))}),Gr=Je.extend({method:g("resources/list")}),Jr=Ve.extend({resources:_(kt)}),at=Je.extend({method:g("resources/templates/list")}),Xt=Ve.extend({resourceTemplates:_(Fr)}),Et=a.extend({uri:d()}),Vr=Et,Kr=p.extend({method:g("resources/read"),params:Vr}),Wr=y.extend({contents:_(E([Zt,Yt]))}),Zr=f.extend({method:g("notifications/resources/list_changed"),params:h.optional()}),Yr=Et,Xr=p.extend({method:g("resources/subscribe"),params:Yr}),Qr=Et,en=p.extend({method:g("resources/unsubscribe"),params:Qr}),tn=h.extend({uri:d()}),rn=f.extend({method:g("notifications/resources/updated"),params:tn}),nn=m({name:d(),description:z(d()),required:z(A())}),on=m({...H.shape,...O.shape,description:z(d()),arguments:z(_(nn)),_meta:z(q({}))}),sn=Je.extend({method:g("prompts/list")}),an=Ve.extend({prompts:_(on)}),cn=a.extend({name:d(),arguments:T(d(),d()).optional()}),dn=p.extend({method:g("prompts/get"),params:cn}),Pt=m({type:g("text"),text:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),At=m({type:g("image"),data:Tt,mimeType:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),xt=m({type:g("audio"),data:Tt,mimeType:d(),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),un=m({type:g("tool_use"),name:d(),id:d(),input:T(d(),M()),_meta:T(d(),M()).optional()}),ct=m({type:g("resource"),resource:E([Zt,Yt]),annotations:Oe.optional(),_meta:T(d(),M()).optional()}),ln=kt.extend({type:g("resource_link")}),Pe=E([Pt,At,xt,ln,ct]),Qt=m({role:$e,content:Pe}),er=y.extend({description:d().optional(),messages:_(Qt)}),Ut=f.extend({method:g("notifications/prompts/list_changed"),params:h.optional()}),pn=m({title:d().optional(),readOnlyHint:A().optional(),destructiveHint:A().optional(),idempotentHint:A().optional(),openWorldHint:A().optional()}),tr=m({taskSupport:j(["required","optional","forbidden"]).optional()}),Ot=m({...H.shape,...O.shape,description:d().optional(),inputSchema:m({type:g("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(M()),outputSchema:m({type:g("object"),properties:T(d(),e).optional(),required:_(d()).optional()}).catchall(M()).optional(),annotations:pn.optional(),execution:tr.optional(),_meta:T(d(),M()).optional()}),rr=Je.extend({method:g("tools/list")}),nr=Ve.extend({tools:_(Ot)}),or=y.extend({content:_(Pe),structuredContent:T(d(),M()).optional(),isError:A().optional()}),ae=u.extend({name:d(),arguments:T(d(),M()).optional()}),mn=p.extend({method:g("tools/call"),params:ae}),go=f.extend({method:g("notifications/tools/list_changed"),params:h.optional()}),sr=j(["debug","info","notice","warning","error","critical","alert","emergency"]),hn=a.extend({level:sr}),fn=p.extend({method:g("logging/setLevel"),params:hn}),gn=h.extend({level:sr,logger:d().optional(),data:M()}),yn=f.extend({method:g("notifications/message"),params:gn}),Sn=m({name:d().optional()}),_n=m({hints:_(Sn).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),wn=m({mode:j(["auto","required","none"]).optional()}),yo=m({type:g("tool_result"),toolUseId:d().describe("The unique identifier for the corresponding tool call."),content:_(Pe),structuredContent:m({}).loose().optional(),isError:A().optional(),_meta:T(d(),M()).optional()}),Rn=Ns("type",[Pt,At,xt]),dt=Ns("type",[Pt,At,xt,un,yo]),bn=m({role:$e,content:E([dt,_(dt)]),_meta:T(d(),M()).optional()}),vn=u.extend({messages:_(bn),modelPreferences:_n.optional(),systemPrompt:d().optional(),includeContext:j(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Ot).optional(),toolChoice:wn.optional()}),In=p.extend({method:g("sampling/createMessage"),params:vn}),Cn=y.extend({model:d(),stopReason:z(j(["endTurn","stopSequence","maxTokens"]).or(d())),role:$e,content:Rn}),Tn=y.extend({model:d(),stopReason:z(j(["endTurn","stopSequence","maxTokens","toolUse"]).or(d())),role:$e,content:E([dt,_(dt)])}),kn=m({type:g("boolean"),title:d().optional(),description:d().optional(),default:A().optional()}),En=m({type:g("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:j(["email","uri","date","date-time"]).optional(),default:d().optional()}),Pn=m({type:j(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),An=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),xn=m({type:g("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),Un=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),On=E([An,xn]),Mt=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:g("string"),enum:_(d())}),default:_(d()).optional()}),zt=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),So=E([Mt,zt]),_o=E([Un,On,So]),Re=E([_o,kn,En,Pn]),be=u.extend({mode:g("form").optional(),message:d(),requestedSchema:m({type:g("object"),properties:T(d(),Re),required:_(d()).optional()}).catchall(M())}),Mn=u.extend({mode:g("url"),message:d(),elicitationId:d(),url:d().url()}),Me=E([be,Mn]),wo=p.extend({method:g("elicitation/create"),params:Me}),Ro=h.extend({elicitationId:d()}),bo=f.extend({method:g("notifications/elicitation/complete"),params:Ro}),vo=y.extend({action:j(["accept","decline","cancel"]),content:zo(ce=>ce===null?void 0:ce,T(d(),E([d(),b(),A(),_(d())])).optional())}),Io=m({type:g("ref/resource"),uri:d()}),Co=m({type:g("ref/prompt"),name:d()}),To=a.extend({ref:E([Co,Io]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()}),zn=p.extend({method:g("completion/complete"),params:To}),ko=y.extend({completion:q({values:_(d()).max(100),total:z(b().int()),hasMore:z(A())})}),Eo=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),M()).optional()}),ir=p.extend({method:g("roots/list"),params:a.optional()}),qn=y.extend({roots:_(Eo)}),Po=f.extend({method:g("notifications/roots/list_changed"),params:h.optional()}),Ao=q({ttl:b().optional(),pollInterval:b().optional()}),xo=j(["working","input_required","completed","failed","cancelled"]),ut=m({taskId:d(),status:xo,ttl:E([b(),Mo()]),createdAt:d(),lastUpdatedAt:d(),pollInterval:z(b()),statusMessage:z(d())}),fe=y.extend({task:ut}),Uo=h.merge(ut),qt=f.extend({method:g("notifications/tasks/status"),params:Uo}),ar=p.extend({method:g("tasks/get"),params:a.extend({taskId:d()})}),cr=y.merge(ut),dr=p.extend({method:g("tasks/result"),params:a.extend({taskId:d()})}),zs=y.loose(),ge=Je.extend({method:g("tasks/list")}),Z=Ve.extend({tasks:_(ut)}),Nt=p.extend({method:g("tasks/cancel"),params:a.extend({taskId:d()})});return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,TaskMetadataSchema:s,RelatedTaskMetadataSchema:i,RequestMetaSchema:c,BaseRequestParamsSchema:a,TaskAugmentedRequestParamsSchema:u,RequestSchema:p,NotificationsParamsSchema:h,NotificationSchema:f,ResultSchema:y,RequestIdSchema:S,EmptyResultSchema:k,CancelledNotificationParamsSchema:w,CancelledNotificationSchema:I,IconSchema:U,IconsSchema:O,BaseMetadataSchema:H,ImplementationSchema:F,ClientTasksCapabilitySchema:V,ServerTasksCapabilitySchema:Ge,ClientCapabilitiesSchema:oe,InitializeRequestParamsSchema:je,InitializeRequestSchema:L,ServerCapabilitiesSchema:Ue,InitializeResultSchema:Br,InitializedNotificationSchema:Vt,PingRequestSchema:st,ProgressSchema:Ct,ProgressNotificationParamsSchema:De,ProgressNotificationSchema:it,PaginatedRequestParamsSchema:Kt,PaginatedRequestSchema:Je,PaginatedResultSchema:Ve,ResourceContentsSchema:Wt,TextResourceContentsSchema:Zt,BlobResourceContentsSchema:Yt,RoleSchema:$e,AnnotationsSchema:Oe,ResourceSchema:kt,ResourceTemplateSchema:Fr,ListResourcesRequestSchema:Gr,ListResourcesResultSchema:Jr,ListResourceTemplatesRequestSchema:at,ListResourceTemplatesResultSchema:Xt,ResourceRequestParamsSchema:Et,ReadResourceRequestParamsSchema:Vr,ReadResourceRequestSchema:Kr,ReadResourceResultSchema:Wr,ResourceListChangedNotificationSchema:Zr,SubscribeRequestParamsSchema:Yr,SubscribeRequestSchema:Xr,UnsubscribeRequestParamsSchema:Qr,UnsubscribeRequestSchema:en,ResourceUpdatedNotificationParamsSchema:tn,ResourceUpdatedNotificationSchema:rn,PromptArgumentSchema:nn,PromptSchema:on,ListPromptsRequestSchema:sn,ListPromptsResultSchema:an,GetPromptRequestParamsSchema:cn,GetPromptRequestSchema:dn,TextContentSchema:Pt,ImageContentSchema:At,AudioContentSchema:xt,ToolUseContentSchema:un,EmbeddedResourceSchema:ct,ResourceLinkSchema:ln,ContentBlockSchema:Pe,PromptMessageSchema:Qt,GetPromptResultSchema:er,PromptListChangedNotificationSchema:Ut,ToolAnnotationsSchema:pn,ToolExecutionSchema:tr,ToolSchema:Ot,ListToolsRequestSchema:rr,ListToolsResultSchema:nr,CallToolResultSchema:or,CallToolRequestParamsSchema:ae,CallToolRequestSchema:mn,ToolListChangedNotificationSchema:go,LoggingLevelSchema:sr,SetLevelRequestParamsSchema:hn,SetLevelRequestSchema:fn,LoggingMessageNotificationParamsSchema:gn,LoggingMessageNotificationSchema:yn,ModelHintSchema:Sn,ModelPreferencesSchema:_n,ToolChoiceSchema:wn,ToolResultContentSchema:yo,SamplingContentSchema:Rn,SamplingMessageContentBlockSchema:dt,SamplingMessageSchema:bn,CreateMessageRequestParamsSchema:vn,CreateMessageRequestSchema:In,CreateMessageResultSchema:Cn,CreateMessageResultWithToolsSchema:Tn,BooleanSchemaSchema:kn,StringSchemaSchema:En,NumberSchemaSchema:Pn,UntitledSingleSelectEnumSchemaSchema:An,TitledSingleSelectEnumSchemaSchema:xn,LegacyTitledEnumSchemaSchema:Un,SingleSelectEnumSchemaSchema:On,UntitledMultiSelectEnumSchemaSchema:Mt,TitledMultiSelectEnumSchemaSchema:zt,MultiSelectEnumSchemaSchema:So,EnumSchemaSchema:_o,PrimitiveSchemaDefinitionSchema:Re,ElicitRequestFormParamsSchema:be,ElicitRequestURLParamsSchema:Mn,ElicitRequestParamsSchema:Me,ElicitRequestSchema:wo,ElicitationCompleteNotificationParamsSchema:Ro,ElicitationCompleteNotificationSchema:bo,ElicitResultSchema:vo,ResourceTemplateReferenceSchema:Io,PromptReferenceSchema:Co,CompleteRequestParamsSchema:To,CompleteRequestSchema:zn,CompleteResultSchema:ko,RootSchema:Eo,ListRootsRequestSchema:ir,ListRootsResultSchema:qn,RootsListChangedNotificationSchema:Po,TaskCreationParamsSchema:Ao,TaskStatusSchema:xo,TaskSchema:ut,CreateTaskResultSchema:fe,TaskStatusNotificationParamsSchema:Uo,TaskStatusNotificationSchema:qt,GetTaskRequestSchema:ar,GetTaskResultSchema:cr,GetTaskPayloadRequestSchema:dr,GetTaskPayloadResultSchema:zs,ListTasksRequestSchema:ge,ListTasksResultSchema:Z,CancelTaskRequestSchema:Nt,CancelTaskResultSchema:y.merge(ut),ClientRequestSchema:E([st,L,zn,fn,dn,sn,Gr,at,Kr,Xr,en,mn,rr,ar,dr,ge,Nt]),ClientNotificationSchema:E([I,it,Vt,Po,qt]),ClientResultSchema:E([k,Cn,Tn,vo,qn,cr,Z,fe]),ServerRequestSchema:E([st,In,wo,ir,ar,dr,ge,Nt]),ServerNotificationSchema:E([I,it,yn,rn,Zr,go,Ut,qt,bo]),ServerResultSchema:E([k,Br,ko,er,an,Jr,Xt,Wr,or,nr,cr,Z,fe]),CallToolResultWireSchema:M().superRefine((ce,vg)=>{if(!(typeof ce!="object"||ce===null||Array.isArray(ce)||ce.content!==void 0)){for(let $a of Gl)if($a in ce){vg.addIssue({code:"custom",message:`content is required when the body carries '${$a}' \u2014 another result family cannot default into an empty tools/call success`});return}}}).transform(ry).pipe(or)}}n(ny,"build$1");var oy;function _i(){return oy??=ny()}n(_i,"buildSchemas2025");function Jl(e){return e.type!=="object"}n(Jl,"isNonObjectJsonSchemaRoot");var sy=new Set(["const","enum","default","examples"]),iy=new Set(["properties","patternProperties","$defs","definitions","dependentSchemas","dependencies"]);function Ul(e){return e!==void 0&&!(typeof e=="string"&&e.startsWith("#"))}n(Ul,"establishesNewBase");function ay(e){let t=typeof e.$schema=="string"?e.$schema:void 0;if(Ul(e.$id))return{...t!==void 0&&{$schema:t},type:"object",properties:{result:e},required:["result"]};let r=xl(e.$schema)&&e.$recursiveAnchor!==!0,o=n((s,i)=>{if(Array.isArray(s))return s.map(u=>o(u,!1));if(s===null||typeof s!="object"||!i&&Ul(s.$id))return s;let c={},a=!1;for(let[u,p]of Object.entries(s))i?c[u]=o(p,!1):(u==="$ref"||u==="$dynamicRef")&&typeof p=="string"?c[u]=p==="#"?"#/properties/result":p.startsWith("#/")?`#/properties/result${p.slice(1)}`:p:u==="$recursiveRef"&&p==="#"&&r?a=!0:sy.has(u)?c[u]=p:iy.has(u)?c[u]=o(p,!0):c[u]=o(p,!1);return a&&("$ref"in c?c.allOf=[...Array.isArray(c.allOf)?c.allOf:[],{$ref:"#/properties/result"}]:c.$ref="#/properties/result"),c},"rewriteRefs");return{...t!==void 0&&{$schema:t},type:"object",properties:{result:o(e,!1)},required:["result"]}}n(ay,"wrapOutputSchemaForLegacy");var Vl={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"tasks/get":null,"tasks/result":null,"tasks/list":null,"tasks/cancel":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},Kl={"notifications/cancelled":null,"notifications/progress":null,"notifications/initialized":null,"notifications/roots/list_changed":null,"notifications/tasks/status":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/elicitation/complete":null},cy={ping:null,initialize:null,"completion/complete":null,"logging/setLevel":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"resources/subscribe":null,"resources/unsubscribe":null,"tools/call":null,"tools/list":null,"sampling/createMessage":null,"elicitation/create":null,"roots/list":null},ts;function is(){if(ts)return ts;let e=_i();return ts={requestSchemas:{ping:e.PingRequestSchema,initialize:e.InitializeRequestSchema,"completion/complete":e.CompleteRequestSchema,"logging/setLevel":e.SetLevelRequestSchema,"prompts/get":e.GetPromptRequestSchema,"prompts/list":e.ListPromptsRequestSchema,"resources/list":e.ListResourcesRequestSchema,"resources/templates/list":e.ListResourceTemplatesRequestSchema,"resources/read":e.ReadResourceRequestSchema,"resources/subscribe":e.SubscribeRequestSchema,"resources/unsubscribe":e.UnsubscribeRequestSchema,"tools/call":e.CallToolRequestSchema,"tools/list":e.ListToolsRequestSchema,"tasks/get":e.GetTaskRequestSchema,"tasks/result":e.GetTaskPayloadRequestSchema,"tasks/list":e.ListTasksRequestSchema,"tasks/cancel":e.CancelTaskRequestSchema,"sampling/createMessage":e.CreateMessageRequestSchema,"elicitation/create":e.ElicitRequestSchema,"roots/list":e.ListRootsRequestSchema},notificationSchemas:{"notifications/cancelled":e.CancelledNotificationSchema,"notifications/progress":e.ProgressNotificationSchema,"notifications/initialized":e.InitializedNotificationSchema,"notifications/roots/list_changed":e.RootsListChangedNotificationSchema,"notifications/tasks/status":e.TaskStatusNotificationSchema,"notifications/message":e.LoggingMessageNotificationSchema,"notifications/resources/updated":e.ResourceUpdatedNotificationSchema,"notifications/resources/list_changed":e.ResourceListChangedNotificationSchema,"notifications/tools/list_changed":e.ToolListChangedNotificationSchema,"notifications/prompts/list_changed":e.PromptListChangedNotificationSchema,"notifications/elicitation/complete":e.ElicitationCompleteNotificationSchema},resultSchemas:{ping:e.EmptyResultSchema,initialize:e.InitializeResultSchema,"completion/complete":e.CompleteResultSchema,"logging/setLevel":e.EmptyResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"resources/subscribe":e.EmptyResultSchema,"resources/unsubscribe":e.EmptyResultSchema,"tools/call":e.CallToolResultWireSchema,"tools/list":e.ListToolsResultSchema,"sampling/createMessage":e.CreateMessageResultWithToolsSchema,"elicitation/create":e.ElicitResultSchema,"roots/list":e.ListRootsResultSchema}},ts}n(is,"registryMaps");function dy(){is()}n(dy,"warmRegistryMaps2025");function Wl(e){return Object.prototype.hasOwnProperty.call(Vl,e)}n(Wl,"hasRequestMethod2025");function Zl(e){return Object.prototype.hasOwnProperty.call(Kl,e)}n(Zl,"hasNotificationMethod2025");function uy(e){return Object.prototype.hasOwnProperty.call(cy,e)}n(uy,"hasResultMethod");function ly(e){return uy(e)?is().resultSchemas[e]:void 0}n(ly,"getResultSchema");function py(e){return Wl(e)?is().requestSchemas[e]:void 0}n(py,"getRequestSchema");function my(e){return Zl(e)?is().notificationSchemas[e]:void 0}n(my,"getNotificationSchema");var UT=Object.keys(Vl),OT=Object.keys(Kl);function hi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(hi,"isPlainObject$4");function rs(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n(rs,"triState$1");var Ol={ok:!1,reason:"not-in-era"};function Ml(e){return hi(e)&&hi(e.outputSchema)&&Jl(e.outputSchema)}n(Ml,"toolNeedsLegacyWrap");var wi={era:"2025-11-25",hasRequestMethod:Wl,hasNotificationMethod:Zl,validateRequest:n((e,t)=>rs(py(e),t),"validateRequest"),validateResult:n((e,t)=>rs(ly(e),t),"validateResult"),validateNotification:n((e,t)=>rs(my(e),t),"validateNotification"),hasInputRequestMethod:n(()=>!1,"hasInputRequestMethod"),validateInputRequest:n(()=>Ol,"validateInputRequest"),validateInputResponse:n(()=>Ol,"validateInputResponse"),samplingResultVariant:n(((e,t)=>{let r=_i();return rs(e?r.CreateMessageResultWithToolsSchema:r.CreateMessageResultSchema,t)}),"samplingResultVariant"),outboundEnvelope:n(e=>{},"outboundEnvelope"),validateEnvelopeMeta:n(e=>[],"validateEnvelopeMeta"),projectCallToolResult(e,t){let r=Fl(e),o=r.structuredContent;if(o===void 0)return r;let s=typeof o!="object"||o===null||Array.isArray(o),i=t!==void 0&&Jl(t);return!s&&!i?r:{...r,structuredContent:{result:o}}},decodeResult(e,t){if(hi(t)&&"resultType"in t){let r={...t};return delete r.resultType,{kind:"complete",result:r}}return{kind:"complete",result:t}},encodeResult(e,t){if(e!=="tools/list")return t;let r=t.tools;return!Array.isArray(r)||!r.some(o=>Ml(o))?t:{...t,tools:r.map(o=>Ml(o)?{...o,outputSchema:ay(o.outputSchema)}:o)}},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope:n(e=>{},"checkInboundEnvelope")};function hy(){let e=js(()=>E([d(),b(),A(),Mo(),T(d(),e),_(e)])),t=T(d(),e),r=E([d(),b().int()]),o=d(),s=E([d(),b().int()]),i=j(["user","assistant"]),c=j(["debug","info","notice","warning","error","critical","alert","emergency"]),a=d().refine(Z=>{try{return atob(Z),!0}catch{return!1}},{message:"Invalid Base64 string"}),u=m({ttl:b().optional()}),p=m({taskId:d()}),h=q({progressToken:r.optional(),"io.modelcontextprotocol/related-task":p.optional()}),f=m({_meta:h.optional()}),y=f.extend({task:u.optional()}),S=m({_meta:h.optional()}),k=m({method:d(),params:S.loose().optional()}),w=m({src:d(),mimeType:d().optional(),sizes:_(d()).optional(),theme:j(["light","dark"]).optional()}),I=m({icons:_(w).optional()}),U=m({name:d(),title:d().optional()}),O=U.extend({...U.shape,...I.shape,version:d(),websiteUrl:d().optional(),description:d().optional()}),H=jn(m({applyDefaults:A().optional()}),t),F=zo(Z=>Z&&typeof Z=="object"&&!Array.isArray(Z)&&Object.keys(Z).length===0?{form:{}}:Z,jn(m({form:H.optional(),url:t.optional()}),t.optional())),ee=q({list:t.optional(),cancel:t.optional(),requests:q({sampling:q({createMessage:t.optional()}).optional(),elicitation:q({create:t.optional()}).optional()}).optional()}),G=q({list:t.optional(),cancel:t.optional(),requests:q({tools:q({call:t.optional()}).optional()}).optional()}),V=m({experimental:T(d(),t).optional(),sampling:m({context:t.optional(),tools:t.optional()}).optional(),elicitation:F.optional(),roots:m({listChanged:A().optional()}).optional(),tasks:ee.optional(),extensions:T(d(),t).optional()}),Ge=m({experimental:T(d(),t).optional(),logging:t.optional(),completions:t.optional(),prompts:m({listChanged:A().optional()}).optional(),resources:m({subscribe:A().optional(),listChanged:A().optional()}).optional(),tools:m({listChanged:A().optional()}).optional(),tasks:G.optional(),extensions:T(d(),t).optional()}),oe=m({progress:b(),total:z(b()),message:z(d())}),je=m({...S.shape,...oe.shape,progressToken:r}),L=k.extend({method:g("notifications/progress"),params:je}),Ue=S.extend({level:c,logger:d().optional(),data:M()}),Br=k.extend({method:g("notifications/message"),params:Ue}),Vt=m({uri:d(),mimeType:z(d()),_meta:T(d(),M()).optional()}),st=Vt.extend({text:d()}),Ct=Vt.extend({blob:a}),De=m({audience:_(i).optional(),priority:b().min(0).max(1).optional(),lastModified:Nn.datetime({offset:!0}).optional()}),it=m({...U.shape,...I.shape,uri:d(),description:z(d()),mimeType:z(d()),size:z(b()),annotations:De.optional(),_meta:z(q({}))}),Kt=m({...U.shape,...I.shape,uriTemplate:d(),description:z(d()),mimeType:z(d()),annotations:De.optional(),_meta:z(q({}))}),Je=k.extend({method:g("notifications/resources/list_changed"),params:S.optional()}),Ve=S.extend({uri:d()}),Wt=k.extend({method:g("notifications/resources/updated"),params:Ve}),Zt=m({name:d(),description:z(d()),required:z(A())}),Tt=m({...U.shape,...I.shape,description:z(d()),arguments:z(_(Zt)),_meta:z(q({}))}),Yt=k.extend({method:g("notifications/prompts/list_changed"),params:S.optional()}),$e=m({type:g("text"),text:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),Oe=m({type:g("image"),data:a,mimeType:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),kt=m({type:g("audio"),data:a,mimeType:d(),annotations:De.optional(),_meta:T(d(),M()).optional()}),Fr=m({type:g("tool_use"),name:d(),id:d(),input:T(d(),M()),_meta:T(d(),M()).optional()}),Gr=m({type:g("resource"),resource:E([st,Ct]),annotations:De.optional(),_meta:T(d(),M()).optional()}),Jr=it.extend({type:g("resource_link")}),at=E([$e,Oe,kt,Jr,Gr]),Xt=m({role:i,content:at}),Et=m({title:d().optional(),readOnlyHint:A().optional(),destructiveHint:A().optional(),idempotentHint:A().optional(),openWorldHint:A().optional()}),Vr=k.extend({method:g("notifications/tools/list_changed"),params:S.optional()}),Kr=m({name:d().optional()}),Wr=m({hints:_(Kr).optional(),costPriority:b().min(0).max(1).optional(),speedPriority:b().min(0).max(1).optional(),intelligencePriority:b().min(0).max(1).optional()}),Zr=m({mode:j(["auto","required","none"]).optional()}),Yr=m({type:g("boolean"),title:d().optional(),description:d().optional(),default:A().optional()}),Xr=m({type:g("string"),title:d().optional(),description:d().optional(),minLength:b().optional(),maxLength:b().optional(),format:j(["email","uri","date","date-time"]).optional(),default:d().optional()}),Qr=m({type:j(["number","integer"]),title:d().optional(),description:d().optional(),minimum:b().optional(),maximum:b().optional(),default:b().optional()}),en=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),default:d().optional()}),tn=m({type:g("string"),title:d().optional(),description:d().optional(),oneOf:_(m({const:d(),title:d()})),default:d().optional()}),rn=m({type:g("string"),title:d().optional(),description:d().optional(),enum:_(d()),enumNames:_(d()).optional(),default:d().optional()}),nn=E([en,tn]),on=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({type:g("string"),enum:_(d())}),default:_(d()).optional()}),sn=m({type:g("array"),title:d().optional(),description:d().optional(),minItems:b().optional(),maxItems:b().optional(),items:m({anyOf:_(m({const:d(),title:d()}))}),default:_(d()).optional()}),an=E([on,sn]),cn=E([rn,nn,an]),dn=E([cn,Yr,Xr,Qr]),Pt=y.extend({mode:g("form").optional(),message:d(),requestedSchema:m({type:g("object"),properties:T(d(),dn),required:_(d()).optional()}).catchall(M())}),At=m({type:g("ref/resource"),uri:d()}),xt=m({type:g("ref/prompt"),name:d()}),un=m({uri:d().startsWith("file://"),name:d().optional(),_meta:T(d(),M()).optional()}),ct=V.shape,ln=m({experimental:ct.experimental,sampling:ct.sampling,elicitation:ct.elicitation,roots:ct.roots,extensions:ct.extensions}),Pe=Ge.shape,Qt=m({experimental:Pe.experimental,logging:Pe.logging,completions:Pe.completions,prompts:Pe.prompts,resources:Pe.resources,tools:Pe.tools,extensions:Pe.extensions}),er=q({progressToken:r.optional(),[ur]:d(),[Dn]:O.optional(),[pr]:ln,[$n]:c.optional()}),Ut=m({...U.shape,...I.shape,description:d().optional(),inputSchema:q({$schema:d().optional(),type:g("object")}),outputSchema:q({$schema:d().optional()}).optional(),annotations:Et.optional(),_meta:T(d(),M()).optional()}),pn=m({type:g("tool_result"),toolUseId:d(),content:_(at),structuredContent:M().optional(),isError:A().optional(),_meta:T(d(),M()).optional()}),tr=E([$e,Oe,kt,Fr,pn]),Ot=m({role:i,content:E([tr,_(tr)]),_meta:T(d(),M()).optional()}),rr=d(),nr=q({[lr]:O.optional().catch(void 0)}),or=nr.optional();function ae(Z){return q({_meta:or,resultType:rr.default("complete"),...Z})}n(ae,"wireResult");let mn=ae({}),go=ae({nextCursor:o.optional()}),sr=ae({content:_(at),structuredContent:M().optional(),isError:A().optional()}),hn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),tools:_(Ut),nextCursor:o.optional()}),fn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),prompts:_(Tt),nextCursor:o.optional()}),gn=ae({description:d().optional(),messages:_(Xt)}),yn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resources:_(it),nextCursor:o.optional()}),Sn=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resourceTemplates:_(Kt),nextCursor:o.optional()}),_n=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),contents:_(E([st,Ct]))}),wn=ae({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:A().optional()}).loose()}),yo=ae({ttlMs:b().int().min(0),cacheScope:j(["public","private"])}),Rn=ae({ttlMs:b().int().min(0).catch(0),cacheScope:j(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Qt,instructions:d().optional()}),dt=m({messages:_(Ot),modelPreferences:Wr.optional(),systemPrompt:d().optional(),includeContext:j(["none","thisServer","allServers"]).optional(),temperature:b().optional(),maxTokens:b().int(),stopSequences:_(d()).optional(),metadata:t.optional(),tools:_(Ut).optional(),toolChoice:Zr.optional()}),bn=m({method:g("sampling/createMessage"),params:dt}),vn=m({method:g("roots/list"),params:m({_meta:T(d(),M()).optional()}).optional()}),In=m({...Ot.shape,model:d(),stopReason:d().optional()}),Cn=m({roots:_(un)}),Tn=m({action:j(["accept","decline","cancel"]),content:T(d(),E([d(),b(),A(),_(d())])).optional()}),kn=m({mode:g("url"),message:d(),url:d().url()}),En=E([Pt,kn]),Pn=m({method:g("elicitation/create"),params:En}),An=E([bn,vn,Pn]),xn=E([In,Cn,Tn]),Un=T(d(),An),On=T(d(),xn),Mt=ae({inputRequests:Un.optional(),requestState:d().optional()}),zt={inputResponses:On.optional(),requestState:d().optional()},So=m({_meta:er,...zt}),_o=q({progressToken:r.optional()});function Re(Z,Nt){return m({method:g(Z),params:m({_meta:er,...Nt})})}n(Re,"wireRequest");function be(Z,Nt){return m({method:g(Z),params:m({_meta:_o.optional(),...Nt}).optional()})}n(be,"dispatchRequest");let Mn={name:d(),arguments:T(d(),M()).optional(),...zt},Me={cursor:o.optional()},wo=Re("tools/call",Mn),Ro=Re("tools/list",Me),bo=Re("prompts/list",Me),vo=Re("prompts/get",{name:d(),arguments:T(d(),d()).optional(),...zt}),Io=Re("resources/list",Me),Co=Re("resources/templates/list",Me),To=Re("resources/read",{uri:d(),...zt}),zn={ref:E([xt,At]),argument:m({name:d(),value:d()}),context:m({arguments:T(d(),d()).optional()}).optional()},ko=Re("completion/complete",zn),Eo=Re("server/discover",{}),ir=m({toolsListChanged:A().optional(),promptsListChanged:A().optional(),resourcesListChanged:A().optional(),resourceSubscriptions:_(d()).optional()}),qn={notifications:ir},Po=Re("subscriptions/listen",qn),Ao=nr.extend({"io.modelcontextprotocol/subscriptionId":s}),xo=q({_meta:Ao,resultType:rr.default("complete")}),ut={"tools/call":be("tools/call",Mn),"tools/list":be("tools/list",Me),"prompts/get":be("prompts/get",{name:d(),arguments:T(d(),d()).optional()}),"prompts/list":be("prompts/list",Me),"resources/list":be("resources/list",Me),"resources/templates/list":be("resources/templates/list",Me),"resources/read":be("resources/read",{uri:d()}),"completion/complete":be("completion/complete",zn),"server/discover":be("server/discover",{}),"subscriptions/listen":be("subscriptions/listen",qn)};function fe(Z){return q({_meta:or,...Z})}n(fe,"liftedResult");let Uo={"tools/call":fe({content:_(at),structuredContent:M().optional(),isError:A().optional()}),"tools/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),tools:_(Ut),nextCursor:o.optional()}),"prompts/get":fe({description:d().optional(),messages:_(Xt)}),"prompts/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),prompts:_(Tt),nextCursor:o.optional()}),"resources/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resources:_(it),nextCursor:o.optional()}),"resources/templates/list":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),resourceTemplates:_(Kt),nextCursor:o.optional()}),"resources/read":fe({ttlMs:b().int().min(0),cacheScope:j(["public","private"]),contents:_(E([st,Ct]))}),"completion/complete":fe({completion:m({values:_(d()).max(100),total:b().int().optional(),hasMore:A().optional()}).loose()}),"server/discover":fe({ttlMs:b().int().min(0).catch(0),cacheScope:j(["public","private"]).catch("private"),supportedVersions:_(d()),capabilities:Qt,instructions:d().optional()}),"subscriptions/listen":fe({})},qt=q({"io.modelcontextprotocol/subscriptionId":s.optional()}),ar=m({method:g("notifications/subscriptions/acknowledged"),params:m({_meta:qt.optional(),notifications:ir})}),cr=m({_meta:qt.optional(),requestId:s,reason:d().optional()}),dr=m({method:g("notifications/cancelled"),params:cr}),zs={"notifications/cancelled":dr,"notifications/progress":L,"notifications/message":Br,"notifications/resources/updated":Wt,"notifications/resources/list_changed":Je,"notifications/tools/list_changed":Vr,"notifications/prompts/list_changed":Yt,"notifications/subscriptions/acknowledged":ar},ge=n(Z=>m({jsonrpc:g("2.0"),id:E([d(),b().int()]),result:Z}).strict(),"wireResultResponse");return{JSONValueSchema:e,JSONObjectSchema:t,ProgressTokenSchema:r,CursorSchema:o,RequestIdSchema:s,RoleSchema:i,LoggingLevelSchema:c,TaskMetadataSchema:u,RelatedTaskMetadataSchema:p,RequestMetaSchema:h,BaseRequestParamsSchema:f,TaskAugmentedRequestParamsSchema:y,NotificationsParamsSchema:S,NotificationSchema:k,IconSchema:w,IconsSchema:I,BaseMetadataSchema:U,ImplementationSchema:O,ClientTasksCapabilitySchema:ee,ServerTasksCapabilitySchema:G,ClientCapabilitiesSchema:V,ServerCapabilitiesSchema:Ge,ProgressSchema:oe,ProgressNotificationParamsSchema:je,ProgressNotificationSchema:L,LoggingMessageNotificationParamsSchema:Ue,LoggingMessageNotificationSchema:Br,ResourceContentsSchema:Vt,TextResourceContentsSchema:st,BlobResourceContentsSchema:Ct,AnnotationsSchema:De,ResourceSchema:it,ResourceTemplateSchema:Kt,ResourceListChangedNotificationSchema:Je,ResourceUpdatedNotificationParamsSchema:Ve,ResourceUpdatedNotificationSchema:Wt,PromptArgumentSchema:Zt,PromptSchema:Tt,PromptListChangedNotificationSchema:Yt,TextContentSchema:$e,ImageContentSchema:Oe,AudioContentSchema:kt,ToolUseContentSchema:Fr,EmbeddedResourceSchema:Gr,ResourceLinkSchema:Jr,ContentBlockSchema:at,PromptMessageSchema:Xt,ToolAnnotationsSchema:Et,ToolListChangedNotificationSchema:Vr,ModelHintSchema:Kr,ModelPreferencesSchema:Wr,ToolChoiceSchema:Zr,BooleanSchemaSchema:Yr,StringSchemaSchema:Xr,NumberSchemaSchema:Qr,UntitledSingleSelectEnumSchemaSchema:en,TitledSingleSelectEnumSchemaSchema:tn,LegacyTitledEnumSchemaSchema:rn,SingleSelectEnumSchemaSchema:nn,UntitledMultiSelectEnumSchemaSchema:on,TitledMultiSelectEnumSchemaSchema:sn,MultiSelectEnumSchemaSchema:an,EnumSchemaSchema:cn,PrimitiveSchemaDefinitionSchema:dn,ElicitRequestFormParamsSchema:Pt,ResourceTemplateReferenceSchema:At,PromptReferenceSchema:xt,RootSchema:un,ClientCapabilities2026Schema:ln,ServerCapabilities2026Schema:Qt,RequestMetaEnvelopeSchema:er,ToolSchema:Ut,ToolResultContentSchema:pn,SamplingMessageContentBlockSchema:tr,SamplingMessageSchema:Ot,ResultTypeSchema:rr,ResultMetaSchema:nr,ResultSchema:mn,PaginatedResultSchema:go,CallToolResultSchema:sr,ListToolsResultSchema:hn,ListPromptsResultSchema:fn,GetPromptResultSchema:gn,ListResourcesResultSchema:yn,ListResourceTemplatesResultSchema:Sn,ReadResourceResultSchema:_n,CompleteResultSchema:wn,CacheableResultSchema:yo,DiscoverResultSchema:Rn,CreateMessageRequestParamsSchema:dt,CreateMessageRequestSchema:bn,ListRootsRequestSchema:vn,CreateMessageResultSchema:In,ListRootsResultSchema:Cn,ElicitResultSchema:Tn,ElicitRequestURLParamsSchema:kn,ElicitRequestParamsSchema:En,ElicitRequestSchema:Pn,InputRequestSchema:An,InputResponseSchema:xn,InputRequestsSchema:Un,InputResponsesSchema:On,InputRequiredResultSchema:Mt,InputResponseRequestParamsSchema:So,CallToolRequestSchema:wo,ListToolsRequestSchema:Ro,ListPromptsRequestSchema:bo,GetPromptRequestSchema:vo,ListResourcesRequestSchema:Io,ListResourceTemplatesRequestSchema:Co,ReadResourceRequestSchema:To,CompleteRequestSchema:ko,DiscoverRequestSchema:Eo,SubscriptionFilterSchema:ir,SubscriptionsListenRequestSchema:Po,SubscriptionsListenResultMetaSchema:Ao,SubscriptionsListenResultSchema:xo,dispatchRequestSchemas:ut,dispatchResultSchemas:Uo,NotificationMetaSchema:qt,SubscriptionsAcknowledgedNotificationSchema:ar,CancelledNotificationParamsSchema:cr,CancelledNotificationSchema:dr,notificationSchemas2026:zs,JSONRPCResultResponseSchema:ge(mn),CallToolResultResponseSchema:ge(E([sr,Mt])),ListToolsResultResponseSchema:ge(hn),ListPromptsResultResponseSchema:ge(fn),GetPromptResultResponseSchema:ge(E([gn,Mt])),ListResourcesResultResponseSchema:ge(yn),ListResourceTemplatesResultResponseSchema:ge(Sn),ReadResourceResultResponseSchema:ge(E([_n,Mt])),CompleteResultResponseSchema:ge(wn),DiscoverResultResponseSchema:ge(Rn)}}n(hy,"build");var fy;function ht(){return fy??=hy()}n(ht,"buildSchemas2026");var gy=["tools/list","prompts/list","resources/list","resources/templates/list","resources/read","server/discover"];function yy(e){return gy.includes(e)}n(yy,"isCacheableResultMethod");var Ri=Symbol("modelcontextprotocol.resultCacheHintFallback");function Sy(e){return e[Ri]}n(Sy,"cacheHintFallbackOf");function Yl(e){return typeof e=="number"&&Number.isSafeInteger(e)&&e>=0}n(Yl,"isValidCacheTtlMs");function Xl(e){return e==="public"||e==="private"}n(Xl,"isValidCacheScope");var P=(function(e){return e[e.ParseError=-32700]="ParseError",e[e.InvalidRequest=-32600]="InvalidRequest",e[e.MethodNotFound=-32601]="MethodNotFound",e[e.InvalidParams=-32602]="InvalidParams",e[e.InternalError=-32603]="InternalError",e[e.ResourceNotFound=-32002]="ResourceNotFound",e[e.MissingRequiredClientCapability=-32021]="MissingRequiredClientCapability",e[e.UnsupportedProtocolVersion=-32022]="UnsupportedProtocolVersion",e[e.UrlElicitationRequired=-32042]="UrlElicitationRequired",e})({}),ie=class Ql extends Error{static{n(this,"ProtocolError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ProtocolError"})}static[Symbol.hasInstance](t){return Ie(this,t)}static isInstance(t){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,t)}constructor(t,r,o){super(r),this.code=t,this.data=o,this.name="ProtocolError",Ht(this,new.target)}static fromError(t,r,o){if(t===P.UrlElicitationRequired&&o){let s=o;if(s.elicitations)return new as(s.elicitations,r)}if(t===P.UnsupportedProtocolVersion&&o){let s=o;if(Array.isArray(s.supported)&&typeof s.requested=="string")return new tp({supported:s.supported,requested:s.requested},r)}if(t===P.InvalidParams||t===P.ResourceNotFound){let s=o;if(typeof s?.uri=="string"&&(t===P.ResourceNotFound||Object.keys(s).length===1))return new ep(s.uri,r)}if(t===P.MissingRequiredClientCapability&&o){let s=o;if(s.requiredCapabilities!==null&&typeof s.requiredCapabilities=="object"&&!Array.isArray(s.requiredCapabilities))return new rp({requiredCapabilities:s.requiredCapabilities},r)}return new Ql(t,r,o)}},ep=class extends ie{static{n(this,"ResourceNotFoundError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.ResourceNotFoundError"})}constructor(e,t=`Resource not found: ${e}`){super(P.InvalidParams,t,{uri:e})}get uri(){return this.data.uri}},as=class extends ie{static{n(this,"UrlElicitationRequiredError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UrlElicitationRequiredError"})}constructor(e,t=`URL elicitation${e.length>1?"s":""} required`){super(P.UrlElicitationRequired,t,{elicitations:e})}get elicitations(){return this.data?.elicitations??[]}},tp=class extends ie{static{n(this,"UnsupportedProtocolVersionError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnsupportedProtocolVersionError"})}constructor(e,t=`Unsupported protocol version: ${e.requested}`){super(P.UnsupportedProtocolVersion,t,e)}get supported(){return this.data.supported}get requested(){return this.data.requested}},rp=class extends ie{static{n(this,"MissingRequiredClientCapabilityError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.MissingRequiredClientCapabilityError"})}constructor(e,t=`Missing required client capabilities: ${Object.keys(e.requiredCapabilities).join(", ")}`){super(P.MissingRequiredClientCapability,t,e)}get requiredCapabilities(){return this.data.requiredCapabilities}},_y=0,wy="private",Ry=["tools/call","prompts/get","resources/read"];function by(e,t){let r=t.resultType;if(r===void 0)return{...t,resultType:"complete"};if(r==="complete"||Ry.includes(e))return t;throw new ie(P.InternalError,`Handler for ${e} returned resultType '${String(r)}', but results of ${e} only support 'complete' on protocol revision 2026-07-28`)}n(by,"stampResultType");function vy(e,t){let r=Sy(t);if(t.resultType!=="complete"||!yy(e))return r===void 0?t:Ey(t);let o=t,s=Yl(o.ttlMs)?o.ttlMs:Ty(r),i=Xl(o.cacheScope)?o.cacheScope:ky(r),c={...o,ttlMs:s,cacheScope:i};return delete c[Ri],c}n(vy,"fillCacheFields");function Iy(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Iy,"isPlainObject$3");function Cy(e,t){if(t===void 0)return e;let r=e._meta;return r===void 0?{...e,_meta:{[lr]:t}}:!Iy(r)||r[lr]!==void 0?e:{...e,_meta:{...r,[lr]:t}}}n(Cy,"stampServerInfoMeta");function Ty(e){return e!==void 0&&Yl(e.ttlMs)?e.ttlMs:_y}n(Ty,"resolveTtlMs");function ky(e){return e!==void 0&&Xl(e.cacheScope)?e.cacheScope:wy}n(ky,"resolveCacheScope");function Ey(e){let t={...e};return delete t[Ri],t}n(Ey,"stripCacheHintFallback");var Py=["elicitation/create","sampling/createMessage","roots/list"],ns;function bi(){if(ns)return ns;let e=ht();return ns={request:{"elicitation/create":m({method:g("elicitation/create"),params:e.ElicitRequestParamsSchema}),"sampling/createMessage":m({method:g("sampling/createMessage"),params:e.CreateMessageRequestParamsSchema}),"roots/list":m({method:g("roots/list"),params:q({}).optional()})},response:{"elicitation/create":e.ElicitResultSchema,"sampling/createMessage":e.CreateMessageResultSchema,"roots/list":e.ListRootsResultSchema}},ns}n(bi,"inputSchemaMaps");function Ay(){bi()}n(Ay,"warmInputSchemaMaps2026");function np(e){return Py.includes(e)}n(np,"isInputRequestMethod2026");function ci(e){return np(e)?bi().request[e]:void 0}n(ci,"getInputRequestSchema2026");function xy(e){return np(e)?bi().response[e]:void 0}n(xy,"getInputResponseSchema2026");var vi={"tools/call":null,"tools/list":null,"prompts/get":null,"prompts/list":null,"resources/list":null,"resources/templates/list":null,"resources/read":null,"completion/complete":null,"server/discover":null,"subscriptions/listen":null},op={"notifications/cancelled":null,"notifications/progress":null,"notifications/message":null,"notifications/resources/updated":null,"notifications/resources/list_changed":null,"notifications/tools/list_changed":null,"notifications/prompts/list_changed":null,"notifications/subscriptions/acknowledged":null};function sp(e){return Object.prototype.hasOwnProperty.call(vi,e)}n(sp,"hasRequestMethod2026");function ip(e){return Object.prototype.hasOwnProperty.call(op,e)}n(ip,"hasNotificationMethod2026");function Uy(e){return Object.prototype.hasOwnProperty.call(vi,e)}n(Uy,"hasResultMethod2026");function Oy(e){return sp(e)?ht().dispatchRequestSchemas[e]:void 0}n(Oy,"getRequestSchema2026");function My(e){return Uy(e)?ht().dispatchResultSchemas[e]:void 0}n(My,"getResultSchema2026");function zy(e){return ip(e)?ht().notificationSchemas2026[e]:void 0}n(zy,"getNotificationSchema2026");var MT=Object.keys(vi),zT=Object.keys(op);function Zn(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(Zn,"isPlainObject$2");function Kn(e,t){if(e===void 0)return{ok:!1,reason:"not-in-era"};let r=e.safeParse(t);return r.success?{ok:!0,value:r.data}:{ok:!1,reason:"invalid",message:String(r.error)}}n(Kn,"triState");var qy={ok:!1,reason:"not-in-era"},Ny=[ur,pr];function jy(e,t){let r=t,o=!1,s=n(()=>(o||(r={...r},o=!0),r),"copy"),i=t.tools;e==="tools/list"&&Array.isArray(i)&&i.some(a=>Zn(a)&&"execution"in a)&&(s().tools=i.map(a=>{if(!Zn(a)||!("execution"in a))return a;let u={...a};return delete u.execution,u}));let c=t.capabilities;if(Zn(c)&&"tasks"in c){let a={...c};delete a.tasks,s().capabilities=a}return r}n(jy,"enforceDeletedFields");var Ii={era:"2026-07-28",hasRequestMethod:sp,hasNotificationMethod:ip,hasInputRequestMethod:n(e=>ci(e)!==void 0,"hasInputRequestMethod"),validateRequest:n((e,t)=>Kn(Oy(e),t),"validateRequest"),validateResult:n((e,t)=>Kn(My(e),t),"validateResult"),validateNotification:n((e,t)=>Kn(zy(e),t),"validateNotification"),validateInputRequest:n((e,t)=>Kn(ci(e),t),"validateInputRequest"),validateInputResponse:n((e,t)=>Kn(xy(e),t),"validateInputResponse"),samplingResultVariant:n(()=>qy,"samplingResultVariant"),outboundEnvelope(e){return{[ur]:e.protocolVersion,[Dn]:e.clientInfo,[pr]:e.clientCapabilities,...e.logLevel!==void 0&&{[$n]:e.logLevel}}},validateEnvelopeMeta(e){let t=[];for(let o of Ny)o in e||t.push({key:o,problem:"missing"});let r=ht().RequestMetaEnvelopeSchema.safeParse(e);if(!r.success)for(let o of r.error.issues){let s=o.path.map(String),i=s.length>0?s.join("."):"_meta";s.length===1&&t.some(c=>c.key===i&&c.problem==="missing")||t.push({key:i,problem:o.message})}return t},projectCallToolResult:n(e=>Fl(e),"projectCallToolResult"),inputRequestSchema:ci,decodeResult(e,t){if(!Zn(t))return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: not an object`,{method:e})};let r=t.resultType;if(r===void 0)return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: missing required resultType \u2014 servers implementing protocol revision 2026-07-28 MUST include it (the absent-means-complete bridge applies only to earlier-revision servers)`,{method:e,violation:"missing-resultType"})};if(typeof r!="string")return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: non-string resultType`,{method:e,resultType:r})};if(r==="input_required"){let c=t.inputRequests,a=Zn(c)?c:{},u=t.requestState;return Object.keys(a).length===0&&typeof u!="string"?{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`,{method:e,violation:"input-required-missing-both"})}:{kind:"input_required",inputRequests:a,...typeof u=="string"&&{requestState:u}}}if(r!=="complete")return{kind:"invalid",error:new re(se.UnsupportedResultType,`Unsupported result type '${r}' for ${e}`,{resultType:r,method:e})};let o=ap(),s=Object.hasOwn(o,e)?o[e]:void 0;if(s!==void 0){let c=s.safeParse(t);if(!c.success)return{kind:"invalid",error:new re(se.InvalidResult,`Invalid result for ${e}: ${c.error}`,{method:e})}}let i={...t};return delete i.resultType,{kind:"complete",result:i}},encodeResult(e,t,r){return Cy(vy(e,by(e,jy(e,t))),r)},encodeErrorCode:n(e=>e===-32002?-32602:e,"encodeErrorCode"),checkInboundEnvelope(e){if(e.envelope===void 0)return"Request is missing the required _meta envelope for protocol revision 2026-07-28 (io.modelcontextprotocol/protocolVersion, io.modelcontextprotocol/clientCapabilities)";let t=ht().RequestMetaEnvelopeSchema.safeParse(e.envelope);if(!t.success)return`Invalid _meta envelope for protocol revision 2026-07-28: ${t.error.issues.map(r=>r.message).join("; ")}`}},os;function ap(){if(os)return os;let e=ht();return os={"tools/call":e.CallToolResultSchema,"tools/list":e.ListToolsResultSchema,"prompts/get":e.GetPromptResultSchema,"prompts/list":e.ListPromptsResultSchema,"resources/list":e.ListResourcesResultSchema,"resources/templates/list":e.ListResourceTemplatesResultSchema,"resources/read":e.ReadResourceResultSchema,"completion/complete":e.CompleteResultSchema,"server/discover":e.DiscoverResultSchema},os}n(ap,"getWireResultSchemas");function Dy(){ap()}n(Dy,"warmWireResultSchemas2026");var Ci="2026-07-28";function Xn(e){return e!==void 0&&Bl(e)?Ii:wi}n(Xn,"codecForVersion");function zl(e){return e.revision!==void 0?Xn(e.revision).era:e.era==="modern"?Ii.era:wi.era}n(zl,"classifiedWireEra");function di(e){return cp.some(t=>t.hasRequestMethod(e))}n(di,"isSpecRequestMethod");function ui(e){return cp.some(t=>t.hasNotificationMethod(e))}n(ui,"isSpecNotificationMethod");var cp=[wi,Ii],$y=Pl({AnnotationsSchema:n(()=>Dc,"AnnotationsSchema"),AudioContentSchema:n(()=>Sd,"AudioContentSchema"),BaseMetadataSchema:n(()=>yc,"BaseMetadataSchema"),BaseRequestParamsSchema:n(()=>nc,"BaseRequestParamsSchema"),BlobResourceContentsSchema:n(()=>Nc,"BlobResourceContentsSchema"),BooleanSchemaSchema:n(()=>Gs,"BooleanSchemaSchema"),CallToolRequestParamsSchema:n(()=>Od,"CallToolRequestParamsSchema"),CallToolRequestSchema:n(()=>Md,"CallToolRequestSchema"),CallToolResultSchema:n(()=>xd,"CallToolResultSchema"),CancelTaskRequestSchema:n(()=>ku,"CancelTaskRequestSchema"),CancelTaskResultSchema:n(()=>Eu,"CancelTaskResultSchema"),CancelledNotificationParamsSchema:n(()=>mc,"CancelledNotificationParamsSchema"),CancelledNotificationSchema:n(()=>hc,"CancelledNotificationSchema"),ClientCapabilitiesSchema:n(()=>Rc,"ClientCapabilitiesSchema"),ClientNotificationSchema:n(()=>Au,"ClientNotificationSchema"),ClientRequestSchema:n(()=>Pu,"ClientRequestSchema"),ClientResultSchema:n(()=>xu,"ClientResultSchema"),ClientTasksCapabilitySchema:n(()=>_c,"ClientTasksCapabilitySchema"),CompatibilityCallToolResultSchema:n(()=>Ud,"CompatibilityCallToolResultSchema"),CompleteRequestParamsSchema:n(()=>cu,"CompleteRequestParamsSchema"),CompleteRequestSchema:n(()=>du,"CompleteRequestSchema"),CompleteResultSchema:n(()=>uu,"CompleteResultSchema"),ContentBlockSchema:n(()=>bd,"ContentBlockSchema"),CreateMessageRequestParamsSchema:n(()=>Kd,"CreateMessageRequestParamsSchema"),CreateMessageRequestSchema:n(()=>Wd,"CreateMessageRequestSchema"),CreateMessageResultSchema:n(()=>Zd,"CreateMessageResultSchema"),CreateMessageResultWithToolsSchema:n(()=>Yd,"CreateMessageResultWithToolsSchema"),CreateTaskResultSchema:n(()=>Su,"CreateTaskResultSchema"),CursorSchema:n(()=>Qa,"CursorSchema"),DiscoverRequestSchema:n(()=>kc,"DiscoverRequestSchema"),DiscoverResultSchema:n(()=>Bs,"DiscoverResultSchema"),ElicitRequestFormParamsSchema:n(()=>$o,"ElicitRequestFormParamsSchema"),ElicitRequestParamsSchema:n(()=>tu,"ElicitRequestParamsSchema"),ElicitRequestSchema:n(()=>ru,"ElicitRequestSchema"),ElicitRequestURLParamsSchema:n(()=>Lo,"ElicitRequestURLParamsSchema"),ElicitResultSchema:n(()=>su,"ElicitResultSchema"),ElicitationCompleteNotificationParamsSchema:n(()=>nu,"ElicitationCompleteNotificationParamsSchema"),ElicitationCompleteNotificationSchema:n(()=>ou,"ElicitationCompleteNotificationSchema"),EmbeddedResourceSchema:n(()=>wd,"EmbeddedResourceSchema"),EmptyResultSchema:n(()=>pc,"EmptyResultSchema"),EnumSchemaSchema:n(()=>eu,"EnumSchemaSchema"),GetPromptRequestParamsSchema:n(()=>hd,"GetPromptRequestParamsSchema"),GetPromptRequestSchema:n(()=>fd,"GetPromptRequestSchema"),GetPromptResultSchema:n(()=>Id,"GetPromptResultSchema"),GetTaskPayloadRequestSchema:n(()=>vu,"GetTaskPayloadRequestSchema"),GetTaskPayloadResultSchema:n(()=>Iu,"GetTaskPayloadResultSchema"),GetTaskRequestSchema:n(()=>Ru,"GetTaskRequestSchema"),GetTaskResultSchema:n(()=>bu,"GetTaskResultSchema"),IconSchema:n(()=>fc,"IconSchema"),IconsSchema:n(()=>gc,"IconsSchema"),ImageContentSchema:n(()=>yd,"ImageContentSchema"),ImplementationSchema:n(()=>Sc,"ImplementationSchema"),InitializeRequestParamsSchema:n(()=>bc,"InitializeRequestParamsSchema"),InitializeRequestSchema:n(()=>vc,"InitializeRequestSchema"),InitializeResultSchema:n(()=>Cc,"InitializeResultSchema"),InitializedNotificationSchema:n(()=>Tc,"InitializedNotificationSchema"),JSONArraySchema:n(()=>Ya,"JSONArraySchema"),JSONObjectSchema:n(()=>Za,"JSONObjectSchema"),JSONRPCErrorResponseSchema:n(()=>Ln,"JSONRPCErrorResponseSchema"),JSONRPCMessageSchema:n(()=>Hs,"JSONRPCMessageSchema"),JSONRPCNotificationSchema:n(()=>$s,"JSONRPCNotificationSchema"),JSONRPCRequestSchema:n(()=>Dt,"JSONRPCRequestSchema"),JSONRPCResponseSchema:n(()=>lc,"JSONRPCResponseSchema"),JSONRPCResultResponseSchema:n(()=>Ls,"JSONRPCResultResponseSchema"),JSONValueSchema:n(()=>Wa,"JSONValueSchema"),LegacyTitledEnumSchemaSchema:n(()=>Ks,"LegacyTitledEnumSchemaSchema"),ListChangedOptionsBaseSchema:n(()=>Fs,"ListChangedOptionsBaseSchema"),ListPromptsRequestSchema:n(()=>pd,"ListPromptsRequestSchema"),ListPromptsResultSchema:n(()=>md,"ListPromptsResultSchema"),ListResourceTemplatesRequestSchema:n(()=>Fc,"ListResourceTemplatesRequestSchema"),ListResourceTemplatesResultSchema:n(()=>Gc,"ListResourceTemplatesResultSchema"),ListResourcesRequestSchema:n(()=>Hc,"ListResourcesRequestSchema"),ListResourcesResultSchema:n(()=>Bc,"ListResourcesResultSchema"),ListRootsRequestSchema:n(()=>pu,"ListRootsRequestSchema"),ListRootsResultSchema:n(()=>mu,"ListRootsResultSchema"),ListTasksRequestSchema:n(()=>Cu,"ListTasksRequestSchema"),ListTasksResultSchema:n(()=>Tu,"ListTasksResultSchema"),ListToolsRequestSchema:n(()=>Pd,"ListToolsRequestSchema"),ListToolsResultSchema:n(()=>Ad,"ListToolsResultSchema"),LoggingLevelSchema:n(()=>qd,"LoggingLevelSchema"),LoggingMessageNotificationParamsSchema:n(()=>Dd,"LoggingMessageNotificationParamsSchema"),LoggingMessageNotificationSchema:n(()=>$d,"LoggingMessageNotificationSchema"),ModelHintSchema:n(()=>Ld,"ModelHintSchema"),ModelPreferencesSchema:n(()=>Hd,"ModelPreferencesSchema"),MultiSelectEnumSchemaSchema:n(()=>Qd,"MultiSelectEnumSchemaSchema"),NotificationSchema:n(()=>ac,"NotificationSchema"),NotificationsParamsSchema:n(()=>ic,"NotificationsParamsSchema"),NumberSchemaSchema:n(()=>Do,"NumberSchemaSchema"),PaginatedRequestParamsSchema:n(()=>Uc,"PaginatedRequestParamsSchema"),PaginatedRequestSchema:n(()=>Oc,"PaginatedRequestSchema"),PaginatedResultSchema:n(()=>Mc,"PaginatedResultSchema"),PingRequestSchema:n(()=>Ec,"PingRequestSchema"),PrimitiveSchemaDefinitionSchema:n(()=>Ys,"PrimitiveSchemaDefinitionSchema"),ProgressNotificationParamsSchema:n(()=>Ac,"ProgressNotificationParamsSchema"),ProgressNotificationSchema:n(()=>xc,"ProgressNotificationSchema"),ProgressSchema:n(()=>Pc,"ProgressSchema"),ProgressTokenSchema:n(()=>Xa,"ProgressTokenSchema"),PromptArgumentSchema:n(()=>ud,"PromptArgumentSchema"),PromptListChangedNotificationSchema:n(()=>Cd,"PromptListChangedNotificationSchema"),PromptMessageSchema:n(()=>vd,"PromptMessageSchema"),PromptReferenceSchema:n(()=>au,"PromptReferenceSchema"),PromptSchema:n(()=>ld,"PromptSchema"),ReadResourceRequestParamsSchema:n(()=>Vc,"ReadResourceRequestParamsSchema"),ReadResourceRequestSchema:n(()=>Kc,"ReadResourceRequestSchema"),ReadResourceResultSchema:n(()=>Wc,"ReadResourceResultSchema"),RelatedTaskMetadataSchema:n(()=>tc,"RelatedTaskMetadataSchema"),RequestIdSchema:n(()=>uc,"RequestIdSchema"),RequestMetaSchema:n(()=>rc,"RequestMetaSchema"),RequestSchema:n(()=>sc,"RequestSchema"),ResourceContentsSchema:n(()=>zc,"ResourceContentsSchema"),ResourceLinkSchema:n(()=>Rd,"ResourceLinkSchema"),ResourceListChangedNotificationSchema:n(()=>Zc,"ResourceListChangedNotificationSchema"),ResourceRequestParamsSchema:n(()=>Jc,"ResourceRequestParamsSchema"),ResourceSchema:n(()=>$c,"ResourceSchema"),ResourceTemplateReferenceSchema:n(()=>iu,"ResourceTemplateReferenceSchema"),ResourceTemplateSchema:n(()=>Lc,"ResourceTemplateSchema"),ResourceUpdatedNotificationParamsSchema:n(()=>cd,"ResourceUpdatedNotificationParamsSchema"),ResourceUpdatedNotificationSchema:n(()=>dd,"ResourceUpdatedNotificationSchema"),ResultMetaObjectSchema:n(()=>cc,"ResultMetaObjectSchema"),ResultSchema:n(()=>dc,"ResultSchema"),RoleSchema:n(()=>jc,"RoleSchema"),RootSchema:n(()=>lu,"RootSchema"),RootsListChangedNotificationSchema:n(()=>hu,"RootsListChangedNotificationSchema"),SamplingContentSchema:n(()=>Gd,"SamplingContentSchema"),SamplingMessageContentBlockSchema:n(()=>Jd,"SamplingMessageContentBlockSchema"),SamplingMessageSchema:n(()=>Vd,"SamplingMessageSchema"),ServerCapabilitiesSchema:n(()=>Ic,"ServerCapabilitiesSchema"),ServerNotificationSchema:n(()=>Ou,"ServerNotificationSchema"),ServerRequestSchema:n(()=>Uu,"ServerRequestSchema"),ServerResultSchema:n(()=>Mu,"ServerResultSchema"),ServerTasksCapabilitySchema:n(()=>wc,"ServerTasksCapabilitySchema"),SetLevelRequestParamsSchema:n(()=>Nd,"SetLevelRequestParamsSchema"),SetLevelRequestSchema:n(()=>jd,"SetLevelRequestSchema"),SingleSelectEnumSchemaSchema:n(()=>Xd,"SingleSelectEnumSchemaSchema"),StringSchemaSchema:n(()=>jo,"StringSchemaSchema"),SubscribeRequestParamsSchema:n(()=>Yc,"SubscribeRequestParamsSchema"),SubscribeRequestSchema:n(()=>Xc,"SubscribeRequestSchema"),SubscriptionFilterSchema:n(()=>td,"SubscriptionFilterSchema"),SubscriptionsAcknowledgedNotificationParamsSchema:n(()=>od,"SubscriptionsAcknowledgedNotificationParamsSchema"),SubscriptionsAcknowledgedNotificationSchema:n(()=>sd,"SubscriptionsAcknowledgedNotificationSchema"),SubscriptionsListenRequestParamsSchema:n(()=>rd,"SubscriptionsListenRequestParamsSchema"),SubscriptionsListenRequestSchema:n(()=>nd,"SubscriptionsListenRequestSchema"),SubscriptionsListenResultMetaSchema:n(()=>id,"SubscriptionsListenResultMetaSchema"),SubscriptionsListenResultSchema:n(()=>ad,"SubscriptionsListenResultSchema"),TaskAugmentedRequestParamsSchema:n(()=>oc,"TaskAugmentedRequestParamsSchema"),TaskCreationParamsSchema:n(()=>fu,"TaskCreationParamsSchema"),TaskMetadataSchema:n(()=>ec,"TaskMetadataSchema"),TaskSchema:n(()=>yu,"TaskSchema"),TaskStatusNotificationParamsSchema:n(()=>_u,"TaskStatusNotificationParamsSchema"),TaskStatusNotificationSchema:n(()=>wu,"TaskStatusNotificationSchema"),TaskStatusSchema:n(()=>gu,"TaskStatusSchema"),TextContentSchema:n(()=>gd,"TextContentSchema"),TextResourceContentsSchema:n(()=>qc,"TextResourceContentsSchema"),TitledMultiSelectEnumSchemaSchema:n(()=>Zs,"TitledMultiSelectEnumSchemaSchema"),TitledSingleSelectEnumSchemaSchema:n(()=>Vs,"TitledSingleSelectEnumSchemaSchema"),ToolAnnotationsSchema:n(()=>Td,"ToolAnnotationsSchema"),ToolChoiceSchema:n(()=>Bd,"ToolChoiceSchema"),ToolExecutionSchema:n(()=>kd,"ToolExecutionSchema"),ToolListChangedNotificationSchema:n(()=>zd,"ToolListChangedNotificationSchema"),ToolResultContentSchema:n(()=>Fd,"ToolResultContentSchema"),ToolSchema:n(()=>Ed,"ToolSchema"),ToolUseContentSchema:n(()=>_d,"ToolUseContentSchema"),UnsubscribeRequestParamsSchema:n(()=>Qc,"UnsubscribeRequestParamsSchema"),UnsubscribeRequestSchema:n(()=>ed,"UnsubscribeRequestSchema"),UntitledMultiSelectEnumSchemaSchema:n(()=>Ws,"UntitledMultiSelectEnumSchemaSchema"),UntitledSingleSelectEnumSchemaSchema:n(()=>Js,"UntitledSingleSelectEnumSchemaSchema")});var dp=n(e=>Dt.safeParse(e).success,"isJSONRPCRequest"),up=n(e=>$s.safeParse(e).success,"isJSONRPCNotification"),fi=n(e=>Ls.safeParse(e).success,"isJSONRPCResultResponse"),lp=n(e=>Ln.safeParse(e).success,"isJSONRPCErrorResponse");var Yn=-32020,qT=[{rung:"http-method",order:1,evaluatedAt:"edge",codes:[-32e3],conformance:[],rationale:"The modern era is POST-only; GET/DELETE are body-less 2025-era session operations and are method-routed to legacy serving (405 when legacy serving is not configured), before any body is read."},{rung:"jsonrpc-shape",order:2,evaluatedAt:"edge",codes:[P.InvalidRequest],conformance:["server-stateless"],rationale:"The body must be a JSON-RPC request or notification: posted responses and batch arrays containing a modern or invalid element are rejected before classification (element-wise batch rule); all-legacy arrays stay legacy traffic."},{rung:"era-classification",order:3,evaluatedAt:"edge",codes:[Yn,P.UnsupportedProtocolVersion],conformance:["server-stateless","http-header-validation","http-custom-header-server-validation"],rationale:"Body-primary era classification with the protocol-version header as a cross-check; a header/body disagreement is rejected with -32020 (HeaderMismatch), and an envelope-less request on a modern-only endpoint is answered with the unsupported-protocol-version error naming the supported revisions."},{rung:"envelope",order:4,evaluatedAt:"edge",codes:[P.InvalidParams],conformance:["server-stateless"],rationale:"A present envelope claim with a malformed envelope \u2014 and a missing envelope on a request whose protocol-version header names a modern revision \u2014 is an invalid-params rejection naming the offending or missing key(s); never a silent fall back to legacy handling. This is the only place an invalid-params rejection maps to HTTP 400."},{rung:"method-registry",order:5,evaluatedAt:"dispatch",codes:[P.MethodNotFound],conformance:["server-stateless"],rationale:"Method existence outranks parameter validity: a method absent from the negotiated revision\u2019s registry (or with no handler installed) answers method-not-found before params or capabilities are looked at."},{rung:"request-params",order:6,evaluatedAt:"dispatch",codes:[P.InvalidParams],conformance:[],rationale:"Per-method params validation; emitted in-band by the dispatch layer (HTTP 200), never via the ladder status table."},{rung:"standard-header-validation",order:7,evaluatedAt:"pre-dispatch",codes:[Yn],conformance:["http-header-validation"],rationale:"SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers \u2014 presence, sentinel decoding, and `Mcp-Name` \u2194 body cross-check \u2014 are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier\u2019s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5\u20136) are consulted."},{rung:"client-capabilities",order:8,evaluatedAt:"pre-dispatch",codes:[P.MissingRequiredClientCapability],conformance:["server-stateless"],rationale:"The capability requirement is checked by the HTTP entry, pre-dispatch, against the validated envelope the classifier produced \u2014 pinning the spec-mandated HTTP 400 independently of how dispatch- and handler-produced errors are mapped. The documented order (after method resolution and params validation) is preserved observably only while the requirement table is empty: once a served method gains a requirement entry, a request that is missing the capability and would also fail a dispatch rung is answered by this gate first, so the entry must consult the method registry before the gate if the documented precedence is to stay observable."},{rung:"param-header-validation",order:9,evaluatedAt:"pre-dispatch",codes:[Yn],conformance:["http-custom-header-server-validation"],rationale:"SEP-2243 `Mcp-Param-*` headers are validated against the named tool\u2019s `x-mcp-header` declarations and the body `arguments` after the tool registry is known and before dispatch reaches the handler; a missing/disagreeing/malformed header is rejected 400 / -32020 with the same shape as the standard-header cross-checks. The documented order (after method resolution and params validation) is preserved observably only when the body `arguments` would otherwise validate: the check runs pre-dispatch, so a `tools/call` that fails BOTH this rung and a dispatch-time rung (e.g. order-6 `request-params`, -32602) is answered by this gate first with 400 / -32020, not by the earlier-ordered rung."}],NT={[P.ParseError]:400,[P.InvalidRequest]:400,[P.MethodNotFound]:404,[P.UnsupportedProtocolVersion]:400,[P.MissingRequiredClientCapability]:400,[Yn]:400};function Ti(e,t){return Ha(e,t)}n(Ti,"parseSchema");function Wn(e){return new Set(e.flatMap(t=>Object.keys(t.shape)))}n(Wn,"shapeKeys");function gi(e){if(e==null)return!1;let t=typeof e;return t!=="object"&&t!=="function"||!("~standard"in e)?!1:typeof e["~standard"]?.validate=="function"}n(gi,"isStandardSchema");var ql=!1,yi="draft-2020-12";function Ly(e,t="input"){let r=e["~standard"],o;if(r.jsonSchema)o=r.jsonSchema[t]({target:yi});else if(r.vendor==="zod"){if(!("_zod"in e))throw new Error("Schema appears to be from zod 3, which the SDK cannot convert to JSON Schema. Upgrade to zod >=4.2.0, or wrap your JSON Schema with fromJsonSchema().");ql||(ql=!0,console.warn("[mcp-sdk] Your zod version does not implement `~standard.jsonSchema` (added in zod 4.2.0). Falling back to z.toJSONSchema(). Upgrade to zod >=4.2.0 to silence this warning.")),o=qs(e,{target:yi,io:t})}else throw new Error(`Schema library "${r.vendor}" does not implement StandardJSONSchemaV1 (\`~standard.jsonSchema\`). Upgrade to a version that does, or wrap your JSON Schema with fromJsonSchema().`);if(t==="output")return o.type!==void 0?o:pp(o)?{type:"object",...o}:o;if(o.type!==void 0&&o.type!=="object")throw new Error(`MCP tool and prompt schemas must describe objects (got type: ${JSON.stringify(o.type)}). Wrap your schema in z.object({...}) or equivalent.`);return{type:"object",...o}}n(Ly,"standardSchemaToJsonSchema");function pp(e){if("properties"in e||"patternProperties"in e||"additionalProperties"in e||"required"in e)return!0;for(let t of["oneOf","anyOf","allOf"]){let r=e[t];if(Array.isArray(r)&&r.length>0)return r.every(o=>o!==null&&typeof o=="object"&&(o.type==="object"||pp(o)))}return!1}n(pp,"isProvablyObjectShapedRoot");function Hy(e){return e.path?.length?`${e.path.map(t=>String(typeof t=="object"?t.key:t)).join(".")}: ${e.message}`:e.message}n(Hy,"formatIssue");async function li(e,t){let r=await e["~standard"].validate(t);return r.issues&&r.issues.length>0?{success:!1,error:r.issues.map(o=>Hy(o)).join(", ")}:{success:!0,data:r.value}}n(li,"validateStandardSchema");function By(e){let t=qs(e,{target:yi,io:"input"});return typeof t.pattern=="string"?t.pattern:void 0}n(By,"zodEmittedPattern");var Fy=/\\\.\\d\{(\d+)\}/;function Gy(e){let t=Fy.exec(e),r=[void 0,-1,0];return t&&r.push(Number(t[1])),[!1,!0].flatMap(o=>[!1,!0].flatMap(s=>r.map(i=>Nn.datetime({local:o,offset:s,precision:i}))))}n(Gy,"datetimeReferenceSchemas");function Jy(e,t){let r;switch(e){case"email":r=[Ba()];break;case"uri":r=[Fa()];break;case"date":r=[Nn.date()];break;case"date-time":r=Gy(t);break}return new Set(r.map(o=>By(o)).filter(o=>o!==void 0))}n(Jy,"referencePatternsForFormat");function Vy(e,t,r){return r!=="zod"?!0:Jy(e,t).has(t)}n(Vy,"isLibraryFormatPattern");function Qn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n(Qn,"isJsonObject");function Ky(e){try{return Ly(e,"input")}catch(t){let r=t instanceof Error?t.message:String(t);throw new ie(P.InvalidParams,`Elicitation requestedSchema must describe an object with flat primitive properties: ${r}`)}}n(Ky,"convertStandardElicitationSchema");var Wy=new Set(["$comment","deprecated","description","examples","readOnly","title","writeOnly"]);function ki(e){return Wy.has(e)||e.startsWith("x-")}n(ki,"isAnnotationOnlyJsonSchemaKeyword");var Zy=new Set(["$schema",...Object.keys($o.shape.requestedSchema.shape)]),Nl={string:Wn([jo,Js,Vs,Ks]),number:Wn([Do]),integer:Wn([Do]),boolean:Wn([Gs]),array:Wn([Ws,Zs])},Yy=new Set(jo.shape.format.unwrap().options);function Xy(e,t,r,o){if(!Qn(e))return e;let s=typeof e.type=="string"&&Object.hasOwn(Nl,e.type)?Nl[e.type]:void 0;if(s===void 0)return e;let i={};for(let[c,a]of Object.entries(e))s.has(c)||ki(c)?i[c]=a:c==="pattern"&&e.type==="string"&&typeof e.format=="string"?Yy.has(e.format)?(typeof a!="string"||!Vy(e.format,a,r))&&o.push(`${t}.${c}`):i[c]=a:o.push(`${t}.${c}`);return i}n(Xy,"walkProperty");function Qy(e,t){let r={},o=[];for(let[s,i]of Object.entries(e))s==="properties"&&Qn(i)?r[s]=Object.fromEntries(Object.entries(i).map(([c,a])=>[c,Xy(a,`properties.${c}`,t,o)])):Zy.has(s)?r[s]=i:ki(s)||o.push(s);if(o.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${o.join(", ")}`);return r}n(Qy,"walkRequestedSchema");function eS(e,t){if(!Qn(e.properties))return t;let r=Object.entries(e.properties).filter(([,o])=>!Ti(Ys,o).success).map(([o])=>`properties.${o}`);return r.length>0?r.join(", "):t}n(eS,"describeUnsupportedProperties");function Si(e,t,r=""){return Array.isArray(e)&&Array.isArray(t)?e.flatMap((o,s)=>Si(o,t[s],`${r}[${s}]`)):!Qn(e)||!Qn(t)?[]:Object.entries(e).flatMap(([o,s])=>{let i=r?`${r}.${o}`:o;return Object.prototype.hasOwnProperty.call(t,o)?Si(s,t[o],i):ki(o)?[]:[i]})}n(Si,"findDroppedConstraintPaths");function tS(e){if(!gi(e.requestedSchema))return{...e,mode:"form",requestedSchema:e.requestedSchema};let t=e.requestedSchema["~standard"].vendor,r=Qy(Ky(e.requestedSchema),t),o=Ti($o.shape.requestedSchema,r);if(!o.success)throw new ie(P.InvalidParams,`Elicitation requestedSchema only supports flat primitive properties (string, number, integer, boolean, and string enums): ${eS(r,o.error.message)}`);let s=Si(r,o.data);if(s.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema contains unsupported JSON Schema constraint(s) after Standard Schema conversion: ${s.join(", ")}`);let i=(o.data.required??[]).filter(c=>!Object.prototype.hasOwnProperty.call(o.data.properties,c));if(i.length>0)throw new ie(P.InvalidParams,`Elicitation requestedSchema lists required properties that are not defined in properties: ${i.join(", ")}`);return{...e,mode:"form",requestedSchema:o.data}}n(tS,"normalizeElicitInputParams");function rS(e){let t=e.inputRequests!==void 0&&Object.keys(e.inputRequests).length>0,r=typeof e.requestState=="string";if(!t&&!r)throw new TypeError("inputRequired() requires at least one of inputRequests (with at least one entry) or requestState (spec: every InputRequiredResult MUST include at least one of the two)");return{resultType:"input_required",...e.inputRequests!==void 0&&{inputRequests:e.inputRequests},...e.requestState!==void 0&&{requestState:e.requestState}}}n(rS,"buildInputRequired");var jT=Object.assign(rS,{elicit(e){try{return{method:"elicitation/create",params:tS(e)}}catch(t){throw t instanceof ie?new TypeError(t.message,{cause:t}):t}},elicitUrl(e){return{method:"elicitation/create",params:{...e,mode:"url"}}},createMessage(e){return{method:"sampling/createMessage",params:e}},listRoots(){return{method:"roots/list"}}});var nS=["AnnotationsSchema","AudioContentSchema","BaseMetadataSchema","BlobResourceContentsSchema","BooleanSchemaSchema","CallToolRequestSchema","CallToolRequestParamsSchema","CallToolResultSchema","CancelledNotificationSchema","CancelledNotificationParamsSchema","CancelTaskRequestSchema","CancelTaskResultSchema","ClientCapabilitiesSchema","ClientNotificationSchema","ClientRequestSchema","ClientResultSchema","CompatibilityCallToolResultSchema","CompleteRequestSchema","CompleteRequestParamsSchema","CompleteResultSchema","ContentBlockSchema","CreateMessageRequestSchema","CreateMessageRequestParamsSchema","CreateMessageResultSchema","CreateMessageResultWithToolsSchema","CreateTaskResultSchema","CursorSchema","DiscoverRequestSchema","DiscoverResultSchema","ElicitationCompleteNotificationSchema","ElicitationCompleteNotificationParamsSchema","ElicitRequestSchema","ElicitRequestFormParamsSchema","ElicitRequestParamsSchema","ElicitRequestURLParamsSchema","ElicitResultSchema","EmbeddedResourceSchema","EmptyResultSchema","EnumSchemaSchema","GetPromptRequestSchema","GetPromptRequestParamsSchema","GetPromptResultSchema","GetTaskPayloadRequestSchema","GetTaskPayloadResultSchema","GetTaskRequestSchema","GetTaskResultSchema","IconSchema","IconsSchema","ImageContentSchema","ImplementationSchema","InitializedNotificationSchema","InitializeRequestSchema","InitializeRequestParamsSchema","InitializeResultSchema","JSONArraySchema","JSONObjectSchema","JSONRPCErrorResponseSchema","JSONRPCMessageSchema","JSONRPCNotificationSchema","JSONRPCRequestSchema","JSONRPCResponseSchema","JSONRPCResultResponseSchema","JSONValueSchema","LegacyTitledEnumSchemaSchema","ListPromptsRequestSchema","ListPromptsResultSchema","ListResourcesRequestSchema","ListResourcesResultSchema","ListResourceTemplatesRequestSchema","ListResourceTemplatesResultSchema","ListRootsRequestSchema","ListRootsResultSchema","ListTasksRequestSchema","ListTasksResultSchema","ListToolsRequestSchema","ListToolsResultSchema","LoggingLevelSchema","LoggingMessageNotificationSchema","LoggingMessageNotificationParamsSchema","ModelHintSchema","ModelPreferencesSchema","MultiSelectEnumSchemaSchema","NotificationSchema","NumberSchemaSchema","PaginatedRequestSchema","PaginatedRequestParamsSchema","PaginatedResultSchema","PingRequestSchema","PrimitiveSchemaDefinitionSchema","ProgressSchema","ProgressNotificationSchema","ProgressNotificationParamsSchema","ProgressTokenSchema","PromptSchema","PromptArgumentSchema","PromptListChangedNotificationSchema","PromptMessageSchema","PromptReferenceSchema","ReadResourceRequestSchema","ReadResourceRequestParamsSchema","ReadResourceResultSchema","RelatedTaskMetadataSchema","RequestSchema","RequestIdSchema","RequestMetaSchema","ResourceSchema","ResourceContentsSchema","ResourceLinkSchema","ResourceListChangedNotificationSchema","ResourceRequestParamsSchema","ResourceTemplateSchema","ResourceTemplateReferenceSchema","ResourceUpdatedNotificationSchema","ResourceUpdatedNotificationParamsSchema","ResultMetaObjectSchema","ResultSchema","RoleSchema","RootSchema","RootsListChangedNotificationSchema","SamplingContentSchema","SamplingMessageSchema","SamplingMessageContentBlockSchema","ServerCapabilitiesSchema","ServerNotificationSchema","ServerRequestSchema","ServerResultSchema","SetLevelRequestSchema","SetLevelRequestParamsSchema","SingleSelectEnumSchemaSchema","StringSchemaSchema","SubscribeRequestSchema","SubscribeRequestParamsSchema","SubscriptionFilterSchema","SubscriptionsAcknowledgedNotificationSchema","SubscriptionsAcknowledgedNotificationParamsSchema","SubscriptionsListenRequestSchema","SubscriptionsListenRequestParamsSchema","SubscriptionsListenResultSchema","SubscriptionsListenResultMetaSchema","TaskAugmentedRequestParamsSchema","TaskCreationParamsSchema","TaskMetadataSchema","TaskSchema","TaskStatusSchema","TaskStatusNotificationSchema","TaskStatusNotificationParamsSchema","TextContentSchema","TextResourceContentsSchema","TitledMultiSelectEnumSchemaSchema","TitledSingleSelectEnumSchemaSchema","ToolSchema","ToolAnnotationsSchema","ToolChoiceSchema","ToolExecutionSchema","ToolListChangedNotificationSchema","ToolResultContentSchema","ToolUseContentSchema","UnsubscribeRequestSchema","UnsubscribeRequestParamsSchema","UntitledMultiSelectEnumSchemaSchema","UntitledSingleSelectEnumSchemaSchema"],oS={IdJagTokenExchangeResponseSchema:Xs,OAuthClientInformationFullSchema:$t,OAuthClientInformationSchema:Hn,OAuthClientMetadataSchema:qu,OAuthClientRegistrationErrorSchema:Nu,OAuthErrorResponseSchema:Ho,OAuthMetadataSchema:fr,OAuthProtectedResourceMetadataSchema:hr,OAuthTokenRevocationRequestSchema:ju,OAuthTokensSchema:lt,OpenIdProviderDiscoveryMetadataSchema:gr,OpenIdProviderMetadataSchema:zu},mp={},hp={};function fp(e,t){let r=e.slice(0,-6);mp[r]=t,hp[r]=o=>t.safeParse(o).success}n(fp,"register");for(let e of nS)fp(e,$y[e]);for(let[e,t]of Object.entries(oS))fp(e,t);var sS=Object.freeze(mp),iS=Object.freeze(hp);function aS(e){switch(e){case"initialize":case"notifications/initialized":return Xn(void 0);case"server/discover":return Xn(Ci);default:return}}n(aS,"bootstrapOutboundCodec");var gp=6e4,cS=[ur,Dn,pr,$n],dS=["inputResponses","requestState"];function jl(e,t){let r=e.params;if(!pi(r))return{message:e,lifted:{}};let o=r._meta,s=pi(o)?cS.filter(u=>u in o):[],i=t==="request"?dS.filter(u=>u in r):[];if(s.length===0&&i.length===0)return{message:e,lifted:{}};let c={},a={...r};if(s.length>0&&pi(o)){let u={},p={...o};for(let h of s)u[h]=o[h],delete p[h];c.envelope=u,Object.keys(p).length>0?a._meta=p:delete a._meta}for(let u of i)u==="inputResponses"&&(c.inputResponses=a[u]),u==="requestState"&&(c.requestState=a[u]),delete a[u];return{message:{...e,params:a},lifted:c}}n(jl,"liftWireOnlyMaterial");function Dl(e,t){let r=e.validateResult(t,void 0);if(!(!r.ok&&r.reason==="not-in-era"))return{"~standard":{version:1,vendor:"mcp-wire-codec",validate(o){let s=e.validateResult(t,o);return s.ok?{value:s.value}:{issues:[{message:s.reason==="invalid"?s.message:`not-in-era: ${t}`}]}}}}}n(Dl,"codecResultValidator");function yp(e){return()=>e}n(yp,"requestStateAccessor");var uS=yp(void 0),lS,pS=class{static{n(this,"Protocol")}_transport;_requestMessageId=0;_requestHandlers=new Map;_requestHandlerAbortControllers=new Map;_notificationHandlers=new Map;_responseHandlers=new Map;_progressHandlers=new Map;_timeoutInfo=new Map;_pendingDebouncedNotifications=new Set;_negotiatedProtocolVersion;static{lS=n((e,t)=>{e._negotiatedProtocolVersion=t},"writeNegotiatedProtocolVersion")}_supportedProtocolVersions;onclose;onerror;fallbackRequestHandler;fallbackNotificationHandler;constructor(e){this._options=e,this._supportedProtocolVersions=e?.supportedProtocolVersions??Ds,this.setNotificationHandler("notifications/cancelled",t=>{this._oncancel(t)}),this.setNotificationHandler("notifications/progress",t=>{this._onprogress(t)}),this.setRequestHandler("ping",t=>({}))}_shouldDropInbound(e){}_outboundMetaEnvelope(){}_envelopeOutbound(e){let t=this._outboundMetaEnvelope();if(t===void 0)return e;let r=e.params??{};return{...e,params:{...r,_meta:{...t,...r._meta}}}}_resolveNonCompleteResult(e,t){return Promise.reject(new re(se.UnsupportedResultType,`Unsupported result type '${e.kind}' for ${t.request.method}`,{resultType:e.kind,method:t.request.method}))}_getRequestHandler(e){return this._requestHandlers.get(e)}async _oncancel(e){e.params.requestId&&this._requestHandlerAbortControllers.get(e.params.requestId)?.abort(e.params.reason)}_setupTimeout(e,t,r,o,s=!1){this._timeoutInfo.set(e,{timeoutId:setTimeout(o,t),startTime:Date.now(),timeout:t,maxTotalTimeout:r,resetTimeoutOnProgress:s,onTimeout:o})}_resetTimeout(e){let t=this._timeoutInfo.get(e);if(!t)return!1;let r=Date.now()-t.startTime;if(t.maxTotalTimeout&&r>=t.maxTotalTimeout)throw this._timeoutInfo.delete(e),new re(se.RequestTimeout,"Maximum total timeout exceeded",{maxTotalTimeout:t.maxTotalTimeout,totalElapsed:r});return clearTimeout(t.timeoutId),t.timeoutId=setTimeout(t.onTimeout,t.timeout),!0}_cleanupTimeout(e){let t=this._timeoutInfo.get(e);t&&(clearTimeout(t.timeoutId),this._timeoutInfo.delete(e))}async connect(e){this._transport=e;let t=this.transport?.onclose;this._transport.onclose=()=>{try{t?.()}finally{this._onclose()}};let r=this.transport?.onerror;this._transport.onerror=s=>{r?.(s),this._onerror(s)};let o=this._transport?.onmessage;this._transport.onmessage=(s,i)=>{o?.(s,i),fi(s)||lp(s)?this._onresponse(s):dp(s)?this._onrequest(s,i):up(s)?this._onnotification(s,i):this._onerror(new Error(`Unknown message type: ${JSON.stringify(s)}`))},e.setSupportedProtocolVersions?.(this._supportedProtocolVersions),await this._transport.start()}_onclose(){let e=this._responseHandlers;this._responseHandlers=new Map,this._progressHandlers.clear(),this._pendingDebouncedNotifications.clear();for(let o of this._timeoutInfo.values())clearTimeout(o.timeoutId);this._timeoutInfo.clear();let t=this._requestHandlerAbortControllers;this._requestHandlerAbortControllers=new Map;let r=new re(se.ConnectionClosed,"Connection closed");this._transport=void 0;try{this.onclose?.()}finally{for(let o of e.values())o(r);for(let o of t.values())o.abort(r)}}_onerror(e){this.onerror?.(e)}_onnotification(e,t){let{message:r}=jl(e,"notification"),o=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop")return;if(t?.classification!==void 0){let c=zl(t.classification);if(c!==o.era){this._onerror(new Error(`Era mismatch on inbound notification '${r.method}': classified as ${c} but this instance serves ${o.era}`));return}}if(ui(r.method)&&!o.hasNotificationMethod(r.method))return;let s=this._notificationHandlers.get(r.method),i=this.fallbackNotificationHandler;s===void 0&&i===void 0||Promise.resolve().then(()=>s===void 0?i(r):s(r,o)).catch(c=>this._onerror(new Error(`Uncaught error in notification handler: ${c}`)))}_onrequest(e,t){let{message:r,lifted:o}=jl(e,"request"),s=this._negotiatedWireCodec();if(t?.classification===void 0&&this._shouldDropInbound(e)==="drop"){this._onerror(new Error(`Dropped inbound request '${e.method}': not servable on this connection's protocol era`));return}let i=this._transport,c=n((w,I,U)=>{let O={jsonrpc:"2.0",id:r.id,error:{code:w,message:I,...U!==void 0&&{data:U}}};i?.send(O).catch(H=>this._onerror(new Error(`Failed to send an error response: ${H}`)))},"sendErrorResponse");if(t?.classification!==void 0){let w=zl(t.classification);if(w!==s.era){this._onerror(new Error(`Era mismatch on inbound request '${r.method}': classified as ${w} but this instance serves ${s.era}`));let I=t.classification.revision??w;c(P.UnsupportedProtocolVersion,`Unsupported protocol version: ${I}`,{supported:this._supportedProtocolVersions,requested:I});return}}if(di(r.method)&&!s.hasRequestMethod(r.method)){c(P.MethodNotFound,"Method not found");return}let a=this._requestHandlers.get(r.method)??this.fallbackRequestHandler;if(a===void 0){c(P.MethodNotFound,"Method not found");return}let u=s.checkInboundEnvelope(o);if(u!==void 0){c(P.InvalidParams,u);return}let p=n((w,I)=>this._notificationViaCodec(this._resolveOutboundCodec(w.method),w,{...I,relatedRequestId:r.id}),"sendNotification"),h=n((w,I,U)=>this._requestWithSchemaViaCodec(this._resolveOutboundCodec(w.method),w,I,{...U,relatedRequestId:r.id}),"sendRequest"),f=new AbortController;this._requestHandlerAbortControllers.set(r.id,f);let y=o.inputResponses===void 0?void 0:mS(o.inputResponses),S={sessionId:i?.sessionId,mcpReq:{id:r.id,method:r.method,_meta:r.params?._meta,...o.envelope!==void 0&&{envelope:o.envelope},...y!==void 0&&{inputResponses:y.accepted},...y!==void 0&&y.droppedKeys.length>0&&{droppedInputResponseKeys:y.droppedKeys},requestState:o.requestState===void 0?uS:yp(o.requestState),signal:f.signal,send:n(((w,I,U)=>{let O=this._resolveOutboundCodec(w.method);if(this._assertOutboundRequestInEra(O,w.method),gi(I))return h(w,I,U);let H=Dl(O,w.method);if(H===void 0)throw new TypeError(`'${w.method}' is not a spec method; pass a result schema as the second argument to ctx.mcpReq.send().`);return h(w,H,I)}),"send"),notify:p},http:t?.authInfo?{authInfo:t.authInfo}:void 0},k=this.buildContext(S,t);Promise.resolve().then(()=>a(r,k)).then(async w=>{if(f.signal.aborted)return;let I;try{I=s.encodeResult(r.method,w,this._outboundServerInfo())}catch(O){this._onerror(new Error(`Failed to encode result for ${r.method}: ${O}`)),c(P.InternalError,"Internal error");return}let U={result:I,jsonrpc:"2.0",id:r.id};await i?.send(U)},async w=>{if(f.signal.aborted)return;let I=Number.isSafeInteger(w.code)?w.code:P.InternalError,U={jsonrpc:"2.0",id:r.id,error:{code:s.encodeErrorCode(I),message:w.message??"Internal error",...w.data!==void 0&&{data:w.data}}};await i?.send(U)}).catch(w=>this._onerror(new Error(`Failed to send response: ${w}`))).finally(()=>{this._requestHandlerAbortControllers.get(r.id)===f&&this._requestHandlerAbortControllers.delete(r.id)})}_onprogress(e){let{progressToken:t,...r}=e.params,o=Number(t),s=this._progressHandlers.get(o);if(!s){this._onerror(new Error(`Received a progress notification for an unknown token: ${JSON.stringify(e)}`));return}let i=this._responseHandlers.get(o),c=this._timeoutInfo.get(o);if(c&&i&&c.resetTimeoutOnProgress)try{this._resetTimeout(o)}catch(a){this._responseHandlers.delete(o),this._progressHandlers.delete(o),this._cleanupTimeout(o),i(a);return}s(r)}_onresponse(e){let t=Number(e.id),r=this._responseHandlers.get(t);if(r===void 0){this._onerror(new Error(`Received a response for an unknown message ID: ${JSON.stringify(e)}`));return}this._responseHandlers.delete(t),this._cleanupTimeout(t),this._progressHandlers.delete(t),fi(e)?r(e):r(ie.fromError(e.error.code,e.error.message,e.error.data))}get transport(){return this._transport}async close(){await this._transport?.close()}request(e,t,r){let o=this._resolveOutboundCodec(e.method);if(this._assertOutboundRequestInEra(o,e.method),gi(t))return this._requestWithSchemaViaCodec(o,e,t,r);let s=Dl(o,e.method);if(s===void 0)throw new TypeError(`'${e.method}' is not a spec method; pass a result schema as the second argument to request().`);return this._requestWithSchemaViaCodec(o,e,s,t)}_negotiatedWireCodec(){return Xn(this._negotiatedProtocolVersion)}_wireCodec(){return this._negotiatedWireCodec()}_resolveOutboundCodec(e){if(this._negotiatedProtocolVersion===void 0){let t=aS(e);if(t)return t}return this._negotiatedWireCodec()}_assertOutboundRequestInEra(e,t){if(di(t)&&!e.hasRequestMethod(t))throw new re(se.MethodNotSupportedByProtocolVersion,`Method '${t}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t,era:e.era})}_requestWithSchema(e,t,r){let o=this._resolveOutboundCodec(e.method);return this._assertOutboundRequestInEra(o,e.method),this._requestWithSchemaViaCodec(o,e,t,r)}_requestWithSchemaViaCodec(e,t,r,o){let{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c,headers:a}=o??{},u=Date.now(),p,h;return new Promise((f,y)=>{let S=n(G=>{y(G)},"earlyReject");if(!this._transport){S(new Error("Not connected"));return}if(this._options?.enforceStrictCapabilities===!0)try{this.assertCapabilityForMethod(t.method)}catch(G){S(G);return}if(o?.signal?.aborted){let G=o.signal.reason;throw G instanceof re?G:new re(se.RequestTimeout,String(G))}let k=e.era===Ci&&this._transport.hasPerRequestStream===!0?new AbortController:void 0,w=this._requestMessageId++;h=w;let I={...t,jsonrpc:"2.0",id:w};o?.onprogress&&(this._progressHandlers.set(w,o.onprogress),I.params={...t.params,_meta:{...t.params?._meta,progressToken:w}});let U=this._envelopeOutbound(I),O=!1,H=n(G=>{O||(this._progressHandlers.delete(w),k===void 0?this._transport?.send(this._envelopeOutbound({jsonrpc:"2.0",method:"notifications/cancelled",params:{requestId:w,reason:String(G)}}),{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c}).catch(V=>this._onerror(new Error(`Failed to send cancellation: ${V}`))):k.abort(),y(G instanceof re?G:new re(se.RequestTimeout,String(G))))},"cancel");this._responseHandlers.set(w,G=>{if(o?.signal?.aborted)return;if(O=!0,G instanceof Error)return y(G);let V;try{V=e.decodeResult(t.method,G.result)}catch(oe){return y(oe instanceof Error?oe:new Error(String(oe)))}if(V.kind==="invalid")return y(V.error);if(V.kind==="input_required"){if(o?.allowInputRequired===!0)return f(hS(V));let oe={codec:e,request:t,resultSchema:r,options:o,flowStartedAt:u,retry:n((je,L)=>this._requestWithSchemaViaCodec(e,je===void 0?{method:t.method}:{method:t.method,params:je},r,L),"retry")};return f(this._resolveNonCompleteResult(V,oe))}let Ge=V.result;li(r,Ge).then(oe=>{oe.success?f(oe.data):y(new re(se.InvalidResult,`Invalid result for ${t.method}: ${oe.error}`))},y)}),p=n(()=>H(o?.signal?.reason),"onAbort"),o?.signal?.addEventListener("abort",p,{once:!0});let F=o?.timeout??gp,ee=n(()=>H(new re(se.RequestTimeout,"Request timed out",{timeout:F})),"timeoutHandler");this._setupTimeout(w,F,o?.maxTotalTimeout,ee,o?.resetTimeoutOnProgress??!1),this._transport.send(U,{relatedRequestId:s,resumptionToken:i,onresumptiontoken:c,headers:a,requestSignal:k?.signal}).catch(G=>{this._progressHandlers.delete(w),y(G)})}).finally(()=>{p&&o?.signal?.removeEventListener("abort",p),h!==void 0&&(this._responseHandlers.delete(h),this._cleanupTimeout(h))})}async notification(e,t){return this._notificationViaCodec(this._resolveOutboundCodec(e.method),e,t)}async _notificationViaCodec(e,t,r){if(!this._transport)throw new re(se.NotConnected,"Not connected");if(ui(t.method)&&!e.hasNotificationMethod(t.method))throw new re(se.MethodNotSupportedByProtocolVersion,`Notification '${t.method}' is not supported by the negotiated protocol version (wire era ${e.era})`,{method:t.method,era:e.era});this.assertNotificationCapability(t.method);let o=this._envelopeOutbound({jsonrpc:"2.0",...t});if((this._options?.debouncedNotificationMethods??[]).includes(t.method)&&!t.params&&!r?.relatedRequestId){if(this._pendingDebouncedNotifications.has(t.method))return;this._pendingDebouncedNotifications.add(t.method),Promise.resolve().then(()=>{this._pendingDebouncedNotifications.delete(t.method),this._transport&&this._transport?.send(o,r).catch(s=>this._onerror(s))});return}await this._transport.send(o,r)}setRequestHandler(e,t,r){this.assertRequestHandlerCapability(e);let o;if(typeof t=="function"){if(!di(e))throw new TypeError(`'${e}' is not a spec request method; pass schemas as the second argument to setRequestHandler().`);o=n((s,i)=>{let c=this._negotiatedWireCodec(),a=c.validateRequest(e,s);if(!a.ok&&a.reason==="not-in-era"&&(a=c.validateInputRequest(e,s)),!a.ok)throw a.reason==="not-in-era"?new ie(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(a.message);return Promise.resolve(t(a.value,i))},"stored")}else if(r)o=n(async(s,i)=>{let c=await li(t.params,{...s.params});if(!c.success)throw new ie(P.InvalidParams,`Invalid params for ${e}: ${c.error}`);return r(c.data,i)},"stored");else throw new TypeError("setRequestHandler: handler is required");this._requestHandlers.set(e,this._wrapHandler(e,o))}_wrapHandler(e,t){return t}_outboundServerInfo(){}removeRequestHandler(e){this._requestHandlers.delete(e)}assertCanSetRequestHandler(e){if(this._requestHandlers.has(e))throw new Error(`A request handler for ${e} already exists, which would be overridden`)}setNotificationHandler(e,t,r){if(typeof t=="function"){if(!ui(e))throw new TypeError(`'${e}' is not a spec notification method; pass schemas as the second argument to setNotificationHandler().`);this._notificationHandlers.set(e,(o,s)=>{let i=s.validateNotification(e,o);if(!i.ok)throw i.reason==="not-in-era"?new ie(P.InternalError,`No wire schema for ${e} in the resolved era`):new Error(i.message);return Promise.resolve(t(i.value))});return}if(!r)throw new TypeError("setNotificationHandler: handler is required");this._notificationHandlers.set(e,async o=>{let s=await li(t.params,{...o.params});if(!s.success)throw new ie(P.InvalidParams,`Invalid params for notification ${e}: ${s.error}`);await r(s.data,o)})}removeNotificationHandler(e){this._notificationHandlers.delete(e)}};function pi(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(pi,"isPlainObject$1");function $l(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}n($l,"isPlainObject");function mS(e){let t={},r=[];if(!$l(e))return{accepted:t,droppedKeys:r};for(let[o,s]of Object.entries(e)){if(!$l(s)||"method"in s||"result"in s){r.push(o);continue}t[o]=s}return{accepted:t,droppedKeys:r}}n(mS,"partitionInputResponses");function hS(e){return{resultType:"input_required",inputRequests:e.inputRequests,...e.requestState!==void 0&&{requestState:e.requestState}}}n(hS,"manualInputRequiredValue");var fS=El((e=>{var t=/; *([!#$%&'*+.^_`|~0-9A-Za-z-]+) *= *("(?:[\u000b\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u00ff]|\\[\u000b\u0020-\u00ff])*"|[!#$%&'*+.^_`|~0-9A-Za-z-]+) */g,r=/\\([\u000b\u0020-\u00ff])/g,o=/^[!#$%&'*+.^_`|~0-9A-Za-z-]+\/[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;e.parse=s;function s(a){if(!a)throw new TypeError("argument string is required");var u=typeof a=="object"?i(a):a;if(typeof u!="string")throw new TypeError("argument string is required to be a string");var p=u.indexOf(";"),h=p!==-1?u.slice(0,p).trim():u.trim();if(!o.test(h))throw new TypeError("invalid media type");var f=new c(h.toLowerCase());if(p!==-1){var y,S,k;for(t.lastIndex=p;S=t.exec(u);){if(S.index!==p)throw new TypeError("invalid parameter format");p+=S[0].length,y=S[1].toLowerCase(),k=S[2],k.charCodeAt(0)===34&&(k=k.slice(1,-1),k.indexOf("\\")!==-1&&(k=k.replace(r,"$1"))),f.parameters[y]=k}if(p!==u.length)throw new TypeError("invalid parameter format")}return f}n(s,"parse");function i(a){var u;if(typeof a.getHeader=="function"?u=a.getHeader("content-type"):typeof a.headers=="object"&&(u=a.headers&&a.headers["content-type"]),typeof u!="string")throw new TypeError("content-type header is missing from object");return u}n(i,"getcontenttype");function c(a){this.parameters=Object.create(null),this.type=a}n(c,"ContentType")})),DT=Al(fS(),1);var gS=10*1024*1024;function Ei(){_i(),ht(),dy(),Ay(),Dy()}n(Ei,"preloadSchemas");var YT=typeof self<"u"&&self.location&&self.location.origin!=="null"?new URL(self.location.origin+self.location.pathname+location.search):new URL("https://github.com/cfworker");var yS=/^(\d\d\d\d)-(\d\d)-(\d\d)$/,SS=[0,31,28,31,30,31,30,31,31,30,31,30,31],_S=/^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d(?::?\d\d)?)?$/i,wS=/^(?=.{1,253}\.?$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*\.?$/i,RS=/^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,bS=/^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,vS=/^(?:(?:https?|ftp):\/\/)(?:\S+(?::\S*)?@)?(?:(?!10(?:\.\d{1,3}){3})(?!127(?:\.\d{1,3}){3})(?!169\.254(?:\.\d{1,3}){2})(?!192\.168(?:\.\d{1,3}){2})(?!172\.(?:1[6-9]|2\d|3[0-1])(?:\.\d{1,3}){2})(?:[1-9]\d?|1\d\d|2[01]\d|22[0-3])(?:\.(?:1?\d{1,2}|2[0-4]\d|25[0-5])){2}(?:\.(?:[1-9]\d?|1\d\d|2[0-4]\d|25[0-4]))|(?:(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)(?:\.(?:[a-z\u{00a1}-\u{ffff}0-9]+-?)*[a-z\u{00a1}-\u{ffff}0-9]+)*(?:\.(?:[a-z\u{00a1}-\u{ffff}]{2,})))(?::\d{2,5})?(?:\/[^\s]*)?$/iu,IS=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,CS=/^(?:\/(?:[^~/]|~0|~1)*)*$/,TS=/^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,kS=/^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/,ES=n(e=>{if(e[0]==='"')return!1;let[t,r,...o]=e.split("@");return!t||!r||o.length!==0||t.length>64||r.length>253||t[0]==="."||t.endsWith(".")||t.includes("..")||!/^[a-z0-9.-]+$/i.test(r)||!/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+$/i.test(t)?!1:r.split(".").every(s=>/^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/i.test(s))},"EMAIL"),PS=/^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,AS=/^((([0-9a-f]{1,4}:){7}([0-9a-f]{1,4}|:))|(([0-9a-f]{1,4}:){6}(:[0-9a-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){5}(((:[0-9a-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9a-f]{1,4}:){4}(((:[0-9a-f]{1,4}){1,3})|((:[0-9a-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){3}(((:[0-9a-f]{1,4}){1,4})|((:[0-9a-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){2}(((:[0-9a-f]{1,4}){1,5})|((:[0-9a-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9a-f]{1,4}:){1}(((:[0-9a-f]{1,4}){1,6})|((:[0-9a-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9a-f]{1,4}){1,7})|((:[0-9a-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))$/i,xS=n(e=>e.length>1&&e.length<80&&(/^P\d+([.,]\d+)?W$/.test(e)||/^P[\dYMDTHS]*(\d[.,]\d+)?[YMDHS]$/.test(e)&&/^P([.,\d]+Y)?([.,\d]+M)?([.,\d]+D)?(T([.,\d]+H)?([.,\d]+M)?([.,\d]+S)?)?$/.test(e)),"DURATION");function He(e){return e.test.bind(e)}n(He,"bind");var XT={date:Sp,time:_p.bind(void 0,!1),"date-time":MS,duration:xS,uri:NS,"uri-reference":He(RS),"uri-template":He(bS),url:He(vS),email:ES,hostname:He(wS),ipv4:He(PS),ipv6:He(AS),regex:DS,uuid:He(IS),"json-pointer":He(CS),"json-pointer-uri-fragment":He(TS),"relative-json-pointer":He(kS)};function US(e){return e%4===0&&(e%100!==0||e%400===0)}n(US,"isLeapYear");function Sp(e){let t=e.match(yS);if(!t)return!1;let r=+t[1],o=+t[2],s=+t[3];return o>=1&&o<=12&&s>=1&&s<=(o==2&&US(r)?29:SS[o])}n(Sp,"date");function _p(e,t){let r=t.match(_S);if(!r)return!1;let o=+r[1],s=+r[2],i=+r[3],c=!!r[5];return(o<=23&&s<=59&&i<=59||o==23&&s==59&&i==60)&&(!e||c)}n(_p,"time");var OS=/t|\s/i;function MS(e){let t=e.split(OS);return t.length==2&&Sp(t[0])&&_p(!0,t[1])}n(MS,"date_time");var zS=/\/|:/,qS=/^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i;function NS(e){return zS.test(e)&&qS.test(e)}n(NS,"uri");var jS=/[^\\]\\Z/;function DS(e){if(jS.test(e))return!1;try{return new RegExp(e,"u"),!0}catch{return!1}}n(DS,"regex");Ei();var wp=!1;var Pi;Pi=globalThis.crypto;async function LS(e){return(await Pi).getRandomValues(new Uint8Array(e))}n(LS,"getRandomValues");async function HS(e){let t="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~",r=Math.pow(2,8)-Math.pow(2,8)%t.length,o="";for(;o.length<e;){let s=await LS(e-o.length);for(let i of s)i<r&&(o+=t[i%t.length])}return o}n(HS,"random");async function BS(e){return await HS(e)}n(BS,"generateVerifier");async function FS(e){let t=await(await Pi).subtle.digest("SHA-256",new TextEncoder().encode(e));return btoa(String.fromCharCode(...new Uint8Array(t))).replace(/\//g,"_").replace(/\+/g,"-").replace(/=/g,"")}n(FS,"generateChallenge");async function Ai(e){if(e||(e=43),e<43||e>128)throw`Expected a length between 43 and 128. Received ${e}.`;let t=await BS(e),r=await FS(t);return{code_verifier:t,code_challenge:r}}n(Ai,"pkceChallenge");var to=class extends Error{static{n(this,"OAuthClientFlowError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.OAuthClientFlowError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e){super(e),this.name=new.target.name,Ht(this,new.target)}},eo=class extends to{static{n(this,"IssuerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.IssuerMismatchError"})}kind;expected;received;constructor(e,t,r){super(`Issuer mismatch in ${e==="metadata"?"authorization server metadata (RFC 8414 \xA73.3)":"authorization response (RFC 9207)"}: expected ${JSON.stringify(t)}, received ${JSON.stringify(r)}`),this.kind=e,this.expected=t,this.received=r}},zi=class extends to{static{n(this,"RegistrationRejectedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.RegistrationRejectedError"})}status;body;submittedMetadata;constructor(e){super(`Dynamic Client Registration rejected (HTTP ${e.status}): ${e.body}`),this.status=e.status,this.body=e.body,this.submittedMetadata=e.submittedMetadata}},ds=class extends to{static{n(this,"InsecureTokenEndpointError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsecureTokenEndpointError"})}tokenEndpoint;constructor(e){super(`Refusing to send credentials to non-https token endpoint '${e}'. OAuth token requests MUST use TLS (localhost / 127.0.0.1 / ::1 are exempt).`),this.tokenEndpoint=e}},xi=class extends to{static{n(this,"AuthorizationServerMismatchError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.AuthorizationServerMismatchError"})}constructor(e,t){super(`Authorization server changed between redirect and callback (redirected to ${JSON.stringify(e)}, callback resolved ${JSON.stringify(t)}); refusing to send authorization_code/code_verifier to a different token endpoint`),this.recordedIssuer=e,this.currentIssuer=t}},Dk=class extends to{static{n(this,"InsufficientScopeError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.InsufficientScopeError"})}requiredScope;resourceMetadataUrl;errorDescription;constructor(e){super(`Insufficient scope${e.requiredScope?`: required "${e.requiredScope}"`:""}`),this.requiredScope=e.requiredScope,this.resourceMetadataUrl=e.resourceMetadataUrl,this.errorDescription=e.errorDescription}};function Rp(e,t,r){if(e!==void 0)return e.issuer===void 0?(r?.canPersistStamp!==!1&&console.warn("[mcp-sdk] SEP-2352: stored OAuth credential has no 'issuer' stamp (pre-upgrade storage or provider not round-tripping the value). SEP-2352 isolation is inactive for this read; ensure your provider round-trips the issuer field."),e):Ip(e.issuer,t)?e:void 0}n(Rp,"discardIfIssuerMismatch");function Ip(e,t){return e===t||e.endsWith("/")&&e.slice(0,-1)===t||t.endsWith("/")&&t.slice(0,-1)===e}n(Ip,"issuersMatch");var $k=class extends Error{static{n(this,"UnauthorizedError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.UnauthorizedError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e){super(e??"Unauthorized"),this.name="UnauthorizedError",Ht(this,new.target)}};function Cp(e){return e?.authorization_response_iss_parameter_supported===!0}n(Cp,"isIssParameterSupported");function Tp({iss:e,expectedIssuer:t,issParameterSupported:r}){if(t!==void 0){if(e===void 0){if(r)throw new eo("authorization_response",t,void 0);return}if(e!==t)throw new eo("authorization_response",t,e)}}n(Tp,"validateAuthorizationResponseIssuer");function GS(e){return["client_secret_basic","client_secret_post","none"].includes(e)}n(GS,"isClientAuthMethod");var Ui="code",Oi="S256";function JS(e,t){let r=e.client_secret!==void 0;return"token_endpoint_auth_method"in e&&e.token_endpoint_auth_method&&GS(e.token_endpoint_auth_method)&&(t.length===0||t.includes(e.token_endpoint_auth_method))?e.token_endpoint_auth_method:t.length===0?r?"client_secret_basic":"none":r&&t.includes("client_secret_basic")?"client_secret_basic":r&&t.includes("client_secret_post")?"client_secret_post":t.includes("none")?"none":r?"client_secret_post":"none"}n(JS,"selectClientAuthMethod");function VS(e,t,r,o){let{client_id:s,client_secret:i}=t;switch(e){case"client_secret_basic":KS(s,i,r);return;case"client_secret_post":WS(s,i,o);return;case"none":ZS(s,o);return;default:throw new Error(`Unsupported client authentication method: ${e}`)}}n(VS,"applyClientAuthentication");function KS(e,t,r){if(!t)throw new Error("client_secret_basic authentication requires a client_secret");let o=btoa(`${e}:${t}`);r.set("Authorization",`Basic ${o}`)}n(KS,"applyBasicAuth");function WS(e,t,r){r.set("client_id",e),t&&r.set("client_secret",t)}n(WS,"applyPostAuth");function ZS(e,t){t.set("client_id",e)}n(ZS,"applyPublicAuth");function kp(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}n(kp,"isLoopbackHost");function YS(e){let t=new URL(String(e));if(t.protocol!=="https:"&&!kp(t.hostname))throw new ds(t.href);return t}n(YS,"assertSecureTokenEndpoint");function XS(e){for(let t of e??[]){let r;try{r=new URL(t)}catch{continue}if(r.protocol!=="http:"&&r.protocol!=="https:"||kp(r.hostname))return"native"}return"web"}n(XS,"deriveApplicationType");function QS(e){let t=e.clientMetadata;return{...t,grant_types:t.grant_types??(e.redirectUrl===void 0?void 0:["authorization_code","refresh_token"]),application_type:t.application_type??XS(t.redirect_uris)}}n(QS,"resolveClientMetadata");async function bp(e){let t=e instanceof Response?e.status:void 0,r=e instanceof Response?await e.text():e;try{let o=Ho.parse(JSON.parse(r));return ft.fromResponse(o)}catch(o){let s=`${t?`HTTP ${t}: `:""}Invalid OAuth error response: ${o}. Raw body: ${r}`;return new ft(ue.ServerError,s)}}n(bp,"parseErrorResponse");async function qi(e,t){try{return await Mi(e,t)}catch(r){if(r instanceof ft){if(r.code===ue.InvalidClient||r.code===ue.UnauthorizedClient)return await e.invalidateCredentials?.("client"),await e.invalidateCredentials?.("tokens"),await Mi(e,t);if(r.code===ue.InvalidGrant)return await e.invalidateCredentials?.("tokens"),await Mi(e,t)}throw r}}n(qi,"auth");function e_(e){let{requestedScope:t,resourceMetadata:r,authServerMetadata:o,clientMetadata:s}=e,i=t||r?.scopes_supported?.join(" ")||s.scope;return i&&o?.scopes_supported?.includes("offline_access")&&!i.split(" ").includes("offline_access")&&s.grant_types?.includes("refresh_token")&&(i=`${i} offline_access`),i}n(e_,"determineScope");async function Mi(e,{serverUrl:t,authorizationCode:r,iss:o,scope:s,resourceMetadataUrl:i,fetchFn:c,skipIssuerMetadataValidation:a,forceReauthorization:u}){let p=QS(e),h=await e.discoveryState?.(),f,y,S,k,w=i;if(!w&&h?.resourceMetadataUrl&&(w=new URL(h.resourceMetadataUrl)),h?.authorizationServerUrl){if(y=h.authorizationServerUrl,f=h.resourceMetadata,S=h.authorizationServerMetadata??await xp(y,{fetchFn:c,skipIssuerValidation:a}),!f)try{f=await Pp(t,{resourceMetadataUrl:w},c)}catch(L){if(L instanceof TypeError)throw L}(S!==h.authorizationServerMetadata||f!==h.resourceMetadata)&&await e.saveDiscoveryState?.({authorizationServerUrl:String(y),resourceMetadataUrl:w?.toString(),resourceMetadata:f,authorizationServerMetadata:S})}else{let L=await i_(t,{resourceMetadataUrl:w,fetchFn:c,skipIssuerMetadataValidation:a});y=L.authorizationServerUrl,S=L.authorizationServerMetadata,f=L.resourceMetadata,k={authorizationServerUrl:String(y),resourceMetadataUrl:w?.toString(),resourceMetadata:f,authorizationServerMetadata:S}}let I=S?.issuer??String(y),U={issuer:I};if(await e.saveAuthorizationServerUrl?.(I),r!==void 0){let L=h?.authorizationServerMetadata?.issuer??h?.authorizationServerUrl;if(L===void 0){if(e.saveDiscoveryState!==void 0)throw new xi("discoveryState was not available on the callback leg; ensure your provider persists discoveryState alongside codeVerifier",I);console.warn("[mcp-sdk] OAuthClientProvider does not implement saveDiscoveryState()/discoveryState(); the SEP-2352 callback-leg authorization-server binding cannot be checked. Implement discoveryState (persist alongside codeVerifier) \u2014 see docs/migration/upgrade-to-v2.md \xA7SEP-2352.")}else if(!Ip(L,I))throw new xi(L,I)}k&&await e.saveDiscoveryState?.(k);let O=await t_(t,e,f);O&&await e.saveResourceUrl?.(String(O));let H=e_({requestedScope:s,resourceMetadata:f,authServerMetadata:S,clientMetadata:e.clientMetadata}),F=await Promise.resolve(e.clientInformation(U)),ee=Rp(F,I,{canPersistStamp:e.saveClientInformation!==void 0});if(ee===void 0&&F?.issuer&&e.saveClientInformation===void 0)throw new xi(F.issuer,I);if(ee&&ee.issuer===void 0&&(ee={...ee,issuer:I},await e.saveClientInformation?.(ee,U)),!ee){if(r!==void 0)throw new Error("Existing OAuth client information is required when exchanging an authorization code");let L=S?.client_id_metadata_document_supported===!0,Ue=e.clientMetadataUrl;if(Ue&&!Ni(Ue))throw new ft(ue.InvalidClientMetadata,`clientMetadataUrl must be a valid HTTPS URL with a non-root pathname, got: ${Ue}`);if(L&&Ue)ee={client_id:Ue,issuer:I},await e.saveClientInformation?.(ee,U);else{if(!e.saveClientInformation)throw new Error("OAuth client information must be saveable for dynamic registration");ee={...await l_(y,{metadata:S,clientMetadata:p,scope:H,fetchFn:c}),issuer:I},await e.saveClientInformation(ee,U)}}let G=!e.redirectUrl;if(r!==void 0||G){r!==void 0&&Tp({iss:o,expectedIssuer:S?.issuer,issParameterSupported:Cp(S)});let L=await u_(e,y,{metadata:S,resource:O,authorizationCode:r,iss:o,scope:H,fetchFn:c});return await e.saveTokens({...L,issuer:I},U),"AUTHORIZED"}let V=Rp(await e.tokens(U),I);if(V&&V.issuer===void 0&&(V={...V,issuer:I},await e.saveTokens(V,U)),V?.refresh_token&&!u)try{let L=await d_(y,{metadata:S,clientInformation:ee,refreshToken:V.refresh_token,resource:O,addClientAuthentication:e.addClientAuthentication,fetchFn:c});return await e.saveTokens({...L,issuer:I},U),"AUTHORIZED"}catch(L){if(L instanceof ds||!(!(L instanceof ft)||L.code===ue.ServerError))throw L}let Ge=e.state?await e.state():void 0,{authorizationUrl:oe,codeVerifier:je}=await a_(y,{metadata:S,clientInformation:ee,state:Ge,redirectUrl:e.redirectUrl,scope:H,resource:O});return await e.saveCodeVerifier(je),await e.redirectToAuthorization(oe),"REDIRECT"}n(Mi,"authInternal");function Ni(e){if(!e)return!1;try{let t=new URL(e);return t.protocol==="https:"&&t.pathname!=="/"}catch{return!1}}n(Ni,"isHttpsUrl");async function t_(e,t,r){let o=Hl(e);if(t.validateResourceURL)return await t.validateResourceURL(o,r?.resource);if(r){if(!ss({requestedResource:o,configuredResource:r.resource}))throw new Error(`Protected resource ${r.resource} does not match expected ${o} (or origin)`);return new URL(r.resource)}}n(t_,"selectResourceURL");function Ep(e){let t=e.headers.get("WWW-Authenticate");if(!t)return{};let[r,o]=t.split(" ");if(r?.toLowerCase()!=="bearer"||!o)return{};let s=cs(e,"resource_metadata")||void 0,i;if(s)try{i=new URL(s)}catch{}let c=cs(e,"scope")||void 0,a=cs(e,"error")||void 0,u=cs(e,"error_description")||void 0;return{resourceMetadataUrl:i,scope:c,error:a,errorDescription:u}}n(Ep,"extractWWWAuthenticateParams");function cs(e,t){let r=e.headers.get("WWW-Authenticate");if(!r)return null;let o=new RegExp(String.raw`${t}=(?:"([^"]+)"|([^\s,]+))`),s=r.match(o);if(s){let i=s[1]||s[2];if(i)return i}return null}n(cs,"extractFieldFromWwwAuth");async function Pp(e,t,r=fetch){let o=await o_(e,"oauth-protected-resource",r,{protocolVersion:t?.protocolVersion,metadataUrl:t?.resourceMetadataUrl});if(!o||o.status===404)throw await o?.text?.().catch(()=>{}),new Error("Resource server does not implement OAuth 2.0 Protected Resource Metadata.");if(!o.ok)throw await o.text?.().catch(()=>{}),new Error(`HTTP ${o.status} trying to load well-known OAuth protected resource metadata.`);return hr.parse(await o.json())}n(Pp,"discoverOAuthProtectedResourceMetadata");async function Ap(e,t,r=fetch){try{return await r(e,{headers:t})}catch(o){if(!(o instanceof TypeError)||!wp)throw o;if(t)try{return await r(e,{})}catch(s){if(!(s instanceof TypeError))throw s;return}return}}n(Ap,"fetchWithCorsRetry");function r_(e,t="",r={}){return t.endsWith("/")&&(t=t.slice(0,-1)),r.prependPathname?`${t}/.well-known/${e}`:`/.well-known/${e}${t}`}n(r_,"buildWellKnownPath");async function vp(e,t,r=fetch){return await Ap(e,{"MCP-Protocol-Version":t},r)}n(vp,"tryMetadataDiscovery");function n_(e,t){return e?t==="/"?!1:e.status>=400&&e.status<500||e.status===502:!0}n(n_,"shouldAttemptFallback");async function o_(e,t,r,o){let s=new URL(e),i=o?.protocolVersion??No,c;if(o?.metadataUrl)c=new URL(o.metadataUrl);else{let u=r_(t,s.pathname);c=new URL(u,o?.metadataServerUrl??s),c.search=s.search}let a=await vp(c,i,r);return!o?.metadataUrl&&n_(a,s.pathname)&&(a=await vp(new URL(`/.well-known/${t}`,s),i,r)),a}n(o_,"discoverMetadataWithFallback");function s_(e){let t=typeof e=="string"?new URL(e):e,r=t.pathname!=="/",o=[];if(!r)return o.push({url:new URL("/.well-known/oauth-authorization-server",t.origin),type:"oauth"},{url:new URL("/.well-known/openid-configuration",t.origin),type:"oidc"}),o;let s=t.pathname;return s.endsWith("/")&&(s=s.slice(0,-1)),o.push({url:new URL(`/.well-known/oauth-authorization-server${s}`,t.origin),type:"oauth"},{url:new URL(`/.well-known/openid-configuration${s}`,t.origin),type:"oidc"},{url:new URL(`${s}/.well-known/openid-configuration`,t.origin),type:"oidc"}),o}n(s_,"buildDiscoveryUrls");async function xp(e,{fetchFn:t=fetch,protocolVersion:r=No,skipIssuerValidation:o=!1}={}){let s={"MCP-Protocol-Version":r,Accept:"application/json"},i=s_(e);for(let{url:c,type:a}of i){let u=await Ap(c,s,t);if(!u)continue;if(!u.ok){if(await u.text?.().catch(()=>{}),u.status>=400&&u.status<500||u.status===502)continue;throw new Error(`HTTP ${u.status} trying to load ${a==="oauth"?"OAuth":"OpenID provider"} metadata from ${c}`)}let p=a==="oauth"?fr.parse(await u.json()):gr.parse(await u.json());if(!o){let h=typeof e=="string"?e:e.href;if(!(p.issuer===h||h.endsWith("/")&&p.issuer===h.slice(0,-1)))throw new eo("metadata",h,p.issuer)}return p}}n(xp,"discoverAuthorizationServerMetadata");async function i_(e,t){let r,o;try{r=await Pp(e,{resourceMetadataUrl:t?.resourceMetadataUrl},t?.fetchFn),r.authorization_servers&&r.authorization_servers.length>0&&(o=r.authorization_servers[0])}catch(i){if(i instanceof TypeError)throw i}o||(o=String(new URL("/",e)));let s=await xp(o,{fetchFn:t?.fetchFn,skipIssuerValidation:t?.skipIssuerMetadataValidation});return{authorizationServerUrl:o,authorizationServerMetadata:s,resourceMetadata:r}}n(i_,"discoverOAuthServerInfo");async function a_(e,{metadata:t,clientInformation:r,redirectUrl:o,scope:s,state:i,resource:c}){let a;if(t){if(a=new URL(t.authorization_endpoint),!t.response_types_supported.includes(Ui))throw new Error(`Incompatible auth server: does not support response type ${Ui}`);if(t.code_challenge_methods_supported&&!t.code_challenge_methods_supported.includes(Oi))throw new Error(`Incompatible auth server: does not support code challenge method ${Oi}`)}else a=new URL("/authorize",e);let u=await Ai(),p=u.code_verifier,h=u.code_challenge;return a.searchParams.set("response_type",Ui),a.searchParams.set("client_id",r.client_id),a.searchParams.set("code_challenge",h),a.searchParams.set("code_challenge_method",Oi),a.searchParams.set("redirect_uri",String(o)),i&&a.searchParams.set("state",i),s&&a.searchParams.set("scope",s),s?.split(" ").includes("offline_access")&&a.searchParams.append("prompt","consent"),c&&a.searchParams.set("resource",c.href),{authorizationUrl:a,codeVerifier:p}}n(a_,"startAuthorization");function c_(e,t,r){return new URLSearchParams({grant_type:"authorization_code",code:e,code_verifier:t,redirect_uri:String(r)})}n(c_,"prepareAuthorizationCodeRequest");async function Up(e,{metadata:t,tokenRequestParams:r,clientInformation:o,addClientAuthentication:s,resource:i,fetchFn:c}){let a=YS(t?.token_endpoint??new URL("/token",e)),u=new Headers({"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"});i&&r.set("resource",i.href),s?await s(u,r,a,t):o&&VS(JS(o,t?.token_endpoint_auth_methods_supported??[]),o,u,r);let p=await(c??fetch)(a,{method:"POST",headers:u,body:r});if(!p.ok)throw await bp(p);let h=await p.json();try{return lt.parse(h)}catch(f){throw typeof h=="object"&&h!==null&&"error"in h?await bp(JSON.stringify(h)):f}}n(Up,"executeTokenRequest");async function d_(e,{metadata:t,clientInformation:r,refreshToken:o,resource:s,addClientAuthentication:i,fetchFn:c}){return{refresh_token:o,...await Up(e,{metadata:t,tokenRequestParams:new URLSearchParams({grant_type:"refresh_token",refresh_token:o}),clientInformation:r,addClientAuthentication:i,resource:s,fetchFn:c})}}n(d_,"refreshAuthorization");async function u_(e,t,{metadata:r,resource:o,authorizationCode:s,iss:i,scope:c,fetchFn:a}={}){s!==void 0&&Tp({iss:i,expectedIssuer:r?.issuer,issParameterSupported:Cp(r)});let u=c??e.clientMetadata.scope,p;if(e.prepareTokenRequest&&(p=await e.prepareTokenRequest(u)),!p){if(!s)throw new Error("Either provider.prepareTokenRequest() or authorizationCode is required");if(!e.redirectUrl)throw new Error("redirectUrl is required for authorization_code flow");p=c_(s,await e.codeVerifier(),e.redirectUrl)}let h=await e.clientInformation({issuer:r?.issuer??String(t)});return Up(t,{metadata:r,tokenRequestParams:p,clientInformation:h??void 0,addClientAuthentication:e.addClientAuthentication,resource:o,fetchFn:a})}n(u_,"fetchToken");async function l_(e,{metadata:t,clientMetadata:r,scope:o,fetchFn:s}){let i;if(t){if(!t.registration_endpoint)throw new Error("Incompatible auth server: does not support dynamic client registration");i=new URL(t.registration_endpoint)}else i=new URL("/register",e);let c={...r,...o===void 0?{}:{scope:o}},a=await(s??fetch)(i,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(c)});if(!a.ok)throw new zi({status:a.status,body:await a.text(),submittedMetadata:c});return $t.parse(await a.json())}n(l_,"registerClient");var Lk=class extends Error{static{n(this,"SseError")}static{Object.defineProperty(this,"mcpBrand",{value:"mcp.SseError"})}static[Symbol.hasInstance](e){return Ie(this,e)}static isInstance(e){if(typeof this!="function")throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");return Ie(this,e)}constructor(e,t,r){super(`SSE error: ${t}`),this.code=e,this.event=r,Ht(this,new.target)}};function p_(e){let t=Dt.safeParse(e);return t.success?t.data.id:void 0}n(p_,"parseJsonRpcRequestId");function Op(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return p_(t)}catch{return}}n(Op,"readJsonRpcRequestIdFromBody");function us(e){return Ln.parse({jsonrpc:mr,...e.id===void 0?{}:{id:e.id},error:{code:e.error.code,message:e.error.message,...e.error.data===void 0?{}:{data:e.error.data}}})}n(us,"jsonRpcErrorResponse");function Mp(e){return new as([Lo.parse({mode:"url",message:e.message,elicitationId:e.elicitationId,url:e.url})],e.message)}n(Mp,"urlElicitationRequiredError");var ps=l.record(l.string(),l.unknown()),m_=l.record(l.string(),l.unknown()),yt=l.array(l.string().min(1)).min(1).optional(),h_=l.object({name:l.string().min(1),description:l.string().min(1).optional(),annotations:m_.optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),f_=l.object({name:l.string().min(1),description:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),g_=l.object({uri:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),y_=l.object({uriTemplate:l.string().min(1),name:l.string().min(1).optional(),description:l.string().min(1).optional(),mimeType:l.string().min(1).optional(),_meta:ps.optional(),roles:yt,groups:yt,public:l.boolean().optional()}).strict(),S_=l.array(l.union([l.string(),h_])),__=l.array(l.union([l.string(),f_])),w_=l.array(l.union([l.string(),g_])),R_=l.array(l.union([l.string(),y_])),b_=l.object({module:l.unknown(),export:l.string().min(1)}).strict(),v_=l.object({mode:l.enum(["allPublic","rolesAndGroups","function"]).optional(),roleClaim:l.string().min(1).optional(),groupClaim:l.string().min(1).optional(),identifier:b_.optional()}).strict(),I_=l.object({tools:S_.optional(),prompts:__.optional(),resources:w_.optional(),resourceTemplates:R_.optional(),accessControl:v_.optional()}).strict(),gt=[{option:"tools",listMethod:"tools/list",resultProperty:"tools",itemProperty:"name",directMethods:["tools/call"]},{option:"prompts",listMethod:"prompts/list",resultProperty:"prompts",itemProperty:"name",directMethods:["prompts/get"]},{option:"resources",listMethod:"resources/list",resultProperty:"resources",itemProperty:"uri",directMethods:["resources/read"]},{option:"resourceTemplates",listMethod:"resources/templates/list",resultProperty:"resourceTemplates",itemProperty:"uriTemplate",directMethods:[]}];function C_(e,t){return Lu(I_,e,`MCP capability filter policy "${t}"`)}n(C_,"parseMcpCapabilityFilterOptions");function _e(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(_e,"isRecord");function ro(e){return typeof e.method=="string"?e.method:void 0}n(ro,"messageMethod");function zp(e){return typeof e=="string"||typeof e=="number"||e===null?JSON.stringify(e):void 0}n(zp,"correlationKey");function qp(e){if(!Array.isArray(e))return;let t=e.filter(r=>typeof r=="string");return t.length>0?t:void 0}n(qp,"asStringArray");function Np(e,t){if(!_e(e))return[];let r=t in e?e[t]:t.split(".").reduce((o,s)=>_e(o)?o[s]:void 0,e);return Array.isArray(r)?r.filter(o=>typeof o=="string"):typeof r=="string"?r.split(/\s+/).filter(o=>o.length>0):[]}n(Np,"readClaimValues");function $i(e,t){if(typeof e=="string")return{key:e,public:!1};if(!_e(e))return;let r=e[t];if(typeof r=="string")return{key:r,roles:qp(e.roles),groups:qp(e.groups),public:e.public===!0}}n($i,"normalizeEntry");function T_(e,t,r){if(e.public)return!0;let o=e.roles??[],s=e.groups??[];return o.length===0&&s.length===0?!1:o.some(i=>t.has(i))||s.some(i=>r.has(i))}n(T_,"isCallerAllowed");function ls(e,t,r,o){if(e===void 0)return;let s=[];for(let i of e){let c=$i(i,t);c!==void 0&&T_(c,r,o)&&s.push(c.key)}return s}n(ls,"allowedKeys");var $p=n((e,t,r)=>{let o=r.accessControl?.roleClaim??"roles",s=r.accessControl?.groupClaim??"groups",i=new Set(Np(e.user?.data,o)),c=new Set(Np(e.user?.data,s));return{tools:ls(r.tools,"name",i,c),prompts:ls(r.prompts,"name",i,c),resources:ls(r.resources,"uri",i,c),resourceTemplates:ls(r.resourceTemplates,"uriTemplate",i,c)}},"claimsCapabilityResolver");function k_(e,t){let r=[];for(let o of gt){let s=e[o.option];if(s!==void 0)for(let i of s){let c=$i(i,o.itemProperty);if(c===void 0)continue;let a=(c.roles?.length??0)>0||(c.groups?.length??0)>0;c.public&&a&&r.push(`${o.option} "${c.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - with accessControl.mode "rolesAndGroups", a capability cannot set both "public": true and roles/groups ("public" opens it to everyone, roles/groups restrict it). Remove one of the two on: ${r.join(", ")}`)}n(k_,"assertNoConflictingMarkup");function E_(e,t){let r=[];for(let o of gt){let s=e[o.option];if(s!==void 0)for(let i of s){let c=$i(i,o.itemProperty);c!==void 0&&((c.roles?.length??0)>0||(c.groups?.length??0)>0||c.public)&&r.push(`${o.option} "${c.key}"`)}}if(r.length>0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode is "allPublic" (the default) but these capabilities set roles/groups/public; set accessControl.mode to "rolesAndGroups" or remove the markup: ${r.join(", ")}`)}n(E_,"assertNoMarkup");function P_(e,t){let r=e.identifier;if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);if(r.module===null||typeof r.module!="object")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.module must reference a module, e.g. $import(./modules/mcp-access-control)`);if(!r.export)throw new K(`MCP capability filter policy "${t}" - accessControl.identifier.export must be specified`);let o=r.module[r.export];if(typeof o!="function")throw new K(`MCP capability filter policy "${t}" - accessControl.identifier must resolve to a valid function`);let s=o;return async(i,c,a)=>{let u=await s(i,c,a);if(u==null)throw new v(`MCP capability filter policy "${t}" - accessControl resolver returned no value; return an AllowedCapabilities object (use empty arrays to deny)`);if(typeof u!="object"||Array.isArray(u))throw new v(`MCP capability filter policy "${t}" - accessControl resolver must return an AllowedCapabilities object`);return u}}n(P_,"buildCustomResolver");function A_(e,t){let r=e.accessControl,o=r?.mode??"allPublic";if(o==="function"){if(r===void 0)throw new K(`MCP capability filter policy "${t}" - accessControl.mode "function" requires accessControl.identifier`);return P_(r,t)}if(o==="rolesAndGroups")return k_(e,t),$p;E_(e,t)}n(A_,"buildCapabilityResolver");function x_(e){let t={};for(let r of gt){let o=e[r.option];if(o===void 0)continue;let s=new Map;for(let i of o){let c=q_(i,r.itemProperty);c!==void 0&&s.set(c.key,c)}t[r.option]=s}return t}n(x_,"buildProjectionMaps");function ji(e){return e===void 0?void 0:gt.find(t=>t.listMethod===e)}n(ji,"findListRule");function U_(e){return e===void 0?void 0:gt.find(t=>t.directMethods.includes(e))}n(U_,"findDirectRule");function O_(e){switch(e.method){case"tools/call":return{option:"tools",target:e.params.name};case"prompts/get":return{option:"prompts",target:e.params.name};case"resources/read":return{option:"resources",target:e.params.uri};default:return}}n(O_,"directCapabilityAccess");function M_(e){let t=U_(ro(e));if(t===void 0||!_e(e.raw))return;let r=e.raw.params;if(!_e(r))return;let o=r[t.itemProperty==="uri"?"uri":"name"];return typeof o=="string"?{option:t.option,target:o}:void 0}n(M_,"rawDirectCapabilityAccess");function z_(e){return Response.json(us({...e==null?{}:{id:e},error:{code:P.MethodNotFound,message:"Method not found"}}))}n(z_,"methodNotFoundResponse");function q_(e,t){if(typeof e=="string")return{key:e,overlay:{}};if(!_e(e))return;let r=e[t];if(typeof r!="string")return;let o={...e};return delete o.roles,delete o.groups,delete o.public,{key:r,overlay:o}}n(q_,"buildProjection");function jp(e){let t=e.base[e.property],r=e.overlay[e.property];return _e(r)?_e(t)?{...t,...r}:r:t}n(jp,"mergeRecordProperty");function N_(e,t){let r={...e,...t.overlay},o=jp({base:e,overlay:t.overlay,property:"annotations"});o!==void 0&&(r.annotations=o);let s=jp({base:e,overlay:t.overlay,property:"_meta"});return s!==void 0&&(r._meta=s),r}n(N_,"applyProjection");function Dp(e,t,r,o){if(!_e(e))return e;let s=e.result;if(!_e(s))return e;let i=s[t.resultProperty];return!Array.isArray(i)||!i.every(c=>_e(c)&&typeof c[t.itemProperty]=="string")?e:{...e,result:{...s,[t.resultProperty]:i.flatMap(c=>{if(!_e(c))return[];let a=c[t.itemProperty];if(typeof a!="string")return[];if(o!==void 0&&!o.has(a))return[];let u=r.get(a);return u===void 0?[]:[N_(c,u)]})}}}n(Dp,"filterAndProjectItems");function j_(e){let{envelope:t,responseBody:r,projectionMaps:o,allowedSets:s}=e;if(Array.isArray(r)){if(t.shape!=="batch")return r;let u=new Map;for(let p of t.messages){let h=ji(ro(p)),f=h===void 0?void 0:zp(p.id);h!==void 0&&f!==void 0&&u.set(f,h)}return u.size===0?r:r.map(p=>{if(!_e(p)||"error"in p)return p;let h=zp(p.id),f=h===void 0?void 0:u.get(h),y=f===void 0?void 0:o[f.option];return f===void 0||y===void 0?p:Dp(p,f,y,s?.[f.option])})}if(t.shape!=="single"||!_e(r)||"error"in r)return r;let i=t.messages[0],c=ji(i===void 0?void 0:ro(i)),a=c===void 0?void 0:o[c.option];return c===void 0||a===void 0?r:Dp(r,c,a,s?.[c.option])}n(j_,"filterResponseBody");function D_(e){return e.headers.get("content-type")?.includes("json")??!1}n(D_,"isJsonResponse");var Di=class extends qo{static{n(this,"McpCapabilityFilterInboundPolicy")}static policyType="mcp-capability-filter";#e;#r;#t;constructor(t,r){let o=C_(t,r);super(o,r),this.#r=r,this.#e=x_(o),this.#t=A_(o,r)}async handler(t,r){let o=await kl(t);if(o===null)return t;let s=this.#t!==void 0&&this.#n(o)?await this.#s(t,r):void 0;for(let c of o.messages){let a=c.type==="request"?O_(c):M_(c);if(a===void 0)continue;let u=this.#e[a.option];if(u===void 0)continue;let p=s?.[a.option];if(!u.has(a.target)||p!==void 0&&!p.has(a.target))return z_(c.type==="request"?c.id:c.id??void 0)}if(!this.#o(o))return t;let i=this.#e;return r.addResponseSendingHook(async c=>{if(!D_(c))return c;let a;try{a=await c.clone().json()}catch{return c}let u=j_({envelope:o,responseBody:a,projectionMaps:i,allowedSets:s});if(u===a)return c;let p=new Headers(c.headers);return p.delete("content-length"),new Response(JSON.stringify(u),{status:c.status,statusText:c.statusText,headers:p})}),t}#n(t){return t.messages.some(r=>{let o=ro(r);return o===void 0?!1:gt.some(s=>this.#e[s.option]===void 0?!1:s.listMethod===o||s.directMethods.includes(o))})}#o(t){return t.messages.some(r=>{let o=ji(ro(r));return o!==void 0&&this.#e[o.option]!==void 0})}async#s(t,r){let o=this.#t;if(o===void 0)return{};let s;try{s=await o(t,r,this.options)}catch(c){r.log.error(`MCP capability filter policy "${this.#r}" - access-control resolver threw; denying configured capabilities`,c);let a={};for(let u of gt)this.#e[u.option]!==void 0&&(a[u.option]=new Set);return a}let i={};for(let c of gt){let a=this.#e[c.option];if(a===void 0)continue;let u=s[c.option];if(u===void 0)continue;let p=new Set;if(Array.isArray(u))for(let h of u)typeof h=="string"&&a.has(h)&&p.add(h);i[c.option]=p}return i}};var Li="zuplo.com",$_=new Set(["co.jp","co.kr","co.nz","co.uk","com.au","com.br","com.cn","com.mx","com.sg","co.in"]),L_=[".example.test",".example.com",".example.org",".invalid",".localhost",".test"];function Lp(e){return`https://www.google.com/s2/favicons?domain=${e}&sz=128`}n(Lp,"s2FaviconHref");function H_(e){return`https://t0.gstatic.com/faviconV2?client=SOCIAL&type=FAVICON&drop_404_icon=true&fallback_opts=TYPE,SIZE,URL&url=http://${e}&size=128`}n(H_,"strictFaviconHref");var Hp=Lp(Li);function Hi(e){let t=e.toLowerCase();return t===Li||t==="zuplo.app"||t==="zuplo.dev"||t.endsWith(".zuplo.app")||t.endsWith(".zuplo.dev")?Lp(Li):H_(e)}n(Hi,"resolveIconHref");function B_(e){try{return new URL(`http://${e}`).hostname}catch{return e}}n(B_,"hostnameFromHost");function F_(e){return e==="localhost"||e.includes(":")||/^\d{1,3}(?:\.\d{1,3}){3}$/.test(e)}n(F_,"isLocalOrAddressHost");function G_(e){let t=B_(e).toLowerCase().replace(/\.$/,"");if(F_(t)||L_.some(i=>t===i.slice(1)||t.endsWith(i)))return t;let r=t.split(".").filter(Boolean);if(r.length<=2)return t;let o=r.slice(-2).join("."),s=$_.has(o)?3:2;return r.slice(-s).join(".")}n(G_,"inferFaviconDomain");function Bi(e){return{src:Hi(G_(e)),mimeType:"image/png",sizes:["128x128"]}}n(Bi,"resolveMcpFaviconIcon");function ms(e){try{return Bi(new URL(e).host)}catch{return}}n(ms,"resolveMcpFaviconIconFromUrl");function St(e){let t=Se().connectionsById.get(e);if(!t)throw new K(`Unknown upstream server "${e}". Check the route's MCP upstream policy and ensure policies.json declares a matching upstream connection.`);return{displayName:t.displayName,description:t.description,serverInfo:t.serverInfo,transport:{baseUrl:t.mcpUrl,resourceMetadataUrl:t.protectedResourceMetadataUrl}}}n(St,"getUpstreamServerConfig");function hs(e){let t=Se().connectionsById.get(e.upstreamServerId);if(!t||t.authProfileId!==e.authProfileId)throw new K(`Unknown auth profile "${String(e.authProfileId)}" for upstream server "${e.upstreamServerId}". Check the route's MCP upstream policy and ensure policies.json declares a matching auth mode for that upstream connection.`);return t.authConfig}n(hs,"getUpstreamAuthConfig");function kr(e,t){let r=hs({upstreamServerId:e,authProfileId:t});if(r.mode!=="shared-oauth"&&r.mode!=="user-oauth")throw new K(`Upstream server "${e}" does not use upstream OAuth. Select authMode "shared-oauth" or "user-oauth" before starting an upstream OAuth connection flow.`);return r.oauth}n(kr,"requireUpstreamOAuthConfig");function Bp(e,t){let r=hs({upstreamServerId:e,authProfileId:t});if(r.mode!=="id-jag")throw new K(`Upstream server "${e}" does not use upstream ID-JAG. Select authMode "id-jag" before requesting an upstream XAA token exchange.`);return r.idJag}n(Bp,"requireUpstreamIdJagConfig");function Fp(e,t){if(!t)return;if(t.aborted){e.abort(t.reason);return}let r=n(()=>e.abort(t.reason),"abort");return t.addEventListener("abort",r,{once:!0}),()=>t.removeEventListener("abort",r)}n(Fp,"mergeAbortSignals");async function J_(e){try{await e.cancel()}catch{}}n(J_,"cancelReader");async function fs(e,t){if(!e)return new Uint8Array;let r=e.getReader(),o=[],s=0,i=await r.read();for(;!i.done;){let u=i.value;if(s+=u.byteLength,s>t.maxBytes)throw await J_(r),t.createLimitError();o.push(u),i=await r.read()}let c=new Uint8Array(s),a=0;for(let u of o)c.set(u,a),a+=u.byteLength;return c}n(fs,"readBoundedByteStream");var V_=2,K_=1024*1024,W_=1e4,Z_=new Set([301,302,303,307,308]),Y_=["authorization","proxy-authorization","cookie","cookie2"];function Fi(e){return typeof e=="string"?e:e instanceof URL?e.toString():e.url}n(Fi,"readRequestUrl");function Er(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}n(Er,"readRequestMethod");function X_(e,t,r){let o=e.headers.get("content-length");if(!o)return;let s=Number.parseInt(o,10);if(Number.isFinite(s)&&s>t)throw new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[C]:r}})}n(X_,"assertContentLengthWithinLimit");async function Q_(e,t,r){return X_(e,t,r),fs(e.body,{maxBytes:t,createLimitError:n(()=>new v({message:"Outbound response exceeded the maximum allowed size.",extensionMembers:{[C]:r}}),"createLimitError")})}n(Q_,"readBoundedResponseBody");function ew(e,t){let r=new ArrayBuffer(t.byteLength);return new Uint8Array(r).set(t),new Response(r,{status:e.status,statusText:e.statusText,headers:e.headers})}n(ew,"responseFromBufferedBody");function tw(e,t){if(!Z_.has(e.status))return;let r=e.headers.get("location");if(r)return new URL(r,t).toString()}n(tw,"resolveRedirectUrl");function Gp(e,t){try{return t.validateUrl(e)}catch(r){throw new v({message:"Outbound URL was not allowed.",extensionMembers:{[C]:t.problemCode}},{cause:r})}}n(Gp,"validateOutboundUrl");function rw(e,t){throw e instanceof v&&Fo(e.extensionMembers?.[C])?e:new v({message:"Outbound fetch failed.",extensionMembers:{[C]:t}},{cause:e})}n(rw,"normalizeFetchError");function no(e,t){if(e===void 0)return;let r={event:t.event,code:t.problemCode,method:t.method};if(t.host!==void 0&&(r.host=t.host),t.extra!==void 0)for(let[o,s]of Object.entries(t.extra))s!==void 0&&(r[o]=s);t.error!==void 0&&pe(r,"error",t.error),e.log.warn(r,"Outbound HTTP exchange rejected")}n(no,"logOutboundFailure");async function nw(e,t,r,o,s,i,c){let a=Er(r,o);try{return await t(r,o)}catch(u){let p=u instanceof DOMException&&u.name==="AbortError";no(e,{event:p?"outbound_fetch_aborted":"outbound_fetch_failed",problemCode:s,method:a,host:te(i),error:u,extra:{abortReason:c()}}),rw(u,s)}}n(nw,"fetchWithNormalizedError");function ow(e){if(e.redirects>=e.maxRedirects)throw new v({message:"Outbound redirects exceeded the maximum allowed depth.",extensionMembers:{[C]:e.problemCode}});if(e.method!=="GET"&&e.method!=="HEAD")throw new v({message:"Outbound redirect after a non-idempotent request was blocked.",extensionMembers:{[C]:e.problemCode}})}n(ow,"assertRedirectAllowed");function sw(e,t){let r=new Headers(e);for(let o of Y_)r.delete(o);for(let o of t)r.delete(o);return r}n(sw,"stripCrossOriginHeaders");function iw(e,t,r,o,s){let i={...e,method:t,redirect:"manual",signal:r};return o&&(i.headers=sw(e.headers,s)),i}n(iw,"buildRedirectInit");function aw(e,t,r){let o={...t,redirect:"manual",signal:r};return o.headers===void 0&&e instanceof Request&&(o.headers=e.headers),o}n(aw,"buildInitialRequestInit");function cw(e){let t=Er(e.currentInput,e.currentInit);ow({redirects:e.redirects,maxRedirects:e.maxRedirects,method:t,problemCode:e.problemCode});let r=Gp(e.redirectUrl,{problemCode:e.problemCode,validateUrl:e.validateUrl}),o=new URL(e.currentUrl),s=r.origin!==o.origin,i=r.toString();return{currentInput:i,currentUrl:i,currentInit:iw(e.currentInit,t,e.signal,s,e.additionalCrossOriginStrippedHeaders),redirects:e.redirects+1}}n(cw,"followRedirect");async function Gi(e,t,r){let o=r.problemCode??"invalid_request",s=r.maxRedirects??V_,i=r.maxResponseBytes??K_,c=r.timeoutMs??W_,a=r.fetchImpl??fetch,u=r.additionalCrossOriginStrippedHeaders??[],p=r.context,h=new AbortController,f=Fp(h,t.signal),y=!1,S=setTimeout(()=>{y=!0,h.abort()},c),k=e,w=aw(e,t,h.signal),I;try{I=Gp(Fi(e),{problemCode:o,validateUrl:r.validateUrl}).toString()}catch(O){throw no(p,{event:"outbound_url_blocked",problemCode:o,method:Er(e,t),host:te(Fi(e)),error:O}),clearTimeout(S),f?.(),O}let U=0;try{for(;;){let O=await nw(p,a,k,w,o,I,()=>y?`timeout_after_${c}ms`:void 0),H=tw(O,I);if(H!==void 0)try{let F=cw({currentInput:k,currentInit:w,currentUrl:I,redirectUrl:H,redirects:U,maxRedirects:s,problemCode:o,validateUrl:r.validateUrl,signal:h.signal,additionalCrossOriginStrippedHeaders:u});k=F.currentInput,w=F.currentInit,I=F.currentUrl,U=F.redirects;continue}catch(F){throw no(p,{event:"outbound_redirect_blocked",problemCode:o,method:Er(k,w),host:te(I),error:F,extra:{redirects:U,maxRedirects:s,redirectTargetHost:te(H)}}),F}try{return ew(O,await Q_(O,i,o))}catch(F){throw no(p,{event:"outbound_response_size_exceeded",problemCode:o,method:Er(k,w),host:te(I),error:F,extra:{maxResponseBytes:i,status:O.status}}),F}}}finally{clearTimeout(S),f?.()}}n(Gi,"runSafeOutboundExchange");async function oo(e,t,r){let o=await Gi(e,t,r);try{return{response:o,json:await o.clone().json()}}catch(s){throw no(r.context,{event:"outbound_json_parse_failed",problemCode:r.problemCode??"invalid_request",method:Er(e,t),host:te(Fi(e)),error:s,extra:{status:o.status,contentType:o.headers.get("content-type")??void 0}}),new v({message:"Outbound JSON response could not be parsed.",extensionMembers:{[C]:r.problemCode??"invalid_request"}},{cause:s})}}n(oo,"runSafeOutboundJsonExchange");function Jp(e,t={},r={}){return Gi(e,t,{...r,validateUrl:Jn})}n(Jp,"fetchConfiguredOutbound");function Vp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Jn})}n(Vp,"fetchConfiguredOutboundJson");function gs(e,t={},r={}){return oo(e,t,{...r,validateUrl:gl})}n(gs,"fetchIdentityProviderJson");function Kp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Yo})}n(Kp,"fetchCimdClientMetadataJson");function Wp(e,t={},r={}){return oo(e,t,{...r,validateUrl:Vn})}n(Wp,"fetchCimdClientJwksJson");import{errors as tm,jwtVerify as rm,SignJWT as nm}from"jose";var we="zuplo-mcp-gateway",Ce=we,Te="HS256";import{base64url as dw}from"jose";var uw=new TextEncoder,lw="MCP gateway could not initialize secure key material.",pw=32,Zp=new Map,Yp=new Map,mw;function hw(){return mw??La.instance.authPrivateKey}n(hw,"readAuthPrivateKey");function Xp(e){return new ye(lw,e===void 0?void 0:{cause:e})}n(Xp,"createGeneratedKeyMaterialError");function Qp(e,t){let r=dw.decode(t);if(r.byteLength!==pw)throw new Error(`Generated deployment auth key ${e} is invalid.`);return r}n(Qp,"decodeJwkKeyField");function fw(e){let t=hw();if(!t)throw Xp();try{let r=JSON.parse(t);if(r.kty!=="OKP"||r.crv!=="Ed25519"||typeof r.d!="string"||typeof r.x!="string")throw new Error("Generated deployment auth key is not an Ed25519 JWK.");let o=Qp("d",r.d);Qp("x",r.x);let s=uw.encode(`zuplo-mcp-gateway:${e}:Ed25519:`),i=new Uint8Array(s.byteLength+o.byteLength);return i.set(s),i.set(o,s.byteLength),i}catch(r){throw Xp(r)}}n(fw,"decodeGeneratedKeyMaterial");function gw(e){let t=Zp.get(e);return t||(t=fw(e),Zp.set(e,t)),t}n(gw,"getMasterKeyMaterial");async function Be(e){let t=Yp.get(e.purpose);if(t!==void 0)return t;let r=await e.derive(gw(e.keyMaterialPurpose));return Yp.set(e.purpose,r),r}n(Be,"readCachedDerivedKey");var yw="SHA-256",Sw=32,_w="zuplo-mcp-gateway:",ww=new TextEncoder,em=new WeakMap;async function _t(e,t){let r=em.get(e);r||(r=new Map,em.set(e,r));let o=r.get(t);if(o)return o;let s=await Rw(e,t);return r.set(t,s),s}n(_t,"deriveGatewaySigningKey");async function Rw(e,t){let r=me(e),o=await crypto.subtle.importKey("raw",r,{name:"HKDF"},!1,["deriveBits"]),s=ww.encode(`${_w}${t}`),i=await crypto.subtle.deriveBits({name:"HKDF",hash:yw,salt:new Uint8Array,info:me(s)},o,Sw*8);return new Uint8Array(i)}n(Rw,"hkdfExpand");var om=900,bw=900,vw=Xu.extend({id:Rl}),Iw=vw.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),sm=Qs.extend({id:bl,purpose:l.literal("browser_connect")}),Cw=Qs.extend({purpose:l.literal("browser_connect")}),Tw=sm.extend({exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),im=om*1e3;async function am(){return Be({purpose:"oauth-state",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"oauth-state"),"derive")})}n(am,"getOAuthStateKey");async function cm(){return Be({purpose:"browser-connect",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"browser-connect"),"derive")})}n(cm,"getBrowserConnectKey");async function dm(e){let t=Math.floor(Date.now()/1e3)+om;return new nm(e).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(t).sign(await am())}n(dm,"signOAuthState");async function ys(e){try{let{payload:t}=await rm(e,await am(),{algorithms:[Te],issuer:we,audience:Ce});return Iw.parse(t)}catch(t){throw t instanceof tm.JWTExpired?new v({message:"OAuth state has expired",extensionMembers:{[C]:"oauth_state_expired"}},{cause:t}):new v({message:"OAuth state could not be verified",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:t})}}n(ys,"verifyOAuthState");async function um(e){let t=Math.floor(Date.now()/1e3)+bw,r=Cw.parse(e),o=sm.parse({...r,id:Tl()});return new nm(o).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(t).sign(await cm())}n(um,"signBrowserConnectTicket");async function lm(e){try{let{payload:t}=await rm(e,await cm(),{algorithms:[Te],issuer:we,audience:Ce});return Tw.parse(t)}catch(t){throw t instanceof tm.JWTExpired?new v({message:"Browser connect ticket has expired",extensionMembers:{[C]:"oauth_state_expired"}},{cause:t}):new v({message:"Browser connect ticket could not be verified",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:t})}}n(lm,"verifyBrowserConnectTicket");async function pm(e){if((await N().consumeBrowserConnectTicket({id:e.id,expiresAt:D(new Date(e.exp*1e3)),now:D(new Date)})).kind==="consumed")throw new v({message:"Browser connect ticket has already been used",extensionMembers:{[C]:"oauth_state_reused"}})}n(pm,"consumeBrowserConnectTicket");function kw(e,t,r=!1){return r?`${e} authorization must be renewed before this ${t} can be used.`:`${e} authorization is required before this ${t} can be used.`}n(kw,"buildConnectRequiredMessage");async function Ew(e){let t=Y(e.requestUrl,e.requestHeaders),r=new URL(e.path,t);return e.redirect&&r.searchParams.set("redirect","true"),r.searchParams.set("operationId",e.operationId),r.searchParams.set("browserTicket",await um({...Fn(e),purpose:"browser_connect"})),r.toString()}n(Ew,"buildGatewayBrowserTicketUrl");function Pw(e){return de().actionPath(`/auth/connections/${encodeURIComponent(e)}/connect`)}n(Pw,"buildGatewayConnectPath");async function Ji(e){return Ew({...e,path:Pw(e.upstreamServerId),redirect:!0})}n(Ji,"buildGatewayConnectUrl");async function Ss(e){let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return{state:e.requiresReconsent?"reconsent_required":"authenticating",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},authUrl:await Ji(t),message:kw(e.upstreamDisplayName,e.subject,e.requiresReconsent),nextAction:"redirect"}}n(Ss,"buildRedirectConnectRequiredResponse");function mm(e){return Aw({...e,message:e.requiresReconsent?`An administrator must reconnect ${e.upstreamDisplayName} before this tool can be used.`:`An administrator must connect ${e.upstreamDisplayName} before this tool can be used.`})}n(mm,"buildAdminConnectRequiredResponse");function Aw(e){return{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,...e.connectionId?{connectionId:e.connectionId}:{},message:e.message,nextAction:"admin_setup_required"}}n(Aw,"buildAdminSetupRequiredResponse");var hm=12;async function fm(e){let t=await crypto.subtle.digest("SHA-256",me(new TextEncoder().encode(e)));return Array.from(new Uint8Array(t)).map(r=>r.toString(16).padStart(2,"0")).join("")}n(fm,"sha256Hex");async function Bt(e){if(e)return(await fm(e)).slice(0,hm)}n(Bt,"fingerprintSecret");async function Pr(e){let t=JSON.stringify([e.owner.mode,e.owner.mode==="user"?e.owner.subjectId:"",e.upstreamServerId,e.authProfileId]);return(await fm(t)).slice(0,hm)}n(Pr,"fingerprintConnectionIdentity");var xw=6e4;function Ar(e,t){return e===void 0?!0:e.status!==t.status||e.encryptedAccessToken!==t.encryptedAccessToken||e.encryptedRefreshToken!==t.encryptedRefreshToken||e.expiresAt!==t.expiresAt||e.scopes.length!==t.scopes.length||e.scopes.some((r,o)=>t.scopes[o]!==r)}n(Ar,"credentialGenerationChanged");function he(e){if(!e)return"no_connection";if(e.status!=="active")return"inactive";if(!e.encryptedAccessToken)return"no_access_token";if(e.expiresAt){let t=new Date(e.expiresAt).getTime();if(t<=Date.now())return"expired";if(t<=Date.now()+xw)return"near_expiry"}return"usable"}n(he,"describeAccessTokenState");var gm=new Set(["client_id","code_challenge","code_challenge_method","display","login_hint","nonce","prompt","redirect_uri","response_mode","response_type","state"]);function Uw(e,t){return e&&e.length>0?e.join(t):void 0}n(Uw,"joinOAuthScopes");function Ow(e){if(e?.authorization_endpoint===void 0)return e;let t=new URL(e.authorization_endpoint);for(let r of gm)t.searchParams.delete(r);return{...e,authorization_endpoint:t.toString()}}n(Ow,"sanitizeAuthorizationServerMetadata");function ym(e){let t=Ow(e.authorizationServerMetadata);return t===e.authorizationServerMetadata?e:{...e,authorizationServerMetadata:t}}n(ym,"sanitizeOAuthDiscoveryState");function Sm(e){let t=new URL(e);for(let r of gm){let o=t.searchParams.getAll(r);o.length<=1||(t.searchParams.delete(r),t.searchParams.set(r,o.at(-1)??""))}return t}n(Sm,"dedupeSingletonAuthorizationRequestParams");function _s(e){let t=new URL(e);return ve(t)&&$u(t.hostname)!=="localhost"&&(t.hostname="localhost"),t}n(_s,"normalizeLoopbackOAuthRedirectUri");function _m(e){return Uw(e.state?.resourceMetadata?.scopes_supported,e.delimiter)}n(_m,"readProtectedResourceMetadataScope");function Mw(e){return`Zuplo MCP Gateway - ${e}`}n(Mw,"buildGatewayOAuthClientName");function zw(e,t){return e&&e.length>0?e.join(t):void 0}n(zw,"joinOAuthScopeList");function qw(e){if(e.clientRegistration.mode!=="auto")return zw(e.scopes,e.scopeDelimiter)}n(qw,"readPublicClientMetadataScope");function Vi(e){return new URL(de().actionPath(`/.well-known/oauth-client/${encodeURIComponent(e.upstreamServerId)}`),e.origin).toString()}n(Vi,"buildOAuthClientMetadataDocumentUrl");function Ki(e){let t=St(e.upstreamServerId);return{client_name:Mw(t.displayName),client_uri:new URL("/",e.origin).toString(),redirect_uris:[e.redirectUri],grant_types:["authorization_code","refresh_token"],response_types:["code"],application_type:"web",...e.scope===void 0?{}:{scope:e.scope},token_endpoint_auth_method:"none"}}n(Ki,"buildGatewayOAuthClientMetadata");function wm(e,t,r){let o=kr(t,r),s=qw(o);return{client_id:Vi({origin:e,upstreamServerId:t}),...Ki({origin:e,upstreamServerId:t,redirectUri:_s(new URL(o.redirectPath,e)).toString(),scope:s})}}n(wm,"buildOAuthClientMetadataDocument");import{base64url as wt}from"jose";var Nw="SHA-256",xr="AES-GCM",jw=12,Zi="zuplo-secret",Yi=1,Rm="generated:auth_private_key:token-encryption",Dw=l.object({version:l.literal(Yi),keyId:l.literal(Rm),algorithm:l.literal(xr),iv:l.string().min(1),ciphertext:l.string().min(1)}).strict();async function Wi(){return Be({purpose:"token-encryption",keyMaterialPurpose:"token-encryption",derive:n(async e=>{let t=await crypto.subtle.digest(Nw,me(e));return crypto.subtle.importKey("raw",t,{name:xr},!1,["encrypt","decrypt"])},"derive")})}n(Wi,"getEncryptionKey");function bm(e){return me(new TextEncoder().encode(`${Zi}:v${e.version}:${e.keyId}`))}n(bm,"getAssociatedData");function $w(e){return`${Zi}:v${e.version}:${wt.encode(new TextEncoder().encode(JSON.stringify(e)))}`}n($w,"encodeEnvelope");function Lw(e){let t=`${Zi}:v${Yi}:`;if(!e.startsWith(t))return;let r=e.slice(t.length),o=new TextDecoder().decode(wt.decode(r));return Dw.parse(JSON.parse(o))}n(Lw,"decodeEnvelope");async function et(e){let t=await Wi(),r=crypto.getRandomValues(new Uint8Array(jw)),o={version:Yi,keyId:Rm},s=await crypto.subtle.encrypt({name:xr,iv:r,additionalData:bm(o)},t,new TextEncoder().encode(e));return $w({...o,algorithm:xr,iv:wt.encode(r),ciphertext:wt.encode(new Uint8Array(s))})}n(et,"encryptSecret");async function tt(e){let t=Lw(e);if(t){let c=await Wi(),a=await crypto.subtle.decrypt({name:xr,iv:me(wt.decode(t.iv)),additionalData:bm(t)},c,me(wt.decode(t.ciphertext)));return new TextDecoder().decode(a)}let[r,o]=e.split(".");if(!r||!o)throw new ye("Encrypted payload is malformed");let s=await Wi(),i=await crypto.subtle.decrypt({name:xr,iv:me(wt.decode(r))},s,me(wt.decode(o)));return new TextDecoder().decode(i)}n(tt,"decryptSecret");var vm={issuer:l.string().min(1).optional()},Hw=l.union([$t.extend(vm),Hn.extend(vm)]),Im=l.object({authorizationServerUrl:l.url(),resourceMetadataUrl:l.url().optional(),resourceMetadata:hr.optional(),authorizationServerMetadata:l.union([fr,gr]).optional()}).passthrough(),Bw="Bearer",Fw="__zuplo_refresh_only_upstream_access_token__";function Xi(e){return e?e.split(/[,\s]+/).filter(Boolean):[]}n(Xi,"splitScopes");function Qi(e,t){let r=new Set(e);return t.every(o=>r.has(o))}n(Qi,"scopesCover");function Gw(e){return Sr.parse(e)}n(Gw,"parsePkceCodeVerifier");function Jw(e){if(typeof e.expires_in=="number")return D(new Date(Date.now()+e.expires_in*1e3))}n(Jw,"readTokenExpiry");async function Cm(e){if(e!==void 0)return et(JSON.stringify(e))}n(Cm,"encryptJson");async function Tm(e,t){if(!e)return;let r=await tt(e);try{return t.parse(JSON.parse(r))}catch(o){throw new v({message:"Stored upstream OAuth JSON state is invalid.",extensionMembers:{[C]:"oauth_state_invalid"}},{cause:o})}}n(Tm,"decryptJson");function Vw(e,t){return"redirect_uris"in e?e.redirect_uris.includes(t):!0}n(Vw,"clientInformationAllowsRedirectUri");function Kw(e){return e.clientMetadataUrl===void 0?"redirect_uris"in e.clientInformation:"redirect_uris"in e.clientInformation||e.clientInformation.client_id===e.clientMetadataUrl}n(Kw,"clientInformationMatchesCurrentClientMetadataUrl");function Ww(e){return e.clientMetadataUrl!==void 0&&!("redirect_uris"in e.clientInformation)&&e.clientInformation.client_id===e.clientMetadataUrl}n(Ww,"isUrlBasedClientInformation");function Zw(e,t){return t===void 0?e:{...e,scope:t}}n(Zw,"applyOAuthClientMetadataScope");function Yw(e,t){return _m({state:e,delimiter:t})}n(Yw,"readResourceMetadataScope");function Xw(e,t){return e&&e.length>0?e.join(t):void 0}n(Xw,"joinOAuthScopeList");function Qw(e){let t;if(e.registration.tokenEndpointAuthMethod!=="none"&&(t=e.registration.clientSecret,!t))throw new K(`Manual OAuth registration for upstream "${e.upstreamServerId}" requires clientSecret. Set the env var that backs the client secret or use tokenEndpointAuthMethod "none".`);return $t.parse({...e.clientMetadata,client_id:e.registration.clientId,token_endpoint_auth_method:e.registration.tokenEndpointAuthMethod,...t===void 0?{}:{client_secret:t}})}n(Qw,"buildManualOAuthClientInformation");function eR(e,t){let r=Vi({origin:new URL(t).origin,upstreamServerId:e});return Ni(r)?r:void 0}n(eR,"buildClientMetadataUrl");function tR(e){for(let t of e)if(t!==void 0)return t}n(tR,"firstDefined");function rR(e){let t=kr(e.target.upstreamServerId,e.target.authProfileId),r=Xw(t.scopes,t.scopeDelimiter),o=Ki({origin:new URL(e.redirectUri).origin,upstreamServerId:e.target.upstreamServerId,redirectUri:e.redirectUri,scope:r});if(t.clientRegistration.mode==="manual")return{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation,configuredClientInformation:Qw({clientMetadata:o,registration:t.clientRegistration,upstreamServerId:e.target.upstreamServerId})};let s=eR(e.target.upstreamServerId,e.redirectUri);return s===void 0?{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation}:{clientMetadata:o,configuredScope:r,scopeDelimiter:t.scopeDelimiter,promptOverride:t.prompt,skipIssuerMetadataValidation:t.skipIssuerMetadataValidation,skipResourceIndicatorValidation:t.skipResourceIndicatorValidation,clientMetadataUrl:s}}n(rR,"buildInitialOAuthClientSetup");function nR(e,t){if(t===void 0)return tR([e.pendingState?.encryptedClientInformation,e.connectionMetadata?.encryptedClientInformation,e.connection?.metadata?.encryptedClientInformation])}n(nR,"readEncryptedClientInformation");function oR(e){return e.pendingState?.encryptedDiscoveryState}n(oR,"readEncryptedDiscoveryState");function ea(e,t){return t===void 0?e:{...e,issuer:t}}n(ea,"applyIssuerStamp");var Rt=class{static{n(this,"UpstreamOAuthProvider")}clientMetadataUrl;target;redirectUriValue;returnOrigin;clientMetadataValue;configuredScope;scopeDelimiter;promptOverride;skipIssuerMetadataValidationValue;skipResourceIndicatorValidationValue;configuredClientInformation;challengeScope;inferredScope;authorizationUrlValue;credentialState;pendingState;encryptedClientInformation;encryptedDiscoveryState;cachedClientInformation;clientInformationLoaded=!1;cachedDiscoveryState;discoveryStateLoaded=!1;tokensLoaded=!1;tokenPersistenceOutcome;connectionFingerprintValue;usedRefreshTokenFingerprintValue;constructor(t){let r=rR({target:t.target,redirectUri:t.redirectUri});this.target=t.target,this.redirectUriValue=t.redirectUri,this.returnOrigin=t.returnOrigin,this.clientMetadataValue=r.clientMetadata,this.configuredScope=r.configuredScope,this.scopeDelimiter=r.scopeDelimiter,this.promptOverride=r.promptOverride,this.skipIssuerMetadataValidationValue=r.skipIssuerMetadataValidation,this.skipResourceIndicatorValidationValue=r.skipResourceIndicatorValidation,this.configuredClientInformation=r.configuredClientInformation,r.clientMetadataUrl!==void 0&&(this.clientMetadataUrl=r.clientMetadataUrl),this.credentialState={sourceConnection:t.connection,currentConnection:t.connection},this.pendingState=t.pendingState?{...t.pendingState}:void 0,this.encryptedClientInformation=nR(t,this.configuredClientInformation),this.encryptedDiscoveryState=oR(t)}get authorizationUrl(){return this.authorizationUrlValue}get configuredAuthorizationScope(){return this.configuredScope}get skipIssuerMetadataValidation(){return this.skipIssuerMetadataValidationValue}get usedRefreshTokenFingerprint(){return this.usedRefreshTokenFingerprintValue}get currentConnection(){return this.credentialState.currentConnection}get tokenWriteWasPersisted(){return this.tokenPersistenceOutcome==="persisted"}connectionSatisfiesRequestedScope(t,r){let o=Xi(this.configuredScope??r??this.readEffectiveScope());return Qi(t.scopes,o)}readUsablePeerAdoption(t){let r=this.credentialState.peerAdoption?.connection;return r!==void 0&&he(r)==="usable"&&this.connectionSatisfiesRequestedScope(r,t)?r:void 0}async adoptConnectionForDirectResolution(t,r){this.adoptPeerConnection(t,r),this.tokensLoaded=!1,this.credentialState.sdkTokenMemo=void 0;let o=W();o&&o.info({event:"upstream_oauth_peer_credential_adopted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,adoptionReason:r,sourceUpdatedAt:this.credentialState.sourceConnection?.updatedAt,resultingUpdatedAt:t.updatedAt,sourceScopeCount:this.credentialState.sourceConnection?.scopes.length,resultingScopeCount:t.scopes.length,accessTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedAccessToken),refreshTokenGenerationFingerprint:await this.storedSecretFingerprint(t.encryptedRefreshToken)},"Adopted a concurrent upstream OAuth credential")}adoptPeerConnection(t,r){this.credentialState.currentConnection=t,this.credentialState.peerAdoption={connection:t,reason:r}}async connectionFingerprint(){return this.connectionFingerprintValue===void 0&&(this.connectionFingerprintValue=await Pr({owner:this.target.owner,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId})),this.connectionFingerprintValue}async storedSecretFingerprint(t){if(t!==void 0)try{return await Bt(await tt(t))}catch{return}}async conditionalUpsertCredential(t,r){try{return await N().conditionalUpsertUpstreamConnection(t,r)}catch(o){let s=W();if(s){let i=Object.assign(new Error("Upstream OAuth conditional storage write failed",{cause:o}),{event:"upstream_oauth_conditional_write_failed",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),sourceUpdatedAt:"expectedUpdatedAt"in r?r.expectedUpdatedAt:void 0,expectAbsent:"expectAbsent"in r,scopeCount:t.scopes.length});s.error(i,"Upstream OAuth conditional storage write failed")}throw o}}get redirectUrl(){return this.redirectUriValue}get clientMetadata(){return Zw(this.clientMetadataValue,this.readEffectiveScope())}async state(){let t=await this.createPendingState();return dm({id:t.id,...Fn({owner:this.target.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId})})}async clientInformation(t){return this.configuredClientInformation?ea(this.configuredClientInformation,t?.issuer):this.loadPersistedClientInformation(t)}async saveClientInformation(t){this.configuredClientInformation||(this.cachedClientInformation=t,this.clientInformationLoaded=!0,W()?.info({event:"upstream_oauth_client_registered",upstreamServerId:this.target.upstreamServerId,clientId:"client_id"in t?t.client_id:void 0,redirectUriCount:"redirect_uris"in t?t.redirect_uris.length:void 0},"Upstream OAuth client registered for the gateway"),!Ww({clientInformation:t,clientMetadataUrl:this.clientMetadataUrl})&&(this.encryptedClientInformation=await Cm(t),await this.syncPendingState(!1)))}async validateResourceURL(t,r){if(r!==void 0){if(this.skipResourceIndicatorValidationValue!==!0&&!ss({requestedResource:t,configuredResource:r}))throw new Error(`Protected resource ${r} does not match expected ${t} (or origin)`);return new URL(r)}}async discoveryState(){return this.readCachedDiscoveryState()}applyChallengeScope(t){this.challengeScope=t}async saveDiscoveryState(t){let r=ym(Im.parse(t));this.cachedDiscoveryState=r,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=await Cm(r),await this.syncPendingState(!1),W()?.info({event:"upstream_oauth_discovery_resolved",upstreamServerId:this.target.upstreamServerId,authorizationServerHost:te(r.authorizationServerUrl),resourceMetadataHost:te(r.resourceMetadataUrl),resource:r.resourceMetadata?.resource,scopesSupportedCount:r.resourceMetadata?.scopes_supported?.length,hasResourceMetadata:r.resourceMetadata!==void 0},"Upstream OAuth discovery resolved authorization server and resource"),this.inferredScope=Yw(r,this.scopeDelimiter);let o=r.resourceMetadata?.scopes_supported;if(this.configuredScope!==void 0&&o!==void 0){let s=Xi(this.configuredScope).filter(i=>!o.includes(i));s.length>0&&W()?.debug({event:"upstream_oauth_configured_scopes_not_advertised",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,unadvertisedScopes:s,scopesSupported:o},"Configured upstream OAuth scopes include values the resource metadata does not advertise")}}async tokens(t){let r=await this.loadStoredTokens();if(r!==void 0)return ea(r,t?.issuer)}async saveTokens(t){let r=lt.parse(t),o=this.target.owner.mode==="user"?this.target.owner.subjectId:void 0,s=this.credentialState.sourceConnection,i=!r.refresh_token&&!!s?.encryptedRefreshToken,c=r.refresh_token?await et(r.refresh_token):s?.encryptedRefreshToken;this.credentialState.sdkTokenMemo=r.refresh_token||!s?.encryptedRefreshToken?r:lt.parse({...r,refresh_token:await tt(s.encryptedRefreshToken)}),this.tokensLoaded=!0;let a={id:s?.id??Xo(),ownerMode:this.target.owner.mode,subjectId:o,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,status:"active",encryptedAccessToken:await et(r.access_token),encryptedRefreshToken:c,scopes:Xi(r.scope??this.readEffectiveScope()),expiresAt:Jw(r),metadata:this.readStoredOAuthPersistence(this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0)},u=s?{expectedUpdatedAt:s.updatedAt}:{expectAbsent:!0},p=await this.conditionalUpsertCredential(a,u),h=!1;if(p.kind==="precondition_failed"&&p.connection!==void 0&&(he(p.connection)!=="usable"||!Qi(p.connection.scopes,a.scopes)||!Ar(s,p.connection))){h=!0;let y=p.connection,S={id:y.id,ownerMode:y.ownerMode,subjectId:y.subjectId,upstreamServerId:y.upstreamServerId,authProfileId:y.authProfileId,status:"active",encryptedAccessToken:a.encryptedAccessToken,encryptedRefreshToken:r.refresh_token===void 0?y.encryptedRefreshToken:a.encryptedRefreshToken,scopes:a.scopes,expiresAt:a.expiresAt,metadata:y.metadata};W()?.info({event:"upstream_oauth_bounded_rebase_attempted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:y.id,sourceUpdatedAt:s?.updatedAt,winnerUpdatedAt:y.updatedAt,sourceScopeCount:s?.scopes.length,winnerScopeCount:y.scopes.length,resultingScopeCount:S.scopes.length},"Retrying an upstream OAuth token write against the CAS winner"),p=await this.conditionalUpsertCredential(S,{expectedUpdatedAt:y.updatedAt})}if(p.kind!=="persisted"&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),this.tokenPersistenceOutcome=p.kind,p.kind==="persisted"?(this.credentialState.currentConnection=p.connection,this.credentialState.peerAdoption=void 0):p.kind==="precondition_failed"&&p.connection!==void 0?(this.credentialState.currentConnection=p.connection,Ar(s,p.connection)&&he(p.connection)==="usable"&&Qi(p.connection.scopes,a.scopes)?this.adoptPeerConnection(p.connection,"cas_loss"):this.credentialState.peerAdoption=void 0):(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0),h){let y=p.kind==="persisted"?"succeeded":p.kind==="precondition_failed"?"lost":"exhausted";W()?.info({event:`upstream_oauth_bounded_rebase_${y}`,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:this.credentialState.currentConnection?.id,sourceUpdatedAt:s?.updatedAt,resultingUpdatedAt:this.credentialState.currentConnection?.updatedAt,sourceScopeCount:s?.scopes.length,resultingScopeCount:this.credentialState.currentConnection?.scopes.length},`Upstream OAuth bounded rebase ${y}`)}let f=p.kind==="persisted"?p.connection:void 0;W()?.info({event:"upstream_oauth_tokens_persisted",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,ownerMode:this.target.owner.mode,connectionFingerprint:await this.connectionFingerprint(),connectionId:f?.id??this.credentialState.currentConnection?.id,hasRefreshToken:!!c,sourceScopeCount:s?.scopes.length,priorStatus:s?.status,priorUpdatedAt:s?.updatedAt,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,newRefreshTokenFingerprint:await Bt(r.refresh_token),reusedSnapshotRefreshToken:i,scopeCount:a.scopes.length,expiresAt:a.expiresAt,outcome:p.kind,rebaseAttempted:h,resultingUpdatedAt:f?.updatedAt??this.credentialState.currentConnection?.updatedAt,resultingScopeCount:f?.scopes.length??this.credentialState.currentConnection?.scopes.length},f?"Upstream OAuth tokens persisted; upstream connection is active":"Upstream OAuth token persistence yielded to concurrent storage state")}async redirectToAuthorization(t){let r=Sm(t);this.promptOverride===!1?r.searchParams.delete("prompt"):this.promptOverride!==void 0&&r.searchParams.set("prompt",this.promptOverride),this.authorizationUrlValue=r.toString()}async saveCodeVerifier(t){let r=await this.createPendingState();await this.persistPendingState({...r,codeVerifier:Gw(t)})}async codeVerifier(){if(!this.pendingState?.codeVerifier)throw new v({message:"OAuth code verifier is missing",extensionMembers:{[C]:"oauth_state_invalid"}});return this.pendingState.codeVerifier}async invalidateCredentials(t){let r=t==="all"||t==="client"||t==="tokens",o=t==="all"||t==="client",s=t==="all"||t==="discovery",i=t==="all"||t==="verifier";o&&(this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,this.encryptedClientInformation=void 0),s&&(this.cachedDiscoveryState=void 0,this.discoveryStateLoaded=!0,this.encryptedDiscoveryState=void 0,this.challengeScope=void 0,this.inferredScope=void 0),r&&(this.credentialState.sdkTokenMemo=void 0,this.tokensLoaded=!0),await this.syncPendingState(i),await this.persistCredentialInvalidation(r)}async createPendingState(){if(this.pendingState)return this.pendingState;let t={id:Cl(),...Fn({owner:this.target.owner,initiatedBySubjectId:this.target.initiatedBySubjectId,upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,operationId:this.target.operationId,...this.target.returnTo===void 0?{}:{returnTo:this.target.returnTo}}),callbackPath:new URL(this.redirectUriValue).pathname,expiresAt:D(new Date(Date.now()+im)),redirectUri:this.redirectUriValue,...this.returnOrigin===void 0?{}:{returnOrigin:this.returnOrigin},encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState,connectedBySubjectId:this.target.owner.mode==="shared"?this.target.initiatedBySubjectId:void 0};return await this.persistPendingState(t),t}async persistPendingState(t){await N().saveUpstreamOAuthState({record:t}),this.pendingState=t}async syncPendingState(t){this.pendingState&&await this.persistPendingState({...this.pendingState,codeVerifier:t?void 0:this.pendingState.codeVerifier,encryptedClientInformation:this.encryptedClientInformation,encryptedDiscoveryState:this.encryptedDiscoveryState})}async loadPersistedClientInformation(t){if(this.clientInformationLoaded)return this.cachedClientInformation;let r;try{r=await Tm(this.encryptedClientInformation,Hw)}catch{this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}if(r&&(!Vw(r,this.redirectUriValue)||!Kw({clientInformation:r,clientMetadataUrl:this.clientMetadataUrl}))){this.encryptedClientInformation=void 0,this.cachedClientInformation=void 0,this.clientInformationLoaded=!0,await this.syncPendingState(!1),await this.persistCredentialInvalidation(!1);return}return r===void 0&&this.pendingState?.codeVerifier!==void 0&&this.clientMetadataUrl!==void 0&&(r=ea(Hn.parse({client_id:this.clientMetadataUrl}),t?.issuer)),this.cachedClientInformation=r,this.clientInformationLoaded=!0,this.cachedClientInformation}async readCachedDiscoveryState(){if(this.discoveryStateLoaded)return this.cachedDiscoveryState;this.discoveryStateLoaded=!0;try{this.cachedDiscoveryState=await Tm(this.encryptedDiscoveryState,Im)}catch{this.encryptedDiscoveryState=void 0,this.cachedDiscoveryState=void 0}return this.cachedDiscoveryState}readEffectiveScope(){return this.configuredScope??this.challengeScope??this.inferredScope}async loadStoredTokens(){if(this.tokensLoaded)return this.credentialState.sdkTokenMemo;this.tokensLoaded=!0;let t=this.credentialState.currentConnection;if(!t||t.status!=="active"){W()?.debug({event:"upstream_oauth_tokens_not_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t?.id,status:t?.status??"not_connected"},"Upstream OAuth tokens not loaded; connection is not active");return}let r=t.encryptedAccessToken?await tt(t.encryptedAccessToken):void 0,o=t.encryptedRefreshToken?await tt(t.encryptedRefreshToken):void 0;if(!r&&!o)return;let s=W();this.usedRefreshTokenFingerprintValue=s?await Bt(o):void 0,s?.debug({event:"upstream_oauth_tokens_loaded",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:t.id,hasAccessToken:!!r,hasRefreshToken:!!o,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,expiresAt:t.expiresAt},"Upstream OAuth tokens loaded from stored connection");let i=lt.parse({access_token:r??Fw,token_type:Bw,refresh_token:o,scope:t.scopes.length>0?t.scopes.join(" "):void 0});return this.credentialState.sdkTokenMemo=i,i}async persistCredentialInvalidation(t){let r=this.credentialState.sourceConnection;if(!r)return;let o=r.status,s=r.updatedAt,i={id:r.id,ownerMode:r.ownerMode,subjectId:r.subjectId,upstreamServerId:r.upstreamServerId,authProfileId:r.authProfileId,status:r.status,encryptedAccessToken:r.encryptedAccessToken,encryptedRefreshToken:r.encryptedRefreshToken,scopes:[...r.scopes],expiresAt:r.expiresAt,metadata:r.metadata?{...r.metadata}:void 0};t&&(i.status="reconsent_required",i.encryptedAccessToken=void 0,i.encryptedRefreshToken=void 0,i.scopes=[],i.expiresAt=void 0),i.metadata=this.readStoredOAuthPersistence(r.metadata?.connectedBySubjectId);let c=await this.conditionalUpsertCredential(i,{expectedUpdatedAt:r.updatedAt});c.kind==="persisted"?(this.credentialState.currentConnection=c.connection,this.credentialState.peerAdoption=void 0):c.kind==="missing"?(this.credentialState.currentConnection=void 0,this.credentialState.peerAdoption=void 0):c.connection!==void 0&&(this.credentialState.currentConnection=c.connection,Ar(r,c.connection)&&he(c.connection)==="usable"&&this.connectionSatisfiesRequestedScope(c.connection)?this.adoptPeerConnection(c.connection,"cas_loss"):this.credentialState.peerAdoption=void 0);let a=W();if(a){let u=c.kind==="missing"?void 0:c.connection,p={event:"upstream_oauth_credentials_invalidated",upstreamServerId:this.target.upstreamServerId,authProfileId:this.target.authProfileId,connectionFingerprint:await this.connectionFingerprint(),connectionId:u?.id,clearedTokens:t,priorStatus:o,newStatus:u?.status,priorUpdatedAt:s,usedRefreshTokenFingerprint:this.usedRefreshTokenFingerprintValue,outcome:c.kind};c.kind==="precondition_failed"?a.warn({...p,event:"upstream_oauth_invalidation_precondition_lost"},"Upstream OAuth credential invalidation yielded to concurrent storage state"):t?a.warn(p,"Upstream OAuth credentials invalidated; connection now requires reconsent"):a.debug(p,"Upstream OAuth credential metadata rewritten")}}readStoredOAuthPersistence(t){if(!(!this.encryptedClientInformation&&!t))return{encryptedClientInformation:this.encryptedClientInformation,connectedBySubjectId:t}}};var sR=3e4,iR=256*1024,aR=2,cR="does not support dynamic client registration",dR=["Resource server does not implement OAuth 2.0 Protected Resource Metadata","trying to load well-known OAuth protected resource metadata"],uR=["trying to load OAuth metadata from","trying to load OpenID provider metadata from"],lR=["Incompatible auth server: does not support response type","Incompatible auth server: does not support code challenge method"],pR="Protected resource ",mR=" does not match expected ",hR=["HTTP 403 Forbidden","Access Denied","permission to access"],fR=new Set([ue.AccessDenied,ue.InvalidClient,ue.InvalidGrant,ue.InvalidRequest,ue.InvalidScope,ue.InvalidTarget,ue.UnauthorizedClient,ue.UnsupportedGrantType]);function gR(e){return e instanceof Error&&e.message.includes(cR)}n(gR,"isDynamicClientRegistrationUnsupported");function yR(e){return e instanceof Error&&dR.some(t=>e.message.includes(t))}n(yR,"isProtectedResourceMetadataUnavailable");function SR(e){return e instanceof Error&&uR.some(t=>e.message.includes(t))}n(SR,"isAuthorizationServerMetadataUnavailable");function _R(e){return e instanceof Error&&lR.some(t=>e.message.includes(t))}n(_R,"isAuthorizationServerIncompatible");function wR(e){return e instanceof Error&&e.message.includes(pR)&&e.message.includes(mR)}n(wR,"isProtectedResourceMismatch");function RR(e){return e instanceof Error&&hR.some(t=>e.message.includes(t))}n(RR,"isUpstreamProviderAccessDenied");function bR(e){return e instanceof ft&&fR.has(e.code)}n(bR,"isStoredConnectionReconsentError");function rt(e){let t=e.diagnostics??{};return new v({message:e.message,extensionMembers:{[C]:e.code,[Bo]:e.upstreamServerId,[Rr]:e.resourceMetadataUrl,...t.upstreamUrl===void 0?{}:{[We]:t.upstreamUrl},...t.httpStatus===void 0?{}:{[Ke]:t.httpStatus},...t.providerError===void 0?{}:{[br]:t.providerError},...t.providerErrorDescription===void 0?{}:{[vr]:t.providerErrorDescription}}},{cause:e.cause})}n(rt,"buildUpstreamSetupProblem");function vR(e,t){return`The authorization server for ${e} failed RFC 8414 \xA73.3 issuer validation: the gateway discovered it at "${t.expected}", but its metadata document declares issuer "${t.received}". Providers that publish a path-scoped authorization server whose metadata reports the root origin hit this; if that is the case here, set skipIssuerMetadataValidation on this upstream's OAuth config to accept it \u2014 that weakens the authorization-server mix-up defense, so scope it to this upstream. Otherwise correct the authorization server URL this upstream points at, or ask the provider to fix the published issuer.`}n(vR,"describeIssuerMetadataMismatch");var IR=128,CR=256;function km(e,t){if(e!==void 0)return e.length<=t?e:`${e.slice(0,t)}\u2026`}n(km,"truncateProviderDetail");function TR(e){let{error:t,errorDescription:r}=Pm(e.body),o=km(t,IR),s=km(r,CR);return{httpStatus:e.status,...o===void 0?{}:{providerError:o},...s===void 0?{}:{providerErrorDescription:s}}}n(TR,"readRegistrationRejectionDiagnostics");function kR(e){return e.providerError===void 0?`HTTP ${e.httpStatus}`:e.providerErrorDescription===void 0?`HTTP ${e.httpStatus}, ${e.providerError}`:`HTTP ${e.httpStatus}, ${e.providerError}: ${e.providerErrorDescription}`}n(kR,"describeRegistrationRejection");function ER(e){return/(https?:\/\/\S+)/.exec(e)?.[1]}n(ER,"readDiscoveryEndpointUrl");function PR(e){if(e.error instanceof v&&e.error.extensionMembers?.[C]!==void 0)return e.error;let t={upstreamServerId:e.upstreamServerId,resourceMetadataUrl:e.resourceMetadataUrl,cause:e.error};if(gR(e.error))return rt({...t,code:"upstream_client_registration_required",message:`The authorization server for ${e.upstreamServerId} does not advertise Client ID Metadata Document support and does not support Dynamic Client Registration. Register an OAuth client for the gateway manually before retrying.`});if(e.error instanceof zi){let r=TR(e.error);return rt({...t,code:"upstream_client_registration_required",message:`The authorization server for ${e.upstreamServerId} rejected the gateway's Dynamic Client Registration request (${kR(r)}). Register an OAuth client for the gateway manually and configure it on this upstream, or correct the registration metadata the provider objected to, before retrying.`,diagnostics:r})}if(e.error instanceof eo&&e.error.kind==="metadata")return rt({...t,code:"upstream_oauth_issuer_mismatch",message:vR(e.upstreamServerId,e.error),diagnostics:{upstreamUrl:e.error.expected}});if(e.error instanceof ds)return rt({...t,code:"upstream_oauth_server_incompatible",message:`The authorization server for ${e.upstreamServerId} publishes the non-HTTPS token endpoint "${e.error.tokenEndpoint}". The gateway will not send credentials to it. Ask the provider to serve the token endpoint over TLS before retrying.`,diagnostics:{upstreamUrl:e.error.tokenEndpoint}});if(_R(e.error))return rt({...t,code:"upstream_oauth_server_incompatible",message:`The authorization server for ${e.upstreamServerId} cannot run the OAuth flow the gateway requires: ${e.error.message}. Ask the provider to support the authorization code flow with PKCE (S256), or configure this upstream to use an authorization server that does.`});if(SR(e.error)){let r=ER(e.error.message);return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The gateway could not load OAuth authorization server metadata for the upstream MCP server "${e.upstreamServerId}": ${e.error.message}. Confirm the authorization server advertised by "${e.resourceMetadataUrl}" publishes RFC 8414 or OpenID Connect discovery metadata and is reachable from the gateway, then retry.`,diagnostics:r===void 0?{}:{upstreamUrl:r}})}if(wR(e.error))return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The protected resource metadata at "${e.resourceMetadataUrl}" names a resource that does not match the configured MCP URL for ${e.upstreamServerId}: ${e.error.message}. Point this upstream's MCP URL at the resource the provider publishes, or ask the provider to correct the advertised resource.`});if(yR(e.error))return rt({...t,code:"upstream_oauth_discovery_unavailable",message:`The upstream MCP server "${e.upstreamServerId}" does not publish OAuth protected resource metadata at "${e.resourceMetadataUrl}". Configure protectedResourceMetadataUrl to a working metadata document, use a provider-supported legacy client, or contact the provider to approve/allowlist this gateway OAuth client before retrying.`});if(RR(e.error))return rt({...t,code:"upstream_provider_access_denied",message:`The upstream provider denied access while connecting ${e.upstreamServerId}. Confirm the provider allows this gateway and its OAuth client, then retry.`})}n(PR,"mapUpstreamOAuthSetupError");function AR(e){return typeof e=="string"||e instanceof URL?{url:new URL(e.toString())}:{method:e.method,url:new URL(e.url)}}n(AR,"readOAuthFetchRequest");function xR(e,t){return t?.method!==void 0?t.method.toUpperCase():e instanceof Request?e.method.toUpperCase():"GET"}n(xR,"readOAuthFetchMethod");function UR(e,t){return(e.headers.get("content-type")??"").includes("json")||t.trimStart().startsWith("{")||t.trimStart().startsWith("[")}n(UR,"responseLooksJson");function OR(e,t){let r=e.headers.get("content-type")??"",o=t.trimStart().toLowerCase();return r.includes("html")||o.startsWith("<!doctype html")||o.startsWith("<html")}n(OR,"responseLooksHtml");var MR=["/.well-known/oauth-protected-resource","/.well-known/oauth-authorization-server","/.well-known/openid-configuration"];function zR(e){return MR.some(t=>e.pathname.endsWith(t)||e.pathname.startsWith(`${t}/`))}n(zR,"isMetadataDiscoveryRequest");function qR(e,t,r){return e!=="GET"||!zR(t)?!1:r>=400&&r<500||r===502}n(qR,"sdkRetriesDiscoveryCandidate");function NR(e){let t=e.response.statusText?` ${e.response.statusText}`:"",r=e.response.headers.get("content-type")??"text/html";throw new v({message:`The upstream provider returned ${e.response.status}${t} (${r}) from ${e.request.url.toString()} while connecting ${e.upstreamServerId}.`,extensionMembers:{[C]:e.response.status===403?"upstream_provider_access_denied":"upstream_token_exchange_failed",[Ke]:e.response.status,[_r]:r,[We]:e.request.url.toString(),[wr]:e.body}})}n(NR,"throwUpstreamHtmlError");function Pm(e){try{let t=JSON.parse(e);if(typeof t!="object"||t===null)return{};let r=t;return{error:typeof r.error=="string"?r.error:void 0,errorDescription:typeof r.error_description=="string"?r.error_description:void 0}}catch{return{}}}n(Pm,"readUpstreamOAuthErrorBody");function jR(e){let{error:t,errorDescription:r}=Pm(e.body);e.log?.warn({event:"upstream_oauth_http_error",upstreamServerId:e.upstreamServerId,method:e.method,host:te(e.request.url),path:e.request.url.pathname,status:e.response.status,oauthError:t,oauthErrorDescription:r?.slice(0,256)},"Upstream OAuth HTTP request returned an error response")}n(jR,"logUpstreamOAuthHttpError");function Am(e){return async(t,r)=>{let o=AR(t),s=xR(t,r),i=W(),c=Date.now(),a=await Jp(t,r,{maxRedirects:aR,maxResponseBytes:iR,problemCode:"upstream_token_exchange_failed",timeoutMs:sR}),u=await a.clone().text();if(i?.debug({event:"upstream_oauth_http_request",upstreamServerId:e,method:s,host:te(o.url),path:o.url.pathname,status:a.status,durationMs:Date.now()-c,responseChars:u.length},"Upstream OAuth HTTP request completed"),a.ok||jR({log:i,upstreamServerId:e,method:s,request:o,response:a,body:u}),qR(s,o.url,a.status)||(!a.ok&&OR(a,u)&&NR({upstreamServerId:e,request:o,response:a,body:u}),!UR(a,u)))return a;try{JSON.parse(u)}catch(p){throw new v({message:`Upstream OAuth fetch ${o.url.origin}${o.url.pathname} for ${e} returned invalid JSON.`,extensionMembers:{[C]:"upstream_token_exchange_failed"}},{cause:p})}return a}}n(Am,"createUpstreamOAuthFetch");function xm(e){W()?.debug({event:e.phase==="authorize"?"upstream_oauth_authorize_started":"upstream_oauth_token_exchange_started",upstreamServerId:e.upstreamServerId,serverHost:te(e.serverUrl),resourceMetadataHost:te(e.resourceMetadataUrl),hasRequestedScope:e.requestedScope!==void 0},e.phase==="authorize"?"Upstream OAuth authorization flow started":"Upstream OAuth authorization-code exchange started")}n(xm,"logUpstreamOAuthFlowStarted");function Um(e){let t={event:"upstream_oauth_flow_failed",phase:e.phase,upstreamServerId:e.upstreamServerId},r=te(e.serverUrl);r!==void 0&&(t.serverHost=r);let o=e.error instanceof v?e.error.extensionMembers?.[C]:void 0;typeof o=="string"&&(t.code=o),pe(t,"error",e.error),W()?.warn(t,"Upstream OAuth flow failed before a connection was established")}n(Um,"logUpstreamOAuthFlowFailed");function Om(e,t){return e.configuredAuthorizationScope??t.requestedScope}n(Om,"readAuthorizationRequestScope");async function Mm(e,t){e.applyChallengeScope(t.requestedScope),xm({phase:"authorize",...t});try{let r={serverUrl:t.serverUrl,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Am(t.upstreamServerId)},o=Om(e,t);return o!==void 0&&(r.scope=o),e.skipIssuerMetadataValidation!==void 0&&(r.skipIssuerMetadataValidation=e.skipIssuerMetadataValidation),await qi(e,r)}catch(r){Um({phase:"authorize",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:r});let o=PR({upstreamServerId:t.upstreamServerId,resourceMetadataUrl:t.resourceMetadataUrl,error:r});throw o!==void 0?o:r}}n(Mm,"runUpstreamOAuth");async function DR(e,t){e.applyChallengeScope(t.requestedScope),xm({phase:"token_exchange",...t});let r={serverUrl:t.serverUrl,authorizationCode:t.authorizationCode,resourceMetadataUrl:new URL(t.resourceMetadataUrl),fetchFn:Am(t.upstreamServerId)};t.iss!==void 0&&(r.iss=t.iss);let o=Om(e,t);o!==void 0&&(r.scope=o),e.skipIssuerMetadataValidation!==void 0&&(r.skipIssuerMetadataValidation=e.skipIssuerMetadataValidation);try{return await qi(e,r)}catch(s){throw Um({phase:"token_exchange",upstreamServerId:t.upstreamServerId,serverUrl:t.serverUrl,error:s}),s}}n(DR,"exchangeUpstreamAuthorizationCode");async function Em(e){let t=e.provider.readUsablePeerAdoption(e.requestedScope);if(t!==void 0)return await e.provider.adoptConnectionForDirectResolution(t,"cas_loss"),!0;let[r]=await N().batchGetUpstreamConnections([{owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}]);return r===void 0||he(r)!=="usable"||!Ar(e.connection,r)||!e.provider.connectionSatisfiesRequestedScope(r,e.requestedScope)?!1:(await e.provider.adoptConnectionForDirectResolution(r,"boundary_reread"),!0)}n(Em,"adoptPeerCredentialAtResolutionBoundary");async function zm(e,t){let r=await Mm(e,t);if(r==="REDIRECT"&&e.authorizationUrl)return e.authorizationUrl;throw r==="AUTHORIZED"?new v({message:`OAuth connect flow reused existing credentials instead of producing a redirect for ${t.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}}):new v({message:`Unexpected OAuth result for ${t.upstreamServerId}: ${r}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}})}n(zm,"requireUpstreamAuthorizationRedirect");async function qm(e){let t=he(e.connection),r=!!e.forceRefresh,o=!r&&t==="usable"&&e.connection!==void 0&&e.provider.connectionSatisfiesRequestedScope(e.connection,e.requestedScope),s=W(),i=s?await Pr({owner:e.target.owner,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId}):void 0;if(s?.debug({event:"upstream_oauth_refresh_decision",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,ownerMode:e.target.owner.mode,connectionFingerprint:i,connectionId:e.connection?.id,accessTokenState:t,forceRefresh:r,willRefresh:!o,expiresAt:e.connection?.expiresAt,connectionUpdatedAt:e.connection?.updatedAt},o?"Reusing stored upstream access token":"Refreshing upstream credential"),o)return{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}};let c;try{c=await Mm(e.provider,{upstreamServerId:e.target.upstreamServerId,serverUrl:e.serverUrl,resourceMetadataUrl:e.resourceMetadataUrl,...e.requestedScope===void 0?{}:{requestedScope:e.requestedScope}})}catch(a){if(e.connection===void 0||!bR(a))throw a;return s?.warn({event:"upstream_oauth_connection_reconsent_required",upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,oauthError:a.code,connectionFingerprint:i,connectionId:e.connection.id,rejectedRefreshTokenFingerprint:e.provider.usedRefreshTokenFingerprint,connectionUpdatedAt:e.connection.updatedAt,connectionExpiresAt:e.connection.expiresAt},"Stored upstream OAuth connection was rejected by the upstream provider"),await e.provider.invalidateCredentials("all"),await Em({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}if(c==="AUTHORIZED"){let a=e.provider.readUsablePeerAdoption(e.requestedScope);return a!==void 0&&await e.provider.adoptConnectionForDirectResolution(a,"cas_loss"),!e.provider.tokenWriteWasPersisted&&a===void 0?{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:void 0,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}:{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}}if(c!=="REDIRECT")throw new v({message:`Unexpected OAuth result for ${e.target.upstreamServerId}: ${c}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});if(!e.provider.authorizationUrl)throw new v({message:`OAuth connect-required flow did not produce a redirect for ${e.target.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});return await Em({provider:e.provider,connection:e.connection,target:e.target,requestedScope:e.requestedScope})?{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:e.provider}}:{kind:"connect_required",payload:await ta({requestUrl:e.target.request.url,requestHeaders:e.target.request.headers,connection:e.connection,owner:e.target.owner,initiatedBySubjectId:e.target.initiatedBySubjectId,upstreamServerId:e.target.upstreamServerId,authProfileId:e.target.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.target.operationId,...e.target.returnTo===void 0?{}:{returnTo:e.target.returnTo}})}}n(qm,"authorizeUpstreamOAuthSession");async function $R(e){let t=await ys(e.stateToken),r=await N().consumeUpstreamOAuthState({id:t.id,now:D(new Date)}),o=LR(r);return HR({storedState:o,signedState:t,upstreamServerId:e.upstreamServerId,callbackPath:new URL(e.request.url).pathname}),BR(o),o}n($R,"consumeStoredCallbackState");function LR(e){switch(e.kind){case"consumed":throw new v({message:"OAuth state has already been used",extensionMembers:{[C]:"oauth_state_reused"}});case"missing":throw new v({message:"OAuth state is missing or expired",extensionMembers:{[C]:"oauth_state_expired"}});case"available":return e.record}}n(LR,"readConsumedCallbackState");function HR(e){if(![e.storedState.ownerMode===e.signedState.ownerMode,e.storedState.initiatedBySubjectId===e.signedState.initiatedBySubjectId,e.storedState.ownerSubjectId===e.signedState.ownerSubjectId,e.storedState.upstreamServerId===e.signedState.upstreamServerId,e.storedState.authProfileId===e.signedState.authProfileId,e.storedState.operationId===e.signedState.operationId,e.storedState.upstreamServerId===e.upstreamServerId,e.storedState.callbackPath===e.callbackPath].every(Boolean))throw new v({message:"OAuth callback did not match the initiating request",extensionMembers:{[C]:"oauth_callback_mismatch"}})}n(HR,"assertStoredCallbackStateMatches");function BR(e){if(new Date(e.expiresAt).getTime()<=Date.now())throw new v({message:"OAuth state has expired",extensionMembers:{[C]:"oauth_state_expired"}})}n(BR,"assertStoredCallbackStateFresh");async function ta(e){if(e.owner.mode==="shared"){let r={upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,requiresReconsent:!!e.connection};return e.connection!==void 0&&(r.connectionId=e.connection.id),mm(r)}let t={requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders},owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,upstreamDisplayName:e.upstreamDisplayName,operationId:e.operationId,subject:"tool",requiresReconsent:!!e.connection,...e.returnTo===void 0?{}:{returnTo:e.returnTo}};return e.connection!==void 0&&(t.connectionId=e.connection.id),Ss(t)}n(ta,"buildOAuthConnectRequiredResponse");async function Nm(e){let t=await $R({request:e.request,upstreamServerId:e.upstreamServerId,stateToken:e.stateToken}),r=Vo(t),[o]=await N().batchGetUpstreamConnections([{owner:r,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId}]),s={target:{owner:r,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,...t.returnTo===void 0?{}:{returnTo:t.returnTo}},redirectUri:t.redirectUri,pendingState:t};o!==void 0&&(s.connection=o);let i=new Rt(s),c=await DR(i,{upstreamServerId:e.upstreamServerId,serverUrl:e.upstreamServerConfig.transport.baseUrl,authorizationCode:e.authorizationCode,...e.iss===void 0?{}:{iss:e.iss},resourceMetadataUrl:e.upstreamServerConfig.transport.resourceMetadataUrl});if(c==="AUTHORIZED"){let a=i.readUsablePeerAdoption();if(a!==void 0&&await i.adoptConnectionForDirectResolution(a,"cas_loss"),!i.tokenWriteWasPersisted&&a===void 0)throw new v({message:`OAuth callback storage changed while connecting ${e.upstreamServerId}. Restart the connection flow and try again.`,extensionMembers:{[C]:"upstream_token_exchange_failed"}});return t}throw c!=="REDIRECT"?new v({message:`Unexpected OAuth result for ${e.upstreamServerId}: ${c}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}}):new v({message:`OAuth callback flow did not finish authorization for ${e.upstreamServerId}`,extensionMembers:{[C]:"upstream_token_exchange_failed"}})}n(Nm,"finishUpstreamOAuthCallback");import{importPKCS8 as FR,SignJWT as GR}from"jose";var Dm=1e4,$m=64*1024,Lm=2,JR=300,qe=l.string().min(1),VR=l.object({access_token:qe,issued_token_type:l.literal(ti),token_type:l.string().optional(),expires_in:l.number().int().positive().optional(),scope:qe.optional()}).passthrough(),KR=l.object({id_token:qe,token_type:qe.optional(),expires_in:l.number().int().positive().optional(),refresh_token:qe.optional(),scope:qe.optional()}).passthrough(),WR=l.object({access_token:qe,token_type:qe,expires_in:l.number().int().positive().optional(),scope:qe.optional(),resource:qe.optional(),refresh_token:qe.optional()}).passthrough();function jm(e){return encodeURIComponent(e).replace(/%20/g,"+")}n(jm,"formEncodeClientCredential");function ZR(e){return e.replaceAll("\\n",`
 `)}n(ZR,"normalizePem");async function YR(e){let t=e.clientAuth.algorithm??"RS256",r=e.clientAuth.expiresInSeconds??JR,o=await FR(ZR(e.clientAuth.privateKeyPem),t),s={alg:t,typ:"JWT",...e.clientAuth.keyId===void 0?{}:{kid:e.clientAuth.keyId}};return new GR({jti:crypto.randomUUID()}).setProtectedHeader(s).setIssuer(e.clientAuth.clientId).setSubject(e.clientAuth.clientId).setAudience(e.clientAuth.audience??e.tokenUrl).setIssuedAt().setExpirationTime(`${r}s`).sign(o)}n(YR,"createPrivateKeyJwtClientAssertion");async function XR(e){switch(e.clientAuth.method){case"client_secret_post":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_secret",e.clientAuth.clientSecret);return;case"client_secret_basic":{let t=jm(e.clientAuth.clientId),r=jm(e.clientAuth.clientSecret);e.headers.authorization=`Basic ${btoa(`${t}:${r}`)}`;return}case"private_key_jwt":e.form.set("client_id",e.clientAuth.clientId),e.form.set("client_assertion_type",Wo),e.form.set("client_assertion",await YR({clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}));return}}n(XR,"appendClientAuthentication");async function ra(e){let t={"Content-Type":"application/x-www-form-urlencoded"};return await XR({form:e.form,headers:t,clientAuth:e.clientAuth,tokenUrl:e.tokenUrl}),{method:"POST",headers:t,body:e.form.toString()}}n(ra,"buildFormRequest");function Hm(e){return(t,r)=>gs(t,r,{context:e,maxRedirects:Lm,maxResponseBytes:$m,problemCode:"upstream_token_exchange_failed",timeoutMs:Dm})}n(Hm,"defaultIdpFetchJson");function QR(e){return(t,r)=>Vp(t,r,{context:e,maxRedirects:Lm,maxResponseBytes:$m,problemCode:"upstream_token_exchange_failed",timeoutMs:Dm})}n(QR,"defaultResourceAsFetchJson");function ws(e){let t={[C]:e.code,[We]:e.tokenUrl};return e.response!==void 0&&(t[Ke]=e.response.status),new v({message:e.message,extensionMembers:t},e.cause===void 0?void 0:{cause:e.cause})}n(ws,"runtimeError");function na(e){if(!e.response.ok)throw ws({code:"upstream_token_exchange_failed",message:(()=>{switch(e.stage){case"idp_refresh_token":return"IdP refresh-token grant failed while renewing the upstream ID-JAG subject token.";case"idp_token_exchange":return"IdP token exchange failed while requesting an upstream ID-JAG.";case"resource_as_jwt_bearer":return"Upstream Resource AS rejected the ID-JAG JWT-bearer exchange."}})(),tokenUrl:e.tokenUrl,response:e.response})}n(na,"assertTokenEndpointSucceeded");function eb(e){let t=KR.safeParse(e.json);if(!t.success)throw ws({code:"upstream_token_response_invalid",message:"IdP refresh-token grant returned an invalid subject-token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={idToken:t.data.id_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),t.data.scope!==void 0&&(r.scope=t.data.scope),r}n(eb,"parseIdpRefreshTokenResponse");function tb(e){let t=VR.safeParse(e.json);if(!t.success)throw ws({code:"upstream_token_response_invalid",message:"IdP token exchange returned an invalid ID-JAG response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={assertion:t.data.access_token};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),r}n(tb,"parseIdJagTokenExchangeResponse");function rb(e){let t=WR.safeParse(e.json);if(!t.success)throw ws({code:"upstream_token_response_invalid",message:"Upstream Resource AS returned an invalid JWT-bearer token response.",tokenUrl:e.tokenUrl,response:e.response,cause:t.error});let r={accessToken:t.data.access_token,tokenType:t.data.token_type};return t.data.expires_in!==void 0&&(r.expiresIn=t.data.expires_in),t.data.scope!==void 0&&(r.scope=t.data.scope),t.data.resource!==void 0&&(r.resource=t.data.resource),t.data.refresh_token!==void 0&&(r.refreshToken=t.data.refresh_token),r}n(rb,"parseAccessTokenResponse");async function Bm(e){let t=new URLSearchParams({grant_type:Ko,requested_token_type:ti,subject_token:e.subjectToken,subject_token_type:e.subjectTokenType,audience:e.audience});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope),e.authorizationDetails!==void 0&&t.set("authorization_details",JSON.stringify(e.authorizationDetails));let r=e.fetchJson??Hm(e.context),{response:o,json:s}=await r(e.idp.tokenUrl,await ra({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return na({response:o,tokenUrl:e.idp.tokenUrl,stage:"idp_token_exchange"}),tb({json:s,response:o,tokenUrl:e.idp.tokenUrl})}n(Bm,"requestIdJag");async function Fm(e){let t=new URLSearchParams({grant_type:"refresh_token",refresh_token:e.refreshToken}),r=e.fetchJson??Hm(e.context),{response:o,json:s}=await r(e.idp.tokenUrl,await ra({form:t,clientAuth:e.clientAuth,tokenUrl:e.idp.tokenUrl}));return na({response:o,tokenUrl:e.idp.tokenUrl,stage:"idp_refresh_token"}),eb({json:s,response:o,tokenUrl:e.idp.tokenUrl})}n(Fm,"refreshIdpSubjectToken");async function Gm(e){let t=new URLSearchParams({grant_type:mt,assertion:e.assertion});e.resource!==void 0&&t.set("resource",e.resource),e.scope!==void 0&&t.set("scope",e.scope);let r=e.fetchJson??QR(e.context),{response:o,json:s}=await r(e.resourceAs.tokenUrl,await ra({form:t,clientAuth:e.clientAuth,tokenUrl:e.resourceAs.tokenUrl}));return na({response:o,tokenUrl:e.resourceAs.tokenUrl,stage:"resource_as_jwt_bearer"}),rb({json:s,response:o,tokenUrl:e.resourceAs.tokenUrl})}n(Gm,"exchangeIdJagForAccessToken");function nb(e){return he(e)==="usable"}n(nb,"hasUsableAccessToken");function ob(e){if(e.tokenType.toLowerCase()!=="bearer")throw new v({message:"Upstream Resource AS returned a token type the MCP gateway cannot send as a bearer token.",extensionMembers:{[C]:"upstream_token_response_invalid"}})}n(ob,"assertBearerToken");function Jm(e,t){if(t===Tr)return!1;let r=e?.metadata?.idpSubjectTokenExpiresAt;return r!==void 0&&new Date(r).getTime()<=Date.now()}n(Jm,"hasExpiredSubjectToken");async function sb(e){let t=await tt(e.encryptedSubjectToken);if(e.subjectTokenType!==Tr)return{connection:e.connection,subjectToken:t,subjectTokenType:e.subjectTokenType};let r=await Fm({idp:e.idp,refreshToken:t,clientAuth:e.clientAuth,context:e.context});if(r.refreshToken===void 0)return{connection:e.connection,subjectToken:r.idToken,subjectTokenType:Gn};let o=await N().upsertUpstreamConnection({id:e.connection.id,ownerMode:e.connection.ownerMode,subjectId:e.connection.subjectId,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,status:"active",encryptedAccessToken:e.connection.encryptedAccessToken,encryptedRefreshToken:e.connection.encryptedRefreshToken,scopes:e.connection.scopes,expiresAt:e.connection.expiresAt,metadata:{...e.connection.metadata??{},encryptedIdpSubjectToken:await et(r.refreshToken),idpSubjectTokenType:Tr,idpSubjectTokenExpiresAt:void 0}});return W()?.info({event:"upstream_id_jag_subject_token_rotated",upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId,connectionFingerprint:e.connectionFingerprint,connectionId:o.id,priorStatus:e.connection.status,priorUpdatedAt:e.connection.updatedAt,usedSubjectRefreshTokenFingerprint:await Bt(t),newSubjectRefreshTokenFingerprint:await Bt(r.refreshToken)},"Upstream ID-JAG IdP subject refresh token rotated and persisted"),{connection:o,subjectToken:r.idToken,subjectTokenType:Gn}}n(sb,"resolveIdJagSubjectToken");async function Vm(e){let t="preloadedConnection"in e?e.preloadedConnection:(await N().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0],r=he(t),o=!!e.forceRefresh,s=!o&&r==="usable",i=W(),c=i?await Pr({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}):void 0;if(i?.debug({event:"upstream_id_jag_auth_decision",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode,connectionFingerprint:c,connectionId:t?.id,accessTokenState:r,forceRefresh:o,willMint:!s,expiresAt:t?.expiresAt,connectionUpdatedAt:t?.updatedAt},s?"Reusing stored upstream ID-JAG access token":"Minting upstream ID-JAG access token"),!e.forceRefresh&&nb(t))return{kind:"authorized",credential:{type:"bearer_token",token:await tt(t.encryptedAccessToken)}};let a=t?.metadata?.encryptedIdpSubjectToken,u=t?.metadata?.idpSubjectTokenType;if(t?.status!=="active"||a===void 0||u===void 0||Jm(t,u))return i?.debug({event:"upstream_id_jag_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:c,connectionId:t?.id,status:t?.status??"not_connected",hasSubjectToken:a!==void 0,subjectTokenType:u,subjectTokenExpired:u!==void 0&&Jm(t,u)},"Upstream ID-JAG requires an admin subject-token binding"),{kind:"connect_required",payload:{state:"admin_connect_required",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,message:`An IdP subject-token binding is required for ${e.upstreamDisplayName} before this tool can use XAA / ID-JAG.`,nextAction:"admin_setup_required"}};let p=St(e.upstreamServerId),h=Bp(e.upstreamServerId,e.authProfileId),f=h.resourceAs.resource??p.transport.baseUrl,y=e.requestedScope??(h.scopes.length===0?void 0:h.scopes.join(h.scopeDelimiter)),S=await sb({connection:t,connectionFingerprint:c,encryptedSubjectToken:a,subjectTokenType:u,idp:{tokenUrl:h.idp.tokenUrl},clientAuth:h.idp.clientAuth,context:e.context}),k=await Bm({idp:{tokenUrl:h.idp.tokenUrl},subjectToken:S.subjectToken,subjectTokenType:S.subjectTokenType,audience:h.resourceAs.audience,resource:f,scope:y,clientAuth:h.idp.clientAuth,context:e.context}),w=k.scope??y,I=await Gm({resourceAs:{tokenUrl:h.resourceAs.tokenUrl},assertion:k.assertion,resource:f,scope:w,clientAuth:h.resourceAs.clientAuth,context:e.context});if(ob(I),t!==void 0){let O=(I.scope??w)?.split(/[,\s]+/).filter(Boolean)??[],H=I.expiresIn===void 0?void 0:D(new Date(Date.now()+I.expiresIn*1e3)),F=await N().upsertUpstreamConnection({id:S.connection.id,ownerMode:S.connection.ownerMode,subjectId:S.connection.subjectId,upstreamServerId:S.connection.upstreamServerId,authProfileId:S.connection.authProfileId,status:"active",encryptedAccessToken:await et(I.accessToken),encryptedRefreshToken:S.connection.encryptedRefreshToken,scopes:O,expiresAt:H,metadata:S.connection.metadata});i?.info({event:"upstream_id_jag_access_token_persisted",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,connectionFingerprint:c,connectionId:F.id,priorStatus:S.connection.status,priorUpdatedAt:S.connection.updatedAt,scopeCount:O.length,expiresAt:H},"Upstream ID-JAG access token persisted; connection is active")}return{kind:"authorized",credential:{type:"bearer_token",token:I.accessToken}}}n(Vm,"authorizeUpstreamIdJagRequest");var Rs=new Map;function ib(e){return[...new Set(e?.split(/[,\s]+/).filter(Boolean)??[])].sort().join(" ")}n(ib,"normalizeRefreshFlightScope");function ab(e){return _s(new URL(e.callbackPath,Y(e.requestUrl,e.requestHeaders))).toString()}n(ab,"buildGatewayOAuthRedirectUri");async function oa(e){let t=St(e.upstreamServerId),r=kr(e.upstreamServerId,e.authProfileId),o=ab({callbackPath:r.redirectPath,requestUrl:e.request.url,requestHeaders:e.request.headers}),s="preloadedConnection"in e?e.preloadedConnection:(await N().batchGetUpstreamConnections([{owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}]))[0];return{upstreamServerConfig:t,connection:s,providerInput:{target:{owner:e.owner,initiatedBySubjectId:e.initiatedBySubjectId,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,operationId:e.operationId,returnTo:e.returnTo},redirectUri:o,returnOrigin:Y(e.request.url,e.request.headers)}}}n(oa,"prepareUpstreamOAuthRequest");async function Km(e){let t=await oa(e),r=new Rt({...t.providerInput,...t.connection?.metadata===void 0?{}:{connectionMetadata:t.connection.metadata}});return zm(r,{upstreamServerId:e.upstreamServerId,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl})}n(Km,"startUpstreamConnect");async function Wm(e){let t=await oa(e),r=new Rt({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),o=n(()=>qm({target:e,provider:r,connection:t.connection,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,upstreamDisplayName:t.upstreamServerConfig.displayName,serverUrl:t.upstreamServerConfig.transport.baseUrl,resourceMetadataUrl:t.upstreamServerConfig.transport.resourceMetadataUrl}),"runSession");if(!e.forceRefresh&&t.connection!==void 0&&he(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return o();let s=vl({owner:e.owner,upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId}),i=JSON.stringify([s,ib(r.configuredAuthorizationScope??e.requestedScope)]),c=Rs.get(i);if(c!==void 0){W()?.debug({event:"upstream_oauth_refresh_single_flight_coalesced",upstreamServerId:e.upstreamServerId,authProfileId:e.authProfileId,ownerMode:e.owner.mode},"Upstream OAuth refresh joined an isolate-local single-flight");let p=await c;if(p.kind==="usable"&&r.connectionSatisfiesRequestedScope(p.connection,e.requestedScope))return await r.adoptConnectionForDirectResolution(p.connection,"single_flight"),{kind:"authorized",credential:{type:"mcp_oauth_provider",provider:r}};let{preloadedConnection:h,...f}=e;if(t=await oa(f),r=new Rt({...t.providerInput,...t.connection===void 0?{}:{connection:t.connection}}),!e.forceRefresh&&t.connection!==void 0&&he(t.connection)==="usable"&&r.connectionSatisfiesRequestedScope(t.connection,e.requestedScope))return o()}let a=o(),u;return u=a.then(()=>{let p=r.currentConnection;return p!==void 0&&he(p)==="usable"?{kind:"usable",connection:p}:{kind:"unresolved"}}).catch(()=>({kind:"unresolved"})).finally(()=>{Rs.get(i)===u&&Rs.delete(i)}),Rs.set(i,u),a}n(Wm,"authorizeUpstreamRequest");async function Ur(e){let{routeAuth:t}=e;switch(t.authMode){case"shared-oauth":case"user-oauth":return Wm({request:e.request,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo});case"id-jag":return Vm({request:e.request,context:e.context,authMode:t.authMode,ownerMode:t.ownerMode,owner:t.owner,initiatedBySubjectId:t.initiatedBySubjectId,upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId,operationId:t.operationId,upstreamDisplayName:t.upstreamDisplayName,forceRefresh:e.forceRefresh,requestedScope:e.requestedScope,...e.preloadedConnection===void 0?{}:{preloadedConnection:e.preloadedConnection},returnTo:t.returnTo})}let r=t;throw new ye(`Unsupported upstream auth route context ${JSON.stringify(r)}.`)}n(Ur,"resolveUpstreamCredentialForRoute");async function Zm(e){if(e.connectRequest.authMode==="id-jag")throw new ye(`Upstream server ${e.connectRequest.upstreamServerId} uses XAA / ID-JAG and does not support browser OAuth connection flows.`);let t=await Km({request:e.request,owner:e.connectRequest.owner,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,upstreamServerId:e.connectRequest.upstreamServerId,authProfileId:e.connectRequest.authProfileId,operationId:e.connectRequest.operationId,returnTo:e.connectRequest.returnTo});return{authProfileId:e.connectRequest.authProfileId,authUrl:t,initiatedBySubjectId:e.connectRequest.initiatedBySubjectId,owner:e.connectRequest.owner,upstreamDisplayName:e.connectRequest.upstreamDisplayName,operationId:e.connectRequest.operationId}}n(Zm,"startUpstreamConnectForRequest");async function Ym(e){let r=(await ys(e.callbackRequest.state)).authProfileId;if(hs({upstreamServerId:e.callbackRequest.upstreamServerId,authProfileId:r}).mode==="id-jag")throw new ye(`Upstream server ${e.callbackRequest.upstreamServerId} uses XAA / ID-JAG and does not support OAuth callbacks.`);return Nm({request:e.request,upstreamServerId:e.callbackRequest.upstreamServerId,authorizationCode:e.callbackRequest.code,stateToken:e.callbackRequest.state,...e.callbackRequest.iss===void 0?{}:{iss:e.callbackRequest.iss},upstreamServerConfig:St(e.callbackRequest.upstreamServerId)})}n(Ym,"finishUpstreamCallbackForRequest");function cb(e){return{upstreamServerId:e.connection.upstreamServerId,operationId:e.operationId,authProfileId:e.connection.authProfileId,upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}n(cb,"buildRouteAuthBaseFromConnection");function Xm(e){return{upstreamServerId:e.connection.id,operationId:e.operationId,authProfileId:Qu(e.connection.id,e.connection.authMode),upstreamDisplayName:e.connection.displayName,authMode:e.connection.authMode,ownerMode:e.connection.ownerMode}}n(Xm,"buildRouteAuthBaseFromPolicyOptions");function bs(e,t){let o=Se().byOperationId.get(t);if(!o)throw new K(`Unknown MCP route "${t}". Ensure routes.oas.json declares this operationId before starting an upstream connection flow.`);if(o.connection===void 0)throw new K(`MCP route "${t}" does not declare an MCP token exchange policy. Add one before starting an upstream connection flow.`);if(o.connection.upstreamServerId!==e)throw new K(`MCP route "${t}" does not bind upstream "${e}". Check the route's MCP upstream policies and bind the upstream before starting an upstream connection flow.`);return cb({connection:o.connection,operationId:t})}n(bs,"resolveRouteAuthBase");function sa(e,t){switch(e){case"user":return Ir(t);case"shared":return Yu()}}n(sa,"buildOwnerForSubject");function Or(e,t){switch(e.authMode){case"shared-oauth":return{...e,authMode:"shared-oauth",ownerMode:"shared",owner:sa("shared",t),initiatedBySubjectId:t};case"user-oauth":return{...e,authMode:"user-oauth",ownerMode:"user",owner:sa("user",t),initiatedBySubjectId:t};case"id-jag":return{...e,authMode:"id-jag",ownerMode:"user",owner:sa("user",t),initiatedBySubjectId:t}}}n(Or,"resolveRouteAuthForSubject");var db=P.InvalidRequest;function ub(e,t){return{credentialType:e.type,forceRefresh:t}}n(ub,"buildCredentialResolvedAttributes");function lb(e){switch(e){case"admin_connect_required":return"admin_connect_required";case"authenticating":return"connect_required"}}n(lb,"connectRequiredReasonCode");function Qm(e){J(e.context,{eventType:B.MCP_AUTH_UPSTREAM_CREDENTIAL_RESOLVED,outcome:"success",routeBinding:e.routeBinding,attributes:ub(e.credential,e.forceRefresh===!0)})}n(Qm,"emitCredentialResolvedAnalyticsEvent");function eh(e){let t={forceRefresh:e.forceRefresh===!0,nextAction:e.payload.nextAction,state:e.payload.state};if(J(e.context,{eventType:B.MCP_AUTH_UPSTREAM_CREDENTIAL_MISSING,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"connect_required",reasonClass:"auth",attributes:t}),e.payload.state==="reconsent_required"){J(e.context,{eventType:B.MCP_AUTH_UPSTREAM_RECONSENT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:"reconsent_required",reasonClass:"auth",attributes:t});return}J(e.context,{eventType:B.MCP_AUTH_UPSTREAM_CONNECT_REQUIRED,outcome:"connect_required",routeBinding:e.routeBinding,reasonCode:lb(e.payload.state),reasonClass:"auth",attributes:t})}n(eh,"emitCredentialMissingAnalyticsEvents");function pb(e){let t=e.route.raw();return Jo.parse(t?.operationId)}n(pb,"readOperationId");async function mb(e,t,r,o){let s=await Ur({request:e,context:o,routeAuth:t});if(s.kind==="connect_required")return eh({context:o,payload:s.payload,routeBinding:t}),o.log.info({event:"mcp_upstream_connect_required",upstreamServerId:t.upstreamServerId,authProfileId:t.authProfileId},"MCP upstream proxy: upstream connection required"),{kind:"connect_required",payload:s.payload};let i=s.credential;if(Qm({context:o,credential:i,routeBinding:t}),i.type==="bearer_token")return{kind:"headers",headers:[["authorization",`Bearer ${i.token}`]]};let c=await i.provider.tokens();return c?{kind:"headers",headers:[["authorization",`${c.token_type??"Bearer"} ${c.access_token}`]]}:(o.log.warn({event:"mcp_upstream_no_tokens",upstreamServerId:t.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens"),Response.json({error:"no_upstream_tokens"},{status:401}))}n(mb,"buildCredentialHeaders");var hb=new Set(["authorization","cookie","cookie2"]);function fb(e){if(e!==void 0)try{let t=JSON.parse(new TextDecoder().decode(e));return t&&typeof t=="object"&&!Array.isArray(t)&&"method"in t&&typeof t.method=="string"?t.method:void 0}catch{return}}n(fb,"readJsonRequestMethod");function gb(e){let t=e.headers.get("content-type")??"";return/\bapplication\/(?:[\w.+-]+\+)?json\b/i.test(t)}n(gb,"isJsonResponse");function ia(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}n(ia,"isRecord");function yb(e){return Array.isArray(e)&&e.length>0}n(yb,"hasIconList");function Sb(e){if(e.connection.serverInfo?.icons!==void 0&&e.connection.serverInfo.icons.length>0)return e.connection.serverInfo.icons;try{let t=ms(Vu(e.context.route.handler));return t===void 0?void 0:[t]}catch{return}}n(Sb,"readFallbackServerIcons");function _b(e){if(!ia(e.body))return e.body;let t=e.body.result;if(!ia(t))return e.body;let r=t.serverInfo;return!ia(r)||yb(r.icons)?e.body:{...e.body,result:{...t,serverInfo:{...r,icons:e.icons}}}}n(_b,"addMissingServerIcons");function wb(e,t){let r=th(e);for(let o of hb)r.delete(o);for(let[o,s]of t)r.set(o,s);return new Ja(e,{headers:r})}n(wb,"applyUpstreamHeaders");function th(e){let t=new Headers(e.headers);return Ka(t),t}n(th,"buildProxyHeaders");async function Rb(e){if(!(e.method==="GET"||e.method==="HEAD"))return e.clone().arrayBuffer()}n(Rb,"readRetryBody");function rh(e,t){let r=t.authUrl===void 0?void 0:Mp({message:t.message,elicitationId:["connect",t.operationId,t.upstreamServerId,t.authProfileId].join(":"),url:t.authUrl});return Response.json(us({id:Op(e),error:{code:r?.code??db,message:t.message,data:{...r?.data??{},connectRequired:t}}}))}n(rh,"connectRequiredJsonRpcResponse");async function bb(e){let{scope:t}=Ep(e.upstreamResponse),r=await Ur({request:e.request,context:e.context,routeAuth:e.routeAuth,forceRefresh:!0,requestedScope:t});if(r.kind==="connect_required")return eh({context:e.context,payload:r.payload,routeBinding:e.routeAuth,forceRefresh:!0}),{kind:"connect_required",payload:r.payload};let o=new Headers(e.headers),s=r.credential;if(Qm({context:e.context,credential:s,routeBinding:e.routeAuth,forceRefresh:!0}),s.type==="bearer_token")return o.set("authorization",`Bearer ${s.token}`),{kind:"headers",headers:o};let i=await s.provider.tokens();return i?(o.set("authorization",`${i.token_type??"Bearer"} ${i.access_token}`),{kind:"headers",headers:o}):(e.context.log.warn({event:"mcp_upstream_no_tokens_after_refresh",upstreamServerId:e.routeAuth.upstreamServerId},"MCP upstream proxy: OAuth provider returned no tokens after refresh"),{kind:"response",response:Response.json({error:"no_upstream_tokens"},{status:401})})}n(bb,"applyRefreshedCredentialHeaders");function vb(e){e.context.addResponseSendingHook(async(t,r)=>{if(t.status!==401)return t;let o=await bb({request:e.request,context:e.context,headers:th(r),routeAuth:e.routeAuth,upstreamResponse:t});if(o.kind==="connect_required")return rh(e.requestBody,o.payload);if(o.kind==="response")return o.response;let s=Ku({handler:e.context.route.handler,request:r,body:e.requestBody,headers:o.headers});return Oo.fetch(s.url,s.init)})}n(vb,"installUpstreamAuthRetryHook");function Ib(e){if(fb(e.requestBody)!=="initialize")return;let t=Sb({connection:e.connection,context:e.context});t===void 0||t.length===0||e.context.addResponseSendingHook(async r=>{if(!gb(r))return r;let o;try{o=await r.clone().json()}catch{return r}let s=_b({body:o,icons:t});if(s===o)return r;let i=new Headers(r.headers);return i.delete("content-length"),new Response(JSON.stringify(s),{status:r.status,statusText:r.statusText,headers:i})})}n(Ib,"installInitializeIconHook");async function aa(e,t,r){let o=pb(t),s=await Rb(e),i=Xm({connection:r,operationId:o}),c=Lt(e.user,e.url,e.headers);t.log.setLogProperties?.({requestId:t.requestId}),sl(t,c);let a=Or(i,c.subjectId),u=await mb(e,a,r,t);if(!(u instanceof Response)&&u.kind==="connect_required")return rh(s,u.payload);if(u instanceof Response)return u;let p=wb(e,u.headers);return vb({request:p,context:t,requestBody:s,routeAuth:a}),Ib({context:t,requestBody:s,connection:r}),p}n(aa,"mcpTokenExchangePolicy");var ca=class extends qo{static{n(this,"McpTokenExchangeInboundPolicy")}static policyType="mcp-token-exchange";#e;constructor(t,r){let o=el(t,r);super(o,r),this.#e=o}async handler(t,r){return aa(t,r,this.#e)}};var nh=Symbol("Html");function Cb(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}n(Cb,"escapeHtml");function Tb(e){return e===null||typeof e!="object"?!1:e[nh]===!0}n(Tb,"isHtml");function vs(e){return e==null||e===!1?"":Array.isArray(e)?e.map(vs).join(""):Tb(e)?e.value:Cb(String(e))}n(vs,"renderValue");function Ae(e){return{[nh]:!0,value:e}}n(Ae,"trustedHtml");var xe=Ae("");function $(e,...t){let r=e[0]??"";for(let o=0;o<t.length;o+=1)r+=vs(t[o]),r+=e[o+1]??"";return Ae(r)}n($,"html");function Mr(e,t=xe){let r=vs(t),o="",s=!0;for(let i of e)s||(o+=r),o+=vs(i),s=!1;return Ae(o)}n(Mr,"joinHtml");function zr(e){return e.value}n(zr,"renderHtml");function oh(e){return $`<section class="page-section" aria-labelledby="error-next-steps"><h2 class="section-label" id="error-next-steps">What to do next</h2><ol class="steps" role="list">${e.steps}</ol>${e.action}</section><section class="page-section" aria-labelledby="error-reference"><h2 class="section-label" id="error-reference">Reference</h2><dl class="kv kv--boxed">${e.reference}</dl></section><section class="page-section tech" aria-labelledby="error-technical"><h2 class="section-label" id="error-technical">Technical details <span class="section-label__count">for administrators</span></h2><dl class="kv">${e.diagnostics}</dl>${e.upstreamResponse}</section>`}n(oh,"renderBrowserErrorPage");var sh=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9.25"/><path d="m8.25 12.25 2.5 2.5 5-5.25"/></svg>'),ih=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.75" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="12" cy="12" r="9.25"/><line x1="12" y1="7.5" x2="12" y2="12.75"/><circle cx="12" cy="16.25" r=".9" fill="currentColor" stroke="none"/></svg>'),qr=Ae('*,:before,:after{box-sizing:border-box}:root{--bg:#f5f6f8;--surface:#fff;--surface-2:#f8fafc;--border:#e5e7eb;--border-strong:#d1d5db;--text:#0f172a;--text-2:#475569;--text-3:#64748b;--text-muted:#94a3b8;--accent:#0f172a;--accent-hover:#1e293b;--accent-text:#fff;--focus-ring:#0f172a29;--danger:#b91c1c;--danger-bg:#b91c1c0f;--danger-border:#b91c1c38;--warning:#92400e;--warning-bg:#fffbeb;--warning-border:#fde68a;--success:#15803d;--success-bg:#f0fdf4;--success-border:#bbf7d0;--radius-sm:4px;--radius:8px;--radius-lg:12px;--radius-pill:9999px;--shadow-sm:0 1px 2px #0f172a0d;--shadow:0 1px 2px #0f172a0a,0 6px 16px #0f172a0f;--font-sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Inter,system-ui,sans-serif;--font-mono:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Monaco,Consolas,monospace}@media (prefers-color-scheme:dark){:root{--bg:#0a0c10;--surface:#15171c;--surface-2:#1e2128;--border:#262932;--border-strong:#3a3e48;--text:#fafafa;--text-2:#cbd5e1;--text-3:#94a3b8;--text-muted:#71717a;--accent:#fafafa;--accent-hover:#e4e4e7;--accent-text:#0a0c10;--focus-ring:#fafafa2e;--danger:#f87171;--danger-bg:#f8717114;--danger-border:#f871714d;--warning:#fbbf24;--warning-bg:#fbbf2414;--warning-border:#fbbf2447;--success:#34d399;--success-bg:#34d39914;--success-border:#34d3994d;--shadow-sm:0 1px 2px #0006;--shadow:0 1px 2px #0006,0 8px 24px #0006}}html,body{margin:0;padding:0}body{font-family:var(--font-sans);background:var(--bg);color:var(--text);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;flex-direction:column;justify-content:center;align-items:center;min-height:100dvh;padding:48px 20px;font-size:14px;line-height:1.5;display:flex}.card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius-lg);width:100%;max-width:480px;box-shadow:var(--shadow);overflow:hidden}.card__head{text-align:center;padding:32px 32px 24px}.card__icon{border-radius:var(--radius);background:var(--surface-2);object-fit:contain;border:1px solid var(--border);width:48px;height:48px;margin:0 auto 16px;display:block}.card__title{letter-spacing:-.01em;color:var(--text);margin:0;font-size:20px;font-weight:600;line-height:1.3}.card__subtitle{color:var(--text-2);margin:8px 0 0;font-size:14px;line-height:1.55}.card__subtitle strong{color:var(--text);font-weight:600}.card__description{color:var(--text-3);margin:12px 0 0;font-size:13px;line-height:1.55}.card__principal{color:var(--text-3);background:var(--surface-2);border-radius:var(--radius-pill);text-overflow:ellipsis;white-space:nowrap;align-items:center;gap:6px;max-width:100%;margin:16px 0 0;padding:4px 12px;font-size:12.5px;display:inline-flex;overflow:hidden}.card__body{flex-direction:column;gap:20px;padding:8px 32px 24px;display:flex}.card__head+.card__body{border-top:1px solid var(--border);padding-top:24px}.card__footer{border-top:1px solid var(--border);background:var(--surface-2);flex-wrap:wrap;justify-content:flex-end;align-items:center;gap:8px;padding:16px 24px;display:flex}.card__fineprint{color:var(--text-3);text-align:center;margin:0;font-size:12.5px;line-height:1.5}.card__fineprint strong{color:var(--text-2);font-weight:600}.section-label{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);align-items:baseline;gap:6px;margin:0;font-size:11px;font-weight:600;display:flex}.section-label__count{color:var(--text-3);letter-spacing:0;font-weight:500}.banner{border-radius:var(--radius);border:1px solid;align-items:flex-start;gap:10px;padding:12px 14px;font-size:13px;display:flex}.banner__icon{flex-shrink:0;justify-content:center;align-items:center;width:16px;height:16px;margin-top:1px;display:inline-flex}.banner__body{flex-direction:column;flex:1;gap:2px;min-width:0;display:flex}.banner__title{color:var(--text);margin:0;font-size:13px;font-weight:600}.banner__message{color:var(--text-2);margin:0;font-size:13px;line-height:1.5}.banner--warning{background:var(--warning-bg);border-color:var(--warning-border)}.banner--warning .banner__icon{color:var(--warning)}.banner--alert{background:var(--danger-bg);border-color:var(--danger-border)}.banner--alert .banner__icon,.banner--alert .banner__title{color:var(--danger)}.upstream-list{flex-direction:column;gap:8px;margin:0;padding:0;list-style:none;display:flex}.upstream-card{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);flex-direction:column;gap:10px;padding:14px;display:flex}.upstream-card--needs-action{border-color:var(--warning-border);background:var(--warning-bg)}.upstream-card__head{align-items:flex-start;gap:10px;display:flex}.icon-frame{border-radius:var(--radius-sm);border:1px solid var(--border);background:var(--surface-2);width:32px;height:32px;color:var(--text-3);flex-shrink:0;justify-content:center;align-items:center;display:inline-flex;overflow:hidden}.icon-frame img{object-fit:contain;max-width:100%;max-height:100%}.icon-frame--fallback svg{width:18px;height:18px}.inline-icon{object-fit:contain;vertical-align:-2px;border-radius:2px;width:14px;height:14px;margin-right:4px}.upstream-card__main{flex-direction:column;flex:1;gap:3px;min-width:0;display:flex}.upstream-card__title-row{justify-content:space-between;align-items:center;gap:10px;min-width:0;display:flex}.upstream-card__title{color:var(--text);letter-spacing:-.005em;text-overflow:ellipsis;white-space:nowrap;flex:1;min-width:0;margin:0;font-size:14px;font-weight:600;line-height:1.3;overflow:hidden}.upstream-card__meta{color:var(--text-3);flex-wrap:wrap;align-items:center;gap:6px;font-size:12px;display:flex}.upstream-card__host{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);padding:1px 6px;font-size:11.5px}.upstream-card__sep{color:var(--border-strong)}.upstream-card__description{color:var(--text-2);margin:4px 0 0;font-size:12.5px;line-height:1.5}.status-badge{border-radius:var(--radius-pill);white-space:nowrap;border:1px solid #0000;flex-shrink:0;align-items:center;gap:6px;padding:2px 8px;font-size:11.5px;font-weight:600;display:inline-flex}.status-badge:before{content:"";background:currentColor;border-radius:50%;flex-shrink:0;width:5px;height:5px}.status-badge--success{background:var(--success-bg);color:var(--success);border-color:var(--success-border)}.status-badge--warning{background:var(--warning-bg);color:var(--warning);border-color:var(--warning-border)}.status-badge--neutral{background:var(--surface-2);color:var(--text-2);border-color:var(--border)}.upstream-card__capabilities,.upstream-card__scopes{border-top:1px solid var(--border);margin-top:2px;padding-top:10px}.upstream-card__capabilities--empty{color:var(--text-3);font-size:12px;font-style:italic}.capabilities-summary,.scopes-summary{cursor:pointer;user-select:none;color:var(--text-2);justify-content:space-between;align-items:center;gap:12px;padding:2px 0;font-size:12.5px;list-style:none;display:flex}.capabilities-summary::-webkit-details-marker,.scopes-summary::-webkit-details-marker{display:none}.capabilities-summary:hover,.scopes-summary:hover{color:var(--text)}.capabilities-summary:focus-visible,.scopes-summary:focus-visible{outline:2px solid var(--accent);outline-offset:2px;border-radius:var(--radius-sm)}.capabilities-summary__counts{flex-wrap:wrap;align-items:center;gap:12px;display:flex}.count-pill{color:var(--text-2);align-items:baseline;gap:4px;font-size:12.5px;display:inline-flex}.count-pill__num{font-variant-numeric:tabular-nums;color:var(--text);font-size:13px;font-weight:600}.count-pill--destructive .count-pill__num,.count-pill--destructive .count-pill__label{color:var(--danger)}.capabilities-summary__chevron{color:var(--text-3);flex-shrink:0;transition:transform .15s;display:inline-flex}details[open]>.capabilities-summary .capabilities-summary__chevron,details[open]>.scopes-summary .capabilities-summary__chevron{transform:rotate(180deg)}.capabilities-detail{margin-top:10px}.capability-section{margin-top:14px}.capability-section:first-child{margin-top:6px}.capability-section__title{text-transform:uppercase;letter-spacing:.07em;color:var(--text-3);margin:0 0 6px;font-size:11px;font-weight:600}.capability-list{flex-direction:column;gap:5px;margin:0;padding:0;font-size:12.5px;list-style:none;display:flex}.capability-row{flex-wrap:wrap;align-items:baseline;gap:6px;padding:2px 0;display:flex}.capability-row__name{font-weight:500;font-family:var(--font-mono);color:var(--text);font-size:12.5px}.capability-row__description{color:var(--text-3);flex-basis:100%;font-size:12px;line-height:1.45}.capability-row__description code{font-family:var(--font-mono);background:var(--surface-2);border-radius:var(--radius-sm);color:var(--text-2);padding:1px 4px}.capability-row--more{color:var(--text-3);font-size:12px;font-style:italic}.scopes-list{flex-wrap:wrap;gap:4px;margin-top:8px;display:flex}.scope-chip{font-family:var(--font-mono);background:var(--surface-2);color:var(--text-2);border-radius:var(--radius-sm);border:1px solid var(--border);padding:2px 7px;font-size:11.5px}.badge{border-radius:var(--radius-sm);letter-spacing:.04em;text-transform:uppercase;align-items:center;padding:1px 5px;font-size:10px;font-weight:600;display:inline-flex}.badge--destructive{background:var(--danger-bg);color:var(--danger)}.badge--muted{background:var(--surface-2);color:var(--text-3)}.badge-row{flex-wrap:wrap;gap:4px;display:inline-flex}.muted{color:var(--text-3)}.button{font:inherit;border-radius:var(--radius);cursor:pointer;white-space:nowrap;border:1px solid #0000;justify-content:center;align-items:center;gap:6px;min-height:40px;padding:8px 16px;font-size:14px;font-weight:500;text-decoration:none;transition:background .12s,border-color .12s,color .12s,box-shadow .12s,transform 40ms;display:inline-flex}.button:active{transform:translateY(1px)}.button:focus-visible{box-shadow:0 0 0 3px var(--focus-ring);outline:0}.button--small{padding:5px 10px;font-size:12.5px}.button--primary{background:var(--accent);color:var(--accent-text);border-color:var(--accent)}.button--primary:hover:not(:disabled):not([aria-disabled=true]){background:var(--accent-hover);border-color:var(--accent-hover)}.button:disabled,.button[aria-disabled=true]{cursor:not-allowed;opacity:.55}.button:disabled:hover,.button[aria-disabled=true]:hover{background:var(--accent);border-color:var(--accent)}.button--secondary{background:var(--surface);color:var(--text);border-color:var(--border-strong)}.button--secondary:hover{background:var(--surface-2);border-color:var(--border-strong)}.button--block{width:100%}.reconnect-action{align-items:center;margin-right:auto;display:inline-flex;position:relative}.reconnect-button{gap:7px}.tooltip{width:16px;height:16px;color:var(--accent);background:color-mix(in srgb,var(--accent)8%,transparent);cursor:help;border:1.5px solid;border-radius:50%;justify-content:center;align-items:center;font-size:10.5px;font-weight:700;line-height:1;display:inline-flex;position:relative}.tooltip:after{content:attr(aria-label);z-index:10;border-radius:var(--radius-sm);background:var(--accent);width:280px;max-width:min(280px,100vw - 48px);color:var(--accent-text);box-shadow:var(--shadow);text-align:left;white-space:normal;opacity:0;pointer-events:none;padding:12px 14px;font-size:13px;font-weight:600;line-height:1.45;transition:opacity .12s;position:absolute;bottom:calc(100% + 12px);left:50%;transform:translate(-50%)}.tooltip:before{content:"";z-index:11;border-left:7px solid #0000;border-right:7px solid #0000;border-top:8px solid var(--accent);opacity:0;pointer-events:none;transition:opacity .12s;position:absolute;bottom:calc(100% + 5px);left:50%;transform:translate(-50%)}.tooltip:hover:after,.tooltip:hover:before,.tooltip:focus-visible:after,.tooltip:focus-visible:before{opacity:1}.form{flex-direction:column;gap:6px;display:flex}.form__label{color:var(--text);margin:8px 0 0;font-size:13px;font-weight:600;display:block}.form__label:first-child{margin-top:0}.form__input{box-sizing:border-box;border:1px solid var(--border-strong);border-radius:var(--radius);width:100%;font:inherit;background:var(--surface);color:var(--text);padding:9px 12px;font-size:14px;transition:border-color .12s,box-shadow .12s}.form__input:focus{border-color:var(--accent);box-shadow:0 0 0 3px var(--focus-ring);outline:0}.form__note{color:var(--text-3);margin:4px 0 0;font-size:12.5px;line-height:1.5}.form__submit{margin-top:8px}.empty{text-align:center;color:var(--text-3);border:1px dashed var(--border);border-radius:var(--radius);background:var(--surface);padding:24px 16px;font-size:13px}.actions{gap:8px;margin:0;display:flex}.card__status{border:1px solid;border-radius:50%;justify-content:center;align-items:center;width:48px;height:48px;margin:0 auto 16px;display:flex}.card__status svg{width:24px;height:24px}.card__status--error{background:var(--danger-bg);border-color:var(--danger-border);color:var(--danger)}.card__status--success{background:var(--success-bg);border-color:var(--success-border);color:var(--success)}.card__status--neutral{background:var(--surface-2);border-color:var(--border);color:var(--text-3)}.page-section{flex-direction:column;gap:10px;display:flex}.steps{counter-reset:step;flex-direction:column;gap:8px;margin:0;padding:0;list-style:none;display:flex}.steps li{counter-increment:step;color:var(--text-2);align-items:flex-start;gap:10px;font-size:13.5px;line-height:1.5;display:flex}.steps li:before{content:counter(step);border:1px solid var(--border-strong);background:var(--surface);width:20px;height:20px;color:var(--text-2);border-radius:50%;flex-shrink:0;justify-content:center;align-items:center;margin-top:1px;font-size:11.5px;font-weight:600;line-height:1;display:inline-flex}.kv{flex-direction:column;margin:0;display:flex}.kv__row{border-top:1px solid var(--border);grid-template-columns:124px minmax(0,1fr);gap:2px 12px;padding:7px 0;display:grid}.kv__row:first-child{border-top:0;padding-top:0}.kv__row:last-child{padding-bottom:0}.kv__row--block{grid-template-columns:minmax(0,1fr)}.kv__label{color:var(--text-3);margin:0;padding-top:1px;font-size:12px;font-weight:500}.kv__value{min-width:0;color:var(--text);overflow-wrap:anywhere;margin:0;font-size:13px;line-height:1.5}.kv__value code{font-family:var(--font-mono);color:var(--text);font-size:12px}.kv__row--fix .kv__value{color:var(--text);font-weight:500}.kv--boxed{background:var(--surface-2);border:1px solid var(--border);border-radius:var(--radius);padding:10px 14px}.kv--boxed .kv__row{grid-template-columns:92px minmax(0,1fr);padding:6px 0}.kv--boxed .kv__row:first-child{padding-top:0}.kv--boxed .kv__row:last-child{padding-bottom:0}.tech{border-top:1px solid var(--border);padding-top:18px}.provider-response{border:1px solid var(--border);border-radius:var(--radius);background:var(--surface-2)}.provider-response__summary{cursor:pointer;user-select:none;color:var(--text-2);align-items:center;gap:8px;padding:9px 12px;font-size:12.5px;font-weight:500;list-style:none;display:flex}.provider-response__summary::-webkit-details-marker{display:none}.provider-response__summary:before{content:"";border-bottom:1.5px solid;border-right:1.5px solid;flex-shrink:0;width:6px;height:6px;margin-left:2px;transition:transform .15s;transform:rotate(-45deg)}.provider-response[open]>.provider-response__summary:before{transform:rotate(45deg)}.provider-response__summary:hover{color:var(--text)}.provider-response__summary:focus-visible{outline:2px solid var(--accent);outline-offset:-2px;border-radius:var(--radius)}.provider-response__frame{border:0;border-top:1px solid var(--border);border-radius:0 0 var(--radius)var(--radius);background:#fff;width:100%;min-height:240px;display:block}@media (width<=480px){body{padding:0}.card{box-shadow:none;border-left:0;border-right:0;border-radius:0;min-height:100dvh}.card__head{padding:24px 20px 16px}.card__body{padding:16px 20px}.card__footer{flex-direction:column-reverse;align-items:stretch;padding:14px 20px}.card__footer .button{width:100%}.reconnect-action{justify-content:center;width:100%;margin-right:0}.reconnect-action .button{flex:1}.kv__row{grid-template-columns:minmax(0,1fr)}.tooltip:after{left:auto;right:0;transform:none}}@media (prefers-reduced-motion:reduce){*{transition:none!important}}');function Nr(e){return $`<!doctype html><html lang="en"><head><meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /><meta name="referrer" content="no-referrer" /><meta name="robots" content="noindex" /><title>${e.title}</title><link rel="icon" href="${e.iconHref}" /><style>
       ${e.styles}
     </style></head><body><main class="card"><header class="card__head">${e.headerIcon}<h1 class="card__title">${e.heading}</h1>${e.subhead}</header><div class="card__body">${e.body}</div>${e.footer}</main></body></html>`}n(Nr,"renderShell");function Is(e){return $`<div class="card__status card__status--${e}" aria-hidden="true">${e==="success"?sh:ih}</div>`}n(Is,"renderStatusIcon");var kb="text/html; charset=utf-8";function jr(e){try{return new URL(e).host}catch{return""}}n(jr,"safeHostFromUrl");function Fe(e){let t=e.kind??"authorization_failed",r=Pb(t),o=Eb(e),s=e.title??r.title;return new Response(zr(Nr({title:s,iconHref:"",styles:qr,headerIcon:Is(t==="access_denied"?"neutral":"error"),heading:s,subhead:$`<p class="card__subtitle">${e.detail}</p>`,body:oh({steps:Mr(r.steps.map(i=>$`<li>${i}</li>`)),action:Ub(e.action),reference:Ob(o),diagnostics:Mb({diagnostic:o,detail:e.detail}),upstreamResponse:zb(e.upstreamHtml)}),footer:""})),{status:e.status??400,headers:{"content-type":kb,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}n(Fe,"browserErrorPageResponse");function Eb(e){let t=e.diagnostic?.code??e.code??"unknown";return{code:t,stage:e.diagnostic?.stage??Ab(t),timestamp:e.diagnostic?.timestamp??new Date().toISOString(),...e.requestId===void 0&&e.diagnostic?.requestId===void 0?{}:{requestId:e.diagnostic?.requestId??e.requestId},...e.diagnostic?.operationId===void 0?{}:{operationId:e.diagnostic.operationId},...e.diagnostic?.routePath===void 0?{}:{routePath:e.diagnostic.routePath},...e.diagnostic?.upstreamServerId===void 0?{}:{upstreamServerId:e.diagnostic.upstreamServerId},...e.diagnostic?.authProfileId===void 0?{}:{authProfileId:e.diagnostic.authProfileId},...e.diagnostic?.upstreamUrl===void 0?{}:{upstreamUrl:e.diagnostic.upstreamUrl},...e.diagnostic?.metadataUrl===void 0?{}:{metadataUrl:e.diagnostic.metadataUrl},...e.diagnostic?.httpStatus===void 0?{}:{httpStatus:e.diagnostic.httpStatus},...e.diagnostic?.contentType===void 0?{}:{contentType:e.diagnostic.contentType},...e.diagnostic?.providerError===void 0?{}:{providerError:e.diagnostic.providerError},...e.diagnostic?.providerErrorDescription===void 0?{}:{providerErrorDescription:e.diagnostic.providerErrorDescription},suggestedFix:e.diagnostic?.suggestedFix??xb(t),underlyingError:e.diagnostic?.underlyingError??e.developerDetail}}n(Eb,"buildBrowserErrorDiagnostic");function Pb(e){switch(e){case"session_expired":return{title:"Authorization expired",steps:["Return to your MCP client and reconnect.","Expired authorization requests cannot be resumed, so start a new connection instead of reloading this page."]};case"access_denied":return{title:"Authorization canceled",steps:["Return to your MCP client.","If you want to grant access, start the connection again and approve the request."]};case"configuration_error":return{title:"Configuration needs attention",steps:["Contact your workspace admin and share the reference below.","The gateway or upstream configuration must be fixed before retrying."]};case"connection_failed":return{title:"Connection failed",steps:["Return to your MCP client and reconnect this upstream.","If this keeps happening, contact your gateway administrator and share the reference below."]};case"invalid_request":return{title:"Authorization request invalid",steps:["Return to your MCP client and try connecting again.","If this keeps happening, the client request may need to be fixed."]};case"admin_required":return{title:"Admin setup required",steps:["Contact your workspace admin and share the reference below.","This connection cannot be completed until setup is finished."]};case"internal_error":return{title:"Gateway error",steps:["Try again later from your MCP client.","If this keeps happening, contact your gateway administrator and share the reference below."]};case"authorization_failed":return{title:"Authorization failed",steps:["Return to your MCP client and start authorization again.","If this keeps happening, contact your gateway administrator and share the reference below."]}}}n(Pb,"readBrowserErrorPagePresentation");function Ab(e){switch(e){case"upstream_oauth_discovery_unavailable":case"upstream_oauth_issuer_mismatch":case"upstream_oauth_server_incompatible":return"upstream_oauth_discovery";case"upstream_client_registration_required":return"upstream_oauth_client_registration";case"upstream_provider_access_denied":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"upstream_token_exchange";case"provider_access_denied":return"upstream_oauth_callback";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"upstream_oauth_state";case"browser_login_verification_failed":return"downstream_browser_login";case"authentication_required":case"identity_context_missing":return"downstream_auth";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"gateway_configuration";case"server_error":case"internal_server_error":return"gateway_internal";default:return"gateway_request"}}n(Ab,"readBrowserErrorStage");function xb(e){switch(e){case"upstream_oauth_discovery_unavailable":return"Confirm the upstream MCP URL and OAuth protected resource metadata. If the provider requires approval, configure the provider app or contact the provider.";case"upstream_oauth_issuer_mismatch":return"Point the upstream at the authorization server URL that matches the `issuer` its metadata document publishes, or ask the provider to correct that issuer value. If the provider publishes a path-scoped authorization server that reports its root origin, set skipIssuerMetadataValidation on this upstream \u2014 that weakens the mix-up defense, so scope it to this one upstream.";case"upstream_oauth_server_incompatible":return"Ask the provider to support the OAuth 2.1 authorization code flow with PKCE (S256) over HTTPS, or configure the upstream to use an authorization server that does.";case"upstream_client_registration_required":return"Register an OAuth client with the upstream provider, then configure the gateway to use that client before retrying.";case"upstream_provider_access_denied":return"Confirm the provider allows this gateway, OAuth client, and upstream MCP URL, then retry the connection.";case"upstream_token_exchange_failed":return"Retry the connection. If it repeats, verify the upstream OAuth client, redirect URI, token endpoint, and provider allowlist.";case"upstream_token_response_invalid":return"Verify the upstream token endpoint returns a valid OAuth token response for this gateway client.";case"provider_access_denied":return"Start the connection again if access was denied by mistake. Otherwise, grant the requested upstream provider access.";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"Start a new connection from the MCP client. The previous browser authorization request cannot be resumed.";case"browser_login_verification_failed":return"Retry the browser login flow. If it repeats, verify the downstream login callback configuration.";case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"Check the MCP route, upstream server, and auth profile entries in the gateway configuration.";case"authentication_required":case"identity_context_missing":return"Verify the normal Zuplo auth policy runs before the MCP gateway policy and sets request.user.";case"server_error":case"internal_server_error":return"Retry later and check gateway logs with the request ID.";default:return"Check the gateway configuration and request details associated with this error code."}}n(xb,"readBrowserErrorSuggestedFix");function Ub(e){return e===void 0?xe:$`<a class="button button--primary button--block" href="${e.href}">${e.label}</a>`}n(Ub,"renderAction");function Cs(e){if(e.value===void 0||e.value==="")return xe;let t=["kv__row",e.block?"kv__row--block":void 0,e.modifier].filter(r=>r!==void 0).join(" ");return $`<div class="${t}"><dt class="kv__label">${e.label}</dt><dd class="kv__value">${e.value}</dd></div>`}n(Cs,"renderRow");function ke(e){return Cs({label:e.label,value:e.value===void 0?void 0:$`<code>${e.value}</code>`})}n(ke,"renderCodeRow");function Ob(e){return Mr([Cs({label:"Error code",value:$`<code data-gateway-error-code="${e.code}">${e.code}</code>`}),ke({label:"Request ID",value:e.requestId}),ke({label:"Time",value:e.timestamp})])}n(Ob,"renderReference");function Mb(e){let{diagnostic:t}=e,r=t.underlyingError===e.detail?void 0:t.underlyingError;return Mr([Cs({label:"Suggested fix",value:t.suggestedFix,block:!0,modifier:"kv__row--fix"}),Cs({label:"Reason",value:r,block:!0}),ke({label:"Stage",value:t.stage}),ke({label:"Gateway route",value:t.routePath}),ke({label:"Operation ID",value:t.operationId}),ke({label:"Upstream",value:t.upstreamServerId}),ke({label:"Auth profile",value:t.authProfileId}),ke({label:"Upstream URL",value:t.upstreamUrl}),ke({label:"Metadata URL",value:t.metadataUrl}),ke({label:"HTTP status",value:t.httpStatus}),ke({label:"Content type",value:t.contentType}),ke({label:"Provider error",value:t.providerError}),ke({label:"Provider error description",value:t.providerErrorDescription})])}n(Mb,"renderDiagnostics");function zb(e){return e===void 0?xe:$`<details class="provider-response"><summary class="provider-response__summary">Show the provider's response</summary><iframe title="Upstream HTML error response" sandbox class="provider-response__frame" srcdoc="${e}"></iframe></details>`}n(zb,"renderUpstreamHtml");var ah="application/json",qb="application/x-www-form-urlencoded";function Ts(e,t){return new v({message:e,extensionMembers:{[C]:"invalid_request"}},t===void 0?void 0:{cause:t})}n(Ts,"invalidRequestError");function Nb(e){return(e??"").split(";")[0]?.trim().toLowerCase()??""}n(Nb,"normalizeContentType");function jb(e,t){return e===t?!0:t===ah&&e.endsWith("+json")}n(jb,"contentTypeMatches");function Db(e,t){if(!t||t.length===0)return;let r=Nb(e.headers.get("content-type"));if(!t.some(o=>jb(r,o)))throw Ts(`Request body must be ${t.join(" or ")}.`)}n(Db,"assertExpectedContentType");function $b(e,t,r){let o=e.headers.get("content-length");if(!o)return;let s=Number.parseInt(o,10);if(Number.isFinite(s)&&s>t)throw Ts(`${r} exceeded the maximum allowed size.`)}n($b,"assertContentLengthWithinLimit");async function ch(e,t){let r=t.label??"Request body";Db(e,t.expectedContentTypes),$b(e,t.maxBytes,r);let o=await fs(e.body,{maxBytes:t.maxBytes,createLimitError:n(()=>Ts(`${r} exceeded the maximum allowed size.`),"createLimitError")});return new TextDecoder().decode(o)}n(ch,"readBoundedTextBody");async function dh(e,t){let r=await ch(e,{...t,expectedContentTypes:[ah]});try{return JSON.parse(r)}catch(o){throw Ts("Request body must be valid JSON.",o)}}n(dh,"readBoundedJsonBody");async function uh(e,t){let r=await ch(e,{...t,expectedContentTypes:[qb]});return new URLSearchParams(r)}n(uh,"readBoundedFormUrlEncodedBody");import{errors as ph,jwtVerify as mh,SignJWT as hh}from"jose";import{base64url as Lb}from"jose";var Hb="mcp-browser-login-pkce:",Bb=new TextEncoder;async function Fb(e){return crypto.subtle.importKey("raw",me(e),{name:"HMAC",hash:"SHA-256"},!1,["sign"])}n(Fb,"importHmacKey");async function da(e){let t=await Fb(e.signingKey),r=Bb.encode(`${Hb}${e.stateId}`),o=await crypto.subtle.sign("HMAC",t,me(r));return Sr.parse(Lb.encode(new Uint8Array(o)))}n(da,"deriveBrowserLoginPkceVerifier");async function lh(e){let t=await da(e),r=await Qo(t);return{codeVerifier:t,codeChallenge:r,codeChallengeMethod:yr}}n(lh,"deriveBrowserLoginPkceParams");var Gb={invalid_request:400,invalid_client:401,invalid_grant:400,invalid_target:400,unsupported_grant_type:400,server_error:500,invalid_redirect_uri:400,invalid_client_metadata:400},R=class extends Error{static{n(this,"OAuthProtocolError")}errorCode;status;constructor(t,r,o=Gb[t],s){super(r,s),this.name="OAuthProtocolError",this.errorCode=t,this.status=o}};var Jb=300,Vb=l.object({purpose:l.literal("gateway_browser_login"),transactionId:ri,stateId:ni,exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),Kb=l.object({purpose:l.literal("gateway_authorization_setup"),transactionId:ri,stateId:ni,exp:l.number().int().positive(),iat:l.number().int().positive().optional()});async function so(){return Be({purpose:"browser-login",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"browser-login"),"derive")})}n(so,"getBrowserLoginKey");async function fh(){return Be({purpose:"authorization-csrf",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"authorization-csrf"),"derive")})}n(fh,"getCsrfKey");function gh(e){return{now:e.now??new Date,ttlSeconds:yh()}}n(gh,"readPendingTransactionDependencies");function yh(){return le().browserLogin.stateTtlSeconds}n(yh,"readBrowserLoginStateTtlSeconds");function Wb(e){let t=de();return ve(e)&&t.isActionPath(e.pathname,"/oauth/dev-login")}n(Wb,"isLoopbackDevLoginUrl");async function Zb(e){let t=le().browserLogin,r=de(),o=new URL(pt("url")),s=new URL(r.actionPath("/oauth/callback"),Cr(e.requestUrl,e.requestHeaders));if(Wb(o))return o.searchParams.set("redirect_uri",s.toString()),o.searchParams.set("state",e.state),o;if(o.searchParams.set("response_type","code"),o.searchParams.set("client_id",pt("clientId")),o.searchParams.set("redirect_uri",s.toString()),o.searchParams.set("scope",t.scope),o.searchParams.set("state",e.state),o.searchParams.set("nonce",e.nonce),t.audience&&o.searchParams.set("audience",t.audience),t.pkce===yr){let i=await lh({stateId:e.stateId,signingKey:await so()});o.searchParams.set("code_challenge",i.codeChallenge),o.searchParams.set("code_challenge_method",i.codeChallengeMethod)}return o}n(Zb,"buildBrowserLoginUrl");function Yb(e,t){return e.subjectId===t.subjectId}n(Yb,"principalsMatch");function Sh(e){return{subjectId:e.subjectId,...e.roles===void 0?{}:{roles:e.roles}}}n(Sh,"toPendingPrincipal");function _h(e){let t={id:e.id,currentStateHash:e.currentStateHash,clientId:e.transaction.clientId,redirectUri:e.transaction.redirectUri,resource:e.transaction.resource,operationId:e.transaction.operationId,scope:e.transaction.scope,codeChallenge:e.transaction.codeChallenge,codeChallengeMethod:e.transaction.codeChallengeMethod,createdAt:D(e.now),expiresAt:D(Ye(e.now,e.ttlSeconds)),...e.transaction.clientState===void 0?{}:{clientState:e.transaction.clientState}};if(e.phase==="awaiting_login")return{...t,phase:"awaiting_login"};if(!e.principal)throw x("identity_context_missing","Authorization setup requires a principal.");return{...t,phase:"awaiting_setup",principal:Sh(e.principal)}}n(_h,"createTransactionRecord");async function wh(e){let{id:t,...r}=e.record,o=await N().startAuthorization({...r,transactionId:t,...e.client===void 0?{}:{client:e.client}});switch(o.kind){case"started":return o.transaction;case"already_exists":throw x("oauth_state_reused","Authorization transaction state already exists.");case"invalid_client":throw new R("invalid_client","OAuth client is not registered.");case"redirect_uri_mismatch":throw new R("invalid_request","redirect_uri is not registered for the client.")}}n(wh,"startPendingTransaction");async function Xb(e){return new hh({purpose:"gateway_browser_login",transactionId:e.transactionId,stateId:e.stateId}).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await so())}n(Xb,"signBrowserLoginState");async function Rh(e){return new hh({purpose:"gateway_authorization_setup",transactionId:e.transactionId,stateId:si()}).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+e.ttlSeconds).sign(await fh())}n(Rh,"signCsrfToken");async function ua(e){try{let{payload:t}=await mh(e,await so(),{algorithms:[Te],issuer:we,audience:Ce}),r=Vb.parse(t);return{transactionId:r.transactionId,stateId:r.stateId}}catch(t){throw t instanceof ph.JWTExpired?x("oauth_state_expired","Browser login state has expired.",t):x("oauth_state_invalid","Browser login state could not be verified.",t)}}n(ua,"verifyBrowserLoginStateToken");async function ks(e){try{let{payload:t}=await mh(e,await fh(),{algorithms:[Te],issuer:we,audience:Ce});return{transactionId:Kb.parse(t).transactionId}}catch(t){throw t instanceof ph.JWTExpired?x("oauth_state_expired","Authorization setup state has expired.",t):x("oauth_state_invalid","Authorization setup state could not be verified.",t)}}n(ks,"verifyCsrfToken");function la(e){return e==="consumed"||e==="consumed_already"||e==="stale_hash"?"oauth_state_reused":e==="expired"?"oauth_state_expired":"oauth_state_invalid"}n(la,"pendingStateErrorCode");function Qb(e){return e.kind==="available"?{kind:"available",record:e.transaction}:e}n(Qb,"toPendingAuthorizationGetResult");function ev(e){return e.kind==="advanced"?{kind:"advanced",record:e.transaction}:e}n(ev,"toPendingAuthorizationAdvanceResult");function pa(e){return e==="principal_mismatch"?"oauth_callback_mismatch":la(e==="consumed_already"?"consumed_already":e)}n(pa,"setupDecisionErrorCode");async function bh(e){let t=e.now??new Date,r=await ks(e.csrfToken),o=await N().markAuthorizationSetupApproved({transactionId:r.transactionId,currentStateHash:await X(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:D(t)});if(o.kind!=="marked")throw x(pa(o.kind),"Authorization setup state is invalid, expired, or already used.");return vh({kind:"available",record:o.transaction})}n(bh,"markSetupApproved");function vh(e){if(e.kind!=="available")throw x(la(e.kind),"Authorization setup state is invalid, expired, or already used.");if(e.record.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization setup state is not in the setup phase.");return e.record}n(vh,"requireAwaitingSetup");function tv(e){if(!Yb(e.currentBrowserPrincipal,e.transaction.principal))throw x("oauth_callback_mismatch","Authorization setup state does not match the current browser session.")}n(tv,"requireCurrentPrincipalMatches");async function Ih(e){let t=e.now??new Date,r=yh(),o=oi(),s=si(),i=await Xb({transactionId:o,stateId:s,ttlSeconds:r}),c=_h({id:o,transaction:e.transaction,currentStateHash:await X(i),phase:"awaiting_login",now:t,ttlSeconds:r});if(c.phase!=="awaiting_login")throw x("oauth_state_invalid","Authorization transaction did not start in login phase.");let a=await wh({record:c,client:e.transaction.client});if(a.phase!=="awaiting_login")throw x("oauth_state_invalid","Authorization transaction did not start in login phase.");let u=await Zb({state:i,nonce:s,stateId:s,requestUrl:e.requestUrl,...e.requestHeaders===void 0?{}:{requestHeaders:e.requestHeaders}});return{transaction:a,browserLoginStateToken:i,browserLoginUrl:u}}n(Ih,"startAwaitingLogin");async function Ch(e){let{now:t,ttlSeconds:r}=gh(e),o=oi(),s=await Rh({transactionId:o,ttlSeconds:r}),i=_h({id:o,transaction:e.transaction,currentStateHash:await X(s),phase:"awaiting_setup",principal:e.principal,now:t,ttlSeconds:r});if(i.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization transaction did not start in setup phase.");let c=await wh({record:i,client:e.transaction.client});if(c.phase!=="awaiting_setup")throw x("oauth_state_invalid","Authorization transaction did not start in setup phase.");return{transaction:c,csrfToken:s}}n(Ch,"startAwaitingSetup");async function Th(e){let{now:t,ttlSeconds:r}=gh(e),o=await ua(e.browserLoginStateToken),s=await Rh({transactionId:o.transactionId,ttlSeconds:r}),i=ev(await N().advancePendingAuthorization({transactionId:o.transactionId,expectedPhase:"awaiting_login",currentStateHash:await X(e.browserLoginStateToken),nextStateHash:await X(s),nextPhase:"awaiting_setup",principal:Sh(e.principal),now:D(t)}));if(i.kind!=="advanced")throw x(la(i.kind),"Browser login state is invalid, expired, or already used.");if(i.record.phase!=="awaiting_setup")throw x("oauth_state_invalid","Browser login did not advance to setup.");return{transaction:i.record,csrfToken:s}}n(Th,"completeLogin");async function kh(e){let t=await ma(e);return tv({transaction:t,currentBrowserPrincipal:e.currentBrowserPrincipal}),t}n(kh,"getSetup");async function ma(e){let t=e.now??new Date,r=await ks(e.csrfToken);return vh(Qb(await N().readPendingAuthorization({transactionId:r.transactionId,currentStateHash:await X(e.csrfToken),now:D(t)})))}n(ma,"getSetupTransaction");async function rv(e){let t=await ks(e.csrfToken),r=Qe(),o=D(Ye(e.now,Jb)),s=await N().decideAuthorizationSetup({decision:"approve",transactionId:t.transactionId,currentStateHash:await X(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},authorizationCodeHash:await X(r),authorizationCodeExpiresAt:o,grantId:dl(),now:D(e.now)});if(s.kind!=="approved")throw x(s.kind==="cancelled"?"oauth_state_invalid":pa(s.kind),"Authorization setup state is invalid, expired, or already used.");let i=new URL(s.transaction.redirectUri);return i.searchParams.set("code",r),s.transaction.clientState&&i.searchParams.set("state",s.transaction.clientState),i}n(rv,"createAuthorizationCodeRedirectWithDecision");async function nv(e){let t=await ks(e.csrfToken),r=await N().decideAuthorizationSetup({decision:"cancel",transactionId:t.transactionId,currentStateHash:await X(e.csrfToken),currentPrincipal:{subjectId:e.currentBrowserPrincipal.subjectId},now:D(e.now)});if(r.kind!=="cancelled")throw x(r.kind==="approved"?"oauth_state_invalid":pa(r.kind),"Authorization setup state is invalid, expired, or already used.");return ov({redirectUri:r.transaction.redirectUri,clientState:r.transaction.clientState})}n(nv,"createCancelRedirectWithDecision");function ov(e){let t=new URL(e.redirectUri);return t.searchParams.set("error","access_denied"),t.searchParams.set("error_description","The user cancelled the MCP authorization request."),e.clientState!==void 0&&t.searchParams.set("state",e.clientState),t}n(ov,"buildClientCancelRedirect");async function Eh(e){let t=e.now??new Date;return rv({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}n(Eh,"approve");async function Ph(e){let t=e.now??new Date;return nv({csrfToken:e.csrfToken,currentBrowserPrincipal:e.currentBrowserPrincipal,now:t})}n(Ph,"cancel");import{createRemoteJWKSet as sv,errors as Dr,jwtVerify as Ah,SignJWT as iv}from"jose";var ga="zuplo_mcp_session",av=l.object({purpose:l.literal("gateway_browser_session"),sub:Bn,browserLoginOrigin:l.string().min(1),roles:l.array(l.string().min(1)).optional(),exp:l.number().int().positive(),iat:l.number().int().positive().optional()}),cv=l.object({id_token:l.string().min(1),token_type:l.string().min(1).optional(),expires_in:l.number().optional(),access_token:l.string().min(1).optional(),refresh_token:l.string().min(1).optional(),scope:l.string().min(1).optional()}),dv=l.object({error:l.string().min(1).optional(),error_description:l.string().min(1).optional(),error_uri:l.string().min(1).optional()}),uv=l.object({sub:Bn,nonce:l.string().min(1)}).catchall(l.unknown()),ha;function lv(e){let t=new Map;if(!e)return t;for(let r of e.split(";")){let o=r.indexOf("=");if(o<0)continue;let s=r.slice(0,o).trim(),i=r.slice(o+1).trim();if(s)try{t.set(s,decodeURIComponent(i))}catch{t.set(s,i)}}return t}n(lv,"parseCookieHeader");async function xh(){return Be({purpose:"browser-session",keyMaterialPurpose:"oauth-state-signing",derive:n(e=>_t(e,"browser-session"),"derive")})}n(xh,"getBrowserSessionKey");function fa(e,t){let r=new URL(Y(e,t)),o=[`${ga}=`,"Path=/","HttpOnly","SameSite=Lax","Max-Age=0"];return r.protocol==="https:"&&o.push("Secure"),o.join("; ")}n(fa,"buildBrowserSessionEvictionCookie");function pv(e){let t=new URL(Y(e.requestUrl,e.requestHeaders)),r=[`${ga}=${encodeURIComponent(e.value)}`,"Path=/","HttpOnly","SameSite=Lax",`Max-Age=${e.ttlSeconds}`];return t.protocol==="https:"&&r.push("Secure"),r.join("; ")}n(pv,"serializeSessionCookie");function Uh(){return new URL(pt("url")).origin}n(Uh,"readBrowserLoginOrigin");function mv(e){let t=dv.safeParse(e);if(!t.success)return{};let r={};return t.data.error!==void 0&&(r.idpError=t.data.error),t.data.error_description!==void 0&&(r.idpErrorDescription=t.data.error_description.slice(0,256)),t.data.error_uri!==void 0&&(r.idpErrorUri=t.data.error_uri.slice(0,256)),r}n(mv,"readIdpErrorFields");function hv(e){return e instanceof Dr.JWTExpired?"expired":e instanceof Dr.JWTClaimValidationFailed?"claim":e instanceof Dr.JWSSignatureVerificationFailed?"signature":e instanceof Dr.JWKSNoMatchingKey?"jwks_no_match":e instanceof Dr.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(hv,"readJwtFailureKind");function fv(e){return e instanceof Error&&"cause"in e?e.cause:e}n(fv,"readErrorCause");function gv(e){if(e!==null&&typeof e=="object"&&"extensionMembers"in e)return e.extensionMembers?.gatewayCode}n(gv,"readRuntimeGatewayCode");function yv(){if(!ha){let e=le();ha=sv(new URL(e.oidc.jwksUrl),{timeoutDuration:e.browserLogin.remoteTimeoutMs})}return ha}n(yv,"readFederatedJwks");function Oh(e){if(!e.user)throw x("authentication_required","The browser login callback did not include an authenticated Zuplo principal.");return Lt(e.user,e.url)}n(Oh,"resolveCurrentRequestPrincipal");async function Es(e,t={}){let r=lv(e.headers.get("cookie")).get(ga);if(!r)return{};try{let{payload:o}=await Ah(r,await xh(),{algorithms:[Te],issuer:we,audience:Ce}),s=av.parse(o);if(s.browserLoginOrigin!==Uh())return{evictCookie:fa(e.url,e.headers)};let i={subjectId:s.sub};return s.roles&&s.roles.length>0&&(i.roles=s.roles),{principal:i}}catch(o){return o instanceof Dr.JWTExpired?{evictCookie:fa(e.url,e.headers)}:(t.context?.log.warn({event:"browser_session_verification_failed",errorName:o instanceof Error?o.name:"unknown",errorMessage:o instanceof Error?o.message:"verification failed"},"Browser session JWT verification failed"),{evictCookie:fa(e.url,e.headers)})}}n(Es,"readBrowserSession");async function Ps(e){let t=le().browserLogin.sessionTtlSeconds,r={purpose:"gateway_browser_session",sub:e.principal.subjectId,browserLoginOrigin:Uh()};e.principal.roles&&(r.roles=e.principal.roles);let o=await new iv(r).setProtectedHeader({alg:Te,typ:"JWT"}).setIssuer(we).setAudience(Ce).setIssuedAt().setExpirationTime(Math.floor(Date.now()/1e3)+t).sign(await xh());return pv({value:o,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,ttlSeconds:t})}n(Ps,"createBrowserSessionCookie");async function Sv(e){let t=le(),r=pt("tokenUrl"),o=pt("clientId"),s=pt("clientSecret"),i=new URL(de().actionPath("/oauth/callback"),Cr(e.requestUrl,e.requestHeaders)).toString(),c=new URLSearchParams({grant_type:"authorization_code",code:e.code,redirect_uri:i,client_id:o,client_secret:s});if(t.browserLogin.pkce===yr){let a=await da({stateId:e.stateId,signingKey:await so()});c.set("code_verifier",a)}try{let{response:a,json:u}=await gs(r,{method:"POST",headers:{accept:"application/json","content-type":"application/x-www-form-urlencoded"},body:c},{maxResponseBytes:32768,problemCode:"browser_login_verification_failed",timeoutMs:t.browserLogin.remoteTimeoutMs,context:e.context});if(!a.ok){let S=mv(u);throw e.context?.log.warn({event:"federated_token_exchange_failed",code:"provider_access_denied",idpHost:te(r),idpStatus:a.status,...S},"Federated browser login token exchange returned non-2xx from the identity provider"),x({code:"provider_access_denied",privateDetail:"Federated browser login token exchange failed.",cause:new Error(`IdP token exchange failed (status=${a.status}${S.idpError?` idp_error=${S.idpError}`:""}${S.idpErrorDescription?` idp_error_description=${S.idpErrorDescription}`:""})`)})}let p=cv.parse(u),h;try{({payload:h}=await Ah(p.id_token,yv(),{issuer:t.oidc.issuer,audience:o}))}catch(S){let k={};throw pe(k,"error",S),e.context?.log.warn({event:"federated_id_token_verification_failed",code:"browser_login_verification_failed",failureKind:hv(S),idpHost:te(r),expectedIssuer:t.oidc.issuer,...k},"Federated id_token failed jose verification"),S}if(h.nonce!==e.nonce)throw e.context?.log.warn({event:"federated_nonce_mismatch",code:"oauth_callback_mismatch",idpHost:te(r),nonceMissingFromIdToken:h.nonce===void 0},"Federated id_token nonce did not match the signed gateway state"),x("oauth_callback_mismatch","Federated browser login nonce did not match the signed gateway state.");let f=uv.parse(h);return{principal:Lt({sub:f.sub,data:f},e.requestUrl),subjectToken:{token:p.id_token,tokenType:Gn,expiresAt:typeof h.exp=="number"?D(new Date(h.exp*1e3)):void 0}}}catch(a){let u=Ze(a)??gv(a);throw u!==void 0&&u!=="browser_login_verification_failed"?a:x("browser_login_verification_failed","Federated browser login callback could not be verified.",fv(a))}}n(Sv,"exchangeFederatedAuthorizationCode");async function Mh(e){let t=typeof e.request.query.code=="string"?e.request.query.code:void 0;if(t)return Sv({code:t,nonce:e.stateId,stateId:e.stateId,requestUrl:e.request.url,requestHeaders:e.request.headers,context:e.context});let r=await Es(e.request,{context:e.context});if(r.principal)return{principal:r.principal};throw x("oauth_callback_mismatch","Federated browser login callback is missing an authorization code.")}n(Mh,"resolveBrowserLoginCallbackIdentity");var _v=new Set(["about","blob","data","file","ftp","ftps","javascript","mailto","urn","ws","wss"]);function wv(e){return e.protocol.replace(/:$/u,"").toLowerCase()}n(wv,"readScheme");function Rv(e){return e.protocol==="https:"}n(Rv,"isSpecCompliantRedirectUri");function bv(e){let t=wv(e);return t.length>0&&t!=="http"&&t!=="https"&&!_v.has(t)}n(bv,"isNativeAppCustomSchemeRedirectUri");var qh=[{id:"oauth.redirect_uri.https",mode:"strict",accepts:n(e=>Rv(e),"accepts")},{id:"oauth.redirect_uri.loopback_http",mode:"native_app",accepts:n(e=>ve(e),"accepts"),matches:n((e,t)=>ve(e)&&ve(t)&&e.pathname===t.pathname&&e.search===t.search,"matches")},{id:"oauth.redirect_uri.custom_scheme",mode:"native_app",accepts:n(e=>bv(e),"accepts")}];function Nh(e){let t=qh.find(r=>r.accepts(e.url));return t===void 0?{kind:"rejected"}:{kind:"allowed",ruleId:t.id,mode:t.mode}}n(Nh,"evaluateBuiltInRedirectUriCompatibility");function zh(e){try{return new URL(e)}catch{return}}n(zh,"parseUrl");function jh(e){if(e.registeredRedirectUri===e.requestedRedirectUri)return!0;let t=zh(e.registeredRedirectUri),r=zh(e.requestedRedirectUri);return t===void 0||r===void 0?!1:qh.some(o=>o.matches?.(t,r))}n(jh,"redirectUriMatchesBuiltInCompatibility");var vv=1e4,Iv=5*1024,Cv=0,Tv=2160*60*60,Dh=["authorization_code","refresh_token",Ko,mt],kv=["authorization_code","refresh_token"],$h=[il],Ev=["code"],Pv=l.object({client_name:l.string().min(1).optional(),redirect_uris:l.array(l.string().min(1)).min(1),grant_types:l.array(l.enum(Dh)).min(1).max(Dh.length).optional(),authorization_grant_profiles_supported:l.array(l.enum($h)).min(1).max($h.length).optional(),response_types:l.array(l.enum(Ev)).min(1).max(1).optional(),scope:l.literal(ne).optional(),token_endpoint_auth_method:cl.optional(),jwks_uri:l.string().min(1).optional()});function Av(e){try{let t=new URL(e);return(t.protocol==="https:"||t.protocol==="http:"&&ve(t))&&t.pathname!=="/"}catch{return!1}}n(Av,"isCimdClientIdCandidate");function Lh(e,t){throw new R("invalid_client",yl({clientId:e})??"OAuth client is not registered.",void 0,t===void 0?void 0:{cause:t})}n(Lh,"invalidCimdClientError");function $r(e,t="invalid_request"){if(xv(e))throw new R(t,"redirect_uris must not include raw whitespace or control characters.");let r;try{r=new URL(e)}catch{throw new R(t,"redirect_uris must be absolute URIs.")}if(r.hash||r.username||r.password)throw new R(t,"redirect_uris must not include credentials or fragments.");if(Nh({url:r}).kind==="rejected")throw new R(t,"redirect_uris must use HTTPS, loopback HTTP, or a native-app private-use URI scheme.")}n($r,"assertValidRedirectUri");function xv(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r<=32||r>=127&&r<=159)return!0}return!1}n(xv,"hasForbiddenRawRedirectUriCharacter");async function Uv(e){let{response:t,json:r}=await Kp(e.initialUrl,{headers:{accept:"application/json"}},{maxRedirects:Cv,maxResponseBytes:Iv,timeoutMs:vv});if(!t.ok)throw x("invalid_request","CIMD metadata could not be fetched.");let o=Zo(r);for(let s of o.redirect_uris)$r(s,"invalid_request");if(o.jwks_uri!==void 0&&Vn(o.jwks_uri),o.client_id!==e.clientId)throw x("invalid_request","Fetched CIMD client_id must exactly match the requested client_id.");return o}n(Uv,"fetchCimdMetadata");async function Ov(e){let t=Yo(e),r=await Uv({clientId:e,initialUrl:t});return{kind:"cimd",clientId:e,metadata:r}}n(Ov,"resolveCimdClient");async function As(e,t){let r=Xe.parse(e);if(Av(r)){le().gateway.downstreamCimdEnabled||Lh(r);try{return await Ov(r)}catch(s){Lh(r,s)}}let o=await N().readClient({clientId:r});if(o.kind==="found"){let s=o.client,i=_l(s.clientId),c=i===void 0?s.tokenEndpointAuthMethod:"private_key_jwt",a=s.jwksUri??i;if(c==="private_key_jwt"&&a===void 0)throw new R("invalid_client","Dynamic private_key_jwt client is missing JWKS metadata. Re-run client registration before authorization.");let u=Zo({client_id:s.clientId,client_name:s.clientName,redirect_uris:s.redirectUris,token_endpoint_auth_method:c,...a===void 0?{}:{jwks_uri:a}}),p={kind:"dcr",clientId:r,metadata:u};return s.hashedClientSecret&&(p.hashedClientSecret=s.hashedClientSecret),p}throw new R("invalid_client",r.startsWith("dcr:")?"Dynamic client is not registered. Re-run client registration before authorization.":"OAuth client is not registered.")}n(As,"resolveClient");function Hh(e,t){if(!e.metadata.redirect_uris.some(r=>jh({registeredRedirectUri:r,requestedRedirectUri:t})))throw x("invalid_request","redirect_uri is not registered for the client.")}n(Hh,"assertRedirectRegistered");function Mv(e){return e===void 0?[...kv]:Array.from(new Set(e))}n(Mv,"normalizeGrantTypes");function zv(e){try{Vn(e)}catch(t){throw new R("invalid_client_metadata","jwks_uri must be an HTTPS URL with a path, no credentials or fragment, and must not point at a blocked host.",void 0,{cause:t})}}n(zv,"assertValidDcrJwksUri");function qv(e){return e.tokenEndpointAuthMethod==="private_key_jwt"&&e.jwksUri!==void 0?Xe.parse(Sl({clientId:crypto.randomUUID(),jwksUri:e.jwksUri})):Xe.parse(`dcr:${crypto.randomUUID()}`)}n(qv,"createDcrClientId");function Lr(e){if(e===void 0||e===ne)return ne;throw new R("invalid_request",`Only the ${ne} scope is supported.`)}n(Lr,"assertSupportedOAuthScope");function Ft(e,t,r){let o;try{o=new URL(t)}catch{throw new R("invalid_target","resource must be an absolute URI.")}if(o.hash)throw new R("invalid_target","resource must not include a fragment.");if(o.protocol!=="https:"&&!ve(o))throw new R("invalid_target","resource must use HTTPS except loopback HTTP resources in local development.");let s=Y(e,r),i=ol(),c=i?[...i.byOperationId.values()].find(a=>new URL(a.routePath,s).toString()===t):void 0;if(!c)throw new R("invalid_target","resource must match a published MCP route.");return c}n(Ft,"resolveResource");async function Bh(e){let t;try{t=Pv.parse(e)}catch(S){if(S instanceof l.ZodError){let k=S.issues.some(w=>w.path[0]==="redirect_uris");throw new R(k?"invalid_redirect_uri":"invalid_client_metadata",S.issues[0]?.message??"Client metadata is invalid.",void 0,{cause:S})}throw S}for(let S of t.redirect_uris)$r(S,"invalid_redirect_uri");if(t.token_endpoint_auth_method==="private_key_jwt"&&t.jwks_uri===void 0)throw new R("invalid_client_metadata","jwks_uri is required for private_key_jwt clients.");t.jwks_uri!==void 0&&zv(t.jwks_uri);let r=new Date,o=t.token_endpoint_auth_method??"none",s=o==="private_key_jwt"?"none":o,i=qv({tokenEndpointAuthMethod:o,jwksUri:t.jwks_uri}),c=Zo({client_id:i,client_name:t.client_name??"Dynamically registered MCP client",redirect_uris:t.redirect_uris,token_endpoint_auth_method:o,...t.jwks_uri===void 0?{}:{jwks_uri:t.jwks_uri}}),a=Ye(r,Tv),u=Math.floor(r.getTime()/1e3),p=Math.floor(a.getTime()/1e3),h={client_id:c.client_id,client_name:c.client_name,redirect_uris:c.redirect_uris,grant_types:Mv(t.grant_types),authorization_grant_profiles_supported:t.authorization_grant_profiles_supported,response_types:["code"],scope:ne,token_endpoint_auth_method:c.token_endpoint_auth_method,client_id_issued_at:u,jwks_uri:c.jwks_uri},f={clientId:c.client_id,clientName:c.client_name,redirectUris:c.redirect_uris,tokenEndpointAuthMethod:s,createdAt:D(r),clientExpiresAt:D(a)};if(o==="client_secret_basic"||o==="client_secret_post"){let S=Qe();f.hashedClientSecret=await X(S),f.clientSecretExpiresAt=D(a),h.client_secret=S,h.client_secret_expires_at=p,h.client_secret_issued_at=u}if((await N().registerClient(f)).kind==="already_exists")throw x("invalid_request","OAuth client is already registered.");return h}n(Bh,"registerDownstreamClient");function Nv(e){return e?.metadata?.idpSubjectTokenType!==Tr&&e?.metadata?.idpSubjectTokenExpiresAt!==void 0&&new Date(e.metadata.idpSubjectTokenExpiresAt).getTime()<=Date.now()?!1:e?.status==="active"&&e.metadata?.encryptedIdpSubjectToken!==void 0&&e.metadata.idpSubjectTokenType!==void 0}n(Nv,"hasStoredIdJagSubjectTokenBinding");async function Fh(e){let t=Ir(e.principal.subjectId);return(await N().batchGetUpstreamConnections([{owner:t,upstreamServerId:e.connection.upstreamServerId,authProfileId:e.connection.authProfileId}]))[0]}n(Fh,"readIdJagSubjectConnection");async function ya(e){let t=Se().byOperationId.get(e.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag")return!1;let r=await Fh({connection:t.connection,principal:e.principal});return!Nv(r)}n(ya,"requiresIdJagSubjectTokenBinding");async function Gh(e){if(e.subjectToken===void 0)return;let t=Se().byOperationId.get(e.transaction.operationId);if(t?.connection===void 0||t.connection.authMode!=="id-jag"||e.principal.subjectId!==e.transaction.principal.subjectId)return;let r=await Fh({connection:t.connection,principal:e.principal});return N().upsertUpstreamConnection({id:r?.id??Xo(),ownerMode:"user",subjectId:e.transaction.principal.subjectId,upstreamServerId:t.connection.upstreamServerId,authProfileId:t.connection.authProfileId,status:"active",encryptedAccessToken:r?.encryptedAccessToken,encryptedRefreshToken:r?.encryptedRefreshToken,scopes:r?.scopes??[],expiresAt:r?.expiresAt,metadata:{...r?.metadata??{},encryptedIdpSubjectToken:await et(e.subjectToken.token),idpSubjectTokenType:e.subjectToken.tokenType,idpSubjectTokenExpiresAt:e.subjectToken.expiresAt}})}n(Gh,"bindIdJagSubjectTokenForAuthorizationTransaction");function Jh(e){return $`<img class="card__icon" src="${e.iconHref}" alt="" width="48" height="48" referrerpolicy="no-referrer" onerror=" this.onerror = null; this.src = '${e.fallbackIconHref}'; " />`}n(Jh,"renderShellIcon");function Vh(e){return $`<form class="actions" method="post" action="${e.setupAction}" ${e.submitOnceAttrs}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate >Cancel</button><button class="button button--primary" type="submit" name="decision" value="approve" ${e.authorizeAttrs} >Authorize</button></form>`}n(Vh,"renderActions");var Kh=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><circle cx="8" cy="8" r="6.5"/><line x1="8" y1="4.6" x2="8" y2="8.4"/><circle cx="8" cy="11" r=".7" fill="currentColor" stroke="none"/></svg>');function Wh(e){return $`<div class="banner banner--warning" role="status"><span class="banner__icon" aria-hidden="true">${e.icon}</span><div class="banner__body"><p class="banner__title">Setup required</p><p class="banner__message">${e.message}</p></div></div>`}n(Wh,"renderBannerWarning");var iO=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="14" height="14" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 6.5l4 4 4-4"/></svg>'),aO=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><rect x="3" y="4" width="18" height="7" rx="1.5"/><rect x="3" y="13" width="18" height="7" rx="1.5"/><circle cx="7" cy="7.5" r=".75" fill="currentColor" stroke="none"/><circle cx="7" cy="16.5" r=".75" fill="currentColor" stroke="none"/></svg>');var cO=Ae('<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 16" width="16" height="16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M7.13 2.46 1.39 12.5a1 1 0 0 0 .87 1.5h11.48a1 1 0 0 0 .87-1.5L8.87 2.46a1 1 0 0 0-1.74 0Z"/><line x1="8" y1="6" x2="8" y2="9.4"/><circle cx="8" cy="11.4" r=".7" fill="currentColor" stroke="none"/></svg>');var jv="data:,",Zh=$`data-submit-once="true" onsubmit="if (this.dataset.submitted === 'true') return false; this.dataset.submitted = 'true'; setTimeout(() => this.querySelectorAll('button').forEach((button) => { button.disabled = true; }), 0);"`,Yh=$`data-activate-once="true" onclick="if (this.dataset.activated === 'true') return false; this.dataset.activated = 'true'; this.setAttribute('aria-disabled', 'true'); this.style.pointerEvents = 'none';"`;function Dv(e,t,r){if(e)try{let o=new URL(t).origin,s=new URL(e,o);return s.origin!==o||!s.pathname.startsWith(r.actionPath("/auth/connections/"))?void 0:s.toString()}catch{return}}n(Dv,"safeGatewayConnectHref");function $v(e){return e.some(r=>r.ownerMode==="user"&&r.status!=="active")?"setup":"grant"}n($v,"deriveMode");function Lv(e){return Vh({state:e.state,setupAction:e.gateway.actionPath("/oauth/setup"),submitOnceAttrs:Zh,authorizeAttrs:xe})}n(Lv,"renderActions");function Sa(e,t,r,o){for(let s of e){if(s.ownerMode!=="user"||s.status!==r)continue;let i=Dv(s.connectUrl,t,o);if(i)return i}}n(Sa,"firstUserConnectHref");function Hv(e){let t=e.connectHref===void 0?xe:$`<a class="button button--primary" href="${e.connectHref}" ${Yh}>Connect</a>`;return $`<form class="actions" method="post" action="${e.gateway.actionPath("/oauth/setup")}" ${Zh}><input type="hidden" name="state" value="${e.state}" /><button class="button button--secondary" type="submit" name="decision" value="cancel" formnovalidate>Cancel</button>${t}</form>`}n(Hv,"renderSetupActions");function Bv(e){return e?$`<span class="reconnect-action"><a class="button button--secondary reconnect-button" href="${e}" ${Yh}>Re-connect<span class="tooltip" tabindex="0" aria-label="Reset or change how the gateway connects to the upstream service, including changing scopes.">?</span></a></span>`:xe}n(Bv,"renderReconnectAction");function Fv(e){try{let t=new URL(e);return t.protocol==="https:"||t.protocol==="http:"?!0:t.protocol==="data:"&&/^data:image\/(?:png|jpe?g|webp|svg\+xml);/i.test(e)}catch{return!1}}n(Fv,"isRenderableIconHref");function Xh(e){return e?.find(t=>Fv(t.src))?.src}n(Xh,"readIconHref");function Gv(e){return Xh(e.serverIcons)??(e.transportHost===void 0?void 0:Bi(e.transportHost).src)}n(Gv,"readUpstreamIconHref");function Jv(e){let t=Xh(e.routeIcons);if(t!==void 0)return t;for(let r of e.upstreams){let o=Gv(r);if(o!==void 0)return o}}n(Jv,"readHeaderIconHref");function Vv(e){let t=e.setupMessage===void 0?xe:Wh({icon:Kh,message:e.setupMessage});return $`<p class="card__subtitle">Authorize '<strong>${e.clientDisplayName}</strong>' to access '<strong>${e.routeDisplayName}</strong>' on your behalf?</p>${t}`}n(Vv,"renderBody");function _a(e){let t=$v(e.upstreams),r=Sa(e.upstreams,e.gatewayOrigin,"not_connected",e.gateway),o=Sa(e.upstreams,e.gatewayOrigin,"reconsent_required",e.gateway),s=Sa(e.upstreams,e.gatewayOrigin,"active",e.gateway),i=t==="setup"?r??o:void 0,c=t==="setup"?e.upstreams.find(p=>p.ownerMode==="user"&&p.status!=="active"&&p.connectUrl===void 0&&p.setupMessage!==void 0)?.setupMessage:void 0,a=Jv({routeIcons:e.routeIcons,upstreams:e.upstreams}),u=t==="setup"?$`<footer class="card__footer">${Hv({state:e.state,connectHref:i,gateway:e.gateway})}</footer>`:$`<footer class="card__footer">${Bv(s)}${Lv({state:e.state,gateway:e.gateway})}</footer>`;return zr(Nr({title:`Authorize access \xB7 ${e.routeDisplayName}`,iconHref:a??jv,styles:qr,headerIcon:a===void 0?xe:Jh({iconHref:a,fallbackIconHref:Hp}),heading:"Authorize access",subhead:xe,body:Vv({routeDisplayName:e.routeDisplayName,clientDisplayName:e.clientDisplayName,setupMessage:c}),footer:u}))}n(_a,"renderConsentPage");var Kv=1e4,Qh="mcp-session-id",Wv;function of(){return{tools:[],prompts:[],resources:[]}}n(of,"emptyCapabilities");function ef(){return new Headers({accept:"application/json, text/event-stream","content-type":"application/json","mcp-protocol-version":ii})}n(ef,"buildReadinessHeaders");async function tf(e){if(e.type==="bearer_token"){let o=ef();return o.set("authorization",`Bearer ${e.token}`),o}let t=await e.provider.tokens();if(!t)return;let r=ef();return r.set("authorization",`${t.token_type??"Bearer"} ${t.access_token}`),r}n(tf,"buildAsyncCredentialHeaders");function rf(e){return new Request(e.upstreamUrl,{method:"POST",headers:e.headers,body:JSON.stringify(Dt.parse({jsonrpc:mr,id:1,method:"initialize",params:{protocolVersion:ii,capabilities:{},clientInfo:{name:"zuplo-mcp-gateway-readiness",version:"0.0.0"}}}))})}n(rf,"buildInitializePreflight");async function wa(e){Jn(e.url);let t=new AbortController,r=setTimeout(()=>t.abort(),Kv);try{let o=new Request(e,{redirect:"manual",signal:t.signal});return await Oo.fetch(o)}finally{clearTimeout(r)}}n(wa,"runPreflight");function Ra(e){e.body?.cancel().catch(()=>{})}n(Ra,"releasePreflightBody");async function Zv(e){let t=e.response.headers.get(Qh);if(!t)return;let r=new Headers(e.headers);r.set(Qh,t),r.delete("content-type");try{let o=await wa(new Request(e.upstreamUrl,{method:"DELETE",headers:r}));Ra(o)}catch{}}n(Zv,"terminatePreflightSession");async function sf(e){let{response:t}=e;return Ra(t),t.status>=200&&t.status<300?(await Zv(e),{kind:"ready",upstreamStatus:t.status,capabilities:of()}):t.status===401||t.status===403?{kind:"upstream_auth_rejected",status:t.status,message:"Upstream MCP server rejected the configured credential."}:{kind:"upstream_unavailable",status:t.status,message:"Upstream MCP server did not accept the readiness preflight."}}n(sf,"classifyResponse");function nf(e){let t={status:e.state==="reconsent_required"?"reconsent_required":"not_connected",connected:!1};return e.nextAction==="admin_setup_required"?{kind:"admin_setup_required",payload:e,connectionStatus:t}:{kind:"connect_required",payload:e,connectionStatus:t}}n(nf,"connectRequiredResult");async function Yv(e){try{return sf({response:await wa(e.request),upstreamUrl:e.upstreamUrl,headers:e.headers})}catch(t){return{kind:"upstream_unavailable",message:t instanceof Error?t.message:"Upstream MCP server readiness preflight failed."}}}n(Yv,"classifyPreflight");async function Xv(e){let t=e.route.connection;if(t===void 0)return{kind:"ready",upstreamStatus:204,capabilities:of()};let r=bs(t.upstreamServerId,e.route.operationId),o=Or(r,e.subjectId),s=e.returnTo===void 0?o:{...o,returnTo:e.returnTo},i=new Request(e.requestUrl,{headers:e.requestHeaders}),c=await Ur({request:i,routeAuth:s,preloadedConnection:e.preloadedConnection});if(c.kind==="connect_required")return nf(c.payload);let a=await tf(c.credential);if(a===void 0)return{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens."};let u=rf({upstreamUrl:t.mcpUrl,headers:a}),p;try{p=await wa(u)}catch(y){return{kind:"upstream_unavailable",message:y instanceof Error?y.message:"Upstream MCP server readiness preflight failed."}}if(p.status!==401)return sf({response:p,upstreamUrl:t.mcpUrl,headers:a});Ra(p);let h=await Ur({request:i,routeAuth:s,forceRefresh:!0});if(h.kind==="connect_required")return nf(h.payload);let f=await tf(h.credential);return f===void 0?{kind:"upstream_auth_rejected",status:401,message:"Upstream credential did not produce tokens after refresh."}:Yv({request:rf({upstreamUrl:t.mcpUrl,headers:f}),upstreamUrl:t.mcpUrl,headers:f})}n(Xv,"checkUpstreamRouteReadinessImpl");function af(e){return(Wv??Xv)(e)}n(af,"checkUpstreamRouteReadiness");function Qv(e){try{return new URL(e).host}catch{return}}n(Qv,"safeUrlHost");function cf(e){return e!==void 0&&e.length>0}n(cf,"hasItems");function eI(e){let t=e.serverInfo?.icons;if(cf(t))return t;let r=ms(e.mcpUrl);return r===void 0?void 0:[r]}n(eI,"readServerIcons");async function tI(e){let{authConfig:t,authMode:r,description:o,displayName:s,mcpUrl:i,ownerMode:c,upstreamServerId:a,authProfileId:u}=e.registeredConnection,p=c==="user",h=p&&r!=="id-jag",f=e.readiness??(p?Il(e.connection):{connected:!0,status:"active"}),y=h?e.readiness?.connectUrl??(e.returnTo!==void 0?await Ji({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,owner:e.userOwner,initiatedBySubjectId:e.transaction.principal.subjectId,upstreamServerId:a,authProfileId:u,operationId:e.route.operationId,returnTo:e.returnTo}):void 0):void 0,S=t.mode==="id-jag"?t.idJag.scopes:t.oauth.scopes;return{upstreamServerId:a,authProfileId:u,authMode:r,ownerMode:c,upstreamDisplayName:s,description:o,transportHost:Qv(i),scopesRequested:cf(S)?S:void 0,serverIcons:eI(e.registeredConnection),status:f.status,connected:f.connected,capabilities:{tools:[],prompts:[],resources:[]},connectUrl:y,setupMessage:e.setupMessage,updatedAt:p&&"updatedAt"in f&&f.updatedAt!==void 0?f.updatedAt:void 0,expiresAt:e.readiness?.expiresAt??e.connection?.expiresAt}}n(tI,"buildSetupRequirement");function df(e){let t=Se().byOperationId.get(e);if(!t)throw x("unknown_mcp_route",`Unknown MCP route: ${e}`);return t}n(df,"requireRoute");async function ba(e){let t=df(e.transaction.operationId),r=Ir(e.transaction.principal.subjectId),o=t.connection;if(o===void 0)return[];let i=o.ownerMode==="user"?(await N().batchGetUpstreamConnections([{owner:r,upstreamServerId:o.upstreamServerId,authProfileId:o.authProfileId}]))[0]:void 0,c=await af({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,route:t,subjectId:e.transaction.principal.subjectId,preloadedConnection:i,returnTo:e.returnTo}),a="connectionStatus"in c?c.connectionStatus:void 0,u=(c.kind==="connect_required"||c.kind==="admin_setup_required")&&c.payload.authUrl!==void 0?c.payload.authUrl:void 0,p=c.kind==="admin_setup_required"?c.payload.message:void 0;return[await tI({connection:i,registeredConnection:o,route:t,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:e.returnTo,transaction:e.transaction,userOwner:r,setupMessage:p,readiness:a===void 0?void 0:{...a,connectUrl:u}})]}n(ba,"requirementsForSetup");async function va(e){let t=df(e.transaction.operationId),r=await N().readClient({clientId:e.transaction.clientId}),o=r.kind==="found"?r.client:void 0,s={gatewayOrigin:Y(e.requestUrl,e.requestHeaders),routeDisplayName:t.connection?.displayName??t.operationId,clientDisplayName:o?.clientName??String(e.transaction.clientId),principalLabel:e.transaction.principal.subjectId},i=t.connection?.description;return i!==void 0&&(s.routeDescription=i),s}n(va,"consentContext");function Ia(e){return e.some(t=>t.ownerMode==="user"&&t.status!=="active")}n(Ia,"hasUnresolvedUserUpstream");var rI=["mcp_user"],nI="dev-browser-user",oI=["resource is required for /oauth/authorize.","MCP clients should start at the MCP server URL and follow its WWW-Authenticate resource_metadata link.","If your client reached this endpoint directly, use /oauth/authorize/{routePath} where {routePath} is the published MCP route path without a leading slash and each segment is URL-encoded as needed, for example /oauth/authorize/mcp/linear, or add resource={protected resource URI from protected-resource metadata}."].join(" "),sI=l.object({response_type:l.literal("code"),client_id:l.string().min(1),redirect_uri:l.string().min(1),resource:l.url(),code_challenge:l.string().min(43),code_challenge_method:Fu,state:l.string().min(1).optional(),scope:l.literal(ne).default(ne)}),iI=l.enum(["continue","approve","cancel"]).default("continue"),aI=l.object({state:l.string().min(1),decision:iI}),bt=class extends Error{static{n(this,"DownstreamAuthorizeRedirectError")}redirectUri;clientState;errorCode;errorDescription;constructor(t){super(t.errorDescription?`${t.errorCode}: ${t.errorDescription}`:t.errorCode,t.cause===void 0?void 0:{cause:t.cause}),this.name="DownstreamAuthorizeRedirectError",this.redirectUri=t.redirectUri,this.clientState=t.clientState,this.errorCode=t.errorCode,this.errorDescription=t.errorDescription}};function uf(e){return typeof e=="string"&&e.length>0?e:void 0}n(uf,"readQueryString");function cI(e,t){let r=uf(e.query.resource);if(t===void 0){if(r!==void 0)return r;throw new R("invalid_target",oI)}let o=ml(t,e.url,e.headers);if(r===void 0||r===o)return o;throw new R("invalid_target","resource must match the scoped OAuth authorization endpoint resource.")}n(cI,"requireAuthorizeResource");async function dI(e,t){let r={};t!==void 0&&(r.context=t);let o=await Es(e,r);if(o.principal)return{principal:o.principal};if(!e.user)return o.evictCookie===void 0?{}:{setCookie:o.evictCookie};let s=Oh(e);return{principal:s,setCookie:await Ps({principal:s,requestUrl:e.url,requestHeaders:e.headers})}}n(dI,"resolveBrowserPrincipal");async function uI(e,t){let r={};t!==void 0&&(r.context=t);let o=await Es(e,r);if(!o.principal)throw x("authentication_required","Authorization setup requires a current browser session.");return o.principal}n(uI,"requireSetupPrincipal");function lf(e){return`${de().actionPath("/oauth/setup")}?state=${encodeURIComponent(e)}`}n(lf,"buildSetupReturnTo");async function pf(e){let t=await ba({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,returnTo:lf(e.csrfToken)}),r=await va({transaction:e.transaction,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders}),o={kind:"setup_page",html:_a({state:e.csrfToken,operationId:e.transaction.operationId,gateway:de(),upstreams:t,...r})};return e.setCookie!==void 0&&(o.setCookie=e.setCookie),o}n(pf,"renderSetup");function lI(e){if(e===void 0)return;let t=e.metadata.token_endpoint_auth_method;return{clientId:e.clientId,clientName:e.metadata.client_name,tokenEndpointAuthMethod:t}}n(lI,"toAuthorizationTransactionClient");async function Ca(e,t={}){let r=sI.parse({...e.query,resource:cI(e,t.operationId),state:uf(e.query.state)}),o=Lr(r.scope);$r(r.redirect_uri,"invalid_request");let s=new Date,i=Xe.parse(r.client_id),c=await As(r.client_id,s);Hh(c,r.redirect_uri);try{let a=Ft(e.url,r.resource,e.headers),u=lI(c);t.context?.log.info({event:"oauth_authorize_request_parsed",clientId:i,operationId:a.operationId,scope:o,hasClientState:r.state!==void 0},"Downstream OAuth authorize: request parsed and client resolved"),t.context&&J(t.context,{eventType:B.MCP_OAUTH_AUTHORIZE_STARTED,outcome:"success",virtualServerName:a.operationId,attributes:{clientId:i,scope:o,responseType:r.response_type}});let p={clientId:c?.clientId??i,...u===void 0?{}:{client:u},redirectUri:r.redirect_uri,resource:r.resource,operationId:a.operationId,scope:o,codeChallenge:r.code_challenge,codeChallengeMethod:r.code_challenge_method,...r.state===void 0?{}:{clientState:r.state}},{principal:h,setCookie:f}=await dI(e,t.context),y=h===void 0?!1:await ya({operationId:a.operationId,principal:h});if(!h||y){let k=await Ih({transaction:p,requestUrl:e.url,requestHeaders:e.headers,now:s});t.context?.log.info({event:"oauth_authorize_awaiting_login",clientId:i,operationId:a.operationId,reason:h?"id_jag_subject_binding_missing":"no_browser_session"},"Downstream OAuth authorize: redirecting to browser login");let w={kind:"redirect",location:k.browserLoginUrl};return f!==void 0&&(w.setCookie=f),w}let S=await Ch({transaction:p,principal:h,now:s});return t.context?.log.info({event:"oauth_authorize_awaiting_setup",clientId:i,operationId:a.operationId,subjectId:h.subjectId},"Downstream OAuth authorize: rendering consent/setup page"),t.context&&J(t.context,{eventType:B.MCP_OAUTH_AUTHORIZE_AWAITING_SETUP,outcome:"success",virtualServerName:a.operationId,attributes:{clientId:i,scope:o,responseType:r.response_type,subjectId:h.subjectId}}),pf({transaction:S.transaction,csrfToken:S.csrfToken,requestUrl:e.url,requestHeaders:e.headers,setCookie:f})}catch(a){throw pI({redirectUri:r.redirect_uri,clientState:r.state,cause:a})}}n(Ca,"authorizeDownstreamClient");function pI(e){if(e.cause instanceof bt)return e.cause;let t=mI(e.cause);return t?new bt({redirectUri:e.redirectUri,clientState:e.clientState,errorCode:t.errorCode,errorDescription:t.errorDescription,cause:e.cause}):e.cause}n(pI,"toDownstreamAuthorizeRedirectError");function mI(e){if(e instanceof R)return{errorCode:e.errorCode,errorDescription:e.message};if(e instanceof l.ZodError){let t=e.issues[0];return{errorCode:t?.path.includes("resource")?"invalid_target":"invalid_request",errorDescription:t?.message}}}n(mI,"mapToOAuthRedirectError");async function mf(e,t={}){let r=typeof e.query.error=="string"?e.query.error:void 0;if(r){let p=typeof e.query.error_description=="string"?e.query.error_description.slice(0,256):void 0,h=typeof e.query.error_uri=="string"?e.query.error_uri.slice(0,256):void 0;throw t.context?.log.warn({event:"browser_login_callback_idp_error",code:"provider_access_denied",idpError:r,...p===void 0?{}:{idpErrorDescription:p},...h===void 0?{}:{idpErrorUri:h}},"Identity provider redirected browser-login callback with an error"),x("provider_access_denied",p??"The delegated browser login was not completed.")}let o=typeof e.query.state=="string"?e.query.state:void 0;if(!o)throw t.context?.log.warn({event:"browser_login_callback_state_missing",code:"oauth_state_invalid"},"Browser login callback was invoked without a state parameter"),x("oauth_state_invalid","Browser login callback is missing state.");let s=await ua(o),i={request:e,stateId:s.stateId};t.context!==void 0&&(i.context=t.context);let c=await Mh(i),a=await Th({browserLoginStateToken:o,principal:c.principal});if(await Gh({transaction:a.transaction,principal:c.principal,subjectToken:c.subjectToken}),await ya({operationId:a.transaction.operationId,principal:c.principal}))throw x("browser_login_verification_failed","The identity provider did not return the subject token required for XAA / ID-JAG.");let u=await pf({transaction:a.transaction,csrfToken:a.csrfToken,requestUrl:e.url,requestHeaders:e.headers});return u.setCookie=await Ps({principal:c.principal,requestUrl:e.url,requestHeaders:e.headers}),u}n(mf,"completeBrowserLoginCallback");async function hf(e){let t=le(),r=new URL(e.url);if(!ve(r))throw x("forbidden","Local browser login is only available on loopback HTTP origins.");let o=typeof e.query.state=="string"?e.query.state:void 0;if(!o)throw x("oauth_state_invalid","Local browser login is missing state.");let s=de().actionPath("/oauth/callback"),i=new URL(typeof e.query.redirect_uri=="string"?e.query.redirect_uri:s,Y(e.url)),c=new URL(Y(e.url)).origin;if(i.origin!==c||i.pathname!==s)throw x("oauth_callback_mismatch",`Local browser login redirect_uri must target this gateway's ${s} route.`);i.searchParams.set("state",o);let a={subjectId:Bn.parse(nI),roles:rI};return{kind:"redirect",location:i,setCookie:await Ps({principal:a,requestUrl:e.url,requestHeaders:e.headers})}}n(hf,"completeLocalDevBrowserLogin");function hI(e){let t=e.method==="POST"?e.body:e.query;return aI.parse(t)}n(hI,"readSetupContinueRequest");async function ff(e){let{state:t,decision:r}=hI({method:e.request.method,query:e.request.query,body:e.body}),o=new Date,s=await ma({csrfToken:t,now:o}),i=await uI(e.request,e.context);if(r==="cancel")return{kind:"redirect",location:await Ph({csrfToken:t,currentBrowserPrincipal:i,now:o})};let c=await kh({csrfToken:t,currentBrowserPrincipal:i,now:o}),a=await ba({transaction:c,requestUrl:e.request.url,requestHeaders:e.request.headers,returnTo:lf(t)});if(r==="approve"&&Ia(a)&&await bh({csrfToken:t,currentBrowserPrincipal:i,now:o}),Ia(a)){let u=await va({transaction:c,requestUrl:e.request.url,requestHeaders:e.request.headers});return{kind:"setup_page",html:_a({state:t,operationId:c.operationId,gateway:de(),upstreams:a,...u})}}return{kind:"redirect",location:await Eh({csrfToken:t,currentBrowserPrincipal:i,now:o})}}n(ff,"continueDownstreamAuthorizeSetup");import{createLocalJWKSet as kI,decodeJwt as EI,errors as ao,jwtVerify as PI}from"jose";import{createRemoteJWKSet as fI,decodeJwt as gI,decodeProtectedHeader as yI,errors as io,jwtVerify as SI}from"jose";var wf=30,Q=l.string().min(1),_I=l.union([Q,l.array(Q).min(1)]),wI=l.union([Q,l.array(Q).min(1)]),RI=l.object({type:Q,locations:l.array(Q).optional(),actions:l.array(Q).optional(),datatypes:l.array(Q).optional(),identifier:Q.optional(),privileges:l.array(Q).optional()}).passthrough(),bI=l.object({iss:l.url(),sub:Q,aud:_I,client_id:Q,resource:wI.optional(),scope:Q.optional(),authorization_details:l.array(RI).optional(),jti:Q,iat:l.number().int(),nbf:l.number().int().optional(),exp:l.number().int(),tenant:Q.optional(),aud_tenant:Q.optional(),aud_sub:Q.optional(),sub_id:Q.optional(),act:l.unknown().optional(),email:Q.optional(),auth_time:l.number().int().optional(),acr:Q.optional(),amr:l.array(Q).optional(),cnf:l.unknown().optional()}).passthrough();function Ee(e){throw new R("invalid_grant",e)}n(Ee,"throwInvalidGrant");function vI(e){return e instanceof io.JWTExpired?"expired":e instanceof io.JWTClaimValidationFailed?"claim":e instanceof io.JWSSignatureVerificationFailed?"signature":e instanceof io.JWKSNoMatchingKey?"jwks_no_match":e instanceof io.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(vI,"readJwtFailureKind");function II(e){return Array.isArray(e.aud)?(e.aud.length!==1&&Ee("ID-JAG audience must contain exactly one value."),e.aud[0]):e.aud}n(II,"readSingleAudience");function gf(e){try{let t=bI.parse(e);return II(t),t}catch(t){if(t instanceof R)throw t;Ee("ID-JAG claims are invalid.")}}n(gf,"parseIdJagClaims");function CI(e,t){e.idJag.enabled||Ee("ID-JAG grant is not enabled.");let r=e.idJag.trustedIssuers.find(o=>o.issuer===t);return r===void 0&&Ee("ID-JAG issuer is not trusted."),r}n(CI,"readTrustedIssuer");function TI(e){let t=e.authorizationDetails;if(t===void 0)return;if(e.allowedTypes===void 0)return t;let r=new Set(e.allowedTypes);return t.filter(o=>r.has(o.type))}n(TI,"readGrantedAuthorizationDetails");function yf(e){if(e.clientAuth.method==="none")throw new R("invalid_client","Client authentication failed.");e.claims.client_id!==e.authenticatedClientId&&Ee("ID-JAG client_id must match the authenticated client."),e.trustedIssuer.expectedClientIds!==void 0&&!e.trustedIssuer.expectedClientIds.includes(e.claims.client_id)&&Ee("ID-JAG client_id is not allowed for this issuer.")}n(yf,"assertClientBinding");function Sf(e){e.cnf!==void 0&&Ee("ID-JAG cnf-bound assertions require DPoP support.")}n(Sf,"assertProofOfPossessionNotDeferred");function _f(e){let t=Math.floor(e.now.getTime()/1e3)+wf;e.claims.iat>t&&Ee("ID-JAG iat must not be in the future.")}n(_f,"assertIssuedAtNotInFuture");async function Rf(e){let t;try{t=yI(e.assertion)}catch{Ee("ID-JAG assertion is malformed.")}t.typ!==ei&&Ee('ID-JAG header typ must be "oauth-id-jag+jwt".');let r;try{r=gf(gI(e.assertion))}catch(a){if(a instanceof R)throw a;Ee("ID-JAG assertion is malformed.")}let o=Cr(e.requestUrl,e.requestHeaders),s=[o];e.requestedResource!==void 0&&e.requestedResource!==o&&s.push(e.requestedResource);let i=CI(e.config,r.iss);s.includes(r.iss)&&Ee("ID-JAG issuer must be different from the gateway."),yf({claims:r,trustedIssuer:i,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Sf(r),_f({claims:r,now:e.now});let c;try{let a=fI(new URL(i.jwksUrl)),{payload:u}=await SI(e.assertion,a,{issuer:i.issuer,audience:s,currentDate:e.now,clockTolerance:wf,typ:ei});c=gf(u)}catch(a){e.context?.log.warn({event:"oauth_id_jag_verification_failed",issuer:i.issuer,failureKind:vI(a)},"OAuth ID-JAG assertion verification failed"),Ee("ID-JAG assertion verification failed.")}return yf({claims:c,trustedIssuer:i,authenticatedClientId:e.authenticatedClientId,clientAuth:e.clientAuth}),Sf(c),_f({claims:c,now:e.now}),{claims:c,trustedIssuer:i,subjectId:hl({issuer:c.iss,subject:c.sub,gatewayIssuer:o,subjectMapping:i.subjectMapping,tenant:c.tenant}),grantedAuthorizationDetails:TI({authorizationDetails:c.authorization_details,allowedTypes:e.config.idJag.enabled?e.config.idJag.authorizationDetailsTypesAllowed:void 0})}}n(Rf,"verifyIdJagAssertion");var AI=new Set(["authorization_code","refresh_token",mt]),xI=1e4,UI=32*1024,OI=2,MI=3600,Ta=l.object({client_id:l.string().min(1).optional(),client_secret:l.string().min(1).optional(),client_assertion_type:l.string().min(1).optional(),client_assertion:l.string().min(1).optional()}),zI=l.discriminatedUnion("grant_type",[Ta.extend({grant_type:l.literal("authorization_code"),code:l.string().min(1),redirect_uri:l.string().min(1),code_verifier:Sr,resource:l.url().optional(),scope:l.literal(ne).optional()}),Ta.extend({grant_type:l.literal("refresh_token"),refresh_token:l.string().min(1),resource:l.url().optional(),scope:l.literal(ne).optional()}),Ta.extend({grant_type:l.literal(mt),assertion:l.string().min(1),resource:l.url().optional(),scope:l.literal(ne).optional(),authorization_details:l.string().min(1).optional()})]);function qI(e){if(typeof e!="object"||e===null)return;let t=e.grant_type;if(t!==void 0&&(typeof t!="string"||!AI.has(t)))throw new R("unsupported_grant_type",`Grant type "${typeof t=="string"?t:""}" is not supported.`)}n(qI,"assertSupportedGrantType");var NI=l.object({token:l.string().min(1),client_id:l.string().min(1).optional(),token_type_hint:l.string().optional(),client_secret:l.string().min(1).optional(),client_assertion_type:l.string().min(1).optional(),client_assertion:l.string().min(1).optional()}),jI=l.object({keys:l.array(l.record(l.string(),l.unknown())).min(1)}).passthrough();function vf(){return le().gateway.accessTokenTtlSeconds}n(vf,"readAccessTokenTtlSeconds");function DI(){return le().gateway.refreshTokenTtlSeconds}n(DI,"readRefreshTokenTtlSeconds");function bf(e,t){let r=vf(),o=Math.max(1,Math.floor((new Date(t).getTime()-e.getTime())/1e3)),s=Math.min(r,o);return{expiresAt:D(Ye(e,s)),expiresIn:s}}n(bf,"calculateAccessTokenExpiresAt");function $I(e){let t=e.claimedResource===void 0?[]:Array.isArray(e.claimedResource)?e.claimedResource:[e.claimedResource];if(e.requestedResource!==void 0){if(t.length>0&&!t.includes(e.requestedResource))throw new R("invalid_target","Token request resource must match the ID-JAG resource.");return e.requestedResource}if(t.length===0)throw new R("invalid_target","resource is required for the ID-JAG JWT bearer grant.");if(t.length!==1)throw new R("invalid_target","ID-JAG resource arrays require a token request resource.");return t[0]}n($I,"readIdJagResource");function LI(e){if(e.claimAuthorizationDetails===void 0)return;let t=(e.grantedAuthorizationDetails??[]).filter(r=>r.locations?.includes(e.resource)===!0);if(t.length===0)throw new R("invalid_grant","ID-JAG authorization_details must authorize the requested resource.");return t}n(LI,"readIdJagGrantedAuthorizationDetails");function HI(e){if(e.claimScope?.split(/\s+/).includes(ne)===!0||(e.grantedAuthorizationDetails?.length??0)>0)return ne;if(e.claimScope===void 0)throw new R("invalid_grant",`ID-JAG must include ${ne} scope or matching authorization_details.`);if(!e.claimScope.split(/\s+/).includes(ne))throw new R("invalid_grant",`ID-JAG scope must include ${ne}.`);return ne}n(HI,"readIdJagGrantedScope");function BI(e){if(e!==void 0&&e.get("dpop")!==null)throw new R("invalid_request","DPoP proofs are not supported for the ID-JAG JWT bearer grant.")}n(BI,"assertNoDpopProofForIdJag");function If(e){if(!e?.startsWith("Basic "))return{};let t;try{t=atob(e.slice(6))}catch{throw new R("invalid_client","Malformed HTTP Basic client authentication.")}let r=t.indexOf(":");if(r<0)throw new R("invalid_client","Malformed HTTP Basic client authentication.");try{return{clientId:decodeURIComponent(t.slice(0,r)),clientSecret:decodeURIComponent(t.slice(r+1))}}catch{throw new R("invalid_client","Malformed HTTP Basic client authentication.")}}n(If,"readBasicClientSecret");function Cf(e){if(e.basicClientId!==void 0&&e.bodyClientId!==void 0&&e.basicClientId!==e.bodyClientId)throw new R("invalid_request","Authenticated client_id must match request client_id.");let t=e.basicClientId??e.bodyClientId;if(t!==void 0)return t;if(e.clientAssertion!==void 0){try{let r=EI(e.clientAssertion);if(typeof r.iss=="string"&&typeof r.sub=="string"&&r.iss===r.sub)return r.iss}catch{throw new R("invalid_client","Malformed private_key_jwt client assertion.")}throw new R("invalid_client","private_key_jwt client assertion must identify the client with matching iss and sub claims.")}throw new R("invalid_client","Client authentication or client_id is required.")}n(Cf,"resolveAuthenticatedClientId");function FI(e){if(e.basicClientSecret!==void 0&&e.bodyClientSecret!==void 0)throw new R("invalid_request","Use only one client authentication method per request.");return e.basicClientSecret!==void 0?{clientSecret:e.basicClientSecret,clientSecretSource:"basic"}:e.bodyClientSecret!==void 0?{clientSecret:e.bodyClientSecret,clientSecretSource:"post"}:{}}n(FI,"resolveClientSecretInput");function GI(e){return e.clientAssertion!==void 0||e.clientAssertionType!==void 0}n(GI,"hasClientAssertion");function JI(e){if(e.requestUrl===void 0)throw new R("invalid_request","Request URL is required for private_key_jwt client authentication.");let t=new URL(de().actionPath(e.pathname),Y(e.requestUrl,e.requestHeaders));return t.search="",t.hash="",t.toString()}n(JI,"buildEndpointAudience");function VI(e){return e instanceof ao.JWTExpired?"expired":e instanceof ao.JWTClaimValidationFailed?"claim":e instanceof ao.JWSSignatureVerificationFailed?"signature":e instanceof ao.JWKSNoMatchingKey?"jwks_no_match":e instanceof ao.JWTInvalid?"invalid":e instanceof l.ZodError?"schema":"other"}n(VI,"readJwtFailureKind");async function KI(e){let{response:t,json:r}=await Wp(e.jwksUri,{headers:{accept:"application/json"}},{context:e.context,maxRedirects:OI,maxResponseBytes:UI,timeoutMs:xI});if(!t.ok)throw new R("invalid_client","Client JWKS could not be fetched.");return jI.parse(r)}n(KI,"fetchClientJwks");async function WI(e){if(e.clientAssertionType!==Wo||e.clientAssertion===void 0)throw new R("invalid_request","private_key_jwt client authentication requires a JWT bearer client_assertion and client_assertion_type.");let t=Xe.parse(e.clientId),r=await As(t,e.now);if(r.metadata.token_endpoint_auth_method!=="private_key_jwt")throw new R("invalid_client","Client is not registered for private_key_jwt authentication.");let o=r.metadata.jwks_uri;if(o===void 0)throw new R("invalid_client","Client JWKS URI is required for private_key_jwt authentication.");let s=JI({requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,pathname:e.endpointPathname});try{let i=await KI({jwksUri:o,context:e.context}),{payload:c}=await PI(e.clientAssertion,kI(i),{issuer:t,subject:t,audience:s,currentDate:e.now}),a=Math.floor(e.now.getTime()/1e3)+MI;if(typeof c.exp!="number"||c.exp>a)throw new R("invalid_client","Client authentication failed.")}catch(i){throw e.context?.log.warn({event:"oauth_private_key_jwt_client_auth_failed",clientId:t,failureKind:VI(i)},"OAuth private_key_jwt client authentication failed"),new R("invalid_client","Client authentication failed.")}return{method:"private_key_jwt",clientId:t}}n(WI,"verifyPrivateKeyJwtClientAssertion");async function ZI(e){let t=Xe.parse(e.clientId);if(wl(t))throw new R("invalid_client","Client is registered for private_key_jwt authentication.");return e.clientSecret===void 0?{method:"none",clientId:t}:{method:e.clientSecretSource==="post"?"client_secret_post":"client_secret_basic",clientId:t,clientSecretHashInput:await X(e.clientSecret)}}n(ZI,"buildRuntimeHttpClientAuth");async function Tf(e){if(GI({clientAssertion:e.clientAssertion,clientAssertionType:e.clientAssertionType})){if(e.basicClientSecret!==void 0||e.bodyClientSecret!==void 0)throw new R("invalid_request","Use only one client authentication method per request.");return WI(e)}let t=FI({basicClientSecret:e.basicClientSecret,bodyClientSecret:e.bodyClientSecret});return ZI({clientId:e.clientId,...t})}n(Tf,"resolveRuntimeHttpClientAuth");async function kf(e){qI(e.body);let t=zI.parse(e.body),r=If(e.authorizationHeader),o=Cf({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),s=new Date,i=await Tf({clientId:o,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/token",now:s,context:e.context});return YI({parsed:t,clientId:o,clientAuth:i,now:s,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,context:e.context})}n(kf,"exchangeDownstreamToken");async function YI(e){if(e.parsed.grant_type==="authorization_code"){$r(e.parsed.redirect_uri,"invalid_request"),Lr(e.parsed.scope),e.parsed.resource!==void 0&&Ft(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let a=Qe(),u=Qe(),p=D(Ye(e.now,DI())),h=bf(e.now,p),f=await N().exchangeAuthorizationCode({clientAuth:e.clientAuth,codeHash:await X(e.parsed.code),redirectUri:e.parsed.redirect_uri,resource:e.parsed.resource,codeChallenge:await Qo(e.parsed.code_verifier),currentRefreshTokenHash:await X(a),accessTokenHash:await X(u),grantExpiresAt:p,accessTokenExpiresAt:h.expiresAt,now:D(e.now)});if(f.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(f.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the authorization code resource.");if(f.kind!=="exchanged")throw new R("invalid_grant","Authorization code is invalid, expired, already used, or failed binding validation.");return e.context&&J(e.context,{eventType:B.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"authorization_code"}}),{access_token:u,token_type:"Bearer",expires_in:h.expiresIn,refresh_token:a,scope:f.grant.scope,resource:f.grant.resource}}if(e.parsed.grant_type===mt){Lr(e.parsed.scope),BI(e.requestHeaders);let a=await Rf({assertion:e.parsed.assertion,authenticatedClientId:e.clientId,clientAuth:e.clientAuth,requestUrl:e.requestUrl??e.parsed.resource??"",requestHeaders:e.requestHeaders,requestedResource:e.parsed.resource,now:e.now,context:e.context,config:le()}),u=$I({claimedResource:a.claims.resource,requestedResource:e.parsed.resource}),p=Ft(e.requestUrl??u,u,e.requestHeaders),h=LI({claimAuthorizationDetails:a.claims.authorization_details,grantedAuthorizationDetails:a.grantedAuthorizationDetails,resource:u}),f=HI({claimScope:a.claims.scope,grantedAuthorizationDetails:h}),y=Qe(),S=D(new Date(a.claims.exp*1e3)),k=bf(e.now,S),w=await N().issueAccessTokenForIdJag({clientAuth:e.clientAuth,accessTokenHash:await X(y),subjectId:a.subjectId,resource:u,operationId:p.operationId,scope:f,authorizationDetails:h,accessTokenExpiresAt:k.expiresAt,now:D(e.now),idJag:{issuer:a.claims.iss,jti:a.claims.jti,tenant:a.claims.tenant,expiresAt:S}});if(w.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(w.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the ID-JAG resource.");return e.context&&J(e.context,{eventType:B.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"jwt-bearer"}}),{access_token:y,token_type:"Bearer",expires_in:k.expiresIn,scope:w.grant.scope,resource:w.grant.resource,...h===void 0?{}:{authorization_details:h}}}Lr(e.parsed.scope),e.parsed.resource!==void 0&&Ft(e.requestUrl??e.parsed.resource,e.parsed.resource,e.requestHeaders);let t=await X(e.parsed.refresh_token),r=e.parsed.refresh_token,o=Qe(),s=D(Ye(e.now,vf())),i=await N().refreshToken({clientAuth:e.clientAuth,currentRefreshTokenHash:t,nextRefreshTokenHash:t,accessTokenHash:await X(o),resource:e.parsed.resource,accessTokenExpiresAt:s,now:D(e.now)});if(i.kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");if(i.kind==="resource_mismatch")throw new R("invalid_target","Token request resource must match the refresh token grant resource.");if(i.kind!=="rotated")throw new R("invalid_grant","Refresh token is invalid, expired, or revoked.");Ft(e.requestUrl??i.grant.resource,i.grant.resource,e.requestHeaders);let c=i.accessToken.expiresAt;return e.context&&J(e.context,{eventType:B.MCP_OAUTH_TOKEN_ISSUED,outcome:"success",attributes:{clientId:e.clientId,grantType:"refresh_token"}}),{access_token:o,token_type:"Bearer",expires_in:Math.max(1,Math.floor((new Date(c).getTime()-e.now.getTime())/1e3)),refresh_token:r,scope:i.grant.scope,resource:i.grant.resource}}n(YI,"exchangeDownstreamTokenWithRuntimeHttp");async function Ef(e){let t=NI.parse(e.body),r=If(e.authorizationHeader),o=Cf({basicClientId:r.clientId,bodyClientId:t.client_id,clientAssertion:t.client_assertion}),s=new Date;if((await N().revokeOAuthToken({clientAuth:await Tf({clientId:o,basicClientSecret:r.clientSecret,bodyClientSecret:t.client_secret,clientAssertion:t.client_assertion,clientAssertionType:t.client_assertion_type,requestUrl:e.requestUrl,requestHeaders:e.requestHeaders,endpointPathname:"/oauth/revoke",now:s,context:e.context}),tokenHash:await X(t.token),now:D(s)})).kind==="invalid_client")throw new R("invalid_client","Client authentication failed.");e.context?.log.info({event:"oauth_token_revoked",clientId:o,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}},"OAuth token revocation request processed"),e.context&&J(e.context,{eventType:B.MCP_OAUTH_TOKEN_REVOKED,outcome:"success",attributes:{clientId:o,...t.token_type_hint===void 0?{}:{tokenTypeHint:t.token_type_hint}}})}n(Ef,"revokeDownstreamToken");var XI=64*1024,QI=16*1024,eC="text/html; charset=utf-8";function tC(e){let t={};for(let[r,o]of e.entries())t[r]=o;return t}n(tC,"formDataToObject");async function rC(e){return dh(e,{maxBytes:XI,label:"Request body"})}n(rC,"readJsonBody");async function Ea(e){return tC(await uh(e,{maxBytes:QI,label:"Request body"}))}n(Ea,"readFormBody");async function Pf(e,t,r){let o=Ze(r),s=r instanceof l.ZodError?vt(r):void 0,i={code:o??(r instanceof l.ZodError?"invalid_request":"internal_server_error")};return s!==void 0&&(i.detail=s),Go(e,t,i)}n(Pf,"handleProblem");function Af(e){return e?.requestId}n(Af,"readBrowserRequestId");function xf(e){if(!(e instanceof v))return;let t=e.extensionMembers?.[wr];return typeof t=="string"?t:void 0}n(xf,"readUpstreamHtmlError");function Hr(e,t){let r=e.extensionMembers?.[t];return typeof r=="string"?r:void 0}n(Hr,"readRuntimeErrorExtensionString");function nC(e,t){let r=e.extensionMembers?.[t];return typeof r=="number"?r:void 0}n(nC,"readRuntimeErrorExtensionNumber");function oC(e){try{return new URL(e.url).pathname}catch{return}}n(oC,"readBrowserRequestPath");function Gt(e){let t={code:e.code,requestId:e.requestId,routePath:oC(e.request),underlyingError:e.underlyingError};return e.error instanceof v&&(t.httpStatus=nC(e.error,Ke),t.contentType=Hr(e.error,_r),t.upstreamUrl=Hr(e.error,We),t.upstreamServerId=Hr(e.error,Bo),t.metadataUrl=Hr(e.error,Rr),t.providerError=Hr(e.error,br),t.providerErrorDescription=Hr(e.error,vr)),t}n(Gt,"buildBrowserErrorDiagnostic");function co(e){let t=new Headers(e.headers);t.set("cache-control","no-store"),t.set("pragma","no-cache");let r={error:e.error};return e.errorDescription!==void 0&&(r.error_description=e.errorDescription),Response.json(r,{status:e.status??400,headers:t})}n(co,"oauthErrorResponse");function sC(e,t){return e.errorCode!=="invalid_client"?{}:t.includeInvalidClientChallenge===!1?{}:{"WWW-Authenticate":'Basic realm="OAuth"'}}n(sC,"readOAuthProtocolHeaders");function iC(e,t){let r=ze("internal_server_error");return co({error:e.errorCode,errorDescription:e.errorCode==="server_error"?r.publicDetail:e.message,status:e.status,headers:sC(e,t)})}n(iC,"oauthProtocolErrorResponse");function ka(e){return e.issues[0]?.path.includes("resource")===!0?"invalid_target":"invalid_request"}n(ka,"readZodOAuthErrorCode");function aC(e){let t={error:ka(e)},r=vt(e);return r!==void 0&&(t.errorDescription=r),co(t)}n(aC,"oauthZodErrorResponse");function cC(e){let t=Ze(e);if(t===void 0)return;let r=ze(t);if(r.oauthError===void 0)return;let o={error:r.oauthError,status:uC(r.oauthError)};return r.oauthError==="server_error"?o.errorDescription=r.publicDetail:e instanceof Error?o.errorDescription=e.message:o.errorDescription=r.publicDetail,co(o)}n(cC,"oauthGatewayProblemResponse");function dC(){let t={error:"server_error",status:500,errorDescription:ze("internal_server_error").publicDetail};return co(t)}n(dC,"oauthFallbackErrorResponse");function uC(e){switch(e){case"invalid_client":return 401;case"server_error":return 500;default:return 400}}n(uC,"readOAuthStatus");function Pa(e,t={}){return e instanceof bt?Mf(e):e instanceof R?iC(e,t):e instanceof l.ZodError?aC(e):cC(e)??dC()}n(Pa,"oauthProblemResponse");function Aa(e,t,r){let o=jr(e.url),s=Af(t);if(r instanceof bt)return Mf(r);if(r instanceof R){let a=ze("internal_server_error");return Fe({host:o,kind:lC(r.errorCode),title:"Authorization failed",detail:r.errorCode==="server_error"?a.publicDetail:r.message,developerDetail:r.errorCode==="server_error"?a.publicDetail:r.message,code:r.errorCode,diagnostic:Gt({request:e,requestId:s,code:r.errorCode,underlyingError:r.errorCode==="server_error"?a.publicDetail:r.message,error:r}),requestId:s,status:r.status})}if(r instanceof l.ZodError)return Fe({host:o,kind:"invalid_request",detail:vt(r)??"The authorization request was invalid.",developerDetail:vt(r)??"The authorization request was invalid.",code:ka(r),diagnostic:Gt({request:e,requestId:s,code:ka(r),underlyingError:vt(r)??"The authorization request was invalid.",error:r}),requestId:s});let i=Ze(r);if(i!==void 0){let a=ze(i);return Fe({host:o,kind:Of(i),detail:a.publicDetail,developerDetail:a.status>=500||!(r instanceof Error)?a.publicDetail:r.message,code:i,diagnostic:Gt({request:e,requestId:s,code:i,underlyingError:a.status>=500||!(r instanceof Error)?a.publicDetail:r.message,error:r}),requestId:s,upstreamHtml:xf(r),status:a.status})}let c=ze("internal_server_error");return Fe({host:o,kind:"internal_error",detail:c.publicDetail,developerDetail:c.publicDetail,code:"server_error",diagnostic:Gt({request:e,requestId:s,code:"server_error",underlyingError:c.publicDetail,error:r}),requestId:s,status:c.status})}n(Aa,"browserOAuthProblemResponse");function Uf(e,t,r){let o=jr(e.url),s=Af(t),i=Ze(r);if(i!==void 0){let a=ze(i);return Fe({host:o,kind:Of(i),detail:a.publicDetail,developerDetail:a.status>=500||!(r instanceof Error)?a.publicDetail:r.message,code:i,diagnostic:Gt({request:e,requestId:s,code:i,underlyingError:a.status>=500||!(r instanceof Error)?a.publicDetail:r.message,error:r}),requestId:s,upstreamHtml:xf(r),status:a.status})}if(r instanceof l.ZodError)return Fe({host:o,kind:"invalid_request",detail:vt(r)??"The authorization request was invalid.",developerDetail:vt(r)??"The authorization request was invalid.",code:"invalid_request",diagnostic:Gt({request:e,requestId:s,code:"invalid_request",underlyingError:vt(r)??"The authorization request was invalid.",error:r}),requestId:s});let c=ze("internal_server_error");return Fe({host:o,kind:"internal_error",detail:c.publicDetail,developerDetail:c.publicDetail,code:"internal_server_error",diagnostic:Gt({request:e,requestId:s,code:"internal_server_error",underlyingError:c.publicDetail,error:r}),requestId:s,status:c.status})}n(Uf,"browserGatewayProblemResponse");function lC(e){return e==="server_error"?"internal_error":"invalid_request"}n(lC,"readOAuthBrowserErrorKind");function Of(e){if(ze(e).status>=500)return"internal_error";switch(e){case"mcp_route_not_enabled":case"unknown_upstream_server":case"unknown_mcp_route":case"unknown_auth_profile":case"mcp_route_upstream_mismatch":return"configuration_error";case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"upstream_oauth_discovery_unavailable":case"upstream_oauth_issuer_mismatch":case"upstream_oauth_server_incompatible":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"invalid_request":case"authentication_required":case"forbidden":case"not_found":case"too_many_requests":case"identity_context_missing":return"invalid_request";case"upstream_capability_invocation_failed":case"upstream_capability_unavailable":case"upstream_import_failed":return"connection_failed";case"internal_server_error":return"internal_error"}return"authorization_failed"}n(Of,"readGatewayBrowserErrorKind");function nt(e,t,r){let o={event:t},s=!1;if(r instanceof R)o.oauthError=r.errorCode,o.status=r.status,pe(o,"error",r);else if(r instanceof bt)o.oauthError=r.errorCode,pe(o,"error",r);else if(r instanceof l.ZodError){o.code="invalid_request",pe(o,"error",r);let i=r.issues[0];i&&(o.zodPath=i.path.join("."))}else{let i=Ze(r);if(i!==void 0){let c=ze(i);o.code=i,o.status=c.status,c.oauthError!==void 0&&(o.oauthError=c.oauthError),s=c.status>=500||c.oauthError==="server_error",pe(o,"error",r)}else s=!0,pe(o,"error",r)}if(s){let i=r instanceof Error?r:new Error("Non-Error thrown from OAuth handler",{cause:r});e.log.error(o,i.message)}else e.log.warn(o,"OAuth handler rejected the request")}n(nt,"logUnexpectedOAuthHandlerError");function Mf(e){let t;try{t=new URL(e.redirectUri)}catch{return co({error:e.errorCode,...e.errorDescription===void 0?{}:{errorDescription:e.errorDescription}})}t.searchParams.set("error",e.errorCode),e.errorDescription!==void 0&&t.searchParams.set("error_description",e.errorDescription),e.clientState!==void 0&&t.searchParams.set("state",e.clientState);let r=new Headers({location:t.toString(),"cache-control":"no-store"});return new Response(null,{status:302,headers:r})}n(Mf,"downstreamAuthorizeRedirectErrorResponse");function vt(e){let t=e.issues[0];if(!t)return;let r=t.path.join(".");return r?`${r}: ${t.message}`:t.message}n(vt,"formatZodErrorDetail");function pC(e,t){let r={event:"browser_login_callback_failed",code:Ze(t)??"invalid_request"};pe(r,"error",t),e.log.warn(r,"Browser login callback failed; client received a connection-failure page")}n(pC,"logBrowserLoginCallbackFailure");function zf(e){e.location.hash||(e.location.hash="#");let t=new Headers({location:e.location.toString(),"cache-control":"no-store"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(null,{status:302,headers:t})}n(zf,"redirectResultResponse");function xs(e){if(e.kind==="setup_page"){let t=new Headers({"content-type":eC,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"});return e.setCookie&&t.append("set-cookie",e.setCookie),new Response(e.html,{status:200,headers:t})}return zf(e)}n(xs,"authorizeResultResponse");async function qf(e,t){try{return Response.json(ul(e.url,e.headers))}catch(r){return nt(t,"oauth_authorization_server_metadata_failed",r),Pf(e,t,r)}}n(qf,"authorizationServerMetadataHandler");async function Nf(e,t){try{let r=ai(e.params.routePath);return Response.json(ll({operationId:r.operationId,requestUrl:e.url,requestHeaders:e.headers}))}catch(r){return nt(t,"oauth_authorization_server_metadata_failed",r),Pf(e,t,r)}}n(Nf,"scopedAuthorizationServerMetadataHandler");async function jf(e,t){try{let r=await Bh(await rC(e)),o=r.client_id,s=r.client_name,i=r.redirect_uris.length,c=r.token_endpoint_auth_method;return t.log.info({event:"oauth_dcr_client_registered",clientId:o,clientName:s,redirectUriCount:i,tokenEndpointAuthMethod:c},"OAuth Dynamic Client Registration completed"),J(t,{eventType:B.MCP_OAUTH_CLIENT_REGISTERED,outcome:"success",clientName:s,attributes:{clientId:o,redirectUriCount:i,tokenEndpointAuthMethod:c}}),Response.json(r,{status:201,headers:{"cache-control":"no-store"}})}catch(r){return nt(t,"oauth_register_failed",r),Pa(r)}}n(jf,"registerHandler");async function Df(e,t){try{return xs(await Ca(e,{context:t}))}catch(r){return nt(t,"oauth_authorize_failed",r),Aa(e,t,r)}}n(Df,"authorizeHandler");async function $f(e,t){try{let r=ai(e.params.routePath);return xs(await Ca(e,{operationId:r.operationId,context:t}))}catch(r){return nt(t,"oauth_authorize_scoped_failed",r),Aa(e,t,r)}}n($f,"scopedAuthorizeHandler");async function Lf(e,t){try{let r=await mf(e,{context:t});return t.log.info({event:"browser_login_callback_completed",resultKind:r.kind},"Browser login callback completed; consent setup rendered"),xs(r)}catch(r){return pC(t,r),Uf(e,t,r)}}n(Lf,"callbackHandler");async function Hf(e,t){try{return zf(await hf(e))}catch(r){return nt(t,"oauth_dev_login_failed",r),Aa(e,t,r)}}n(Hf,"devLoginHandler");async function Bf(e,t){try{if(!["GET","POST"].includes(e.method))return new Response(null,{status:405,headers:{allow:"GET, POST"}});let r=await ff({request:e,body:e.method==="POST"?await Ea(e):void 0,context:t});return xs(r)}catch(r){return nt(t,"oauth_setup_failed",r),Uf(e,t,r)}}n(Bf,"setupHandler");async function Ff(e,t){try{return Response.json(await kf({body:await Ea(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),{headers:{"cache-control":"no-store",pragma:"no-cache"}})}catch(r){return nt(t,"oauth_token_failed",r),Pa(r)}}n(Ff,"tokenHandler");async function Gf(e,t){try{return await Ef({body:await Ea(e),authorizationHeader:e.headers.get("authorization"),requestUrl:e.url,requestHeaders:e.headers,context:t}),new Response(null,{status:200,headers:{"cache-control":"no-store"}})}catch(r){return nt(t,"oauth_revoke_failed",r),Pa(r)}}n(Gf,"revokeHandler");var Jf="0.0.0",mC=new Set(["image/png","image/jpeg","image/jpg","image/svg+xml","image/webp"]);function uo(...e){for(let t of e)if(t!==void 0&&t.trim().length>0)return t}n(uo,"firstNonBlank");function lo(e,t){let r=[...e];return r.length<=t?e:`${r.slice(0,t-3).join("")}...`}n(lo,"clampToCodePoints");function hC(e){let t=2166136261;for(let r=0;r<e.length;r++)t^=e.charCodeAt(r),t=Math.imul(t,16777619)>>>0;return t.toString(16).padStart(8,"0")}n(hC,"shortHash");function Vf(e,t){let r=[...e];if(r.length<=t)return e;let o=`-${hC(e)}`;return t<=o.length?r.slice(0,t).join(""):`${r.slice(0,t-o.length).join("")}${o}`}n(Vf,"clampNameSegment");function fC(e){let t=e.replace(/[^A-Za-z0-9._-]+/gu,"-").replace(/^[-.]+|[-.]+$/gu,"");return t.length>0?t:"server"}n(fC,"sanitizeRegistryNameSegment");var gC=/^\d{1,3}(\.\d{1,3}){3}$/u;function yC(e){let t=new URL(e).hostname.toLowerCase();if(gC.test(t)||t.startsWith("["))return"local";let r=t.split(".").reverse().map(o=>o.replace(/[^a-z0-9-]+/gu,"-").replace(/^-+|-+$/gu,"")).filter(o=>o.length>0);return r.length>0?r.join("."):"local"}n(yC,"buildRegistryNamespaceFromOrigin");function SC(e){if(e!==void 0)try{let t=new URL(e);return t.protocol!=="https:"&&t.protocol!=="http:"?void 0:t.toString()}catch{return}}n(SC,"sanitizeWebsiteUrl");function _C(e){if(e===void 0)return;let t=[];for(let r of e){if(typeof r.src!="string"||r.src.length===0)continue;let o;try{let i=new URL(r.src);if(i.protocol!=="https:")continue;o=i.toString()}catch{continue}if(o.length>255||r.mimeType!==void 0&&!mC.has(r.mimeType))continue;let s=r.sizes?.filter(i=>/^(\d+x\d+|any)$/u.test(i));t.push({src:o,...r.mimeType===void 0?{}:{mimeType:r.mimeType},...s===void 0||s.length===0?{}:{sizes:s},...r.theme===void 0?{}:{theme:r.theme}})}return t.length>0?t:void 0}n(_C,"sanitizeIcons");function wC(e){return e.replace(/^\/+|\/+$/gu,"").split("/").join("-")}n(wC,"localNameFromRoutePath");function Kf(e){return e.includes("{")||e.includes(":")}n(Kf,"isParameterizedRoutePath");var RC=/^\s*[~^<>=]|\s|\|\||(?:^|[.\s])[x*](?:$|[.\s])/u;function Wf(e){let t=uo(e)??Jf;return RC.test(t)?Jf:lo(t,255)}n(Wf,"sanitizeRegistryVersion");function Zf(e){let t=Vf(yC(e.origin),150),r=200-t.length-1,o=new Set,s=[];function i(a){let u=Vf(fC(a),r),p=u;for(let h=2;o.has(p);h++){let f=`-${h}`;p=`${[...u].slice(0,r-f.length).join("")}${f}`}return o.add(p),p}n(i,"claimLocalName");function c(a,u){let p=`${t}/${i(a)}`;s.push({name:p,response:{server:{...u,name:p},_meta:{"io.modelcontextprotocol.registry/official":{status:"active",isLatest:!0}}}})}n(c,"pushEntry");for(let a of e.registry.byRoutePath.values()){if(Kf(a.routePath))continue;let u=a.connection,p=u?.serverInfo,h=lo(uo(u?.description,p?.description,u?.displayName,a.operationId)??a.operationId,100),f=uo(p?.title,u?.displayName),y=SC(p?.websiteUrl),S=_C(p?.icons);c(a.operationId,{description:h,...f===void 0?{}:{title:lo(f,100)},version:Wf(p?.version),...y===void 0?{}:{websiteUrl:y},...S===void 0?{}:{icons:S},remotes:[{type:"streamable-http",url:new URL(a.routePath,e.origin).toString()}]})}for(let a of e.registry.standaloneMcpRoutes){if(Kf(a.routePath))continue;let u=a.operationId??wC(a.routePath),p=lo(uo(a.summary,a.description,a.serverName,a.operationId,u)??u,100),h=uo(a.serverName);c(u,{description:p,...h===void 0?{}:{title:lo(h,100)},version:Wf(a.serverVersion),remotes:[{type:"streamable-http",url:new URL(a.routePath,e.origin).toString()}]})}return s}n(Zf,"buildMcpRegistryDirectory");var bC=30,Yf=100;function Ne(e,t){return Promise.resolve(Response.json({error:t},{status:e}))}n(Ne,"registryErrorResponse");function Ua(e){return Zf({registry:Se(),origin:Y(e.url,e.headers)})}n(Ua,"readEntries");function xa(e){if(typeof e!="string")return{ok:!1};try{return{ok:!0,value:decodeURIComponent(e)}}catch{return{ok:!1}}}n(xa,"decodePathParam");function Xf(e,t){return e.find(r=>r.name===t)}n(Xf,"findEntryByName");function vC(e){let t=e.get("limit");return t===null?{ok:!0,value:bC}:!/^\d+$/u.test(t)||Number.parseInt(t,10)<1?{ok:!1}:{ok:!0,value:Math.min(Number.parseInt(t,10),Yf)}}n(vC,"parseLimit");function IC(e){let t=e.get("cursor");return t===null?{ok:!0,value:0}:/^\d+$/u.test(t)?{ok:!0,value:Number.parseInt(t,10)}:{ok:!1}}n(IC,"parseCursor");var CC=/^(\d{4})-(\d{2})-(\d{2})T([01]\d|2[0-3]):([0-5]\d):([0-5]\d)(\.\d+)?(Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/u;function TC(e){let t=CC.exec(e);if(!t)return!1;let[,r,o,s,i,c,a]=t,u=new Date(Date.UTC(Number(r),Number(o)-1,Number(s),Number(i),Number(c),Number(a)));return u.getUTCFullYear()===Number(r)&&u.getUTCMonth()===Number(o)-1&&u.getUTCDate()===Number(s)&&u.getUTCHours()===Number(i)&&u.getUTCMinutes()===Number(c)&&u.getUTCSeconds()===Number(a)}n(TC,"isValidRfc3339Timestamp");async function Qf(e,t){let r=new URL(e.url).searchParams,o=vC(r);if(!o.ok)return Ne(400,`Invalid 'limit' parameter: expected a positive integer (max ${Yf}).`);let s=IC(r);if(!s.ok)return Ne(400,"Invalid 'cursor' parameter: pass the exact 'metadata.nextCursor' value returned by a previous list response.");let i=r.get("updated_since");if(i!==null&&!TC(i))return Ne(400,"Invalid 'updated_since' parameter: expected an RFC3339 timestamp like 2025-08-07T13:15:04Z.");let c=r.get("search")?.toLowerCase(),a=r.get("version"),u=Ua(e).sort((f,y)=>f.name<y.name?-1:f.name>y.name?1:0);c!==void 0&&c!==""&&(u=u.filter(f=>f.name.toLowerCase().includes(c))),a!==null&&a!=="latest"&&(u=u.filter(f=>f.response.server.version===a));let p=u.slice(s.value,s.value+o.value),h=s.value+o.value;return Response.json({servers:p.map(f=>f.response),metadata:{count:p.length,...h<u.length?{nextCursor:String(h)}:{}}})}n(Qf,"listMcpRegistryServersHandler");async function eg(e,t){let r=xa(e.params.serverName);if(!r.ok)return Ne(400,"Invalid server name: the name must be URL-encoded (e.g. 'com.example%2Fmy-server').");let o=Xf(Ua(e),r.value);return o===void 0?Ne(404,"Server not found"):Response.json({servers:[o.response],metadata:{count:1}})}n(eg,"listMcpRegistryServerVersionsHandler");async function tg(e,t){let r=xa(e.params.serverName);if(!r.ok)return Ne(400,"Invalid server name: the name must be URL-encoded (e.g. 'com.example%2Fmy-server').");let o=xa(e.params.version);if(!o.ok)return Ne(400,"Invalid version: malformed encoding.");let s=Xf(Ua(e),r.value);return s===void 0?Ne(404,"Server not found"):o.value!=="latest"&&o.value!==s.response.server.version?Ne(404,"Server or version not found"):Response.json(s.response)}n(tg,"getMcpRegistryServerVersionHandler");function Us(e,t){return(r,o)=>Ne(e,t)}n(Us,"createWriteNotSupportedHandler");async function rg(e,t){return Ne(404,"Not found")}n(rg,"mcpRegistryNotFoundHandler");var ng=Us(501,"Publishing is not supported by this registry"),og=Us(501,"Updates are not supported by this registry"),sg=Us(501,"Deletion is not supported by this registry"),Oa=Us(403,"You do not have publish or edit permissions for this server");function ig(e){return $`<section class="page-section" aria-labelledby="result-next-steps"><h2 class="section-label" id="result-next-steps">What to do next</h2><ol class="steps" role="list">${e.steps}</ol></section>`}n(ig,"renderBrowserResult");var kC="text/html; charset=utf-8";function EC(e){return Nr({title:e.title,iconHref:Hi(e.host),styles:qr,headerIcon:Is("success"),heading:e.title,subhead:$`<p class="card__subtitle">${e.detail}</p>`,body:ig({steps:Mr(e.steps.map(t=>$`<li>${t}</li>`))}),footer:""})}n(EC,"browserResultHtml");function PC(e,t=200){return new Response(zr(e),{status:t,headers:{"content-type":kC,"cache-control":"no-store","referrer-policy":"no-referrer","x-frame-options":"DENY"}})}n(PC,"browserResultResponse");function ag(e){return PC(EC(e))}n(ag,"browserConnectionSuccessResponse");function Os(e,t,r={}){let o=Ju(t);return Fe({host:e,kind:AC(t),detail:o.body,developerDetail:r.developerDetail,code:t,diagnostic:r.diagnostic,upstreamHtml:r.upstreamHtml})}n(Os,"browserConnectionFailureResponse");function AC(e){switch(e){case"provider_access_denied":return"access_denied";case"oauth_state_invalid":case"oauth_state_expired":case"oauth_state_reused":case"oauth_callback_mismatch":return"session_expired";case"browser_login_verification_failed":case"upstream_token_exchange_failed":case"upstream_token_response_invalid":return"connection_failed";case"upstream_oauth_discovery_unavailable":case"upstream_oauth_issuer_mismatch":case"upstream_oauth_server_incompatible":case"upstream_provider_access_denied":case"upstream_client_registration_required":return"admin_required"}}n(AC,"readCallbackFailureBrowserErrorKind");var xC={connect:"Connect",callback_authorization_code:"Callback",callback_provider_error:"Callback",callback_invalid:"Callback",client_metadata:"Client metadata"},cg=Symbol("upstream-request");function po(e,t){Object.defineProperty(e,cg,{configurable:!0,value:t})}n(po,"setUpstreamRequestContext");function UC(e){let t=e[cg];if(!t)throw new ye("Upstream request context has not been set");return t}n(UC,"readUpstreamRequestContext");function OC(e,t){return t.some(r=>r===e)}n(OC,"requestContextMatchesKind");function MC(e){return typeof e=="string"?[e]:e}n(MC,"toExpectedKinds");function mo(e,t){let r=UC(e),o=MC(t);if(!OC(r.kind,o)){let s=xC[o[0]];throw new ye(`${s} request context has not been set`)}return r}n(mo,"requireUpstreamRequestContext");function It(e){if(typeof e=="string"&&e.length!==0)return e}n(It,"readOptionalQueryString");function zC(e,t){let r=e.params[t];if(typeof r!="string"||r.length===0)throw new ye(`Validated path parameter ${t} is missing`);return qC(r,t)}n(zC,"requirePathString");function qC(e,t){try{return decodeURIComponent(e)}catch(r){throw new v({message:`Path parameter "${t}" must be valid URL encoding.`,extensionMembers:{[C]:"invalid_request"}},{cause:r})}}n(qC,"decodePathString");function NC(e){let t=It(e);return t?Jo.parse(t):void 0}n(NC,"readOptionalOperationId");function jC(e){let t=Se().connectionsById.get(e);if(t!==void 0)return t.authProfileId;throw new v({message:`No upstream connection is registered for ${e}.`,extensionMembers:{[C]:"unknown_upstream_server"}})}n(jC,"readRegisteredAuthProfileId");function DC(e){let t=NC(e);if(!t)throw new v({message:"operationId query parameter is required.",extensionMembers:{[C]:"invalid_request"}});return t}n(DC,"readRequiredOperationId");async function $C(e,t){let r=bs(t,DC(e.query.operationId));if(r.authMode==="id-jag")throw new v({message:"This upstream uses XAA / ID-JAG and does not support browser OAuth connection flows.",extensionMembers:{[C]:"invalid_request"}});let o=e.query.redirect==="true",s=It(e.query.browserTicket);if(e.user){if(s)throw new v({message:"Use either an authenticated gateway request or a browser connect ticket, not both.",extensionMembers:{[C]:"invalid_request"}});let a=Lt(e.user,e.url),u={kind:"connect",...Or(r,a.subjectId),redirect:o},p=Zu(It(e.query.returnTo));return p!==void 0&&(u.returnTo=p),u}if(!s)throw new v({message:"Authentication is required to start the upstream connection flow.",extensionMembers:{[C]:"authentication_required"}});let i=await lm(s);if(i.ownerMode!==r.ownerMode||i.upstreamServerId!==r.upstreamServerId||i.authProfileId!==r.authProfileId||i.operationId!==r.operationId)throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[C]:"oauth_callback_mismatch"}});await pm(i);let c=Vo(i);switch(r.authMode){case"shared-oauth":{if(c.mode!=="shared")throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[C]:"oauth_callback_mismatch"}});let a={kind:"connect",...r,authMode:"shared-oauth",ownerMode:"shared",owner:c,initiatedBySubjectId:i.initiatedBySubjectId,redirect:o};return i.returnTo!==void 0&&(a.returnTo=i.returnTo),a}case"user-oauth":{if(c.mode!=="user")throw new v({message:"Browser connect ticket did not match the requested upstream flow",extensionMembers:{[C]:"oauth_callback_mismatch"}});let a={kind:"connect",...r,authMode:"user-oauth",ownerMode:"user",owner:c,initiatedBySubjectId:i.initiatedBySubjectId,redirect:o};return i.returnTo!==void 0&&(a.returnTo=i.returnTo),a}}}n($C,"resolveConnectContext");async function LC(e,t,r){let o=Wu.parse(zC(e,"connection"));switch(r){case"connect":po(e,await $C(e,o));return;case"callback":{let s=It(e.query.error);if(s){let a={kind:"callback_provider_error",upstreamServerId:o,error:s},u=It(e.query.error_description);u!==void 0&&(a.errorDescription=u),po(e,a);return}let i=It(e.query.code),c=It(e.query.state);if(i&&c){let a=It(e.query.iss);po(e,{kind:"callback_authorization_code",upstreamServerId:o,code:i,state:c,...a===void 0?{}:{iss:a}});return}po(e,{kind:"callback_invalid",upstreamServerId:o});return}case"client_metadata":po(e,{kind:"client_metadata",upstreamServerId:o,authProfileId:jC(o)});return}}n(LC,"resolveUpstreamRequestInbound");async function HC(e,t,r){try{await LC(e,t,r);return}catch(o){let s=o instanceof v?o.extensionMembers?.[C]:void 0,i=o instanceof Error?o.message:void 0;switch(s){case"invalid_request":case"unknown_upstream_server":case"oauth_callback_mismatch":return jt.badRequest(e,t,{code:s,detail:i});case"authentication_required":return jt.unauthorized(e,t,{code:s,detail:i});default:throw o}}}n(HC,"applyUpstreamRequestContext");function Ms(e,t){return n(async(o,s)=>{let i=await HC(o,s,e);return i||t(o,s)},"wrapped")}n(Ms,"withUpstreamRequestContext");var BC=["callback_authorization_code","callback_provider_error","callback_invalid"];function Ma(e){try{return new URL(e.url).pathname}catch{return}}n(Ma,"readBrowserRequestPath");function FC(e){return"cause"in e?e.cause:void 0}n(FC,"readErrorCause");function GC(e){return e.stack?.split(`