drafter-mcp 0.26.1 → 0.26.2

package/drafter-mcp.js

@@ -7,7 +7,7 @@ import { join, posix, win32 } from "node:path";
 import { parseArgs } from "node:util";
 import { constants } from "node:fs";
 import { lstat, open, readdir, realpath, stat } from "node:fs/promises";
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/chunk-vYduTEsO.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -38,7 +38,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	value: mod,
 	enumerable: true
 }) : target, mod));
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/dialects-CDpMbily.mjs
 /**
 * Canonical `$schema` URIs per supported dialect (http + https variants, trailing-`#` stripped).
 */
@@ -7426,6 +7426,7 @@ const ServerResultSchema = union([
 	ListToolsResultSchema,
 	SubscriptionsListenResultSchema
 ]);
+// ../../node_modules/.pnpm/@modelcontextprotocol+core@2.4.0/node_modules/@modelcontextprotocol/core/dist/auth-UMQCo-ad.mjs
 /**
 * Reusable URL validation that disallows `javascript:` scheme
 */
@@ -7628,7 +7629,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token: string(),
 	token_type_hint: string().optional()
 }).strip();
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/src-DdvbAHrR.mjs
 /**
 * Cross-bundle `instanceof` support for the SDK error classes.
 *
@@ -11889,25 +11890,22 @@ const X_MCP_HEADER_KEY = "x-mcp-header";
 */
 const RFC9110_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
 /**
-* JSON Schema `type` values the spec admits on an `x-mcp-header` property.
-*
-* The spec text names `integer`, `string`, `boolean` and explicitly excludes
-* `number`. The published conformance referee at the pinned release ships its
-* `http-custom-headers` scenario with two `type: "number"` `x-mcp-header`
-* parameters and expects the client to mirror them, so `number` is accepted
-* here so that the conformance gate passes; the discrepancy is tracked
-* upstream. Everything else (`object`, `array`, `null`, absent) is rejected.
+* JSON Schema `type` values the spec admits on an `x-mcp-header` property:
+* `integer`, `string` and `boolean`. `number` is explicitly not permitted
+* (2026-07-28 Streamable HTTP, "Schema Extension"), so a tool that annotates a
+* `number`-typed property is invalid (the server still checks its headers).
+* Everything else (`object`, `array`, `null`, absent) is rejected too.
 */
 const PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 	"string",
 	"integer",
-	"boolean",
-	"number"
+	"boolean"
 ]);
 /**
 * Scan a tool's JSON-serialized `inputSchema` for `x-mcp-header` declarations
 * and validate every constraint the spec places on them. Returns either the
-* collected declarations (possibly empty) or the first violated constraint.
+* collected declarations (possibly empty) or the first violated constraint
+* (with the declarations too, when `number`-typed declarations are the only fault).
 *
 * The walk descends through `properties` at any depth (the spec's "any nesting
 * depth" clause). The static-reachability MUST is enforced as a structural
@@ -11920,6 +11918,7 @@ const PERMITTED_X_MCP_HEADER_TYPES = /* @__PURE__ */ new Set([
 function scanXMcpHeaderDeclarations(inputSchema) {
 	const declarations = [];
 	const seenLower = /* @__PURE__ */ new Map();
+	let numberFault;
 	const visit = (node, path, reachable) => {
 		if (node === null || typeof node !== "object") return void 0;
 		const schema = node;
@@ -11929,7 +11928,11 @@ function scanXMcpHeaderDeclarations(inputSchema) {
 			if (typeof raw !== "string" || raw.length === 0) return `${pathName(path)}: x-mcp-header MUST be a non-empty string`;
 			if (!RFC9110_TOKEN.test(raw)) return `${pathName(path)}: x-mcp-header '${raw}' is not a valid RFC 9110 token (no spaces, control characters or HTTP delimiters)`;
 			const type = typeof schema.type === "string" ? schema.type : void 0;
-			if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) return `${pathName(path)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+			if (type === void 0 || !PERMITTED_X_MCP_HEADER_TYPES.has(type)) {
+				const fault$1 = `${pathName(path)}: x-mcp-header is only permitted on primitive-typed properties (string, integer, boolean); got ${type ?? "<none>"}`;
+				if (type !== "number") return fault$1;
+				numberFault ??= fault$1;
+			}
 			const lower = raw.toLowerCase();
 			const prior = seenLower.get(lower);
 			if (prior !== void 0) return `x-mcp-header '${raw}' is not case-insensitively unique (also declared as '${prior}')`;
@@ -11956,12 +11959,17 @@ function scanXMcpHeaderDeclarations(inputSchema) {
 		}
 	};
 	const fault = visit(inputSchema, [], true);
-	return fault === void 0 ? {
+	if (fault !== void 0) return {
+		valid: false,
+		reason: numberFault ?? fault
+	};
+	return numberFault === void 0 ? {
 		valid: true,
 		declarations
 	} : {
 		valid: false,
-		reason: fault
+		reason: numberFault,
+		declarations
 	};
 }
 /**
@@ -12003,8 +12011,115 @@ const OBJECT_VALUED_SUBSCHEMA_KEYWORDS = /* @__PURE__ */ new Set([
 function pathName(path) {
 	return path.length === 0 ? "<root>" : path.join(".");
 }
+/**
+* Inbound HTTP request classification and the inbound validation ladder
+* (protocol revision 2026-07-28).
+*
+* `classifyInboundRequest` is the body-primary era predicate for an HTTP
+* entry that serves both protocol eras on one endpoint. It is evaluated
+* exactly once, at the entry boundary, on the already-parsed request body:
+*
+* - `initialize` is a legacy-era request by definition (the modern era has no
+*   `initialize` handshake) — unless it carries a valid envelope claim naming
+*   a modern revision, in which case the claim wins and the request is
+*   classified like any other enveloped request (the modern era then answers
+*   it with method-not-found, exactly like every other method it does not
+*   define).
+* - A request whose `params._meta` carries the reserved protocol-version key
+*   claims the per-request envelope mechanism and classifies into the era the
+*   named revision belongs to (a malformed envelope behind a present claim is
+*   a validation error, never a silent fall back to legacy handling).
+* - A request without a claim is legacy-era traffic.
+* - The `MCP-Protocol-Version` header is a cross-check only *for
+*   classification*: it never upgrades or downgrades a body-derived
+*   classification, and a disagreement between header and body is an explicit
+*   ladder outcome. Its absence likewise never changes the era — but the spec
+*   requires the header on every modern *request* POST, so a
+*   modern-classified request that omits it is refused one rung later, by
+*   {@linkcode validateStandardRequestHeaders}, not here. Notification POSTs
+*   are exempt (see the next bullet), and that rung enforces presence on
+*   requests only.
+* - Notifications carry no envelope claim of their own under the current
+*   spec, so for notification POSTs without a body claim the modern header is
+*   determinative; the `Mcp-Method` header is validated against the body when
+*   the message classifies modern and is never enforced on legacy traffic.
+*   A notification that does carry a claim is treated body-primary like a
+*   request, and a malformed claim is rejected the same way a request's
+*   malformed claim is — never silently resolved against the header.
+*   The notification-POST header cross-checks here are an SDK-defensive
+*   posture, not a spec requirement: the spec leaves header rules for posted
+*   notifications undefined (core client notifications do not occur over
+*   Streamable HTTP); applying the request rules symmetrically is what an
+*   ecosystem custom-notification POST expects, and the −32020 cells stay
+*   passing for them.
+* - `GET`/`DELETE` (and any other non-`POST` method) are body-less 2025-era
+*   session operations: the modern era is `POST`-only, so they are routed to
+*   legacy serving when it is configured and rejected otherwise.
+* - Array (batch) bodies are classified element-wise: an array containing a
+*   modern-claiming or invalid element is rejected, an all-legacy array is
+*   legacy traffic unchanged, and a single-element array is still an array.
+*
+* The classifier returns plain values (it never throws and never touches a
+* transport): a routing outcome (`legacy`/`modern`) or a ladder rejection
+* carrying the JSON-RPC error to emit and the HTTP status to emit it with.
+* Legacy routing outcomes deliberately carry NO `MessageClassification` —
+* legacy and hand-wired traffic is never classified, which keeps its
+* dispatch behavior byte-identical to today's.
+*
+* Error codes for the modern-path rejection cells follow the published
+* conformance suite (and the spec text it asserts):
+*
+* - A header/body cross-check mismatch (the `MCP-Protocol-Version` header
+*   disagreeing with the body, or the `Mcp-Method` header disagreeing with the
+*   body method) is rejected with `-32020` (`HeaderMismatch`) on HTTP 400.
+* - A request whose protocol-version header names a modern revision but whose
+*   body carries no `_meta` envelope claim — including an envelope present but
+*   missing the required protocol-version key — is rejected with `-32602`
+*   (invalid params) naming the missing key(s), on HTTP 400.
+*
+* Should a future spec revision or conformance release change these
+* assignments, the affected cells are re-derived against that release; the
+* `settled` flag on {@linkcode InboundLadderRejection} stays available to mark
+* a cell provisional again while such a change is in flight.
+*/
+/**
+* The error code emitted for header/body cross-check mismatches: the
+* `MCP-Protocol-Version` header disagreeing with the body's envelope claim (or
+* with the body's classification), and the `Mcp-Method` header disagreeing
+* with the body method.
+*
+* `-32020` is the draft schema's `HEADER_MISMATCH` constant (the SEP-2243
+* `HeaderMismatch` code; the spec requires HTTP 400 for it), as also asserted
+* by the published conformance suite for header-validation failures. It has no
+* {@linkcode ProtocolErrorCode} member because it is not part of the 2025-era
+* wire vocabulary; the validation ladder is its only emitter.
+*/
+const HEADER_MISMATCH_ERROR_CODE = -32020;
 ProtocolErrorCode.InvalidRequest, ProtocolErrorCode.UnsupportedProtocolVersion, ProtocolErrorCode.InvalidParams, ProtocolErrorCode.MethodNotFound, ProtocolErrorCode.InvalidParams, ProtocolErrorCode.MissingRequiredClientCapability;
-ProtocolErrorCode.ParseError, ProtocolErrorCode.InvalidRequest, ProtocolErrorCode.MethodNotFound, ProtocolErrorCode.UnsupportedProtocolVersion, ProtocolErrorCode.MissingRequiredClientCapability;
+/**
+* HTTP status for ladder-originated JSON-RPC error codes.
+*
+* Keyed on origin, not on the bare code: this table only applies to errors
+* the ladder (or a pre-handler protocol gate) produced. Errors produced by
+* request handlers — whatever their code — stay in-band on HTTP 200, and are
+* never mapped to an HTTP status by this table; in particular `-32603` and
+* domain-specific codes never become a blanket 500. The single exception is
+* `MissingRequiredClientCapability` (-32021) — see
+* {@linkcode httpStatusForErrorCode}.
+*
+* `-32602` (invalid params) deliberately has NO entry: the only invalid-params
+* rejection that maps to HTTP 400 is the classifier's own envelope rung
+* short-circuit, which carries its HTTP status directly. A dispatch- or
+* handler-produced invalid-params error is always in-band.
+*/
+const LADDER_ERROR_HTTP_STATUS = {
+	[ProtocolErrorCode.ParseError]: 400,
+	[ProtocolErrorCode.InvalidRequest]: 400,
+	[ProtocolErrorCode.MethodNotFound]: 404,
+	[ProtocolErrorCode.UnsupportedProtocolVersion]: 400,
+	[ProtocolErrorCode.MissingRequiredClientCapability]: 400,
+	[HEADER_MISMATCH_ERROR_CODE]: 400
+};
 function rejection(rung, cell, httpStatus, error, settled) {
 	return {
 		kind: "reject",
@@ -12141,22 +12256,26 @@ function standardSchemaToJsonSchema(schema, io = "input") {
 		...result
 	};
 }
+const LOCAL_DEFINITION_REF = /^#\/(\$defs|definitions)\/([^/~%]+)$/;
 /**
 * A typeless JSON Schema root is "provably object-shaped" when either it carries object keywords
 * directly (`properties`/`patternProperties`/`additionalProperties`/`required`), or it is a
 * composition (`oneOf`/`anyOf`/`allOf`) whose every member is itself `type:'object'` or recursively
-* provably object-shaped (e.g. a nested `discriminatedUnion`). `$ref` is not followed. Used to
+* provably object-shaped (e.g. a nested `discriminatedUnion`). A `$ref` is followed one hop, to an
+* entry of the root's `$defs`/`definitions` that is itself `type:'object'`. Used to
 * decide whether stamping `type:'object'` is safe (redundant-but-valid) versus self-contradictory.
 */
-function isProvablyObjectShapedRoot(schema) {
+function isProvablyObjectShapedRoot(schema, root = schema) {
 	if ("properties" in schema || "patternProperties" in schema || "additionalProperties" in schema || "required" in schema) return true;
+	const ref = typeof schema.$ref === "string" && LOCAL_DEFINITION_REF.exec(schema.$ref);
+	if (ref && root[ref[1]]?.[ref[2]]?.type === "object") return true;
 	for (const key of [
 		"oneOf",
 		"anyOf",
 		"allOf"
 	]) {
 		const members = schema[key];
-		if (Array.isArray(members) && members.length > 0) return members.every((m) => m !== null && typeof m === "object" && (m.type === "object" || isProvablyObjectShapedRoot(m)));
+		if (Array.isArray(members) && members.length > 0) return members.every((m) => m !== null && typeof m === "object" && (m.type === "object" || isProvablyObjectShapedRoot(m, "$id" in m ? {} : root)));
 	}
 	return false;
 }
@@ -13821,7 +13940,7 @@ function normalizeRawShapeSchema(schema) {
 	if (!isStandardSchema(schema)) throw new TypeError("inputSchema/outputSchema/argsSchema must be a Standard Schema (e.g. z.object({...})) or a raw Zod shape ({ field: z.string() }).");
 	return schema;
 }
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-DyjnscPj.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -16499,6 +16618,28 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
 	/** @type {(value: string) => boolean} */
 	const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+	/** @type {(value: string) => boolean} */
+	const isPort = RegExp.prototype.test.bind(/^\d*$/u);
+	/** @type {(value: string) => boolean} */
+	const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+	/** @type {(value: string) => boolean} */
+	const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+	/** @type {(value: string) => boolean} */
+	const isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+	/** @type {(value: string) => boolean} */
+	const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+	/** @type {(value: string) => boolean} */
+	const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+	const BYTE_HEX = new Array(256);
+	{
+		const HEX_DIGITS = "0123456789ABCDEF";
+		for (let i = 0; i < 256; i++) BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+	}
+	function percentEncodeNonAscii(cp) {
+		if (cp < 2048) return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+		if (cp < 65536) return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+		return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+	}
 	/**
 	* @param {Array<string>} input
 	* @returns {string}
@@ -16521,119 +16662,162 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 		return acc;
 	}
-	/**
-	* @typedef {Object} GetIPV6Result
-	* @property {boolean} error - Indicates if there was an error parsing the IPv6 address.
-	* @property {string} address - The parsed IPv6 address.
-	* @property {string} [zone] - The zone identifier, if present.
-	*/
+	/** @type {(value: string) => boolean} */
+	const isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+	/** @type {(value: string) => boolean} */
+	const isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+	/** @type {(value: string) => boolean} */
+	const isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
 	/**
 	* @param {string} value
 	* @returns {boolean}
 	*/
 	const nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
 	/**
-	* @param {Array<string>} buffer
+	* @param {string} zone
 	* @returns {boolean}
 	*/
-	function consumeIsZone(buffer) {
-		buffer.length = 0;
+	function isZoneIdentifier(zone) {
+		if (zone.length === 0) return false;
+		for (let i = 0; i < zone.length; i++) {
+			if (isZoneCharacter(zone[i])) continue;
+			if (zone[i] === "%" && i + 2 < zone.length && isHexPair(zone.slice(i + 1, i + 3))) {
+				i += 2;
+				continue;
+			}
+			return false;
+		}
 		return true;
 	}
 	/**
-	* @param {Array<string>} buffer
-	* @param {Array<string>} address
-	* @param {GetIPV6Result} output
-	* @returns {boolean}
+	* Compresses the longest run of zero hextets to "::" per RFC 5952. A run of a
+	* single zero hextet is left uncompressed. On ties the leftmost run wins.
+	*
+	* @param {string[]} hextets
+	* @returns {string}
 	*/
-	function consumeHextets(buffer, address, output) {
-		if (buffer.length) {
-			const hex = stringArrayToHexStripped(buffer);
-			if (hex !== "") address.push(hex);
-			else {
-				output.error = true;
-				return false;
+	function compressIPv6ZeroRun(hextets) {
+		let bestStart = -1;
+		let bestLength = 0;
+		let runStart = -1;
+		let runLength = 0;
+		for (let i = 0; i < hextets.length; i++) if (hextets[i] === "0") {
+			if (runStart === -1) runStart = i;
+			runLength++;
+			if (runLength > bestLength) {
+				bestLength = runLength;
+				bestStart = runStart;
 			}
-			buffer.length = 0;
+		} else {
+			runStart = -1;
+			runLength = 0;
 		}
-		return true;
+		if (bestLength < 2) return hextets.join(":");
+		const head = hextets.slice(0, bestStart).join(":");
+		const tail = hextets.slice(bestStart + bestLength).join(":");
+		return head + "::" + tail;
 	}
 	/**
+	* Validates an IPv6 address against the alternatives in RFC 3986 section
+	* 3.2.2 and returns the same address with leading hextet zeroes removed.
+	* An embedded IPv4 address counts as two hextets and is only valid at the end.
+	*
 	* @param {string} input
-	* @returns {GetIPV6Result}
-	*/
-	function getIPV6(input) {
-		let tokenCount = 0;
-		const output = {
-			error: false,
-			address: "",
-			zone: ""
-		};
-		/** @type {Array<string>} */
-		const address = [];
-		/** @type {Array<string>} */
-		const buffer = [];
-		let endipv6Encountered = false;
-		let endIpv6 = false;
-		let consume = consumeHextets;
-		for (let i = 0; i < input.length; i++) {
-			const cursor = input[i];
-			if (cursor === "[" || cursor === "]") continue;
-			if (cursor === ":") {
-				if (endipv6Encountered === true) endIpv6 = true;
-				if (!consume(buffer, address, output)) break;
-				if (++tokenCount > 7) {
-					output.error = true;
-					break;
-				}
-				if (i > 0 && input[i - 1] === ":") endipv6Encountered = true;
-				address.push(":");
-				continue;
-			} else if (cursor === "%") {
-				if (!consume(buffer, address, output)) break;
-				consume = consumeIsZone;
-			} else {
-				buffer.push(cursor);
+	* @returns {string|undefined}
+	*/
+	function normalizeIPv6Address(input) {
+		const compression = input.indexOf("::");
+		if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+		const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+		const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+		if (compression !== -1) {
+			if (left.length === 1 && left[0] === "") left.length = 0;
+			if (right.length === 1 && right[0] === "") right.length = 0;
+		}
+		const parts = left.concat(right);
+		let hextetCount = 0;
+		for (let i = 0; i < parts.length; i++) {
+			const part = parts[i];
+			if (part === "") return void 0;
+			if (part.indexOf(".") !== -1) {
+				if (i !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+				hextetCount += 2;
 				continue;
 			}
+			if (!isHextet(part)) return void 0;
+			parts[i] = parseInt(part, 16).toString(16);
+			hextetCount++;
 		}
-		if (buffer.length) if (consume === consumeIsZone) output.zone = buffer.join("");
-		else if (endIpv6) address.push(buffer.join(""));
-		else address.push(stringArrayToHexStripped(buffer));
-		output.address = address.join("");
-		return output;
+		if (compression === -1) {
+			if (hextetCount !== 8) return void 0;
+			return compressIPv6ZeroRun(parts);
+		}
+		if (hextetCount >= 8) return void 0;
+		const expanded = parts.slice(0, left.length);
+		for (let i = hextetCount; i < 8; i++) expanded.push("0");
+		for (let i = left.length; i < parts.length; i++) expanded.push(parts[i]);
+		return compressIPv6ZeroRun(expanded);
 	}
 	/**
 	* @typedef {Object} NormalizeIPv6Result
 	* @property {string} host - The normalized host.
 	* @property {string} [escapedHost] - The escaped host.
 	* @property {boolean} isIPV6 - Indicates if the host is an IPv6 address.
+	* @property {boolean} [isIPVFuture] - Indicates if the host is an IPvFuture literal.
+	* @property {boolean} [error] - Indicates if a bracketed IP literal is malformed.
 	*/
 	/**
+	* Validates and normalizes a bracketed IP literal. Raw zone separators remain
+	* accepted for backwards compatibility, while encoded separators and zone
+	* contents follow RFC 6874.
+	*
 	* @param {string} host
 	* @returns {NormalizeIPv6Result}
 	*/
 	function normalizeIPv6(host) {
-		if (findToken(host, ":") < 2) return {
+		const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+		if ((host[0] === "[" || host[host.length - 1] === "]") && !bracketed) return {
 			host,
-			isIPV6: false
+			isIPV6: false,
+			error: true
 		};
-		const ipv6 = getIPV6(host);
-		if (!ipv6.error) {
-			let newHost = ipv6.address;
-			let escapedHost = ipv6.address;
-			if (ipv6.zone) {
-				newHost += "%" + ipv6.zone;
-				escapedHost += "%25" + ipv6.zone;
-			}
+		let input = bracketed ? host.slice(1, -1) : host;
+		if (bracketed && isIPvFuture(input)) {
+			input = input.toLowerCase();
 			return {
-				host: newHost,
-				isIPV6: true,
-				escapedHost
+				host: `[${input}]`,
+				escapedHost: input,
+				isIPV6: false,
+				isIPVFuture: true
+			};
+		}
+		if (findToken(input, ":") < 2) return {
+			host,
+			isIPV6: false,
+			error: bracketed
+		};
+		let zoneIdentifier = "";
+		const zoneSeparator = input.indexOf("%");
+		if (zoneSeparator !== -1) {
+			const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+			zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+			if (!isZoneIdentifier(zoneIdentifier)) return {
+				host,
+				isIPV6: false,
+				error: true
 			};
-		} else return {
+			input = input.slice(0, zoneSeparator);
+		}
+		const address = normalizeIPv6Address(input);
+		if (address === void 0) return {
 			host,
-			isIPV6: false
+			isIPV6: false,
+			error: true
+		};
+		return {
+			host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+			escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+			isIPV6: true
 		};
 	}
 	/**
@@ -16721,19 +16905,264 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return output.join("");
 	}
 	/**
-	* @param {import('../types/index').URIComponent} component
-	* @param {boolean} esc
-	* @returns {import('../types/index').URIComponent}
+	* Re-escape RFC 3986 gen-delims that must not appear literally in the host.
+	* After the URI regex parses, these characters cannot be literal in the host
+	* field, so any that appear after decoding came from percent-encoding and
+	* must be restored to prevent authority structure changes.
+	*
+	* @param {string} host
+	* @param {boolean} isIP - true for IPv4/IPv6 hosts (skip colon re-escaping)
+	* @returns {string}
 	*/
-	function normalizeComponentEncoding(component, esc) {
-		const func = esc !== true ? escape : unescape;
-		if (component.scheme !== void 0) component.scheme = func(component.scheme);
-		if (component.userinfo !== void 0) component.userinfo = func(component.userinfo);
-		if (component.host !== void 0) component.host = func(component.host);
-		if (component.path !== void 0) component.path = func(component.path);
-		if (component.query !== void 0) component.query = func(component.query);
-		if (component.fragment !== void 0) component.fragment = func(component.fragment);
-		return component;
+	const HOST_DELIMS = {
+		"@": "%40",
+		"/": "%2F",
+		"?": "%3F",
+		"#": "%23",
+		":": "%3A"
+	};
+	const HOST_DELIM_RE = /[@/?#:]/g;
+	const HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+	function reescapeHostDelimiters(host, isIP) {
+		const re = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+		re.lastIndex = 0;
+		return host.replace(re, (ch) => HOST_DELIMS[ch]);
+	}
+	/**
+	* Normalizes percent escapes and optionally decodes only unreserved ASCII bytes.
+	* Reserved delimiters such as `%2F` stay escaped; `%2E` is unreserved.
+	*
+	* @param {string} input
+	* @param {boolean} [decodeUnreserved=false]
+	* @returns {string}
+	*/
+	function normalizePercentEncoding(input, decodeUnreserved = false) {
+		if (input.indexOf("%") === -1) return input;
+		let output = "";
+		for (let i = 0; i < input.length; i++) {
+			if (input[i] === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					const normalizedHex = hex.toUpperCase();
+					const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+					if (decodeUnreserved && isUnreserved(decoded)) output += decoded;
+					else output += "%" + normalizedHex;
+					i += 2;
+					continue;
+				}
+			}
+			output += input[i];
+		}
+		return output;
+	}
+	/**
+	* Normalizes path data without turning reserved escapes into live path syntax.
+	* Valid escapes are uppercased, raw unsafe characters are escaped, and only
+	* unreserved bytes that are not `.` are decoded.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function normalizePathEncoding(input) {
+		let output = "";
+		for (let i = 0; i < input.length; i++) {
+			const ch = input[i];
+			if (ch === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					const normalizedHex = hex.toUpperCase();
+					const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+					if (decoded !== "." && isUnreserved(decoded)) output += decoded;
+					else output += "%" + normalizedHex;
+					i += 2;
+					continue;
+				}
+			}
+			if (isPathCharacter(ch)) output += ch;
+			else {
+				const code = input.charCodeAt(i);
+				if (code < 128) output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+				else if (code < 55296 || code > 57343) output += percentEncodeNonAscii(code);
+				else if (code <= 56319 && i + 1 < input.length) {
+					const low = input.charCodeAt(i + 1);
+					if (low >= 56320 && low <= 57343) {
+						output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+						i++;
+					} else output += percentEncodeNonAscii(65533);
+				} else output += percentEncodeNonAscii(65533);
+			}
+		}
+		return output;
+	}
+	/**
+	* Serializes a path without rewriting reserved data. Raw RFC 3986 path
+	* characters remain literal, valid escapes are preserved and uppercased, and
+	* everything else is UTF-8 percent-encoded. In a path-noscheme, a colon in the
+	* first segment must be escaped so the result cannot be parsed as a scheme.
+	*
+	* @param {string} input
+	* @param {boolean} [pathNoScheme=false]
+	* @returns {string}
+	*/
+	function serializePathEncoding(input, pathNoScheme = false) {
+		let output = "";
+		let firstSegment = pathNoScheme && input[0] !== "/";
+		for (let i = 0; i < input.length; i++) {
+			const ch = input[i];
+			if (ch === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					output += "%" + hex.toUpperCase();
+					i += 2;
+					continue;
+				}
+			}
+			if (ch === "/") firstSegment = false;
+			if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) output += ch;
+			else {
+				const code = input.charCodeAt(i);
+				if (code < 128) output += BYTE_HEX[code];
+				else if (code < 55296 || code > 57343) output += percentEncodeNonAscii(code);
+				else if (code <= 56319 && i + 1 < input.length) {
+					const low = input.charCodeAt(i + 1);
+					if (low >= 56320 && low <= 57343) {
+						output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+						i++;
+					} else output += percentEncodeNonAscii(65533);
+				} else output += percentEncodeNonAscii(65533);
+			}
+		}
+		return output;
+	}
+	/**
+	* Percent-encodes a URI component using its RFC 3986 literal character set.
+	* Existing valid escapes are preserved and normalized to uppercase hex.
+	*
+	* @param {string} input
+	* @param {(value: string) => boolean} isAllowed
+	* @returns {string}
+	*/
+	function encodeComponent(input, isAllowed) {
+		let output = "";
+		for (let i = 0; i < input.length; i++) {
+			const ch = input[i];
+			if (ch === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					output += "%" + hex.toUpperCase();
+					i += 2;
+					continue;
+				}
+			}
+			if (isAllowed(ch)) output += ch;
+			else {
+				const code = input.charCodeAt(i);
+				if (code < 128) output += BYTE_HEX[code];
+				else if (code < 55296 || code > 57343) output += percentEncodeNonAscii(code);
+				else if (code <= 56319 && i + 1 < input.length) {
+					const low = input.charCodeAt(i + 1);
+					if (low >= 56320 && low <= 57343) {
+						output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+						i++;
+					} else output += percentEncodeNonAscii(65533);
+				} else output += percentEncodeNonAscii(65533);
+			}
+		}
+		return output;
+	}
+	/**
+	* Encodes userinfo while preserving its RFC 3986 §3.2.1 literal characters.
+	* In particular, authority delimiters such as `@`, `/`, `?`, and `#` are data.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function encodeUserinfo(input) {
+		return encodeComponent(input, isUserinfoCharacter);
+	}
+	/**
+	* Encodes query data using the RFC 3986 §3.4 grammar. A literal `#` must be
+	* escaped because it would otherwise begin the fragment component.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function encodeQuery(input) {
+		return encodeComponent(input, isQueryFragmentCharacter);
+	}
+	/**
+	* Encodes fragment data using the RFC 3986 §3.5 grammar.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function encodeFragment(input) {
+		return encodeComponent(input, isQueryFragmentCharacter);
+	}
+	function isEscapeSafe(cp) {
+		return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+	}
+	/**
+	* Normalizes the percent-encoding of a query or fragment component.
+	*
+	* Like `normalizePathEncoding`, but uses the query/fragment character set
+	* (which additionally allows `?`) and decodes `.` since it has no dot-segment
+	* meaning outside of a path.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function normalizeQueryFragmentEncoding(input) {
+		let output = "";
+		for (let i = 0; i < input.length; i++) {
+			const ch = input[i];
+			if (ch === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					const normalizedHex = hex.toUpperCase();
+					const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+					if (isUnreserved(decoded)) output += decoded;
+					else output += "%" + normalizedHex;
+					i += 2;
+					continue;
+				}
+			}
+			if (isQueryFragmentCharacter(ch)) output += ch;
+			else {
+				const code = input.charCodeAt(i);
+				if (code < 128) output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+				else if (code < 55296 || code > 57343) output += percentEncodeNonAscii(code);
+				else if (code <= 56319 && i + 1 < input.length) {
+					const low = input.charCodeAt(i + 1);
+					if (low >= 56320 && low <= 57343) {
+						output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+						i++;
+					} else output += percentEncodeNonAscii(65533);
+				} else output += percentEncodeNonAscii(65533);
+			}
+		}
+		return output;
+	}
+	/**
+	* Escapes a component while preserving existing valid percent escapes.
+	*
+	* @param {string} input
+	* @returns {string}
+	*/
+	function escapePreservingEscapes(input) {
+		let output = "";
+		for (let i = 0; i < input.length; i++) {
+			if (input[i] === "%" && i + 2 < input.length) {
+				const hex = input.slice(i + 1, i + 3);
+				if (isHexPair(hex)) {
+					output += "%" + hex.toUpperCase();
+					i += 2;
+					continue;
+				}
+			}
+			output += escape(input[i]);
+		}
+		return output;
 	}
 	/**
 	* @param {import('../types/index').URIComponent} component
@@ -16742,28 +17171,42 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	function recomposeAuthority(component) {
 		const uriTokens = [];
 		if (component.userinfo !== void 0) {
-			uriTokens.push(component.userinfo);
+			uriTokens.push(encodeUserinfo(component.userinfo));
 			uriTokens.push("@");
 		}
 		if (component.host !== void 0) {
-			let host = unescape(component.host);
+			let host = component.host;
 			if (!isIPv4(host)) {
-				const ipV6res = normalizeIPv6(host);
-				if (ipV6res.isIPV6 === true) host = `[${ipV6res.escapedHost}]`;
-				else host = component.host;
+				let ipV6res = normalizeIPv6(host);
+				if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+					host = normalizePercentEncoding(host, true);
+					ipV6res = normalizeIPv6(host);
+				}
+				if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) host = `[${ipV6res.escapedHost}]`;
+				else host = reescapeHostDelimiters(host, false);
 			}
 			uriTokens.push(host);
 		}
 		if (typeof component.port === "number" || typeof component.port === "string") {
+			const port = String(component.port);
+			if (!isPort(port)) throw new TypeError("URI port is malformed.");
 			uriTokens.push(":");
-			uriTokens.push(String(component.port));
+			uriTokens.push(port);
 		}
 		return uriTokens.length ? uriTokens.join("") : void 0;
 	}
 	module.exports = {
 		nonSimpleDomain,
 		recomposeAuthority,
-		normalizeComponentEncoding,
+		reescapeHostDelimiters,
+		normalizePercentEncoding,
+		normalizePathEncoding,
+		serializePathEncoding,
+		normalizeQueryFragmentEncoding,
+		encodeUserinfo,
+		encodeQuery,
+		encodeFragment,
+		escapePreservingEscapes,
 		removeDotSegments,
 		isIPv4,
 		isUUID,
@@ -16773,7 +17216,7 @@ var require_utils = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 }));
 var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const { isUUID } = require_utils();
-	const URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+	const URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
 	const supportedSchemeNames = [
 		"http",
 		"https",
@@ -16844,9 +17287,10 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			wsComponent.secure = void 0;
 		}
 		if (wsComponent.resourceName) {
-			const [path, query] = wsComponent.resourceName.split("?");
+			const queryIndex = wsComponent.resourceName.indexOf("?");
+			const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
 			wsComponent.path = path && path !== "/" ? path : void 0;
-			wsComponent.query = query;
+			wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
 			wsComponent.resourceName = void 0;
 		}
 		wsComponent.fragment = void 0;
@@ -16859,7 +17303,7 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			return urnComponent;
 		}
 		const matches = urnComponent.path.match(URN_REG);
-		if (matches) {
+		if (matches && matches[0] === urnComponent.path) {
 			const scheme = options.scheme || urnComponent.scheme || "urn";
 			urnComponent.nid = matches[1].toLowerCase();
 			urnComponent.nss = matches[2];
@@ -16953,8 +17397,19 @@ var require_schemes = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	};
 }));
 var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils();
+	const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
 	const { SCHEMES, getSchemeHandler } = require_schemes();
+	const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+	const MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+	/**
+	* @param {string} scheme
+	* @returns {string}
+	*/
+	function decodeValidScheme(scheme) {
+		const decodedScheme = unescape(String(scheme));
+		if (!VALID_SCHEME.test(decodedScheme)) throw new TypeError(MALFORMED_SCHEME_ERROR);
+		return decodedScheme;
+	}
 	/**
 	* @template {import('./types/index').URIComponent|string} T
 	* @param {T} uri
@@ -16962,7 +17417,7 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @returns {T}
 	*/
 	function normalize(uri, options) {
-		if (typeof uri === "string") uri = serialize(parse(uri, options), options);
+		if (typeof uri === "string") uri = normalizeString(uri, options);
 		else if (typeof uri === "object") uri = parse(serialize(uri, options), options);
 		return uri;
 	}
@@ -16974,7 +17429,16 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	*/
 	function resolve(baseURI, relativeURI, options) {
 		const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-		const resolved = resolveComponent(parse(baseURI, schemelessOptions), parse(relativeURI, schemelessOptions), schemelessOptions, true);
+		const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed, malformedPercentEncoding: baseMalformedPercentEncoding, malformedSchemeSpecific: baseMalformedSchemeSpecific, malformedHost: baseMalformedHost, malformedScheme: baseMalformedScheme } = parseWithStatus(baseURI, schemelessOptions);
+		const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed, malformedPercentEncoding: relativeMalformedPercentEncoding, malformedSchemeSpecific: relativeMalformedSchemeSpecific, malformedHost: relativeMalformedHost, malformedScheme: relativeMalformedScheme } = parseWithStatus(relativeURI, schemelessOptions);
+		if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+		const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+		const resolvedSchemeHandler = getSchemeHandler(options && options.scheme || resolved.scheme);
+		const resolvedHost = resolved.host;
+		const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+		canonicalizeHost(resolved, options || {}, resolvedSchemeHandler, resolvedHostIsIP);
+		const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !/\P{ASCII}/u.test(resolvedHost);
+		if (resolved.error && !encodedASCIIHost) throw new Error(resolved.error);
 		schemelessOptions.skipEscape = true;
 		return serialize(resolved, schemelessOptions);
 	}
@@ -17038,27 +17502,9 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	* @returns {boolean}
 	*/
 	function equal(uriA, uriB, options) {
-		if (typeof uriA === "string") {
-			uriA = unescape(uriA);
-			uriA = serialize(normalizeComponentEncoding(parse(uriA, options), true), {
-				...options,
-				skipEscape: true
-			});
-		} else if (typeof uriA === "object") uriA = serialize(normalizeComponentEncoding(uriA, true), {
-			...options,
-			skipEscape: true
-		});
-		if (typeof uriB === "string") {
-			uriB = unescape(uriB);
-			uriB = serialize(normalizeComponentEncoding(parse(uriB, options), true), {
-				...options,
-				skipEscape: true
-			});
-		} else if (typeof uriB === "object") uriB = serialize(normalizeComponentEncoding(uriB, true), {
-			...options,
-			skipEscape: true
-		});
-		return uriA.toLowerCase() === uriB.toLowerCase();
+		const normalizedA = normalizeComparableURI(uriA, options);
+		const normalizedB = normalizeComparableURI(uriB, options);
+		return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
 	}
 	/**
 	* @param {Readonly<import('./types/index').URIComponent>} cmpts
@@ -17084,13 +17530,17 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		};
 		const options = Object.assign({}, opts);
 		const uriTokens = [];
+		if (component.scheme) component.scheme = decodeValidScheme(component.scheme);
 		const schemeHandler = getSchemeHandler(options.scheme || component.scheme);
 		if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options);
-		if (component.path !== void 0) if (!options.skipEscape) {
-			component.path = escape(component.path);
-			if (component.scheme !== void 0) component.path = component.path.split("%3A").join(":");
-		} else component.path = unescape(component.path);
-		if (options.reference !== "suffix" && component.scheme) uriTokens.push(component.scheme, ":");
+		const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+		const pathNoScheme = !options.skipEscape && component.scheme === void 0 && !hasAuthority;
+		if (component.path !== void 0) if (!options.skipEscape) component.path = serializePathEncoding(component.path, pathNoScheme);
+		else component.path = normalizePercentEncoding(component.path);
+		if (options.reference !== "suffix" && component.scheme) {
+			component.scheme = decodeValidScheme(component.scheme);
+			uriTokens.push(component.scheme, ":");
+		}
 		const authority = recomposeAuthority(component);
 		if (authority !== void 0) {
 			if (options.reference !== "suffix") uriTokens.push("//");
@@ -17100,20 +17550,84 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		if (component.path !== void 0) {
 			let s = component.path;
 			if (!options.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) s = removeDotSegments(s);
+			if (pathNoScheme) s = serializePathEncoding(s, true);
 			if (authority === void 0 && s[0] === "/" && s[1] === "/") s = "/%2F" + s.slice(2);
 			uriTokens.push(s);
 		}
-		if (component.query !== void 0) uriTokens.push("?", component.query);
-		if (component.fragment !== void 0) uriTokens.push("#", component.fragment);
+		if (component.query !== void 0) uriTokens.push("?", encodeQuery(component.query));
+		if (component.fragment !== void 0) uriTokens.push("#", encodeFragment(component.fragment));
 		return uriTokens.join("");
 	}
 	const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+	const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+	const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
+	/**
+	* @param {import('./types/index').URIComponent} parsed
+	* @param {RegExpMatchArray} matches
+	* @returns {string|undefined}
+	*/
+	function getParseError(parsed, matches) {
+		if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") return "URI path must start with \"/\" when authority is present.";
+		if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) return "URI port is malformed.";
+	}
+	/**
+	* Checks percent syntax without decoding the represented octets. RFC 3986
+	* percent-encoding is byte-oriented, so sequences such as `%FF` are valid even
+	* though they are not independently valid UTF-8.
+	*
+	* @param {string|undefined} component
+	* @returns {boolean}
+	*/
+	function hasMalformedPercentEncoding(component) {
+		if (component === void 0) return false;
+		let percent = component.indexOf("%");
+		while (percent !== -1) {
+			if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) return true;
+			percent = component.indexOf("%", percent + 3);
+		}
+		return false;
+	}
+	/**
+	* Whether the host is a bracketed IP literal (RFC 3986 `IP-literal`).
+	* An unterminated `[` is not a literal, so it must still be validated as a
+	* reg-name instead of being waved through as an IP.
+	*
+	* @param {string} host
+	* @returns {boolean}
+	*/
+	function isIPLiteral(host) {
+		return host[0] === "[" && host[host.length - 1] === "]";
+	}
+	/**
+	* @param {RegExpMatchArray} matches
+	* @returns {boolean}
+	*/
+	function hasMalformedComponentPercentEncoding(matches) {
+		const host = matches[4];
+		return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !isIPLiteral(host) && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+	}
+	/**
+	* @param {import('./types/index').URIComponent} parsed
+	* @param {import('./types/index').Options} options
+	* @param {{ domainHost?: boolean, unicodeSupport?: boolean }|undefined} schemeHandler
+	* @param {boolean} isIP
+	* @returns {boolean} whether host conversion failed
+	*/
+	function canonicalizeHost(parsed, options, schemeHandler, isIP) {
+		if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && !isIPLiteral(parsed.host) && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
+			parsed.host = new URL("http://" + parsed.host).hostname;
+		} catch (e) {
+			parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
+			return true;
+		}
+		return false;
+	}
 	/**
 	* @param {string} uri
 	* @param {import('./types/index').Options} [opts]
-	* @returns
+	* @returns {{ parsed: import('./types/index').URIComponent, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
 	*/
-	function parse(uri, opts) {
+	function parseWithStatus(uri, opts) {
 		const options = Object.assign({}, opts);
 		/** @type {import('./types/index').URIComponent} */
 		const parsed = {
@@ -17125,9 +17639,34 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			query: void 0,
 			fragment: void 0
 		};
+		let malformedAuthorityOrPort = false;
+		let malformedPercentEncoding = false;
+		let malformedSchemeSpecific = false;
+		let malformedHost = false;
+		let malformedIPLiteral = false;
+		let malformedScheme = false;
 		let isIP = false;
 		if (options.reference === "suffix") if (options.scheme) uri = options.scheme + ":" + uri;
 		else uri = "//" + uri;
+		const authorityMatch = uri.match(AUTHORITY_PREFIX);
+		if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+			parsed.error = "URI authority must not contain a literal backslash.";
+			malformedAuthorityOrPort = true;
+		}
+		const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+		if (introducerMatch !== null) {
+			const region = introducerMatch[1];
+			const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+			if (normalizedRegion.length >= 2) {
+				if (normalizedRegion.slice(0, 2) !== "//") {
+					parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+					malformedAuthorityOrPort = true;
+				} else if (region.length !== normalizedRegion.length) {
+					parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+					malformedAuthorityOrPort = true;
+				}
+			}
+		}
 		const matches = uri.match(URI_PARSE);
 		if (matches) {
 			parsed.scheme = matches[1];
@@ -17137,11 +17676,33 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			parsed.path = matches[6] || "";
 			parsed.query = matches[7];
 			parsed.fragment = matches[8];
+			if (parsed.scheme !== void 0) {
+				const decodedScheme = unescape(parsed.scheme);
+				if (VALID_SCHEME.test(decodedScheme)) parsed.scheme = decodedScheme.toLowerCase();
+				else {
+					parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+					malformedScheme = true;
+				}
+			}
+			malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+			if (malformedPercentEncoding) parsed.error = parsed.error || "URI contains malformed percent-encoding.";
 			if (isNaN(parsed.port)) parsed.port = matches[5];
+			const parseError = getParseError(parsed, matches);
+			if (parseError !== void 0) {
+				parsed.error = parsed.error || parseError;
+				malformedAuthorityOrPort = true;
+			}
 			if (parsed.host) if (isIPv4(parsed.host) === false) {
+				const bracketedIPLiteral = isIPLiteral(parsed.host);
+				const hasIPLiteralBracket = parsed.host.indexOf("[") !== -1 || parsed.host.indexOf("]") !== -1;
 				const ipv6result = normalizeIPv6(parsed.host);
-				parsed.host = ipv6result.host.toLowerCase();
-				isIP = ipv6result.isIPV6;
+				isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+				malformedIPLiteral = hasIPLiteralBracket && (!bracketedIPLiteral || ipv6result.error === true);
+				parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+				if (malformedIPLiteral) {
+					parsed.error = parsed.error || "URI host is malformed.";
+					malformedAuthorityOrPort = true;
+				}
 			} else isIP = true;
 			if (parsed.scheme === void 0 && parsed.userinfo === void 0 && parsed.host === void 0 && parsed.port === void 0 && parsed.query === void 0 && !parsed.path) parsed.reference = "same-document";
 			else if (parsed.scheme === void 0) parsed.reference = "relative";
@@ -17149,24 +17710,78 @@ var require_fast_uri = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			else parsed.reference = "uri";
 			if (options.reference && options.reference !== "suffix" && options.reference !== parsed.reference) parsed.error = parsed.error || "URI is not a " + options.reference + " reference.";
 			const schemeHandler = getSchemeHandler(options.scheme || parsed.scheme);
-			if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-				if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) try {
-					parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
-				} catch (e) {
-					parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
-				}
+			if (!malformedIPLiteral) malformedHost = canonicalizeHost(parsed, options, schemeHandler, isIP);
+			if (uri.indexOf("%") !== -1 && parsed.host !== void 0 && !malformedIPLiteral) {
+				let host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+				if (!isIP) host = normalizePercentEncoding(host.toLowerCase());
+				parsed.host = reescapeHostDelimiters(host, isIP);
 			}
 			if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
-				if (uri.indexOf("%") !== -1) {
-					if (parsed.scheme !== void 0) parsed.scheme = unescape(parsed.scheme);
-					if (parsed.host !== void 0) parsed.host = unescape(parsed.host);
-				}
-				if (parsed.path) parsed.path = escape(unescape(parsed.path));
-				if (parsed.fragment) parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+				if (parsed.path) parsed.path = normalizePathEncoding(parsed.path);
+				if (parsed.query) parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+				if (parsed.fragment) parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
+			}
+			if (schemeHandler && schemeHandler.parse) {
+				schemeHandler.parse(parsed, options);
+				if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) malformedSchemeSpecific = true;
 			}
-			if (schemeHandler && schemeHandler.parse) schemeHandler.parse(parsed, options);
 		} else parsed.error = parsed.error || "URI can not be parsed.";
-		return parsed;
+		return {
+			parsed,
+			malformedAuthorityOrPort,
+			malformedPercentEncoding,
+			malformedSchemeSpecific,
+			malformedHost,
+			malformedScheme
+		};
+	}
+	/**
+	* @param {string} uri
+	* @param {import('./types/index').Options} [opts]
+	* @returns
+	*/
+	function parse(uri, opts) {
+		return parseWithStatus(uri, opts).parsed;
+	}
+	/**
+	* @param {string} uri
+	* @param {import('./types/index').Options} [opts]
+	* @returns {string}
+	*/
+	function normalizeString(uri, opts) {
+		return normalizeStringWithStatus(uri, opts).normalized;
+	}
+	/**
+	* @param {string} uri
+	* @param {import('./types/index').Options} [opts]
+	* @returns {{ normalized: string, malformedAuthorityOrPort: boolean, malformedPercentEncoding: boolean, malformedSchemeSpecific: boolean, malformedHost: boolean, malformedScheme: boolean }}
+	*/
+	function normalizeStringWithStatus(uri, opts) {
+		const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri, opts);
+		return {
+			normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri : serialize(parsed, opts),
+			malformedAuthorityOrPort,
+			malformedPercentEncoding,
+			malformedSchemeSpecific,
+			malformedHost,
+			malformedScheme
+		};
+	}
+	/**
+	* @param {import ('./types/index').URIComponent|string} uri
+	* @param {import('./types/index').Options} [opts]
+	* @returns {string|undefined}
+	*/
+	function normalizeComparableURI(uri, opts) {
+		if (typeof uri !== "string" && typeof uri !== "object") return;
+		let value;
+		try {
+			value = typeof uri === "string" ? uri : serialize(uri, opts);
+		} catch {
+			return;
+		}
+		const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+		return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
 	}
 	const fastUri = {
 		SCHEMES,
@@ -20955,7 +21570,7 @@ var AjvJsonSchemaValidator = class {
 	}
 };
 import_ajv.Ajv;
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/mcp-oHn3ureC.mjs
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -20969,225 +21584,237 @@ function isCompletable(schema) {
 function getCompleter(schema) {
 	return schema[COMPLETABLE_SYMBOL]?.complete;
 }
-/**
-* Whether a `subscriptions/listen` filter accepts a given change event.
-*
-* Pure: no I/O, no mutation. The filter governs ONLY the four
-* subscription-gated change types — non-gated notifications never reach the
-* bus and are not modeled here.
-*
-* `resource_updated` matches only when `resourceSubscriptions` is present and
-* contains the event's URI exactly (per the spec: "for these resource URIs").
-*/
-function listenFilterAccepts(filter, event) {
-	switch (event.kind) {
-		case "tools_list_changed": return filter.toolsListChanged === true;
-		case "prompts_list_changed": return filter.promptsListChanged === true;
-		case "resources_list_changed": return filter.resourcesListChanged === true;
-		case "resource_updated": return filter.resourceSubscriptions !== void 0 && filter.resourceSubscriptions.includes(event.uri);
-	}
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+/** Arms an unref'd timer, or disables keep-alive for invalid delays. */
+function armSseKeepAlive(intervalMs, onTick) {
+	if (!Number.isFinite(intervalMs) || intervalMs < 1) return;
+	const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+	timer.unref?.();
+	return timer;
 }
+let readClassification;
 /**
-* The honored subset of a requested filter: keeps only the fields the client
-* explicitly opted in to (drops `false` and absent fields), narrowed against
-* the server's declared capabilities when supplied. The serving entry sends
-* this back in `notifications/subscriptions/acknowledged` so the ack reflects
-* what the server can actually deliver.
+* The per-request micro-transport: a real, connected `Transport` whose whole
+* lifetime is one HTTP exchange. See the module documentation for the
+* response shapes it produces.
 *
-* - `toolsListChanged` is honored only when `capabilities.tools.listChanged`
-*   is advertised; likewise `promptsListChanged` / `resourcesListChanged`.
-* - `resourceSubscriptions` is honored only when
-*   `capabilities.resources.subscribe` is advertised.
-*
-* `capabilities` is optional on this pure helper for test convenience only —
-* both wired routers REQUIRE capabilities at the call site (the HTTP router's
-* `serve()` takes a required parameter; `StdioListenRouter.serve()` throws
-* before `setServerCapabilities()` was called), so the fail-open
-* `undefined → honor everything` branch is never reachable on a wired entry.
-*/
-function honoredSubset(requested, capabilities) {
-	const honored = {};
-	const allow = (bit) => capabilities === void 0 || bit === true;
-	if (requested.toolsListChanged === true && allow(capabilities?.tools?.listChanged)) honored.toolsListChanged = true;
-	if (requested.promptsListChanged === true && allow(capabilities?.prompts?.listChanged)) honored.promptsListChanged = true;
-	if (requested.resourcesListChanged === true && allow(capabilities?.resources?.listChanged)) honored.resourcesListChanged = true;
-	if (requested.resourceSubscriptions !== void 0 && requested.resourceSubscriptions.length > 0 && allow(capabilities?.resources?.subscribe)) honored.resourceSubscriptions = [...requested.resourceSubscriptions];
-	return honored;
-}
-/** Default capacity guard: refuse a new subscription when this many are already open. */
-const DEFAULT_MAX_SUBSCRIPTIONS = 1024;
-/** Stamp the subscription id onto a notification's `_meta`. Non-mutating. */
-function stampSubscriptionId(notification, subscriptionId) {
-	return {
-		method: notification.method,
-		params: {
-			...notification.params,
-			_meta: {
-				...notification.params?._meta,
-				[SUBSCRIPTION_ID_META_KEY]: subscriptionId
-			}
-		}
-	};
-}
-/**
-* Read the requested filter off a `subscriptions/listen` request body.
-* Returns the validated filter, or `undefined` when `params.notifications`
-* is absent or fails the schema (the caller answers `-32602` — the spec
-* marks `notifications` REQUIRED on the listen request).
-*/
-function parseListenFilter(message) {
-	const outcome = codecForVersion(MODERN_WIRE_REVISION).validateRequest("subscriptions/listen", message);
-	return outcome.ok ? outcome.value.params?.notifications : void 0;
-}
-const CHANGE_NOTIFICATION_METHODS = /* @__PURE__ */ new Set([
-	"notifications/tools/list_changed",
-	"notifications/prompts/list_changed",
-	"notifications/resources/list_changed",
-	"notifications/resources/updated"
-]);
-/**
-* Per-connection listen state for the stdio entry. One instance is held by
-* `serveStdio` for the connection lifetime; it routes inbound
-* `subscriptions/listen` / `notifications/cancelled` and rewrites outbound
-* change notifications onto the active subscriptions. No bus — the long-lived
-* pinned instance's existing `send*ListChanged()` calls feed straight into
-* `routeOutbound()`.
+* Connecting a `Server` binds the instance to the classified modern revision
+* when its `supportedProtocolVersions` lists it and the SDK implements it.
 */
-var StdioListenRouter = class {
-	/** Active subscriptions, keyed by the listen request's JSON-RPC id verbatim. */
-	_subs = /* @__PURE__ */ new Map();
-	/**
-	* The serving instance's declared capabilities. Filled in by the entry
-	* once the modern instance is constructed (the router is created before
-	* the instance exists), so the acknowledged filter is narrowed against
-	* what the server can actually deliver.
-	*/
-	_serverCapabilities;
-	/**
-	* The serving instance's identity, stamped onto the graceful-close
-	* results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
-	* `ResultMetaObject`). Handed over together with the capabilities.
-	*/
-	_serverInfo;
-	constructor(_maxSubscriptions = DEFAULT_MAX_SUBSCRIPTIONS, serverCapabilities, serverInfo) {
-		this._maxSubscriptions = _maxSubscriptions;
-		this._serverCapabilities = serverCapabilities;
-		this._serverInfo = serverInfo;
+var PerRequestHTTPServerTransport = class {
+	static {
+		readClassification = (transport) => transport._classification;
 	}
-	/**
-	* Record the serving instance's declared capabilities and identity once
-	* it has been constructed. Called by `serveStdio`'s connect path;
-	* subsequent `serve()` calls narrow the honored filter against the
-	* capabilities, and `teardownAll()` stamps the identity.
-	*/
-	setServerCapabilities(capabilities, serverInfo) {
-		this._serverCapabilities = capabilities;
-		if (serverInfo !== void 0) this._serverInfo = serverInfo;
+	onclose;
+	onerror;
+	onmessage;
+	_classification;
+	_responseMode;
+	_started = false;
+	_used = false;
+	_closed = false;
+	_terminalDelivered = false;
+	/**
+	* `true` only while the inbound message is being delivered synchronously
+	* to the connected protocol layer. The pre-handler gates (the era
+	* registry gate, the edge→instance handoff check, the missing-handler
+	* rejection) answer inside this window; request handlers always run
+	* after it (the protocol layer defers them to a microtask). An error
+	* sent inside the window is therefore ladder-originated, and an error
+	* sent after it is handler-produced.
+	*/
+	_dispatchWindowOpen = false;
+	_requestId;
+	_deferredResponse;
+	_sse;
+	_abortCleanup;
+	_keepAliveMs;
+	constructor(options) {
+		this._classification = options.classification;
+		this._responseMode = options.responseMode ?? "auto";
+		this._keepAliveMs = options.keepAliveMs ?? 15e3;
 	}
-	/** Whether `id` is an active listen subscription on this connection. */
-	has(id) {
-		return this._subs.has(id);
+	async start() {
+		if (this._started) throw new Error("PerRequestHTTPServerTransport is already started");
+		this._started = true;
 	}
 	/**
-	* Serve one inbound `subscriptions/listen` request: registers the
-	* subscription and returns the stamped acknowledged notification (or, on
-	* capacity / params rejection, the in-band JSON-RPC error response).
+	* Serves the single exchange: delivers the classified message to the
+	* connected server instance and resolves with the HTTP response.
 	*
-	* @throws when called before {@linkcode setServerCapabilities} (or the
-	* constructor) has supplied the serving instance's capabilities. Honoring a
-	* filter without knowing the server's advertised capabilities would fail
-	* open (deliver unadvertised types); the entry guarantees capabilities are
-	* set before any listen request is routed here.
-	*/
-	serve(message) {
-		if (this._serverCapabilities === void 0) throw new Error("StdioListenRouter.serve() called before setServerCapabilities(); refusing to honor a filter without capabilities");
-		if (this._subs.size >= this._maxSubscriptions) return {
-			jsonrpc: "2.0",
-			id: message.id,
-			error: {
-				code: -32603,
-				message: "Subscription limit reached"
-			}
+	* Throws when called a second time (the transport is strictly
+	* single-use), or before a server has been connected to the transport.
+	* The returned promise rejects with a connection-closed error when the
+	* transport is closed before a response was produced (for example because
+	* the client disconnected).
+	*/
+	async handleMessage(message, extra) {
+		if (this._used) throw new Error("PerRequestHTTPServerTransport serves exactly one exchange; construct a new transport per request");
+		if (!this._started || this.onmessage === void 0) throw new Error("PerRequestHTTPServerTransport is not connected: connect a server to this transport before handling a message");
+		if (this._closed) throw new Error("PerRequestHTTPServerTransport is closed");
+		this._used = true;
+		const signal = extra?.request?.signal;
+		if (signal?.aborted) {
+			await this.close();
+			throw new SdkError(SdkErrorCode.ConnectionClosed, "The request was aborted before it could be handled");
+		}
+		const messageExtra = {
+			classification: this._classification,
+			...extra?.request !== void 0 && { request: extra.request },
+			...extra?.authInfo !== void 0 && { authInfo: extra.authInfo }
 		};
-		const filter = parseListenFilter(message);
-		if (filter === void 0) return {
-			jsonrpc: "2.0",
-			id: message.id,
-			error: {
-				code: -32602,
-				message: "Invalid params: 'notifications' is required and must be a valid SubscriptionFilter"
+		if (isJSONRPCRequest(message)) {
+			this._requestId = message.id;
+			let resolve;
+			let reject;
+			const promise = new Promise((promiseResolve, promiseReject) => {
+				resolve = promiseResolve;
+				reject = promiseReject;
+			});
+			this._deferredResponse = {
+				promise,
+				resolve,
+				reject,
+				settled: false
+			};
+			if (signal !== void 0) {
+				const onAbort = () => void this.close();
+				signal.addEventListener("abort", onAbort, { once: true });
+				this._abortCleanup = () => signal.removeEventListener("abort", onAbort);
 			}
-		};
-		const honored = honoredSubset(filter, this._serverCapabilities);
-		this._subs.set(message.id, honored);
-		return stampSubscriptionId({
-			method: "notifications/subscriptions/acknowledged",
-			params: { notifications: honored }
-		}, message.id);
+			this._dispatchWindowOpen = true;
+			try {
+				this.onmessage(message, messageExtra);
+			} finally {
+				this._dispatchWindowOpen = false;
+			}
+			if (this._responseMode === "sse" && !this._closed && !this._deferredResponse.settled) this.upgradeToSse();
+			return promise;
+		}
+		this.onmessage(message, messageExtra);
+		return new Response(null, { status: 202 });
 	}
-	/**
-	* Tear down one subscription (inbound `notifications/cancelled`). Returns
-	* `true` when a subscription was removed. After this call NOTHING further
-	* is delivered for that subscription id (the post-cancel hardening).
-	*/
-	cancel(id) {
-		return this._subs.delete(id);
+	async send(message, options) {
+		if (this._closed) return;
+		const isResponse = isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message);
+		const relatedId = isResponse ? message.id : options?.relatedRequestId;
+		if (this._requestId === void 0 || relatedId === void 0 || relatedId !== this._requestId) {
+			if (isResponse) this.onerror?.(/* @__PURE__ */ new Error(`Received a response for an unknown request id: ${String(message.id)}`));
+			return;
+		}
+		if (isResponse) {
+			if (this._terminalDelivered) return;
+			this._terminalDelivered = true;
+			const errorCode = isJSONRPCErrorResponse(message) ? message.error.code : void 0;
+			const ladderStatus = errorCode !== void 0 && (this._dispatchWindowOpen || errorCode === ProtocolErrorCode.MissingRequiredClientCapability) ? LADDER_ERROR_HTTP_STATUS[errorCode] : void 0;
+			if (ladderStatus !== void 0 && this._sse === void 0) {
+				this.settleResponse(Response.json(message, {
+					status: ladderStatus,
+					headers: { "Content-Type": "application/json" }
+				}));
+				queueMicrotask(() => void this.close());
+				return;
+			}
+			if (this._sse !== void 0 || this._responseMode === "sse") {
+				if (this._sse === void 0) this.upgradeToSse();
+				this.writeMessageFrame(message);
+				this.finalizeStream();
+				return;
+			}
+			this.settleResponse(Response.json(message, {
+				status: 200,
+				headers: { "Content-Type": "application/json" }
+			}));
+			queueMicrotask(() => void this.close());
+			return;
+		}
+		if (this._responseMode === "json") return;
+		if (this._sse === void 0) this.upgradeToSse();
+		this.writeMessageFrame(message);
 	}
 	/**
-	* Route an outbound notification through the active subscriptions.
-	*
-	* - For a subscription-gated change notification, returns one stamped copy
-	*   per subscription that opted in to it (an empty array means it is
-	*   dropped — the modern era never delivers an un-requested change type).
-	* - For any other outbound message, returns `'passthrough'` (the entry
-	*   forwards it as-is).
+	* Writes an SSE comment frame (a keep-alive heartbeat). Dropped when the
+	* exchange is not currently streaming.
 	*/
-	routeOutbound(message) {
-		if (!CHANGE_NOTIFICATION_METHODS.has(message.method)) return "passthrough";
-		const uriParam = message.params?.["uri"];
-		const uri = typeof uriParam === "string" ? uriParam : void 0;
-		const event = notificationToServerEvent(message.method, uri);
-		const out = [];
-		for (const [subscriptionId, filter] of this._subs) if (listenFilterAccepts(filter, event)) out.push(stampSubscriptionId({
-			method: message.method,
-			params: message.params ?? {}
-		}, subscriptionId));
-		return out;
+	writeCommentFrame(comment) {
+		if (this._closed || this._sse === void 0 || this._sse.closed) return;
+		const frame = comment.split("\n").map((line) => `: ${line}`).join("\n");
+		this.writeFrame(`${frame}\n\n`);
 	}
-	/**
-	* Server-side graceful teardown of every active subscription: returns the
-	* empty `subscriptions/listen` JSON-RPC result for each subscription id —
-	* the spec's graceful-close signal, `_meta` carrying the subscription id
-	* and the serving instance's identity — for the entry to emit before
-	* closing the wire. Clears the set so nothing further is delivered.
-	*/
-	teardownAll() {
-		const out = [];
-		for (const id of this._subs.keys()) out.push({
-			jsonrpc: "2.0",
-			id,
-			result: {
-				resultType: "complete",
-				_meta: {
-					[SUBSCRIPTION_ID_META_KEY]: id,
-					...this._serverInfo !== void 0 && { ["io.modelcontextprotocol/serverInfo"]: this._serverInfo }
-				}
+	async close() {
+		if (this._closed) return;
+		this._closed = true;
+		this._abortCleanup?.();
+		this._abortCleanup = void 0;
+		if (this._sse?.keepAliveTimer !== void 0) clearInterval(this._sse.keepAliveTimer);
+		if (this._sse !== void 0 && !this._sse.closed) {
+			this._sse.closed = true;
+			try {
+				this._sse.controller.close();
+			} catch {}
+		}
+		if (this._deferredResponse !== void 0 && !this._deferredResponse.settled) {
+			this._deferredResponse.settled = true;
+			this._deferredResponse.reject(new SdkError(SdkErrorCode.ConnectionClosed, "Connection closed before a response was produced"));
+		}
+		this.onclose?.();
+	}
+	settleResponse(response) {
+		if (this._deferredResponse === void 0 || this._deferredResponse.settled) return;
+		this._deferredResponse.settled = true;
+		this._deferredResponse.resolve(response);
+	}
+	upgradeToSse() {
+		let controller;
+		const readable = new ReadableStream({
+			start: (streamController) => {
+				controller = streamController;
+			},
+			cancel: () => {
+				this.close();
 			}
 		});
-		this._subs.clear();
-		return out;
-	}
-};
-function notificationToServerEvent(method, uri) {
-	switch (method) {
-		case "notifications/tools/list_changed": return { kind: "tools_list_changed" };
-		case "notifications/prompts/list_changed": return { kind: "prompts_list_changed" };
-		case "notifications/resources/list_changed": return { kind: "resources_list_changed" };
-		default: return {
-			kind: "resource_updated",
-			uri: uri ?? ""
+		this._sse = {
+			controller,
+			encoder: new TextEncoder(),
+			closed: false
 		};
+		this._sse.keepAliveTimer = armSseKeepAlive(this._keepAliveMs, () => this.writeCommentFrame("keepalive"));
+		this.settleResponse(new Response(readable, {
+			status: 200,
+			headers: {
+				"Content-Type": "text/event-stream",
+				"Cache-Control": "no-cache, no-transform",
+				Connection: "keep-alive",
+				"X-Accel-Buffering": "no"
+			}
+		}));
+	}
+	finalizeStream() {
+		if (this._sse?.keepAliveTimer !== void 0) clearInterval(this._sse.keepAliveTimer);
+		if (this._sse !== void 0 && !this._sse.closed) {
+			this._sse.closed = true;
+			try {
+				this._sse.controller.close();
+			} catch {}
+		}
+		queueMicrotask(() => void this.close());
 	}
+	writeMessageFrame(message) {
+		this.writeFrame(`event: message\ndata: ${JSON.stringify(message)}\n\n`);
+	}
+	writeFrame(frame) {
+		if (this._sse === void 0 || this._sse.closed) return;
+		try {
+			this._sse.controller.enqueue(this._sse.encoder.encode(frame));
+		} catch (error) {
+			this.onerror?.(/* @__PURE__ */ new Error(`Failed to write to the response stream: ${error}`));
+		}
+	}
+};
+/** Package-internal: the classification a per-request transport serves; `undefined` for any other transport. Not public API. */
+function perRequestClassificationOf(transport) {
+	return transport instanceof PerRequestHTTPServerTransport ? readClassification(transport) : void 0;
 }
 /** @internal */
 function supportsScopeChallengeResolver(transport) {
@@ -21396,6 +22023,7 @@ var Server = class extends Protocol {
 	_requestStateVerify;
 	_inputRequiredServing;
 	_legacyShim;
+	_boundFromTransport = false;
 	/** Lazily-built legacy shim; the loop lives in legacyInputRequiredShim.ts behind a narrow host contract. */
 	_legacyInputRequiredShim() {
 		return this._legacyShim ??= new LegacyInputRequiredShim({
@@ -21435,6 +22063,15 @@ var Server = class extends Protocol {
 	/** Attaches to the given transport; rejects while this instance is connected to another one. */
 	async connect(transport) {
 		if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		if (this._boundFromTransport) {
+			this._boundFromTransport = false;
+			this._negotiatedProtocolVersion = void 0;
+		}
+		const revision = perRequestClassificationOf(transport)?.revision;
+		if (revision !== void 0 && !this._servedModernEra() && SUPPORTED_MODERN_PROTOCOL_VERSIONS.includes(revision) && modernProtocolVersions(this._supportedProtocolVersions).includes(revision)) {
+			this._negotiatedProtocolVersion = revision;
+			this._boundFromTransport = true;
+		}
 		await super.connect(transport);
 	}
 	/**
@@ -21745,8 +22382,8 @@ var Server = class extends Protocol {
 	* @deprecated Read client identity from the per-request handler context instead: on
 	* 2026-07-28 (per-request envelope) requests `ctx.mcpReq.envelope` carries the client's
 	* declared capabilities, while on 2025-era connections this accessor keeps returning the
-	* `initialize`-scoped value. The accessor remains functional — instances serving the
-	* 2026-07-28 era are backfilled per request from the validated envelope.
+	* `initialize`-scoped value. The accessor remains functional where `createMcpHandler`
+	* serves the 2026-07-28 era: it backfills it per request from the validated envelope.
 	*/
 	getClientCapabilities() {
 		return this._clientCapabilities;
@@ -21757,8 +22394,8 @@ var Server = class extends Protocol {
 	* @deprecated Read client identity from the per-request handler context instead: on
 	* 2026-07-28 (per-request envelope) requests `ctx.mcpReq.envelope` carries the client's
 	* name and version, while on 2025-era connections this accessor keeps returning the
-	* `initialize`-scoped value. The accessor remains functional — instances serving the
-	* 2026-07-28 era are backfilled per request from the validated envelope.
+	* `initialize`-scoped value. The accessor remains functional where `createMcpHandler`
+	* serves the 2026-07-28 era: it backfills it per request from the validated envelope.
 	*/
 	getClientVersion() {
 		return this._clientVersion;
@@ -22351,8 +22988,14 @@ var McpServer = class {
 					if (updates.uri) this._registeredResources[updates.uri] = registeredResource;
 				}
 				if (updates.name !== void 0) registeredResource.name = updates.name;
-				if (updates.title !== void 0) registeredResource.title = updates.title;
 				if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
+				if (updates.title !== void 0) {
+					registeredResource.title = updates.title;
+					registeredResource.metadata = {
+						...registeredResource.metadata,
+						title: updates.title
+					};
+				}
 				if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
 				if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
@@ -22378,9 +23021,15 @@ var McpServer = class {
 					delete this._registeredResourceTemplates[name];
 					if (updates.name) this._registeredResourceTemplates[updates.name] = registeredResourceTemplate;
 				}
-				if (updates.title !== void 0) registeredResourceTemplate.title = updates.title;
 				if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
 				if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
+				if (updates.title !== void 0) {
+					registeredResourceTemplate.title = updates.title;
+					registeredResourceTemplate.metadata = {
+						...registeredResourceTemplate.metadata,
+						title: updates.title
+					};
+				}
 				if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
 				if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
@@ -22654,7 +23303,228 @@ function unwrapOptionalSchema(schema) {
 	if (!isOptionalSchema(schema)) return schema;
 	return schema.def?.innerType ?? schema;
 }
-// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/listenRouter-Bartj63y.mjs
+/**
+* Whether a `subscriptions/listen` filter accepts a given change event.
+*
+* Pure: no I/O, no mutation. The filter governs ONLY the four
+* subscription-gated change types — non-gated notifications never reach the
+* bus and are not modeled here.
+*
+* `resource_updated` matches only when `resourceSubscriptions` is present and
+* contains the event's URI exactly (per the spec: "for these resource URIs").
+*/
+function listenFilterAccepts(filter, event) {
+	switch (event.kind) {
+		case "tools_list_changed": return filter.toolsListChanged === true;
+		case "prompts_list_changed": return filter.promptsListChanged === true;
+		case "resources_list_changed": return filter.resourcesListChanged === true;
+		case "resource_updated": return filter.resourceSubscriptions !== void 0 && filter.resourceSubscriptions.includes(event.uri);
+	}
+}
+/**
+* The honored subset of a requested filter: keeps only the fields the client
+* explicitly opted in to (drops `false` and absent fields), narrowed against
+* the server's declared capabilities when supplied. The serving entry sends
+* this back in `notifications/subscriptions/acknowledged` so the ack reflects
+* what the server can actually deliver.
+*
+* - `toolsListChanged` is honored only when `capabilities.tools.listChanged`
+*   is advertised; likewise `promptsListChanged` / `resourcesListChanged`.
+* - `resourceSubscriptions` is honored only when
+*   `capabilities.resources.subscribe` is advertised.
+*
+* `capabilities` is optional on this pure helper for test convenience only —
+* both wired routers REQUIRE capabilities at the call site (the HTTP router's
+* `serve()` takes a required parameter; `StdioListenRouter.serve()` throws
+* before `setServerCapabilities()` was called), so the fail-open
+* `undefined → honor everything` branch is never reachable on a wired entry.
+*/
+function honoredSubset(requested, capabilities) {
+	const honored = {};
+	const allow = (bit) => capabilities === void 0 || bit === true;
+	if (requested.toolsListChanged === true && allow(capabilities?.tools?.listChanged)) honored.toolsListChanged = true;
+	if (requested.promptsListChanged === true && allow(capabilities?.prompts?.listChanged)) honored.promptsListChanged = true;
+	if (requested.resourcesListChanged === true && allow(capabilities?.resources?.listChanged)) honored.resourcesListChanged = true;
+	if (requested.resourceSubscriptions !== void 0 && requested.resourceSubscriptions.length > 0 && allow(capabilities?.resources?.subscribe)) honored.resourceSubscriptions = [...requested.resourceSubscriptions];
+	return honored;
+}
+/** Default capacity guard: refuse a new subscription when this many are already open. */
+const DEFAULT_MAX_SUBSCRIPTIONS = 1024;
+/** Stamp the subscription id onto a notification's `_meta`. Non-mutating. */
+function stampSubscriptionId(notification, subscriptionId) {
+	return {
+		method: notification.method,
+		params: {
+			...notification.params,
+			_meta: {
+				...notification.params?._meta,
+				[SUBSCRIPTION_ID_META_KEY]: subscriptionId
+			}
+		}
+	};
+}
+/**
+* Read the requested filter off a `subscriptions/listen` request body.
+* Returns the validated filter, or `undefined` when `params.notifications`
+* is absent or fails the schema (the caller answers `-32602` — the spec
+* marks `notifications` REQUIRED on the listen request).
+*/
+function parseListenFilter(message) {
+	const outcome = codecForVersion(MODERN_WIRE_REVISION).validateRequest("subscriptions/listen", message);
+	return outcome.ok ? outcome.value.params?.notifications : void 0;
+}
+const CHANGE_NOTIFICATION_METHODS = /* @__PURE__ */ new Set([
+	"notifications/tools/list_changed",
+	"notifications/prompts/list_changed",
+	"notifications/resources/list_changed",
+	"notifications/resources/updated"
+]);
+/**
+* Per-connection listen state for the stdio entry. One instance is held by
+* `serveStdio` for the connection lifetime; it routes inbound
+* `subscriptions/listen` / `notifications/cancelled` and rewrites outbound
+* change notifications onto the active subscriptions. No bus — the long-lived
+* pinned instance's existing `send*ListChanged()` calls feed straight into
+* `routeOutbound()`.
+*/
+var StdioListenRouter = class {
+	/** Active subscriptions, keyed by the listen request's JSON-RPC id verbatim. */
+	_subs = /* @__PURE__ */ new Map();
+	/**
+	* The serving instance's declared capabilities. Filled in by the entry
+	* once the modern instance is constructed (the router is created before
+	* the instance exists), so the acknowledged filter is narrowed against
+	* what the server can actually deliver.
+	*/
+	_serverCapabilities;
+	/**
+	* The serving instance's identity, stamped onto the graceful-close
+	* results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
+	* `ResultMetaObject`). Handed over together with the capabilities.
+	*/
+	_serverInfo;
+	constructor(_maxSubscriptions = DEFAULT_MAX_SUBSCRIPTIONS, serverCapabilities, serverInfo) {
+		this._maxSubscriptions = _maxSubscriptions;
+		this._serverCapabilities = serverCapabilities;
+		this._serverInfo = serverInfo;
+	}
+	/**
+	* Record the serving instance's declared capabilities and identity once
+	* it has been constructed. Called by `serveStdio`'s connect path;
+	* subsequent `serve()` calls narrow the honored filter against the
+	* capabilities, and `teardownAll()` stamps the identity.
+	*/
+	setServerCapabilities(capabilities, serverInfo) {
+		this._serverCapabilities = capabilities;
+		if (serverInfo !== void 0) this._serverInfo = serverInfo;
+	}
+	/** Whether `id` is an active listen subscription on this connection. */
+	has(id) {
+		return this._subs.has(id);
+	}
+	/**
+	* Serve one inbound `subscriptions/listen` request: registers the
+	* subscription and returns the stamped acknowledged notification (or, on
+	* capacity / params rejection, the in-band JSON-RPC error response).
+	*
+	* @throws when called before {@linkcode setServerCapabilities} (or the
+	* constructor) has supplied the serving instance's capabilities. Honoring a
+	* filter without knowing the server's advertised capabilities would fail
+	* open (deliver unadvertised types); the entry guarantees capabilities are
+	* set before any listen request is routed here.
+	*/
+	serve(message) {
+		if (this._serverCapabilities === void 0) throw new Error("StdioListenRouter.serve() called before setServerCapabilities(); refusing to honor a filter without capabilities");
+		if (this._subs.size >= this._maxSubscriptions) return {
+			jsonrpc: "2.0",
+			id: message.id,
+			error: {
+				code: -32603,
+				message: "Subscription limit reached"
+			}
+		};
+		const filter = parseListenFilter(message);
+		if (filter === void 0) return {
+			jsonrpc: "2.0",
+			id: message.id,
+			error: {
+				code: -32602,
+				message: "Invalid params: 'notifications' is required and must be a valid SubscriptionFilter"
+			}
+		};
+		const honored = honoredSubset(filter, this._serverCapabilities);
+		this._subs.set(message.id, honored);
+		return stampSubscriptionId({
+			method: "notifications/subscriptions/acknowledged",
+			params: { notifications: honored }
+		}, message.id);
+	}
+	/**
+	* Tear down one subscription (inbound `notifications/cancelled`). Returns
+	* `true` when a subscription was removed. After this call NOTHING further
+	* is delivered for that subscription id (the post-cancel hardening).
+	*/
+	cancel(id) {
+		return this._subs.delete(id);
+	}
+	/**
+	* Route an outbound notification through the active subscriptions.
+	*
+	* - For a subscription-gated change notification, returns one stamped copy
+	*   per subscription that opted in to it (an empty array means it is
+	*   dropped — the modern era never delivers an un-requested change type).
+	* - For any other outbound message, returns `'passthrough'` (the entry
+	*   forwards it as-is).
+	*/
+	routeOutbound(message) {
+		if (!CHANGE_NOTIFICATION_METHODS.has(message.method)) return "passthrough";
+		const uriParam = message.params?.["uri"];
+		const uri = typeof uriParam === "string" ? uriParam : void 0;
+		const event = notificationToServerEvent(message.method, uri);
+		const out = [];
+		for (const [subscriptionId, filter] of this._subs) if (listenFilterAccepts(filter, event)) out.push(stampSubscriptionId({
+			method: message.method,
+			params: message.params ?? {}
+		}, subscriptionId));
+		return out;
+	}
+	/**
+	* Server-side graceful teardown of every active subscription: returns the
+	* empty `subscriptions/listen` JSON-RPC result for each subscription id —
+	* the spec's graceful-close signal, `_meta` carrying the subscription id
+	* and the serving instance's identity — for the entry to emit before
+	* closing the wire. Clears the set so nothing further is delivered.
+	*/
+	teardownAll() {
+		const out = [];
+		for (const id of this._subs.keys()) out.push({
+			jsonrpc: "2.0",
+			id,
+			result: {
+				resultType: "complete",
+				_meta: {
+					[SUBSCRIPTION_ID_META_KEY]: id,
+					...this._serverInfo !== void 0 && { ["io.modelcontextprotocol/serverInfo"]: this._serverInfo }
+				}
+			}
+		});
+		this._subs.clear();
+		return out;
+	}
+};
+function notificationToServerEvent(method, uri) {
+	switch (method) {
+		case "notifications/tools/list_changed": return { kind: "tools_list_changed" };
+		case "notifications/prompts/list_changed": return { kind: "prompts_list_changed" };
+		case "notifications/resources/list_changed": return { kind: "resources_list_changed" };
+		default: return {
+			kind: "resource_updated",
+			uri: uri ?? ""
+		};
+	}
+}
+// ../../node_modules/.pnpm/@modelcontextprotocol+server@2.4.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 /**
 * Marks a stdout `'error'` listener that a closed transport left attached purely to
 * swallow late write failures (see {@link StdioServerTransport.close}). A fresh
@@ -23233,7 +24103,7 @@ function toError(value) {
 	return value instanceof Error ? value : new Error(String(value));
 }
 // package.json
-var version = "0.26.1";
+var version = "0.26.2";
 // ../fountain/src/inline.ts
 const MARKERS$1 = /[*_\\]/;
 const isSpace$10 = (code) => code === void 0 || /\s/.test(String.fromCharCode(code));
@@ -39512,7 +40382,7 @@ export {};
  * with the code of the packages below inside it. Each one’s licence follows, in full.
  *
  * ----------------------------------------------------------------------
- * @modelcontextprotocol/core 2.3.1 (Apache-2.0)
+ * @modelcontextprotocol/core 2.4.0 (Apache-2.0)
  *
  * The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
  *
@@ -39732,7 +40602,7 @@ export {};
  * the full license text.
  *
  * ----------------------------------------------------------------------
- * @modelcontextprotocol/server 2.3.1 (Apache-2.0)
+ * @modelcontextprotocol/server 2.4.0 (Apache-2.0)
  *
  * The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
  *
@@ -40053,14 +40923,12 @@ export {};
  * SOFTWARE.
  *
  * ----------------------------------------------------------------------
- * fast-uri 3.1.0 (BSD-3-Clause), carried inside @modelcontextprotocol/server
+ * fast-uri 3.1.8 (BSD-3-Clause), carried inside @modelcontextprotocol/server
  *
  * Copyright (c) 2011-2021, Gary Court until https://github.com/garycourt/uri-js/commit/a1acf730b4bba3f1097c9f52e7d9d3aba8cdcaae
- * Copyright (c) 2021-present The Fastify team
+ * Copyright (c) 2021-present The Fastify team <https://github.com/fastify/fastify#team>
  * All rights reserved.
  *
- * The Fastify team members are listed at https://github.com/fastify/fastify#team.
- *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *     * Redistributions of source code must retain the above copyright