ostacky 0.9.3 → 0.9.5

package/assets/mcp/ostacky-controller/node_modules/@modelcontextprotocol/server/dist/{mcp-IJurDZVN.mjs → mcp-Dw2OlZ1f.mjs}

@@ -1,4 +1,4 @@
-import { A as promptArgumentsFromStandardSchema, At as LATEST_PROTOCOL_VERSION, B as scanXMcpHeaderDeclarations, C as REQUEST_STATE_ONLY_LEG_PACING_MS, Ct as CLIENT_CAPABILITIES_META_KEY, E as sleep, H as assertCompleteRequestPrompt, Ht as requiredClientCapabilitiesForInputRequest, It as SERVER_INFO_META_KEY, Kt as SdkError, Lt as SUBSCRIPTION_ID_META_KEY, M as validateStandardSchema, N as parseSchema, T as linkedRoundAbort, U as assertCompleteRequestResourceTemplate, Vt as missingClientCapabilities, _ as mergeCapabilities, _t as normalizeContentlessToolResult, a as UriTemplate, b as withRequestStateValue, bt as legacyProtocolVersions, ct as codecForVersion, dt as ResourceNotFoundError, g as Protocol, gt as attachCacheHintFallback, ht as assertValidCacheHint, j as standardSchemaToJsonSchema, jt as LOG_LEVEL_META_KEY, lt as MissingRequiredClientCapabilityError, mt as ProtocolErrorCode, nt as LoggingLevelSchema, q as isInputRequiredResult, qt as SdkErrorCode, r as normalizeRawShapeSchema, s as validateAndWarnToolName, st as MODERN_WIRE_REVISION, ut as ProtocolError, v as requestStateAccessor, w as inputRequiredRoundsExceededMessage, xt as modernProtocolVersions, yt as isModernProtocolVersion } from "./src-D86MbS1I.mjs";
+import { A as promptArgumentsFromStandardSchema, At as LATEST_PROTOCOL_VERSION, B as scanXMcpHeaderDeclarations, C as REQUEST_STATE_ONLY_LEG_PACING_MS, Ct as CLIENT_CAPABILITIES_META_KEY, E as sleep, H as assertCompleteRequestPrompt, Ht as requiredClientCapabilitiesForInputRequest, It as SERVER_INFO_META_KEY, Kt as SdkError, Lt as SUBSCRIPTION_ID_META_KEY, M as validateStandardSchema, N as parseSchema, T as linkedRoundAbort, U as assertCompleteRequestResourceTemplate, Vt as missingClientCapabilities, Xt as OAuthErrorCode, Yt as OAuthError, _ as mergeCapabilities, _t as normalizeContentlessToolResult, a as UriTemplate, b as withRequestStateValue, bt as legacyProtocolVersions, ct as codecForVersion, dt as ResourceNotFoundError, g as Protocol, gt as attachCacheHintFallback, ht as assertValidCacheHint, j as standardSchemaToJsonSchema, jt as LOG_LEVEL_META_KEY, lt as MissingRequiredClientCapabilityError, mt as ProtocolErrorCode, nt as LoggingLevelSchema, q as isInputRequiredResult, qt as SdkErrorCode, r as normalizeRawShapeSchema, s as validateAndWarnToolName, st as MODERN_WIRE_REVISION, ut as ProtocolError, v as requestStateAccessor, w as inputRequiredRoundsExceededMessage, xt as modernProtocolVersions, yt as isModernProtocolVersion } from "./src-D-y6h4N7.mjs";
 import { DefaultJsonSchemaValidator } from "@modelcontextprotocol/server/_shims";
 
 //#region src/server/completable.ts
@@ -56,6 +56,19 @@ function getCompleter(schema) {
 	return schema[COMPLETABLE_SYMBOL]?.complete;
 }
 
+//#endregion
+//#region src/server/sseKeepAlive.ts
+/** Default interval between SSE keep-alive comment frames. */
+const DEFAULT_SSE_KEEP_ALIVE_MS = 15e3;
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+/** Arms an unref'd timer, or disables keep-alive for invalid delays. */
+function armSseKeepAlive(intervalMs, onTick) {
+	if (!Number.isFinite(intervalMs) || intervalMs < 1) return;
+	const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+	timer.unref?.();
+	return timer;
+}
+
 //#endregion
 //#region src/server/serverEventBus.ts
 /**
@@ -168,8 +181,6 @@ function serverEventToNotification(event) {
 
 //#endregion
 //#region src/server/listenRouter.ts
-/** Default SSE comment-frame keepalive interval for listen streams. */
-const DEFAULT_LISTEN_KEEPALIVE_MS = 15e3;
 /** Default capacity guard: refuse a new subscription when this many are already open. */
 const DEFAULT_MAX_SUBSCRIPTIONS = 1024;
 function jsonRpcError(id, code, message) {
@@ -208,7 +219,7 @@ function parseListenFilter(message) {
 function createListenRouter(options) {
 	const { bus, onerror } = options;
 	const maxSubscriptions = options.maxSubscriptions ?? DEFAULT_MAX_SUBSCRIPTIONS;
-	const keepAliveMs = options.keepAliveMs ?? DEFAULT_LISTEN_KEEPALIVE_MS;
+	const keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
 	const open = /* @__PURE__ */ new Set();
 	function serve(message, signal, capabilities, serverInfo) {
 		if (open.size >= maxSubscriptions) {
@@ -254,7 +265,11 @@ function createListenRouter(options) {
 				}
 			})}\n\n`);
 			closed = true;
-			unsubscribe?.();
+			try {
+				unsubscribe?.();
+			} catch (error) {
+				onerror?.(error instanceof Error ? error : new Error(String(error)));
+			}
 			if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
 			abortCleanup?.();
 			open.delete(teardown);
@@ -275,10 +290,7 @@ function createListenRouter(options) {
 					const note = stampSubscriptionId(serverEventToNotification(event), subscriptionId);
 					writeNotification(note.method, note.params);
 				});
-				if (keepAliveMs > 0) {
-					keepAliveTimer = setInterval(() => writeFrame(": keepalive\n\n"), keepAliveMs);
-					keepAliveTimer.unref?.();
-				}
+				keepAliveTimer = armSseKeepAlive(keepAliveMs, () => writeFrame(": keepalive\n\n"));
 				open.add(teardown);
 			},
 			cancel() {
@@ -295,7 +307,7 @@ function createListenRouter(options) {
 			status: 200,
 			headers: {
 				"Content-Type": "text/event-stream",
-				"Cache-Control": "no-cache",
+				"Cache-Control": "no-cache, no-transform",
 				Connection: "keep-alive",
 				"X-Accel-Buffering": "no"
 			}
@@ -462,6 +474,310 @@ function notificationToServerEvent(method, uri) {
 	}
 }
 
+//#endregion
+//#region src/server/middleware/bearerAuth.ts
+function headerQuotedValue(value) {
+	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
+}
+/**
+* Build a `WWW-Authenticate: Bearer …` challenge header value (RFC 6750).
+*
+* The single formatter behind every challenge this package emits — the
+* bearer-auth 401/403 answers and the per-operation scope-challenge 403 — so
+* all challenges from one server agree on parameter order and quoting. Every
+* parameter value is emitted as an HTTP quoted-string with `\` and `"`
+* escaped and non-printable characters replaced.
+*/
+function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, resourceMetadataUrl) {
+	let header = `Bearer error="${headerQuotedValue(errorCode)}", error_description="${headerQuotedValue(description)}"`;
+	if (requiredScopes.length > 0) header += `, scope="${headerQuotedValue(requiredScopes.join(" "))}"`;
+	if (resourceMetadataUrl) header += `, resource_metadata="${headerQuotedValue(resourceMetadataUrl)}"`;
+	return header;
+}
+/**
+* Validate a raw `Authorization` header value as a Bearer token and return
+* the verified {@link AuthInfo}.
+*
+* The runtime-neutral core of Bearer authentication: it parses the header,
+* runs the verifier, enforces `requiredScopes`, and rejects tokens without an
+* expiration or past it. On any failure it throws an {@link OAuthError} —
+* pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
+* answer, or use {@link requireBearerAuth} to get both steps as one call.
+*
+* Framework adapters build on this: `requireBearerAuth` from
+* `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
+*/
+async function verifyBearerToken(authorizationHeader, options) {
+	const { verifier, requiredScopes = [] } = options;
+	if (!authorizationHeader) throw new OAuthError(OAuthErrorCode.InvalidToken, "Missing Authorization header");
+	const [type, token] = authorizationHeader.split(" ");
+	if (type?.toLowerCase() !== "bearer" || !token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
+	const authInfo = await verifier.verifyAccessToken(token);
+	if (requiredScopes.length > 0) {
+		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope");
+	}
+	if (typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has no expiration time");
+	else if (authInfo.expiresAt < Date.now() / 1e3) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has expired");
+	if (options.resourceMetadataUrl !== void 0 && authInfo.resourceMetadataUrl === void 0) return {
+		...authInfo,
+		resourceMetadataUrl: options.resourceMetadataUrl
+	};
+	return authInfo;
+}
+/**
+* Build the HTTP answer for a Bearer authentication failure.
+*
+* Maps an {@link OAuthError} to its status — `401` for `invalid_token` and
+* `403` for `insufficient_scope` (both carrying the `WWW-Authenticate: Bearer …`
+* challenge, with `resource_metadata` when configured so clients can discover
+* the Authorization Server), `500` for `server_error`, `400` for anything
+* else. A non-`OAuthError` value answers `500 server_error`. The body is the
+* OAuth error JSON.
+*/
+function bearerAuthChallengeResponse(error, options) {
+	const { requiredScopes = [], resourceMetadataUrl } = options ?? {};
+	if (!(error instanceof OAuthError)) {
+		const serverError = new OAuthError(OAuthErrorCode.ServerError, "Internal Server Error");
+		return Response.json(serverError.toResponseObject(), { status: 500 });
+	}
+	switch (error.code) {
+		case OAuthErrorCode.InvalidToken: {
+			const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+			return Response.json(error.toResponseObject(), {
+				status: 401,
+				headers: { "WWW-Authenticate": challenge }
+			});
+		}
+		case OAuthErrorCode.InsufficientScope: {
+			const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+			return Response.json(error.toResponseObject(), {
+				status: 403,
+				headers: { "WWW-Authenticate": challenge }
+			});
+		}
+		case OAuthErrorCode.ServerError: return Response.json(error.toResponseObject(), { status: 500 });
+		default: return Response.json(error.toResponseObject(), { status: 400 });
+	}
+}
+/**
+* Require a valid Bearer token on web-standard requests.
+*
+* The framework-free counterpart of `requireBearerAuth` from
+* `@modelcontextprotocol/express`, for hosts whose HTTP surface is a
+* `fetch(request)` handler — Cloudflare Workers, Deno, Bun, Hono. The
+* returned gate resolves to the verified {@link AuthInfo}, or to the
+* ready-to-return challenge `Response` when the request must be refused.
+*
+* @example
+* ```ts source="./bearerAuth.examples.ts#requireBearerAuth_fetchGate"
+* const gate = requireBearerAuth({ verifier, requiredScopes: ['mcp'] });
+*
+* async function fetchHandler(request: Request): Promise<Response> {
+*     const auth: AuthInfo | Response = await gate(request);
+*     if (auth instanceof Response) return auth;
+*     return handler.fetch(request, { authInfo: auth });
+* }
+* ```
+*/
+function requireBearerAuth(options) {
+	const { verifier, requiredScopes = [], resourceMetadataUrl } = options;
+	const resolved = {
+		verifier,
+		requiredScopes,
+		resourceMetadataUrl
+	};
+	return async (request) => {
+		const [authorizationHeader] = (request.headers.get("authorization") ?? "").split(",");
+		try {
+			return await verifyBearerToken(authorizationHeader || void 0, resolved);
+		} catch (error) {
+			return bearerAuthChallengeResponse(error, resolved);
+		}
+	};
+}
+
+//#endregion
+//#region src/server/middleware/oauthMetadata.ts
+function checkIssuerUrl(issuer, allowInsecure) {
+	if (issuer.protocol !== "https:" && issuer.hostname !== "localhost" && issuer.hostname !== "127.0.0.1" && !allowInsecure) throw new Error("Issuer URL must be HTTPS");
+	if (issuer.hash) throw new Error(`Issuer URL must not have a fragment: ${issuer}`);
+	if (issuer.search) throw new Error(`Issuer URL must not have a query string: ${issuer}`);
+}
+/**
+* Derive the RFC 9728 Protected Resource Metadata document from
+* {@link AuthMetadataOptions}, validating the Authorization Server issuer URL
+* (HTTPS required outside localhost) in the process.
+*
+* `oauthMetadataResponse` and the Express `mcpAuthMetadataRouter` both build
+* on this; use it directly when serving the document through your own
+* routing — or call it once at startup to fail fast on a misconfigured
+* issuer before any request arrives.
+*/
+function buildOAuthProtectedResourceMetadata(options) {
+	checkIssuerUrl(new URL(options.oauthMetadata.issuer), options.dangerouslyAllowInsecureIssuerUrl);
+	return {
+		resource: options.resourceServerUrl.href,
+		authorization_servers: [options.oauthMetadata.issuer],
+		scopes_supported: options.scopesSupported,
+		resource_name: options.resourceName,
+		resource_documentation: options.serviceDocumentationUrl?.href
+	};
+}
+/**
+* Builds the RFC 9728 Protected Resource Metadata URL for a given MCP server
+* URL by inserting `/.well-known/oauth-protected-resource` ahead of the path.
+*
+* @example
+* ```ts
+* getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
+* // → 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
+* ```
+*/
+function getOAuthProtectedResourceMetadataUrl(serverUrl) {
+	const metadataUrl = new URL(serverUrl);
+	metadataUrl.pathname = protectedResourceMetadataPath(serverUrl);
+	metadataUrl.hash = "";
+	return metadataUrl.href;
+}
+/** The RFC 9728 path-aware well-known path for a resource URL. */
+function protectedResourceMetadataPath(resourceServerUrl) {
+	const rsPath = stripTrailingSlash(resourceServerUrl.pathname);
+	return `/.well-known/oauth-protected-resource${rsPath === "/" ? "" : rsPath}`;
+}
+function stripTrailingSlash(path) {
+	return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
+const ALLOWED_METHODS = "GET, HEAD, OPTIONS";
+function metadataDocumentResponse(request, metadata) {
+	if (request.method === "OPTIONS") {
+		const requestedHeaders = request.headers.get("access-control-request-headers");
+		return new Response(null, {
+			status: 204,
+			headers: {
+				"Access-Control-Allow-Origin": "*",
+				"Access-Control-Allow-Methods": ALLOWED_METHODS,
+				...requestedHeaders === null ? {} : {
+					"Access-Control-Allow-Headers": requestedHeaders,
+					Vary: "Access-Control-Request-Headers"
+				}
+			}
+		});
+	}
+	if (request.method !== "GET" && request.method !== "HEAD") {
+		const error = new OAuthError(OAuthErrorCode.MethodNotAllowed, `The method ${request.method} is not allowed for this endpoint`);
+		return Response.json(error.toResponseObject(), {
+			status: 405,
+			headers: {
+				Allow: ALLOWED_METHODS,
+				"Access-Control-Allow-Origin": "*"
+			}
+		});
+	}
+	const response = Response.json(metadata, { headers: { "Access-Control-Allow-Origin": "*" } });
+	return request.method === "HEAD" ? new Response(null, {
+		status: response.status,
+		headers: response.headers
+	}) : response;
+}
+/**
+* Serve the two OAuth discovery documents an MCP server acting as a Resource
+* Server exposes, from a web-standard `fetch(request)` handler:
+*
+*  - `/.well-known/oauth-protected-resource[/<path>]` — RFC 9728 Protected
+*    Resource Metadata, derived from the supplied options (path-aware: the
+*    resource URL's path is reflected in the route).
+*  - `/.well-known/oauth-authorization-server` — RFC 8414 Authorization
+*    Server Metadata, passed through verbatim.
+*
+* Returns the matched document `Response` (JSON with permissive CORS, `405`
+* with an `Allow` header for non-GET methods, `204` for CORS preflight), or
+* `undefined` when the request path is neither well-known route — fall
+* through to your own routing. The framework-free counterpart of
+* `mcpAuthMetadataRouter` from `@modelcontextprotocol/express`; pair it with
+* `requireBearerAuth` and `getOAuthProtectedResourceMetadataUrl` so
+* unauthenticated clients can discover the AS from the `401` challenge.
+*
+* @example
+* ```ts source="./oauthMetadata.examples.ts#oauthMetadataResponse_fetchHandler"
+* async function fetchHandler(request: Request): Promise<Response> {
+*     return oauthMetadataResponse(request, options) ?? serveMcp(request);
+* }
+* ```
+*/
+function oauthMetadataResponse(request, options) {
+	const requestPath = stripTrailingSlash(new URL(request.url).pathname);
+	if (requestPath === protectedResourceMetadataPath(options.resourceServerUrl)) return metadataDocumentResponse(request, buildOAuthProtectedResourceMetadata(options));
+	if (requestPath === "/.well-known/oauth-authorization-server") {
+		buildOAuthProtectedResourceMetadata(options);
+		return metadataDocumentResponse(request, options.oauthMetadata);
+	}
+}
+
+//#endregion
+//#region src/server/scopeChallenge.ts
+/** @internal */
+function supportsScopeChallengeResolver(transport) {
+	return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
+function assertScope(scope, location) {
+	if (typeof scope !== "string" || !/^[\u0021\u0023-\u005B\u005D-\u007E]+$/.test(scope)) throw new TypeError(`${location} must satisfy the OAuth scope-token grammar`);
+}
+function validateScopeChallenge(challenge) {
+	if (challenge === null || typeof challenge !== "object" || !Array.isArray(challenge.scopes) || challenge.scopes.length === 0) throw new TypeError("scope challenge must contain at least one scope");
+	for (const [index, scope] of challenge.scopes.entries()) assertScope(scope, `scope challenge scopes[${index}]`);
+	if (challenge.errorDescription !== void 0 && typeof challenge.errorDescription !== "string") throw new TypeError("scope challenge errorDescription must be a string");
+	if (challenge.errorDescription !== void 0 && !/^[\u0020-\u0021\u0023-\u005B\u005D-\u007E]+$/.test(challenge.errorDescription)) throw new TypeError("scope challenge errorDescription must satisfy the RFC 6750 error-description grammar");
+	return challenge;
+}
+/**
+* Creates a handler that requires every supplied scope exactly.
+*
+* Requests without authentication are left to the server's authentication gate.
+*/
+function requireScopes(...scopes) {
+	if (scopes.length === 0) throw new TypeError("requireScopes must contain at least one scope");
+	for (const [index, scope] of scopes.entries()) assertScope(scope, `requireScopes scope[${index}]`);
+	const requiredScopes = [...scopes];
+	return ({ authInfo }) => {
+		if (authInfo === void 0) return;
+		const activeScopes = new Set(authInfo.scopes);
+		if (requiredScopes.every((scope) => activeScopes.has(scope))) return;
+		return { scopes: requiredScopes };
+	};
+}
+/** @internal */
+async function findScopeChallenge(requests, authInfo, resolve) {
+	for (const request of requests) {
+		const challenge = await resolve({
+			request,
+			...authInfo !== void 0 && { authInfo }
+		});
+		if (challenge !== void 0) return validateScopeChallenge(challenge);
+	}
+}
+/**
+* The RFC 9728 Protected Resource Metadata URL to advertise on a scope
+* challenge, derived from the verified {@link AuthInfo}: the URL the
+* authentication gate stamped (`authInfo.resourceMetadataUrl`, set by the
+* bearer-auth helpers from their `resourceMetadataUrl` option), falling back
+* to the well-known location for an HTTP(S) RFC 8707 `resource` identifier, or
+* `undefined` when neither is available (the `resource_metadata` parameter is
+* then omitted, matching the bearer-auth challenges).
+*
+* @internal
+*/
+function scopeChallengeResourceMetadataUrl(authInfo) {
+	if (authInfo?.resourceMetadataUrl !== void 0) return authInfo.resourceMetadataUrl;
+	if (authInfo?.resource?.protocol === "https:" || authInfo?.resource?.protocol === "http:") return getOAuthProtectedResourceMetadataUrl(authInfo.resource);
+}
+/** @internal */
+function createScopeChallengeResponse(challenge, resourceMetadataUrl) {
+	return bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InsufficientScope, challenge.errorDescription ?? "Insufficient scope"), {
+		requiredScopes: [...challenge.scopes],
+		resourceMetadataUrl
+	});
+}
+
 //#endregion
 //#region src/server/legacyInputRequiredShim.ts
 /**
@@ -1203,7 +1519,7 @@ var Server = class extends Protocol {
 	* notification for the specified elicitation ID.
 	*
 	* The notification (and the `elicitationId` it references) exists only on protocol revision
-	* 2025-11-25 — the 2026-07-28 draft removed both. On a connection negotiated at 2026-07-28 the
+	* 2025-11-25 — the 2026-07-28 revision removed both. On a connection negotiated at 2026-07-28 the
 	* returned callback rejects with a typed local error before anything reaches the transport
 	* (the method is not part of that revision's wire registry).
 	*
@@ -1351,6 +1667,7 @@ var McpServer = class {
 	* ```
 	*/
 	async connect(transport) {
+		if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
 		return await this.server.connect(transport);
 	}
 	/**
@@ -1359,6 +1676,40 @@ var McpServer = class {
 	async close() {
 		await this.server.close();
 	}
+	/** @internal */
+	resolveScopeChallenge = (context) => {
+		switch (context.request.method) {
+			case "tools/call": {
+				const toolName = context.request.params?.name;
+				if (typeof toolName !== "string") return;
+				const tool = this._registeredTools[toolName];
+				if (tool === void 0 || !tool.enabled) return;
+				return tool.scopeChallenge?.(context);
+			}
+			case "resources/read": {
+				const resourceUri = context.request.params?.uri;
+				if (typeof resourceUri !== "string") return;
+				let uri;
+				try {
+					uri = new URL(resourceUri);
+				} catch {
+					return;
+				}
+				const resource = this._registeredResources[uri.toString()];
+				if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+				for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+				return;
+			}
+			case "prompts/get": {
+				const promptName = context.request.params?.name;
+				if (typeof promptName !== "string") return;
+				const prompt = this._registeredPrompts[promptName];
+				if (prompt === void 0 || !prompt.enabled) return;
+				return prompt.scopeChallenge?.(context);
+			}
+			default: return;
+		}
+	};
 	_toolHandlersInitialized = false;
 	setToolRequestHandlers() {
 		if (this._toolHandlersInitialized) return;
@@ -1524,7 +1875,10 @@ var McpServer = class {
 			}
 			for (const template of Object.values(this._registeredResourceTemplates)) {
 				const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-				if (variables) return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				if (variables) {
+					if (!template.enabled) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+					return attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				}
 			}
 			throw new ResourceNotFoundError(request.params.uri);
 		});
@@ -1555,36 +1909,32 @@ var McpServer = class {
 		this._promptHandlersInitialized = true;
 	}
 	registerResource(name, uriOrTemplate, config, readCallback) {
-		const cacheHint = config.cacheHint;
-		let metadata = config;
-		if (cacheHint !== void 0) {
-			assertValidCacheHint(cacheHint, `resource ${name}`);
-			const rest = { ...config };
-			delete rest.cacheHint;
-			metadata = rest;
-		}
+		const { cacheHint, scopeChallenge, ...resourceMetadata } = config;
+		const metadata = resourceMetadata;
+		if (cacheHint !== void 0) assertValidCacheHint(cacheHint, `resource ${name}`);
 		if (typeof uriOrTemplate === "string") {
 			if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResource;
 		} else {
 			if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResourceTemplate;
 		}
 	}
-	_createRegisteredResource(name, title, uri, metadata, readCallback) {
+	_createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
 		const registeredResource = {
 			name,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResource.update({ enabled: false }),
 			enable: () => registeredResource.update({ enabled: true }),
@@ -1598,6 +1948,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredResource.title = updates.title;
 				if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -1605,12 +1956,13 @@ var McpServer = class {
 		this._registeredResources[uri] = registeredResource;
 		return registeredResource;
 	}
-	_createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+	_createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
 		const registeredResourceTemplate = {
 			resourceTemplate: template,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResourceTemplate.update({ enabled: false }),
 			enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -1624,6 +1976,7 @@ var McpServer = class {
 				if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
 				if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -1633,7 +1986,7 @@ var McpServer = class {
 		if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
 		return registeredResourceTemplate;
 	}
-	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
 		let currentArgsSchema = argsSchema;
 		let currentCallback = callback;
 		const registeredPrompt = {
@@ -1641,6 +1994,7 @@ var McpServer = class {
 			description,
 			argsSchema,
 			icons,
+			scopeChallenge,
 			_meta,
 			handler: createPromptHandler(name, argsSchema, callback),
 			enabled: true,
@@ -1655,6 +2009,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredPrompt.title = updates.title;
 				if (updates.description !== void 0) registeredPrompt.description = updates.description;
 				if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
 				let needsHandlerRegen = false;
 				if (updates.argsSchema !== void 0) {
@@ -1682,7 +2037,7 @@ var McpServer = class {
 		}
 		return registeredPrompt;
 	}
-	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		validateAndWarnToolName(name);
 		if (inputSchema !== void 0) try {
 			const json = standardSchemaToJsonSchema(inputSchema, "input");
@@ -1700,6 +2055,7 @@ var McpServer = class {
 			annotations,
 			icons,
 			execution,
+			scopeChallenge,
 			_meta,
 			handler,
 			executor: createToolExecutor(inputSchema, handler),
@@ -1738,6 +2094,7 @@ var McpServer = class {
 				}
 				if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
 				if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredTool._meta = updates._meta;
 				if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
 				this.sendToolListChanged();
@@ -1750,13 +2107,13 @@ var McpServer = class {
 	}
 	registerTool(name, config, cb) {
 		if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-		const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config;
-		return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+		const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config;
+		return this._createRegisteredTool(name, title, description, normalizeRawShapeSchema(inputSchema), normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
 	}
 	registerPrompt(name, config, cb) {
 		if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-		const { title, description, argsSchema, icons, _meta } = config;
-		const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+		const { title, description, argsSchema, icons, scopeChallenge, _meta } = config;
+		const registeredPrompt = this._createRegisteredPrompt(name, title, description, normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
 		this.setPromptRequestHandlers();
 		this.sendPromptListChanged();
 		return registeredPrompt;
@@ -1915,5 +2272,5 @@ function unwrapOptionalSchema(schema) {
 }
 
 //#endregion
-export { seedClientIdentityFromEnvelope as a, DEFAULT_MAX_SUBSCRIPTIONS as c, InMemoryServerEventBus as d, createServerNotifier as f, installModernOnlyHandlers as i, StdioListenRouter as l, isCompletable as m, ResourceTemplate as n, serverIdentityOf as o, completable as p, Server as r, DEFAULT_LISTEN_KEEPALIVE_MS as s, McpServer as t, createListenRouter as u };
-//# sourceMappingURL=mcp-IJurDZVN.mjs.map
+export { armSseKeepAlive as C, DEFAULT_SSE_KEEP_ALIVE_MS as S, isCompletable as T, DEFAULT_MAX_SUBSCRIPTIONS as _, seedClientIdentityFromEnvelope as a, InMemoryServerEventBus as b, findScopeChallenge as c, buildOAuthProtectedResourceMetadata as d, getOAuthProtectedResourceMetadataUrl as f, verifyBearerToken as g, requireBearerAuth as h, installModernOnlyHandlers as i, requireScopes as l, bearerAuthChallengeResponse as m, ResourceTemplate as n, serverIdentityOf as o, oauthMetadataResponse as p, Server as r, createScopeChallengeResponse as s, McpServer as t, scopeChallengeResourceMetadataUrl as u, StdioListenRouter as v, completable as w, createServerNotifier as x, createListenRouter as y };
+//# sourceMappingURL=mcp-Dw2OlZ1f.mjs.map