ostacky 0.9.4 → 0.9.5

package/assets/mcp/ostacky-controller/node_modules/@modelcontextprotocol/server/dist/{mcp-DM1iHYFo.cjs → mcp-DUcCQSTW.cjs}

@@ -1,5 +1,5 @@
 const require_chunk = require('./chunk-Bnu9O96Y.cjs');
-const require_src = require('./src-BX_fm-dB.cjs');
+const require_src = require('./src-CgFsfg3E.cjs');
 let _modelcontextprotocol_server__shims = require("@modelcontextprotocol/server/_shims");
 let _modelcontextprotocol_core_internal = require("@modelcontextprotocol/core/internal");
 
@@ -58,6 +58,19 @@ function getCompleter(schema) {
 	return schema[COMPLETABLE_SYMBOL]?.complete;
 }
 
+//#endregion
+//#region src/server/sseKeepAlive.ts
+/** Default interval between SSE keep-alive comment frames. */
+const DEFAULT_SSE_KEEP_ALIVE_MS = 15e3;
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
+/** Arms an unref'd timer, or disables keep-alive for invalid delays. */
+function armSseKeepAlive(intervalMs, onTick) {
+	if (!Number.isFinite(intervalMs) || intervalMs < 1) return;
+	const timer = setInterval(onTick, Math.min(intervalMs, MAX_TIMER_DELAY_MS));
+	timer.unref?.();
+	return timer;
+}
+
 //#endregion
 //#region src/server/serverEventBus.ts
 /**
@@ -170,8 +183,6 @@ function serverEventToNotification(event) {
 
 //#endregion
 //#region src/server/listenRouter.ts
-/** Default SSE comment-frame keepalive interval for listen streams. */
-const DEFAULT_LISTEN_KEEPALIVE_MS = 15e3;
 /** Default capacity guard: refuse a new subscription when this many are already open. */
 const DEFAULT_MAX_SUBSCRIPTIONS = 1024;
 function jsonRpcError(id, code, message) {
@@ -210,7 +221,7 @@ function parseListenFilter(message) {
 function createListenRouter(options) {
 	const { bus, onerror } = options;
 	const maxSubscriptions = options.maxSubscriptions ?? DEFAULT_MAX_SUBSCRIPTIONS;
-	const keepAliveMs = options.keepAliveMs ?? DEFAULT_LISTEN_KEEPALIVE_MS;
+	const keepAliveMs = options.keepAliveMs ?? DEFAULT_SSE_KEEP_ALIVE_MS;
 	const open = /* @__PURE__ */ new Set();
 	function serve(message, signal, capabilities, serverInfo) {
 		if (open.size >= maxSubscriptions) {
@@ -256,7 +267,11 @@ function createListenRouter(options) {
 				}
 			})}\n\n`);
 			closed = true;
-			unsubscribe?.();
+			try {
+				unsubscribe?.();
+			} catch (error) {
+				onerror?.(error instanceof Error ? error : new Error(String(error)));
+			}
 			if (keepAliveTimer !== void 0) clearInterval(keepAliveTimer);
 			abortCleanup?.();
 			open.delete(teardown);
@@ -277,10 +292,7 @@ function createListenRouter(options) {
 					const note = stampSubscriptionId(serverEventToNotification(event), subscriptionId);
 					writeNotification(note.method, note.params);
 				});
-				if (keepAliveMs > 0) {
-					keepAliveTimer = setInterval(() => writeFrame(": keepalive\n\n"), keepAliveMs);
-					keepAliveTimer.unref?.();
-				}
+				keepAliveTimer = armSseKeepAlive(keepAliveMs, () => writeFrame(": keepalive\n\n"));
 				open.add(teardown);
 			},
 			cancel() {
@@ -297,7 +309,7 @@ function createListenRouter(options) {
 			status: 200,
 			headers: {
 				"Content-Type": "text/event-stream",
-				"Cache-Control": "no-cache",
+				"Cache-Control": "no-cache, no-transform",
 				Connection: "keep-alive",
 				"X-Accel-Buffering": "no"
 			}
@@ -464,6 +476,310 @@ function notificationToServerEvent(method, uri) {
 	}
 }
 
+//#endregion
+//#region src/server/middleware/bearerAuth.ts
+function headerQuotedValue(value) {
+	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
+}
+/**
+* Build a `WWW-Authenticate: Bearer …` challenge header value (RFC 6750).
+*
+* The single formatter behind every challenge this package emits — the
+* bearer-auth 401/403 answers and the per-operation scope-challenge 403 — so
+* all challenges from one server agree on parameter order and quoting. Every
+* parameter value is emitted as an HTTP quoted-string with `\` and `"`
+* escaped and non-printable characters replaced.
+*/
+function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, resourceMetadataUrl) {
+	let header = `Bearer error="${headerQuotedValue(errorCode)}", error_description="${headerQuotedValue(description)}"`;
+	if (requiredScopes.length > 0) header += `, scope="${headerQuotedValue(requiredScopes.join(" "))}"`;
+	if (resourceMetadataUrl) header += `, resource_metadata="${headerQuotedValue(resourceMetadataUrl)}"`;
+	return header;
+}
+/**
+* Validate a raw `Authorization` header value as a Bearer token and return
+* the verified {@link AuthInfo}.
+*
+* The runtime-neutral core of Bearer authentication: it parses the header,
+* runs the verifier, enforces `requiredScopes`, and rejects tokens without an
+* expiration or past it. On any failure it throws an {@link OAuthError} —
+* pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
+* answer, or use {@link requireBearerAuth} to get both steps as one call.
+*
+* Framework adapters build on this: `requireBearerAuth` from
+* `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
+*/
+async function verifyBearerToken(authorizationHeader, options) {
+	const { verifier, requiredScopes = [] } = options;
+	if (!authorizationHeader) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Missing Authorization header");
+	const [type, token] = authorizationHeader.split(" ");
+	if (type?.toLowerCase() !== "bearer" || !token) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
+	const authInfo = await verifier.verifyAccessToken(token);
+	if (requiredScopes.length > 0) {
+		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new require_src.OAuthError(require_src.OAuthErrorCode.InsufficientScope, "Insufficient scope");
+	}
+	if (typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt)) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Token has no expiration time");
+	else if (authInfo.expiresAt < Date.now() / 1e3) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Token has expired");
+	if (options.resourceMetadataUrl !== void 0 && authInfo.resourceMetadataUrl === void 0) return {
+		...authInfo,
+		resourceMetadataUrl: options.resourceMetadataUrl
+	};
+	return authInfo;
+}
+/**
+* Build the HTTP answer for a Bearer authentication failure.
+*
+* Maps an {@link OAuthError} to its status — `401` for `invalid_token` and
+* `403` for `insufficient_scope` (both carrying the `WWW-Authenticate: Bearer …`
+* challenge, with `resource_metadata` when configured so clients can discover
+* the Authorization Server), `500` for `server_error`, `400` for anything
+* else. A non-`OAuthError` value answers `500 server_error`. The body is the
+* OAuth error JSON.
+*/
+function bearerAuthChallengeResponse(error, options) {
+	const { requiredScopes = [], resourceMetadataUrl } = options ?? {};
+	if (!(error instanceof require_src.OAuthError)) {
+		const serverError = new require_src.OAuthError(require_src.OAuthErrorCode.ServerError, "Internal Server Error");
+		return Response.json(serverError.toResponseObject(), { status: 500 });
+	}
+	switch (error.code) {
+		case require_src.OAuthErrorCode.InvalidToken: {
+			const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+			return Response.json(error.toResponseObject(), {
+				status: 401,
+				headers: { "WWW-Authenticate": challenge }
+			});
+		}
+		case require_src.OAuthErrorCode.InsufficientScope: {
+			const challenge = buildWwwAuthenticateHeader(error.code, error.message, requiredScopes, resourceMetadataUrl);
+			return Response.json(error.toResponseObject(), {
+				status: 403,
+				headers: { "WWW-Authenticate": challenge }
+			});
+		}
+		case require_src.OAuthErrorCode.ServerError: return Response.json(error.toResponseObject(), { status: 500 });
+		default: return Response.json(error.toResponseObject(), { status: 400 });
+	}
+}
+/**
+* Require a valid Bearer token on web-standard requests.
+*
+* The framework-free counterpart of `requireBearerAuth` from
+* `@modelcontextprotocol/express`, for hosts whose HTTP surface is a
+* `fetch(request)` handler — Cloudflare Workers, Deno, Bun, Hono. The
+* returned gate resolves to the verified {@link AuthInfo}, or to the
+* ready-to-return challenge `Response` when the request must be refused.
+*
+* @example
+* ```ts source="./bearerAuth.examples.ts#requireBearerAuth_fetchGate"
+* const gate = requireBearerAuth({ verifier, requiredScopes: ['mcp'] });
+*
+* async function fetchHandler(request: Request): Promise<Response> {
+*     const auth: AuthInfo | Response = await gate(request);
+*     if (auth instanceof Response) return auth;
+*     return handler.fetch(request, { authInfo: auth });
+* }
+* ```
+*/
+function requireBearerAuth(options) {
+	const { verifier, requiredScopes = [], resourceMetadataUrl } = options;
+	const resolved = {
+		verifier,
+		requiredScopes,
+		resourceMetadataUrl
+	};
+	return async (request) => {
+		const [authorizationHeader] = (request.headers.get("authorization") ?? "").split(",");
+		try {
+			return await verifyBearerToken(authorizationHeader || void 0, resolved);
+		} catch (error) {
+			return bearerAuthChallengeResponse(error, resolved);
+		}
+	};
+}
+
+//#endregion
+//#region src/server/middleware/oauthMetadata.ts
+function checkIssuerUrl(issuer, allowInsecure) {
+	if (issuer.protocol !== "https:" && issuer.hostname !== "localhost" && issuer.hostname !== "127.0.0.1" && !allowInsecure) throw new Error("Issuer URL must be HTTPS");
+	if (issuer.hash) throw new Error(`Issuer URL must not have a fragment: ${issuer}`);
+	if (issuer.search) throw new Error(`Issuer URL must not have a query string: ${issuer}`);
+}
+/**
+* Derive the RFC 9728 Protected Resource Metadata document from
+* {@link AuthMetadataOptions}, validating the Authorization Server issuer URL
+* (HTTPS required outside localhost) in the process.
+*
+* `oauthMetadataResponse` and the Express `mcpAuthMetadataRouter` both build
+* on this; use it directly when serving the document through your own
+* routing — or call it once at startup to fail fast on a misconfigured
+* issuer before any request arrives.
+*/
+function buildOAuthProtectedResourceMetadata(options) {
+	checkIssuerUrl(new URL(options.oauthMetadata.issuer), options.dangerouslyAllowInsecureIssuerUrl);
+	return {
+		resource: options.resourceServerUrl.href,
+		authorization_servers: [options.oauthMetadata.issuer],
+		scopes_supported: options.scopesSupported,
+		resource_name: options.resourceName,
+		resource_documentation: options.serviceDocumentationUrl?.href
+	};
+}
+/**
+* Builds the RFC 9728 Protected Resource Metadata URL for a given MCP server
+* URL by inserting `/.well-known/oauth-protected-resource` ahead of the path.
+*
+* @example
+* ```ts
+* getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
+* // → 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
+* ```
+*/
+function getOAuthProtectedResourceMetadataUrl(serverUrl) {
+	const metadataUrl = new URL(serverUrl);
+	metadataUrl.pathname = protectedResourceMetadataPath(serverUrl);
+	metadataUrl.hash = "";
+	return metadataUrl.href;
+}
+/** The RFC 9728 path-aware well-known path for a resource URL. */
+function protectedResourceMetadataPath(resourceServerUrl) {
+	const rsPath = stripTrailingSlash(resourceServerUrl.pathname);
+	return `/.well-known/oauth-protected-resource${rsPath === "/" ? "" : rsPath}`;
+}
+function stripTrailingSlash(path) {
+	return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
+const ALLOWED_METHODS = "GET, HEAD, OPTIONS";
+function metadataDocumentResponse(request, metadata) {
+	if (request.method === "OPTIONS") {
+		const requestedHeaders = request.headers.get("access-control-request-headers");
+		return new Response(null, {
+			status: 204,
+			headers: {
+				"Access-Control-Allow-Origin": "*",
+				"Access-Control-Allow-Methods": ALLOWED_METHODS,
+				...requestedHeaders === null ? {} : {
+					"Access-Control-Allow-Headers": requestedHeaders,
+					Vary: "Access-Control-Request-Headers"
+				}
+			}
+		});
+	}
+	if (request.method !== "GET" && request.method !== "HEAD") {
+		const error = new require_src.OAuthError(require_src.OAuthErrorCode.MethodNotAllowed, `The method ${request.method} is not allowed for this endpoint`);
+		return Response.json(error.toResponseObject(), {
+			status: 405,
+			headers: {
+				Allow: ALLOWED_METHODS,
+				"Access-Control-Allow-Origin": "*"
+			}
+		});
+	}
+	const response = Response.json(metadata, { headers: { "Access-Control-Allow-Origin": "*" } });
+	return request.method === "HEAD" ? new Response(null, {
+		status: response.status,
+		headers: response.headers
+	}) : response;
+}
+/**
+* Serve the two OAuth discovery documents an MCP server acting as a Resource
+* Server exposes, from a web-standard `fetch(request)` handler:
+*
+*  - `/.well-known/oauth-protected-resource[/<path>]` — RFC 9728 Protected
+*    Resource Metadata, derived from the supplied options (path-aware: the
+*    resource URL's path is reflected in the route).
+*  - `/.well-known/oauth-authorization-server` — RFC 8414 Authorization
+*    Server Metadata, passed through verbatim.
+*
+* Returns the matched document `Response` (JSON with permissive CORS, `405`
+* with an `Allow` header for non-GET methods, `204` for CORS preflight), or
+* `undefined` when the request path is neither well-known route — fall
+* through to your own routing. The framework-free counterpart of
+* `mcpAuthMetadataRouter` from `@modelcontextprotocol/express`; pair it with
+* `requireBearerAuth` and `getOAuthProtectedResourceMetadataUrl` so
+* unauthenticated clients can discover the AS from the `401` challenge.
+*
+* @example
+* ```ts source="./oauthMetadata.examples.ts#oauthMetadataResponse_fetchHandler"
+* async function fetchHandler(request: Request): Promise<Response> {
+*     return oauthMetadataResponse(request, options) ?? serveMcp(request);
+* }
+* ```
+*/
+function oauthMetadataResponse(request, options) {
+	const requestPath = stripTrailingSlash(new URL(request.url).pathname);
+	if (requestPath === protectedResourceMetadataPath(options.resourceServerUrl)) return metadataDocumentResponse(request, buildOAuthProtectedResourceMetadata(options));
+	if (requestPath === "/.well-known/oauth-authorization-server") {
+		buildOAuthProtectedResourceMetadata(options);
+		return metadataDocumentResponse(request, options.oauthMetadata);
+	}
+}
+
+//#endregion
+//#region src/server/scopeChallenge.ts
+/** @internal */
+function supportsScopeChallengeResolver(transport) {
+	return typeof transport === "object" && transport !== null && "setScopeChallengeResolver" in transport && typeof transport.setScopeChallengeResolver === "function";
+}
+function assertScope(scope, location) {
+	if (typeof scope !== "string" || !/^[\u0021\u0023-\u005B\u005D-\u007E]+$/.test(scope)) throw new TypeError(`${location} must satisfy the OAuth scope-token grammar`);
+}
+function validateScopeChallenge(challenge) {
+	if (challenge === null || typeof challenge !== "object" || !Array.isArray(challenge.scopes) || challenge.scopes.length === 0) throw new TypeError("scope challenge must contain at least one scope");
+	for (const [index, scope] of challenge.scopes.entries()) assertScope(scope, `scope challenge scopes[${index}]`);
+	if (challenge.errorDescription !== void 0 && typeof challenge.errorDescription !== "string") throw new TypeError("scope challenge errorDescription must be a string");
+	if (challenge.errorDescription !== void 0 && !/^[\u0020-\u0021\u0023-\u005B\u005D-\u007E]+$/.test(challenge.errorDescription)) throw new TypeError("scope challenge errorDescription must satisfy the RFC 6750 error-description grammar");
+	return challenge;
+}
+/**
+* Creates a handler that requires every supplied scope exactly.
+*
+* Requests without authentication are left to the server's authentication gate.
+*/
+function requireScopes(...scopes) {
+	if (scopes.length === 0) throw new TypeError("requireScopes must contain at least one scope");
+	for (const [index, scope] of scopes.entries()) assertScope(scope, `requireScopes scope[${index}]`);
+	const requiredScopes = [...scopes];
+	return ({ authInfo }) => {
+		if (authInfo === void 0) return;
+		const activeScopes = new Set(authInfo.scopes);
+		if (requiredScopes.every((scope) => activeScopes.has(scope))) return;
+		return { scopes: requiredScopes };
+	};
+}
+/** @internal */
+async function findScopeChallenge(requests, authInfo, resolve) {
+	for (const request of requests) {
+		const challenge = await resolve({
+			request,
+			...authInfo !== void 0 && { authInfo }
+		});
+		if (challenge !== void 0) return validateScopeChallenge(challenge);
+	}
+}
+/**
+* The RFC 9728 Protected Resource Metadata URL to advertise on a scope
+* challenge, derived from the verified {@link AuthInfo}: the URL the
+* authentication gate stamped (`authInfo.resourceMetadataUrl`, set by the
+* bearer-auth helpers from their `resourceMetadataUrl` option), falling back
+* to the well-known location for an HTTP(S) RFC 8707 `resource` identifier, or
+* `undefined` when neither is available (the `resource_metadata` parameter is
+* then omitted, matching the bearer-auth challenges).
+*
+* @internal
+*/
+function scopeChallengeResourceMetadataUrl(authInfo) {
+	if (authInfo?.resourceMetadataUrl !== void 0) return authInfo.resourceMetadataUrl;
+	if (authInfo?.resource?.protocol === "https:" || authInfo?.resource?.protocol === "http:") return getOAuthProtectedResourceMetadataUrl(authInfo.resource);
+}
+/** @internal */
+function createScopeChallengeResponse(challenge, resourceMetadataUrl) {
+	return bearerAuthChallengeResponse(new require_src.OAuthError(require_src.OAuthErrorCode.InsufficientScope, challenge.errorDescription ?? "Insufficient scope"), {
+		requiredScopes: [...challenge.scopes],
+		resourceMetadataUrl
+	});
+}
+
 //#endregion
 //#region src/server/legacyInputRequiredShim.ts
 /**
@@ -1205,7 +1521,7 @@ var Server = class extends require_src.Protocol {
 	* notification for the specified elicitation ID.
 	*
 	* The notification (and the `elicitationId` it references) exists only on protocol revision
-	* 2025-11-25 — the 2026-07-28 draft removed both. On a connection negotiated at 2026-07-28 the
+	* 2025-11-25 — the 2026-07-28 revision removed both. On a connection negotiated at 2026-07-28 the
 	* returned callback rejects with a typed local error before anything reaches the transport
 	* (the method is not part of that revision's wire registry).
 	*
@@ -1353,6 +1669,7 @@ var McpServer = class {
 	* ```
 	*/
 	async connect(transport) {
+		if (supportsScopeChallengeResolver(transport)) transport.setScopeChallengeResolver((context) => this.resolveScopeChallenge(context));
 		return await this.server.connect(transport);
 	}
 	/**
@@ -1361,6 +1678,40 @@ var McpServer = class {
 	async close() {
 		await this.server.close();
 	}
+	/** @internal */
+	resolveScopeChallenge = (context) => {
+		switch (context.request.method) {
+			case "tools/call": {
+				const toolName = context.request.params?.name;
+				if (typeof toolName !== "string") return;
+				const tool = this._registeredTools[toolName];
+				if (tool === void 0 || !tool.enabled) return;
+				return tool.scopeChallenge?.(context);
+			}
+			case "resources/read": {
+				const resourceUri = context.request.params?.uri;
+				if (typeof resourceUri !== "string") return;
+				let uri;
+				try {
+					uri = new URL(resourceUri);
+				} catch {
+					return;
+				}
+				const resource = this._registeredResources[uri.toString()];
+				if (resource !== void 0) return resource.enabled ? resource.scopeChallenge?.(context) : void 0;
+				for (const template of Object.values(this._registeredResourceTemplates)) if (template.resourceTemplate.uriTemplate.match(uri.toString())) return template.enabled ? template.scopeChallenge?.(context) : void 0;
+				return;
+			}
+			case "prompts/get": {
+				const promptName = context.request.params?.name;
+				if (typeof promptName !== "string") return;
+				const prompt = this._registeredPrompts[promptName];
+				if (prompt === void 0 || !prompt.enabled) return;
+				return prompt.scopeChallenge?.(context);
+			}
+			default: return;
+		}
+	};
 	_toolHandlersInitialized = false;
 	setToolRequestHandlers() {
 		if (this._toolHandlersInitialized) return;
@@ -1526,7 +1877,10 @@ var McpServer = class {
 			}
 			for (const template of Object.values(this._registeredResourceTemplates)) {
 				const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
-				if (variables) return require_src.attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				if (variables) {
+					if (!template.enabled) throw new require_src.ProtocolError(require_src.ProtocolErrorCode.InvalidParams, `Resource template ${template.resourceTemplate.uriTemplate} disabled`);
+					return require_src.attachCacheHintFallback(await template.readCallback(uri, variables, ctx), template.cacheHint);
+				}
 			}
 			throw new require_src.ResourceNotFoundError(request.params.uri);
 		});
@@ -1557,36 +1911,32 @@ var McpServer = class {
 		this._promptHandlersInitialized = true;
 	}
 	registerResource(name, uriOrTemplate, config, readCallback) {
-		const cacheHint = config.cacheHint;
-		let metadata = config;
-		if (cacheHint !== void 0) {
-			require_src.assertValidCacheHint(cacheHint, `resource ${name}`);
-			const rest = { ...config };
-			delete rest.cacheHint;
-			metadata = rest;
-		}
+		const { cacheHint, scopeChallenge, ...resourceMetadata } = config;
+		const metadata = resourceMetadata;
+		if (cacheHint !== void 0) require_src.assertValidCacheHint(cacheHint, `resource ${name}`);
 		if (typeof uriOrTemplate === "string") {
 			if (this._registeredResources[uriOrTemplate]) throw new Error(`Resource ${uriOrTemplate} is already registered`);
-			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResource.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResource;
 		} else {
 			if (this._registeredResourceTemplates[name]) throw new Error(`Resource template ${name} is already registered`);
-			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, readCallback);
+			const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, metadata, scopeChallenge, readCallback);
 			if (cacheHint !== void 0) registeredResourceTemplate.cacheHint = cacheHint;
 			this.setResourceRequestHandlers();
 			this.sendResourceListChanged();
 			return registeredResourceTemplate;
 		}
 	}
-	_createRegisteredResource(name, title, uri, metadata, readCallback) {
+	_createRegisteredResource(name, title, uri, metadata, scopeChallenge, readCallback) {
 		const registeredResource = {
 			name,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResource.update({ enabled: false }),
 			enable: () => registeredResource.update({ enabled: true }),
@@ -1600,6 +1950,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredResource.title = updates.title;
 				if (updates.metadata !== void 0) registeredResource.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResource.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResource.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResource.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -1607,12 +1958,13 @@ var McpServer = class {
 		this._registeredResources[uri] = registeredResource;
 		return registeredResource;
 	}
-	_createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+	_createRegisteredResourceTemplate(name, title, template, metadata, scopeChallenge, readCallback) {
 		const registeredResourceTemplate = {
 			resourceTemplate: template,
 			title,
 			metadata,
 			readCallback,
+			scopeChallenge,
 			enabled: true,
 			disable: () => registeredResourceTemplate.update({ enabled: false }),
 			enable: () => registeredResourceTemplate.update({ enabled: true }),
@@ -1626,6 +1978,7 @@ var McpServer = class {
 				if (updates.template !== void 0) registeredResourceTemplate.resourceTemplate = updates.template;
 				if (updates.metadata !== void 0) registeredResourceTemplate.metadata = updates.metadata;
 				if (updates.callback !== void 0) registeredResourceTemplate.readCallback = updates.callback;
+				if (updates.scopeChallenge !== void 0) registeredResourceTemplate.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates.enabled !== void 0) registeredResourceTemplate.enabled = updates.enabled;
 				this.sendResourceListChanged();
 			}
@@ -1635,7 +1988,7 @@ var McpServer = class {
 		if (Array.isArray(variableNames) && variableNames.some((v) => !!template.completeCallback(v))) this.setCompletionRequestHandler();
 		return registeredResourceTemplate;
 	}
-	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, _meta) {
+	_createRegisteredPrompt(name, title, description, argsSchema, callback, icons, scopeChallenge, _meta) {
 		let currentArgsSchema = argsSchema;
 		let currentCallback = callback;
 		const registeredPrompt = {
@@ -1643,6 +1996,7 @@ var McpServer = class {
 			description,
 			argsSchema,
 			icons,
+			scopeChallenge,
 			_meta,
 			handler: createPromptHandler(name, argsSchema, callback),
 			enabled: true,
@@ -1657,6 +2011,7 @@ var McpServer = class {
 				if (updates.title !== void 0) registeredPrompt.title = updates.title;
 				if (updates.description !== void 0) registeredPrompt.description = updates.description;
 				if (updates.icons !== void 0) registeredPrompt.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredPrompt.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredPrompt._meta = updates._meta;
 				let needsHandlerRegen = false;
 				if (updates.argsSchema !== void 0) {
@@ -1684,7 +2039,7 @@ var McpServer = class {
 		}
 		return registeredPrompt;
 	}
-	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, _meta, handler) {
+	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		require_src.validateAndWarnToolName(name);
 		if (inputSchema !== void 0) try {
 			const json = require_src.standardSchemaToJsonSchema(inputSchema, "input");
@@ -1702,6 +2057,7 @@ var McpServer = class {
 			annotations,
 			icons,
 			execution,
+			scopeChallenge,
 			_meta,
 			handler,
 			executor: createToolExecutor(inputSchema, handler),
@@ -1740,6 +2096,7 @@ var McpServer = class {
 				}
 				if (updates.annotations !== void 0) registeredTool.annotations = updates.annotations;
 				if (updates.icons !== void 0) registeredTool.icons = updates.icons;
+				if (updates.scopeChallenge !== void 0) registeredTool.scopeChallenge = updates.scopeChallenge === null ? void 0 : updates.scopeChallenge;
 				if (updates._meta !== void 0) registeredTool._meta = updates._meta;
 				if (updates.enabled !== void 0) registeredTool.enabled = updates.enabled;
 				this.sendToolListChanged();
@@ -1752,13 +2109,13 @@ var McpServer = class {
 	}
 	registerTool(name, config, cb) {
 		if (this._registeredTools[name]) throw new Error(`Tool ${name} is already registered`);
-		const { title, description, inputSchema, outputSchema, annotations, icons, _meta } = config;
-		return this._createRegisteredTool(name, title, description, require_src.normalizeRawShapeSchema(inputSchema), require_src.normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, _meta, cb);
+		const { title, description, inputSchema, outputSchema, annotations, icons, scopeChallenge, _meta } = config;
+		return this._createRegisteredTool(name, title, description, require_src.normalizeRawShapeSchema(inputSchema), require_src.normalizeRawShapeSchema(outputSchema), annotations, icons, void 0, scopeChallenge, _meta, cb);
 	}
 	registerPrompt(name, config, cb) {
 		if (this._registeredPrompts[name]) throw new Error(`Prompt ${name} is already registered`);
-		const { title, description, argsSchema, icons, _meta } = config;
-		const registeredPrompt = this._createRegisteredPrompt(name, title, description, require_src.normalizeRawShapeSchema(argsSchema), cb, icons, _meta);
+		const { title, description, argsSchema, icons, scopeChallenge, _meta } = config;
+		const registeredPrompt = this._createRegisteredPrompt(name, title, description, require_src.normalizeRawShapeSchema(argsSchema), cb, icons, scopeChallenge, _meta);
 		this.setPromptRequestHandlers();
 		this.sendPromptListChanged();
 		return registeredPrompt;
@@ -1917,16 +2274,16 @@ function unwrapOptionalSchema(schema) {
 }
 
 //#endregion
-Object.defineProperty(exports, 'DEFAULT_LISTEN_KEEPALIVE_MS', {
+Object.defineProperty(exports, 'DEFAULT_MAX_SUBSCRIPTIONS', {
   enumerable: true,
   get: function () {
-    return DEFAULT_LISTEN_KEEPALIVE_MS;
+    return DEFAULT_MAX_SUBSCRIPTIONS;
   }
 });
-Object.defineProperty(exports, 'DEFAULT_MAX_SUBSCRIPTIONS', {
+Object.defineProperty(exports, 'DEFAULT_SSE_KEEP_ALIVE_MS', {
   enumerable: true,
   get: function () {
-    return DEFAULT_MAX_SUBSCRIPTIONS;
+    return DEFAULT_SSE_KEEP_ALIVE_MS;
   }
 });
 Object.defineProperty(exports, 'InMemoryServerEventBus', {
@@ -1959,6 +2316,24 @@ Object.defineProperty(exports, 'StdioListenRouter', {
     return StdioListenRouter;
   }
 });
+Object.defineProperty(exports, 'armSseKeepAlive', {
+  enumerable: true,
+  get: function () {
+    return armSseKeepAlive;
+  }
+});
+Object.defineProperty(exports, 'bearerAuthChallengeResponse', {
+  enumerable: true,
+  get: function () {
+    return bearerAuthChallengeResponse;
+  }
+});
+Object.defineProperty(exports, 'buildOAuthProtectedResourceMetadata', {
+  enumerable: true,
+  get: function () {
+    return buildOAuthProtectedResourceMetadata;
+  }
+});
 Object.defineProperty(exports, 'completable', {
   enumerable: true,
   get: function () {
@@ -1971,12 +2346,30 @@ Object.defineProperty(exports, 'createListenRouter', {
     return createListenRouter;
   }
 });
+Object.defineProperty(exports, 'createScopeChallengeResponse', {
+  enumerable: true,
+  get: function () {
+    return createScopeChallengeResponse;
+  }
+});
 Object.defineProperty(exports, 'createServerNotifier', {
   enumerable: true,
   get: function () {
     return createServerNotifier;
   }
 });
+Object.defineProperty(exports, 'findScopeChallenge', {
+  enumerable: true,
+  get: function () {
+    return findScopeChallenge;
+  }
+});
+Object.defineProperty(exports, 'getOAuthProtectedResourceMetadataUrl', {
+  enumerable: true,
+  get: function () {
+    return getOAuthProtectedResourceMetadataUrl;
+  }
+});
 Object.defineProperty(exports, 'installModernOnlyHandlers', {
   enumerable: true,
   get: function () {
@@ -1989,6 +2382,30 @@ Object.defineProperty(exports, 'isCompletable', {
     return isCompletable;
   }
 });
+Object.defineProperty(exports, 'oauthMetadataResponse', {
+  enumerable: true,
+  get: function () {
+    return oauthMetadataResponse;
+  }
+});
+Object.defineProperty(exports, 'requireBearerAuth', {
+  enumerable: true,
+  get: function () {
+    return requireBearerAuth;
+  }
+});
+Object.defineProperty(exports, 'requireScopes', {
+  enumerable: true,
+  get: function () {
+    return requireScopes;
+  }
+});
+Object.defineProperty(exports, 'scopeChallengeResourceMetadataUrl', {
+  enumerable: true,
+  get: function () {
+    return scopeChallengeResourceMetadataUrl;
+  }
+});
 Object.defineProperty(exports, 'seedClientIdentityFromEnvelope', {
   enumerable: true,
   get: function () {
@@ -2001,4 +2418,10 @@ Object.defineProperty(exports, 'serverIdentityOf', {
     return serverIdentityOf;
   }
 });
-//# sourceMappingURL=mcp-DM1iHYFo.cjs.map
+Object.defineProperty(exports, 'verifyBearerToken', {
+  enumerable: true,
+  get: function () {
+    return verifyBearerToken;
+  }
+});
+//# sourceMappingURL=mcp-DUcCQSTW.cjs.map