poe-code 3.0.420 → 3.0.421

package/packages/tiny-mcp-client/dist/index.js

@@ -1 +1,3870 @@
-export { createInMemoryTransportPair, discoverOAuthMetadata, createSdkTestPair, createTestPair, ERROR_INTERNAL, ERROR_INVALID_PARAMS, ERROR_INVALID_REQUEST, ERROR_METHOD_NOT_FOUND, ERROR_PARSE, HttpTransport, JsonRpcMessageLayer, McpClient, McpError, OAuthMetadataDiscovery, StdioTransport, } from "./internal.js";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// ../../node_modules/@modelcontextprotocol/sdk/dist/esm/inMemory.js
+var inMemory_exports = {};
+__export(inMemory_exports, {
+  InMemoryTransport: () => InMemoryTransport
+});
+var InMemoryTransport;
+var init_inMemory = __esm({
+  "../../node_modules/@modelcontextprotocol/sdk/dist/esm/inMemory.js"() {
+    InMemoryTransport = class _InMemoryTransport {
+      constructor() {
+        this._messageQueue = [];
+      }
+      /**
+       * Creates a pair of linked in-memory transports that can communicate with each other. One should be passed to a Client and one to a Server.
+       */
+      static createLinkedPair() {
+        const clientTransport = new _InMemoryTransport();
+        const serverTransport = new _InMemoryTransport();
+        clientTransport._otherTransport = serverTransport;
+        serverTransport._otherTransport = clientTransport;
+        return [clientTransport, serverTransport];
+      }
+      async start() {
+        while (this._messageQueue.length > 0) {
+          const queuedMessage = this._messageQueue.shift();
+          this.onmessage?.(queuedMessage.message, queuedMessage.extra);
+        }
+      }
+      async close() {
+        const other = this._otherTransport;
+        this._otherTransport = void 0;
+        await other?.close();
+        this.onclose?.();
+      }
+      /**
+       * Sends a message with optional auth info.
+       * This is useful for testing authentication scenarios.
+       */
+      async send(message, options) {
+        if (!this._otherTransport) {
+          throw new Error("Not connected");
+        }
+        if (this._otherTransport.onmessage) {
+          this._otherTransport.onmessage(message, { authInfo: options?.authInfo });
+        } else {
+          this._otherTransport._messageQueue.push({ message, extra: { authInfo: options?.authInfo } });
+        }
+      }
+    };
+  }
+});
+
+// src/internal.ts
+import { spawn as spawn2 } from "node:child_process";
+import { PassThrough } from "node:stream";
+
+// ../mcp-oauth/dist/client/auth-store-session-store.js
+import crypto from "node:crypto";
+import path2 from "node:path";
+
+// ../auth-store/dist/encrypted-file-store.js
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID, scrypt } from "node:crypto";
+import { promises as fs } from "node:fs";
+import { homedir, hostname, userInfo } from "node:os";
+import path from "node:path";
+
+// ../auth-store/dist/error-codes.js
+function hasOwnErrorCode(error, code) {
+  return error instanceof Error && Object.prototype.hasOwnProperty.call(error, "code") && error.code === code;
+}
+
+// ../auth-store/dist/encrypted-file-store.js
+var derivedKeyCache = /* @__PURE__ */ new Map();
+var ENCRYPTION_ALGORITHM = "aes-256-gcm";
+var ENCRYPTION_VERSION = 1;
+var ENCRYPTION_KEY_BYTES = 32;
+var ENCRYPTION_IV_BYTES = 12;
+var ENCRYPTION_AUTH_TAG_BYTES = 16;
+var ENCRYPTION_FILE_MODE = 384;
+var EncryptedFileStore = class {
+  fs;
+  filePath;
+  symbolicLinkCheckStartPath;
+  salt;
+  getMachineIdentity;
+  getRandomBytes;
+  keyPromise = null;
+  constructor(input) {
+    this.fs = input.fs ?? fs;
+    this.salt = input.salt;
+    if (input.filePath === void 0) {
+      const homeDirectory = (input.getHomeDirectory ?? homedir)();
+      const defaultDirectory = input.defaultDirectory ?? ".auth-store";
+      const defaultFileName = input.defaultFileName ?? "credentials.enc";
+      assertSafeDefaultDirectory(defaultDirectory);
+      assertSafeDefaultFileName(defaultFileName);
+      this.filePath = path.join(homeDirectory, defaultDirectory, defaultFileName);
+      this.symbolicLinkCheckStartPath = resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory);
+    } else {
+      this.filePath = input.filePath;
+      this.symbolicLinkCheckStartPath = null;
+    }
+    this.getMachineIdentity = input.getMachineIdentity ?? defaultMachineIdentity;
+    this.getRandomBytes = input.getRandomBytes ?? randomBytes;
+  }
+  async get() {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    let rawDocument;
+    try {
+      rawDocument = await this.fs.readFile(this.filePath, "utf8");
+    } catch (error) {
+      if (isNotFoundError(error)) {
+        return null;
+      }
+      throw error;
+    }
+    const document = parseEncryptedDocument(rawDocument);
+    if (!document) {
+      return null;
+    }
+    const key2 = await this.getEncryptionKey();
+    try {
+      const iv = Buffer.from(document.iv, "base64");
+      const authTag = Buffer.from(document.authTag, "base64");
+      const ciphertext = Buffer.from(document.ciphertext, "base64");
+      if (iv.byteLength !== ENCRYPTION_IV_BYTES || authTag.byteLength !== ENCRYPTION_AUTH_TAG_BYTES) {
+        return null;
+      }
+      const decipher = createDecipheriv(ENCRYPTION_ALGORITHM, key2, iv);
+      decipher.setAuthTag(authTag);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      return plaintext.toString("utf8");
+    } catch {
+      return null;
+    }
+  }
+  async set(value) {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const key2 = await this.getEncryptionKey();
+    const iv = this.getRandomBytes(ENCRYPTION_IV_BYTES);
+    const cipher = createCipheriv(ENCRYPTION_ALGORITHM, key2, iv);
+    const ciphertext = Buffer.concat([
+      cipher.update(value, "utf8"),
+      cipher.final()
+    ]);
+    const authTag = cipher.getAuthTag();
+    const document = {
+      version: ENCRYPTION_VERSION,
+      iv: iv.toString("base64"),
+      authTag: authTag.toString("base64"),
+      ciphertext: ciphertext.toString("base64")
+    };
+    await this.fs.mkdir(path.dirname(this.filePath), { recursive: true });
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    const temporaryPath = `${this.filePath}.${process.pid}.${randomUUID()}.tmp`;
+    let temporaryCreated = false;
+    try {
+      await this.assertCredentialPathHasNoSymbolicLinks(temporaryPath);
+      await this.fs.writeFile(temporaryPath, JSON.stringify(document), {
+        encoding: "utf8",
+        flag: "wx",
+        mode: ENCRYPTION_FILE_MODE
+      });
+      temporaryCreated = true;
+      await this.fs.chmod(temporaryPath, ENCRYPTION_FILE_MODE);
+      await this.fs.rename(temporaryPath, this.filePath);
+    } catch (error) {
+      if (temporaryCreated || !isAlreadyExistsError(error)) {
+        await removeIfPresent(this.fs, temporaryPath).catch(() => void 0);
+      }
+      throw error;
+    }
+  }
+  async delete() {
+    await this.assertCredentialPathHasNoSymbolicLinks(this.filePath);
+    try {
+      await this.fs.unlink(this.filePath);
+    } catch (error) {
+      if (!isNotFoundError(error)) {
+        throw error;
+      }
+    }
+  }
+  async assertCredentialPathHasNoSymbolicLinks(targetPath) {
+    const resolvedPath = path.resolve(targetPath);
+    const protectedPaths = getProtectedCredentialPaths(resolvedPath, this.symbolicLinkCheckStartPath);
+    for (const currentPath of protectedPaths) {
+      try {
+        const stats = await this.fs.lstat(currentPath);
+        if (stats.isSymbolicLink()) {
+          throw new Error(`Refusing to use encrypted credential path through symbolic link: ${currentPath}`);
+        }
+      } catch (error) {
+        if (isNotFoundError(error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  }
+  getEncryptionKey() {
+    if (!this.keyPromise) {
+      const retryableKeyPromise = deriveEncryptionKey(this.getMachineIdentity, this.salt).catch((error) => {
+        if (this.keyPromise === retryableKeyPromise) {
+          this.keyPromise = null;
+        }
+        throw error;
+      });
+      this.keyPromise = retryableKeyPromise;
+    }
+    return this.keyPromise;
+  }
+};
+function resolveDefaultDirectoryCheckStart(homeDirectory, defaultDirectory) {
+  const [firstSegment] = defaultDirectory.split(/[\\/]+/).filter(Boolean);
+  return path.resolve(homeDirectory, firstSegment ?? ".");
+}
+function getProtectedCredentialPaths(resolvedPath, symbolicLinkCheckStartPath) {
+  if (symbolicLinkCheckStartPath === null) {
+    return getExplicitProtectedCredentialPaths(resolvedPath);
+  }
+  const resolvedStartPath = path.resolve(symbolicLinkCheckStartPath);
+  if (!isPathInsideOrEqual(resolvedPath, resolvedStartPath)) {
+    return [path.dirname(resolvedPath), resolvedPath];
+  }
+  const protectedPaths = [resolvedStartPath];
+  let currentPath = resolvedStartPath;
+  for (const segment of path.relative(resolvedStartPath, resolvedPath).split(path.sep).filter(Boolean)) {
+    currentPath = path.join(currentPath, segment);
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function assertSafeDefaultDirectory(defaultDirectory) {
+  if (path.isAbsolute(defaultDirectory) || path.win32.isAbsolute(defaultDirectory)) {
+    throw new Error("defaultDirectory must be a relative path inside the home directory");
+  }
+  for (const segment of splitPathSegments(defaultDirectory)) {
+    if (segment === "..") {
+      throw new Error("defaultDirectory must be a relative path inside the home directory");
+    }
+  }
+}
+function assertSafeDefaultFileName(defaultFileName) {
+  if (defaultFileName.trim().length === 0 || defaultFileName === "." || defaultFileName === ".." || splitPathSegments(defaultFileName).length !== 1) {
+    throw new Error("defaultFileName must be a file name without path separators");
+  }
+}
+function splitPathSegments(value) {
+  return value.split("/").flatMap((segment) => segment.split("\\")).filter((segment) => segment.length > 0);
+}
+function getExplicitProtectedCredentialPaths(resolvedPath) {
+  const parsed = path.parse(resolvedPath);
+  const segments = resolvedPath.slice(parsed.root.length).split(path.sep).filter((segment) => segment.length > 0);
+  if (segments.length <= 1) {
+    return [resolvedPath];
+  }
+  const protectedPaths = [];
+  let currentPath = parsed.root;
+  for (const [index, segment] of segments.entries()) {
+    currentPath = path.join(currentPath, segment);
+    if (index === 0) {
+      continue;
+    }
+    protectedPaths.push(currentPath);
+  }
+  return protectedPaths;
+}
+function isPathInsideOrEqual(childPath, parentPath) {
+  const relativePath = path.relative(parentPath, childPath);
+  return relativePath === "" || !relativePath.startsWith("..") && !path.isAbsolute(relativePath);
+}
+async function removeIfPresent(fileSystem, filePath) {
+  try {
+    await fileSystem.unlink(filePath);
+  } catch (error) {
+    if (!isNotFoundError(error)) {
+      throw error;
+    }
+  }
+}
+function defaultMachineIdentity() {
+  return {
+    hostname: hostname(),
+    username: userInfo().username
+  };
+}
+async function deriveEncryptionKey(getMachineIdentity, salt) {
+  const machineIdentity = await getMachineIdentity();
+  const secret = `${machineIdentity.hostname}:${machineIdentity.username}`;
+  const cacheKey = JSON.stringify([machineIdentity.hostname, machineIdentity.username, salt]);
+  const cached = derivedKeyCache.get(cacheKey);
+  if (cached) {
+    return cached;
+  }
+  const keyPromise = new Promise((resolve, reject) => {
+    scrypt(secret, salt, ENCRYPTION_KEY_BYTES, (error, derivedKey) => {
+      if (error) {
+        reject(error);
+        return;
+      }
+      resolve(Buffer.from(derivedKey));
+    });
+  });
+  derivedKeyCache.set(cacheKey, keyPromise);
+  return keyPromise.catch((error) => {
+    if (derivedKeyCache.get(cacheKey) === keyPromise) {
+      derivedKeyCache.delete(cacheKey);
+    }
+    throw error;
+  });
+}
+function parseEncryptedDocument(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry(parsed, "version");
+    const iv = getOwnEntry(parsed, "iv");
+    const authTag = getOwnEntry(parsed, "authTag");
+    const ciphertext = getOwnEntry(parsed, "ciphertext");
+    if (version !== ENCRYPTION_VERSION) {
+      return null;
+    }
+    if (typeof iv !== "string" || typeof authTag !== "string" || typeof ciphertext !== "string") {
+      return null;
+    }
+    return {
+      version,
+      iv,
+      authTag,
+      ciphertext
+    };
+  } catch {
+    return null;
+  }
+}
+function isRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function getOwnEntry(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function isNotFoundError(error) {
+  return hasOwnErrorCode(error, "ENOENT");
+}
+function isAlreadyExistsError(error) {
+  return hasOwnErrorCode(error, "EEXIST");
+}
+
+// ../auth-store/dist/keychain-store.js
+import { spawn } from "node:child_process";
+var SECURITY_CLI = "security";
+var KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE = 44;
+var KeychainStore = class {
+  runCommand;
+  service;
+  account;
+  constructor(input) {
+    this.runCommand = input.runCommand ?? runSecurityCommand;
+    this.service = input.service.trim();
+    this.account = input.account.trim();
+    if (this.service.length === 0) {
+      throw new Error("Keychain service must not be empty");
+    }
+    if (this.account.length === 0) {
+      throw new Error("Keychain account must not be empty");
+    }
+  }
+  async get() {
+    const result = await this.executeSecurityCommand(["find-generic-password", "-s", this.service, "-a", this.account, "-w"], "read secret from macOS Keychain");
+    if (getCommandExitCode(result) === 0) {
+      return stripTrailingLineBreak(getCommandOutput(result, "stdout"));
+    }
+    if (isKeychainEntryNotFound(result)) {
+      return null;
+    }
+    throw createSecurityCliFailure("read secret from macOS Keychain", result);
+  }
+  async set(value) {
+    if (value.includes("\n") || value.includes("\r")) {
+      throw new Error("Keychain secrets cannot contain line breaks");
+    }
+    const result = await this.executeSecurityCommand([
+      "add-generic-password",
+      "-s",
+      this.service,
+      "-a",
+      this.account,
+      "-U",
+      "-w",
+      value
+    ], "store secret in macOS Keychain");
+    if (getCommandExitCode(result) !== 0) {
+      throw createSecurityCliFailure("store secret in macOS Keychain", result);
+    }
+  }
+  async delete() {
+    const result = await this.executeSecurityCommand(["delete-generic-password", "-s", this.service, "-a", this.account], "delete secret from macOS Keychain");
+    if (getCommandExitCode(result) === 0 || isKeychainEntryNotFound(result)) {
+      return;
+    }
+    throw createSecurityCliFailure("delete secret from macOS Keychain", result);
+  }
+  async executeSecurityCommand(args, operation, options) {
+    try {
+      if (options === void 0) {
+        return await this.runCommand(SECURITY_CLI, args);
+      }
+      return await this.runCommand(SECURITY_CLI, args, options);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(`Failed to ${operation}: ${message}`);
+    }
+  }
+};
+function runSecurityCommand(command, args, options) {
+  return new Promise((resolve) => {
+    const child = spawn(command, args, {
+      stdio: [options?.stdin === void 0 ? "ignore" : "pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let stdinErrorMessage;
+    const appendStderr = (message) => {
+      stderr = stderr.length === 0 ? message : `${stderr}${stderr.endsWith("\n") ? "" : "\n"}${message}`;
+    };
+    const appendStdinError = () => {
+      if (stdinErrorMessage === void 0) {
+        return;
+      }
+      appendStderr(stdinErrorMessage);
+      stdinErrorMessage = void 0;
+    };
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    if (options?.stdin !== void 0) {
+      child.stdin?.once("error", (error) => {
+        stdinErrorMessage = error instanceof Error ? error.message : String(error);
+      });
+      child.stdin?.end(options.stdin);
+    }
+    child.on("error", (error) => {
+      const message = error instanceof Error ? error.message : String(error ?? "Unknown error");
+      appendStdinError();
+      appendStderr(message);
+      resolve({
+        stdout,
+        stderr,
+        exitCode: 127
+      });
+    });
+    child.on("close", (code) => {
+      appendStdinError();
+      resolve({
+        stdout,
+        stderr,
+        exitCode: code ?? 1
+      });
+    });
+  });
+}
+function stripTrailingLineBreak(value) {
+  if (value.endsWith("\r\n")) {
+    return value.slice(0, -2);
+  }
+  if (value.endsWith("\n") || value.endsWith("\r")) {
+    return value.slice(0, -1);
+  }
+  return value;
+}
+function isKeychainEntryNotFound(result) {
+  return getCommandExitCode(result) === KEYCHAIN_ITEM_NOT_FOUND_EXIT_CODE;
+}
+function createSecurityCliFailure(operation, result) {
+  const exitCode = getCommandExitCode(result);
+  const details = getCommandOutput(result, "stderr").trim() || getCommandOutput(result, "stdout").trim();
+  if (details) {
+    return new Error(`Failed to ${operation}: security exited with code ${exitCode}: ${details}`);
+  }
+  return new Error(`Failed to ${operation}: security exited with code ${exitCode}`);
+}
+function getCommandExitCode(result) {
+  const value = getOwnEntry2(result, "exitCode");
+  return typeof value === "number" && Number.isInteger(value) ? value : 1;
+}
+function getCommandOutput(result, key2) {
+  const value = getOwnEntry2(result, key2);
+  return typeof value === "string" ? value : "";
+}
+function getOwnEntry2(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+
+// ../auth-store/dist/create-secret-store.js
+var DEFAULT_BACKEND_ENV_VAR = "AUTH_BACKEND";
+var MACOS_PLATFORM = "darwin";
+var storeFactories = {
+  file: (input) => {
+    if (!input.fileStore) {
+      throw new Error("fileStore configuration is required for file backend");
+    }
+    return new EncryptedFileStore(input.fileStore);
+  },
+  keychain: (input) => {
+    if (!input.keychainStore) {
+      throw new Error("keychainStore configuration is required for keychain backend");
+    }
+    return new KeychainStore(input.keychainStore);
+  }
+};
+function createSecretStore(input) {
+  const backend = resolveBackend(input);
+  const platform = input.platform ?? process.platform;
+  if (backend === "keychain" && platform !== MACOS_PLATFORM) {
+    throw new Error(`Keychain backend is only supported on macOS. Current platform: ${platform}`);
+  }
+  const store = storeFactories[backend](input);
+  return { backend, store };
+}
+function resolveBackend(input) {
+  const envVar = input.backendEnvVar ?? DEFAULT_BACKEND_ENV_VAR;
+  const configuredBackend = input.backend ?? getOwnEnvValue(input.env, envVar) ?? getOwnEnvValue(process.env, envVar);
+  const backend = configuredBackend?.trim();
+  if (backend === "keychain") {
+    return "keychain";
+  }
+  if (backend === void 0 || backend === "file") {
+    return "file";
+  }
+  throw new Error(`Unsupported auth store backend: ${backend}`);
+}
+function getOwnEnvValue(env, key2) {
+  return env !== void 0 && Object.prototype.hasOwnProperty.call(env, key2) ? env[key2] : void 0;
+}
+
+// ../mcp-oauth/dist/resource-indicator.js
+function canonicalizeResourceIndicator(value) {
+  let url;
+  try {
+    url = value instanceof URL ? new URL(value.toString()) : new URL(value);
+  } catch {
+    throw new Error("Resource indicator must be an absolute URL");
+  }
+  url.hash = "";
+  return url.toString();
+}
+
+// ../mcp-oauth/dist/client/auth-store-session-store.js
+var DEFAULT_FILE_SALT = "poe-code:mcp-oauth:v1";
+var DEFAULT_FILE_DIRECTORY = ".poe-code/mcp-oauth";
+var DEFAULT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth";
+var DEFAULT_CLIENT_FILE_SALT = "poe-code:mcp-oauth:clients:v1";
+var DEFAULT_CLIENT_FILE_DIRECTORY = ".poe-code/mcp-oauth/clients";
+var DEFAULT_CLIENT_KEYCHAIN_SERVICE = "poe-code-mcp-oauth-clients";
+var MAX_JS_DATE_MS = 864e13;
+function createAuthStoreSessionStore(options = {}) {
+  return {
+    async load(resource) {
+      const store = createResourceSecretStore(resource, options);
+      const value = await store.get();
+      if (value === null) {
+        return null;
+      }
+      const parsed = JSON.parse(value);
+      if (isStoredOAuthSession(parsed)) {
+        return parsed;
+      }
+      throw new Error("Stored OAuth session must match the expected shape");
+    },
+    async save(resource, session) {
+      const store = createResourceSecretStore(resource, options);
+      await store.set(JSON.stringify(session));
+    },
+    async clear(resource) {
+      const store = createResourceSecretStore(resource, options);
+      await store.delete();
+    }
+  };
+}
+function createAuthStoreClientStore(options) {
+  return {
+    async load(issuer) {
+      const store = createIssuerSecretStore(issuer, options);
+      const value = await store.get();
+      if (value === null) {
+        return null;
+      }
+      const parsed = JSON.parse(value);
+      const clientId = isObjectRecord(parsed) ? getOwnString(parsed, "clientId") : void 0;
+      if (clientId !== void 0) {
+        const client = { clientId };
+        if (isObjectRecord(parsed) && Object.prototype.hasOwnProperty.call(parsed, "clientSecret")) {
+          client.clientSecret = getOwnEntry3(parsed, "clientSecret");
+        }
+        return client;
+      }
+      throw new Error("Stored OAuth client must be a JSON object with clientId");
+    },
+    async save(issuer, client) {
+      const store = createIssuerSecretStore(issuer, options);
+      await store.set(JSON.stringify(client));
+    },
+    async clear(issuer) {
+      const store = createIssuerSecretStore(issuer, options);
+      await store.delete();
+    }
+  };
+}
+function createNamedSecretStore(key2, options, defaults) {
+  const hash = crypto.createHash("sha256").update(key2).digest("hex");
+  const configuredFilePath = options.fileStore?.filePath;
+  const parsedFilePath = configuredFilePath === void 0 ? null : path2.parse(configuredFilePath);
+  const fileStore = {
+    ...options.fileStore,
+    filePath: parsedFilePath === null ? void 0 : path2.join(parsedFilePath.dir, `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`),
+    salt: options.fileStore?.salt ?? defaults.salt,
+    defaultDirectory: options.fileStore?.defaultDirectory || defaults.directory,
+    defaultFileName: parsedFilePath === null ? `${hash}.enc` : `${parsedFilePath.name}-${hash}${parsedFilePath.ext || ".enc"}`
+  };
+  const keychainStore = {
+    ...options.keychainStore,
+    service: options.keychainStore?.service ?? defaults.service,
+    account: `${options.keychainStore?.account ?? defaults.accountPrefix}:${hash}`
+  };
+  return createSecretStore({ ...options, fileStore, keychainStore }).store;
+}
+function createResourceSecretStore(resource, options) {
+  return createNamedSecretStore(canonicalizeResourceIndicator(resource), options, {
+    salt: DEFAULT_FILE_SALT,
+    directory: DEFAULT_FILE_DIRECTORY,
+    service: DEFAULT_KEYCHAIN_SERVICE,
+    accountPrefix: "provider"
+  });
+}
+function createIssuerSecretStore(issuer, options) {
+  return createNamedSecretStore(issuer, options, {
+    salt: DEFAULT_CLIENT_FILE_SALT,
+    directory: DEFAULT_CLIENT_FILE_DIRECTORY,
+    service: DEFAULT_CLIENT_KEYCHAIN_SERVICE,
+    accountPrefix: "issuer"
+  });
+}
+function isObjectRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry3(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function getOwnString(record, key2) {
+  const value = getOwnEntry3(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
+function isStoredOAuthSession(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return isNonBlankOwnString(value, "resource") && isNonBlankOwnString(value, "authorizationServer") && isStoredOAuthClient(getOwnEntry3(value, "client")) && isStoredOAuthDiscovery(getOwnEntry3(value, "discovery")) && isStoredOAuthTokensOrMissing(getOwnEntry3(value, "tokens"));
+}
+function isStoredOAuthClient(value) {
+  if (!isObjectRecord(value) || !isNonBlankOwnString(value, "clientId")) {
+    return false;
+  }
+  const clientSecret = getOwnEntry3(value, "clientSecret");
+  return clientSecret === void 0 || typeof clientSecret === "string" && clientSecret.trim().length > 0;
+}
+function isStoredOAuthDiscovery(value) {
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  return isNonBlankOwnString(value, "resourceMetadataUrl") && isObjectRecord(getOwnEntry3(value, "resourceMetadata")) && isObjectRecord(getOwnEntry3(value, "authorizationServerMetadata"));
+}
+function isStoredOAuthTokensOrMissing(value) {
+  if (value === void 0) {
+    return true;
+  }
+  if (!isObjectRecord(value)) {
+    return false;
+  }
+  if (!isNonBlankOwnString(value, "accessToken") || getOwnString(value, "tokenType") !== "Bearer") {
+    return false;
+  }
+  const expiresAt = getOwnEntry3(value, "expiresAt");
+  if (expiresAt !== null && (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS || !Number.isFinite(new Date(expiresAt).getTime()))) {
+    return false;
+  }
+  const refreshToken = getOwnEntry3(value, "refreshToken");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0)) {
+    return false;
+  }
+  const scope = getOwnEntry3(value, "scope");
+  return scope === void 0 || typeof scope === "string" && scope.trim().length > 0;
+}
+function isNonBlankOwnString(record, key2) {
+  const value = getOwnString(record, key2);
+  return value !== void 0 && value.trim().length > 0;
+}
+
+// ../mcp-oauth/dist/client/default-oauth-client-provider.js
+import { URL as URL2 } from "node:url";
+
+// ../mcp-oauth/dist/client/loopback-authorization.js
+import http from "node:http";
+
+// ../mcp-oauth/dist/client/authorization-state.js
+import crypto2 from "node:crypto";
+function createAuthorizationState(input) {
+  const payload = {
+    v: 1,
+    n: crypto2.randomBytes(16).toString("base64url"),
+    i: input.issuer,
+    r: input.requireIssuer
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+}
+function parseAuthorizationState(value) {
+  if (value === null || value.length === 0) {
+    return null;
+  }
+  try {
+    const decoded = Buffer.from(value, "base64url").toString("utf8");
+    const parsed = JSON.parse(decoded);
+    if (!isObjectRecord2(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry4(parsed, "v");
+    const nonce = getOwnEntry4(parsed, "n");
+    const issuer = getOwnEntry4(parsed, "i");
+    const requireIssuer = getOwnEntry4(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
+      return null;
+    }
+    return {
+      issuer,
+      requireIssuer
+    };
+  } catch {
+    return null;
+  }
+}
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry4(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+
+// ../mcp-oauth/dist/client/loopback-authorization.js
+async function createLoopbackAuthorizationSession(options = {}) {
+  const callbackPath = options.callbackPath ?? "/callback";
+  const server = options.createServer ? options.createServer() : http.createServer();
+  const port = await startServer(server);
+  const redirectUri = `http://127.0.0.1:${port}${callbackPath}`;
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      return waitForAuthorizationCode(server, authorizationUrl, options, callbackPath);
+    },
+    close() {
+      server.closeAllConnections?.();
+      server.close();
+    }
+  };
+}
+async function startServer(server) {
+  return new Promise((resolve, reject) => {
+    const handleError = (error) => {
+      server.off("error", handleError);
+      reject(error);
+    };
+    server.once("error", handleError);
+    server.listen(0, "127.0.0.1", () => {
+      server.off("error", handleError);
+      const address = server.address();
+      resolve(address.port);
+    });
+  });
+}
+function waitForAuthorizationCode(server, authorizationUrl, options, callbackPath) {
+  const expectedAuthorization = readExpectedAuthorizationCallback(authorizationUrl);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const settle = (fn) => {
+      if (!settled) {
+        settled = true;
+        fn();
+      }
+    };
+    server.on("request", (req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== callbackPath) {
+        res.writeHead(404);
+        res.end("Not found");
+        return;
+      }
+      const callbackParameters = {
+        code: url.searchParams.get("code"),
+        error: url.searchParams.get("error"),
+        errorDescription: url.searchParams.get("error_description"),
+        state: url.searchParams.get("state"),
+        iss: url.searchParams.get("iss")
+      };
+      try {
+        validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+      } catch (error) {
+        res.writeHead(400);
+        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
+        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+        return;
+      }
+      const authorizationError = callbackParameters.error;
+      if (authorizationError !== null) {
+        const description = callbackParameters.errorDescription ?? authorizationError;
+        res.writeHead(400);
+        res.end(`Authorization failed: ${description}`);
+        settle(() => reject(createAuthorizationError(authorizationError, description)));
+        return;
+      }
+      try {
+        const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(buildSuccessPage(options.landingPage));
+        settle(() => resolve(code));
+      } catch (error) {
+        res.writeHead(400);
+        res.end(error instanceof Error ? error.message : "Invalid OAuth callback");
+        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+      }
+    });
+    if (options.readLine !== void 0) {
+      options.readLine().then((input) => {
+        const callbackParameters = extractCallbackParametersFromInput(input);
+        if (callbackParameters === null) {
+          settle(() => reject(new Error("OAuth callback missing authorization code")));
+          return;
+        }
+        try {
+          validateAuthorizationCallbackBinding(callbackParameters, expectedAuthorization);
+          if (callbackParameters.error !== null) {
+            const description = callbackParameters.errorDescription ?? callbackParameters.error;
+            throw createAuthorizationError(callbackParameters.error, description);
+          }
+          const code = validateAuthorizationCallbackParameters(callbackParameters, expectedAuthorization);
+          settle(() => resolve(code));
+        } catch (error) {
+          settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+        }
+      }).catch((error) => {
+        settle(() => reject(error instanceof Error ? error : new Error(String(error))));
+      });
+    }
+    if (options.openBrowser !== void 0) {
+      options.openBrowser(authorizationUrl).catch((error) => {
+        settle(() => reject(error));
+      });
+    }
+  });
+}
+function extractCallbackParametersFromInput(input) {
+  const trimmed = input.replaceAll("\r", "").replaceAll("\n", "").trim();
+  if (trimmed.length === 0) {
+    return null;
+  }
+  try {
+    const url = new URL(trimmed);
+    return {
+      code: url.searchParams.get("code"),
+      error: url.searchParams.get("error"),
+      errorDescription: url.searchParams.get("error_description"),
+      state: url.searchParams.get("state"),
+      iss: url.searchParams.get("iss")
+    };
+  } catch {
+    return {
+      code: trimmed,
+      error: null,
+      errorDescription: null,
+      state: null,
+      iss: null
+    };
+  }
+}
+function readExpectedAuthorizationCallback(authorizationUrl) {
+  const url = new URL(authorizationUrl);
+  const state = url.searchParams.get("state");
+  const parsedState = parseAuthorizationState(state);
+  return {
+    state,
+    issuer: parsedState?.issuer ?? null,
+    requireIssuer: parsedState?.requireIssuer ?? false
+  };
+}
+function validateAuthorizationCallbackParameters(callback, expected) {
+  validateAuthorizationCallbackBinding(callback, expected);
+  if (callback.code === null || callback.code.length === 0) {
+    throw new Error("OAuth callback missing authorization code");
+  }
+  return callback.code;
+}
+function validateAuthorizationCallbackBinding(callback, expected) {
+  if (expected.state !== null) {
+    if (callback.state === null || callback.state.length === 0) {
+      throw new Error("OAuth callback missing state");
+    }
+    if (callback.state !== expected.state) {
+      throw new Error("OAuth callback state mismatch");
+    }
+  }
+  if (expected.requireIssuer) {
+    if (callback.iss === null || callback.iss.length === 0) {
+      throw new Error("OAuth callback missing issuer");
+    }
+  }
+  if (callback.iss !== null && callback.iss.length > 0 && expected.issuer !== null && callback.iss !== expected.issuer) {
+    throw new Error("OAuth callback issuer mismatch");
+  }
+}
+function createAuthorizationError(error, description) {
+  return new Error(`OAuth authorization failed: ${error} \u2014 ${description}`);
+}
+function escapeHtml(text) {
+  return text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+}
+function buildSuccessPage(landingPage) {
+  const title = landingPage?.title ?? "Connected";
+  const body = landingPage?.body ?? "You can close this tab and return to your terminal.";
+  return [
+    "<!DOCTYPE html>",
+    `<html><head><meta charset=utf-8><title>${escapeHtml(title)}</title></head>`,
+    '<body style="font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0">',
+    '<div style="text-align:center">',
+    `<h1>${escapeHtml(title)}</h1>`,
+    `<p style="color:#666">${escapeHtml(body)}</p>`,
+    "</div></body></html>"
+  ].join("");
+}
+
+// ../mcp-oauth/dist/client/pkce.js
+import crypto3 from "node:crypto";
+function generateCodeVerifier() {
+  return crypto3.randomBytes(32).toString("base64url");
+}
+function generateCodeChallenge(verifier) {
+  return crypto3.createHash("sha256").update(verifier).digest("base64url");
+}
+
+// ../mcp-oauth/dist/client/token-endpoint.js
+var MAX_JS_DATE_MS2 = 864e13;
+var OAuthError = class extends Error {
+  error;
+  errorDescription;
+  errorUri;
+  error_description;
+  error_uri;
+  status;
+  retryable;
+  terminal;
+  constructor(shape, status) {
+    super(shape.error_description ?? shape.error);
+    this.name = "OAuthError";
+    this.error = shape.error;
+    this.errorDescription = shape.error_description;
+    this.errorUri = shape.error_uri;
+    this.error_description = shape.error_description;
+    this.error_uri = shape.error_uri;
+    this.status = status;
+    this.retryable = isRetryableOAuthError(this);
+    this.terminal = !this.retryable;
+  }
+};
+function isRetryableOAuthError(error) {
+  return error instanceof OAuthError && (error.status >= 500 || error.error === "server_error" || error.error === "temporarily_unavailable");
+}
+async function exchangeAuthorizationCode(input) {
+  const resource = canonicalizeResourceIndicator(input.resource);
+  return requestTokens({
+    tokenEndpoint: input.tokenEndpoint,
+    clientId: input.clientId,
+    clientSecret: input.clientSecret,
+    params: {
+      grant_type: "authorization_code",
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: input.redirectUri,
+      resource
+    },
+    fetch: input.fetch,
+    now: input.now
+  });
+}
+async function refreshAccessToken(input) {
+  const resource = canonicalizeResourceIndicator(input.resource);
+  return requestTokens({
+    tokenEndpoint: input.tokenEndpoint,
+    clientId: input.clientId,
+    clientSecret: input.clientSecret,
+    params: {
+      grant_type: "refresh_token",
+      refresh_token: input.refreshToken,
+      resource
+    },
+    fetch: input.fetch,
+    now: input.now
+  });
+}
+async function requestTokens(input) {
+  const body = new URLSearchParams({
+    client_id: input.clientId,
+    ...input.params
+  });
+  if (input.clientSecret !== void 0) {
+    body.set("client_secret", input.clientSecret);
+  }
+  const response = await input.fetch(input.tokenEndpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: body.toString()
+  });
+  const payload = await readOAuthJsonObjectResponse(response);
+  const accessToken = getOwnEntry5(payload, "access_token");
+  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
+    throw new Error("OAuth token response missing access_token");
+  }
+  const normalizedAccessToken = accessToken.trim();
+  const tokenType = normalizeBearerTokenType(getOwnEntry5(payload, "token_type"));
+  if (tokenType === null) {
+    throw new Error("OAuth token response missing token_type=Bearer");
+  }
+  const expiresIn = getOwnEntry5(payload, "expires_in");
+  let expiresAt = null;
+  if (expiresIn !== void 0) {
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || !Number.isInteger(expiresIn) || expiresIn < 0) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+    expiresAt = input.now() + expiresIn * 1e3;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS2 || !Number.isFinite(new Date(expiresAt).getTime())) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+  }
+  const refreshToken = getOwnEntry5(payload, "refresh_token");
+  const scope = getOwnEntry5(payload, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
+  const normalizedScope = typeof scope === "string" && scope.trim().length > 0 ? scope.trim() : void 0;
+  return {
+    accessToken: normalizedAccessToken,
+    refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
+    tokenType,
+    expiresAt,
+    scope: normalizedScope === void 0 ? void 0 : normalizedScope
+  };
+}
+async function readOAuthJsonObjectResponse(response) {
+  const fallbackError = createFallbackOAuthError(response.status);
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  const record = payload;
+  if (!response.ok) {
+    throw new OAuthError(readOAuthError(record, fallbackError.error), response.status);
+  }
+  return record;
+}
+function readOAuthError(payload, fallbackError = "server_error") {
+  const error = getOwnEntry5(payload, "error");
+  const errorDescription = getOwnEntry5(payload, "error_description");
+  const errorUri = getOwnEntry5(payload, "error_uri");
+  return {
+    error: typeof error === "string" ? error : fallbackError,
+    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
+    error_uri: typeof errorUri === "string" ? errorUri : void 0
+  };
+}
+function getOwnEntry5(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function createFallbackOAuthError(status) {
+  const error = status === 503 ? "temporarily_unavailable" : "server_error";
+  return new OAuthError({ error }, status);
+}
+function normalizeBearerTokenType(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  return value.toLowerCase() === "bearer" ? "Bearer" : null;
+}
+
+// ../mcp-oauth/dist/client/default-oauth-client-provider.js
+var MAX_JS_DATE_MS3 = 864e13;
+function createOAuthClientProvider(options) {
+  if (isProviderOptions(options)) {
+    return options.provider;
+  }
+  return createDefaultOAuthClientProvider(options);
+}
+function createDefaultOAuthClientProvider(options) {
+  const sessionStore = options.sessionStore ?? createAuthStoreSessionStore(options.authStore);
+  const clientStore = options.authStore === void 0 ? null : createAuthStoreClientStore(options.authStore);
+  const now = options.now ?? Date.now;
+  const registeredClients = /* @__PURE__ */ new Map();
+  const refreshPromises = /* @__PURE__ */ new Map();
+  const authorizationPromises = /* @__PURE__ */ new Map();
+  return {
+    async authorizeRequest(input) {
+      assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+      const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
+      const session = await ensureAuthorizedSession(requestUrl, void 0, input.fetch, false);
+      const accessToken = session?.tokens?.accessToken;
+      if (session === null || accessToken === void 0 || session.tokens === void 0 || isExpired(session.tokens, now)) {
+        return;
+      }
+      assertRequestMatchesResource(requestUrl, session.resource);
+      input.headers.set("Authorization", `Bearer ${accessToken}`);
+    },
+    async handleUnauthorized(input) {
+      try {
+        assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
+        const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
+        const resource = canonicalizeResourceIndicator(input.discovery.resource);
+        assertRequestMatchesResource(requestUrl, resource);
+        const forceRefresh = hasCachedAccessToken(await loadSession(resource)) && input.challenge?.params.error === "invalid_token";
+        const session = await ensureAuthorizedSession(resource, {
+          ...input.discovery,
+          resource
+        }, input.fetch, true, forceRefresh);
+        if (session?.tokens?.accessToken === void 0) {
+          return { action: "fail" };
+        }
+        return { action: "retry" };
+      } catch (error) {
+        return {
+          action: "fail",
+          error: error instanceof Error ? error : new Error(String(error))
+        };
+      }
+    }
+  };
+  async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false) {
+    const canonicalResource = canonicalizeResourceIndicator(resource);
+    let session = await loadSession(canonicalResource);
+    const sessionDiscovery = resolveDiscovery(discovery, session);
+    if (session?.tokens !== void 0 && !forceRefresh && !isExpired(session.tokens, now)) {
+      return session;
+    }
+    if (session?.tokens?.refreshToken !== void 0 && sessionDiscovery !== void 0 && (forceRefresh || isExpired(session.tokens, now))) {
+      session = await refreshSession(canonicalResource, session, sessionDiscovery, fetch2);
+      if (session?.tokens !== void 0 && !isExpired(session.tokens, now)) {
+        return session;
+      }
+    }
+    if (forceRefresh && session?.tokens !== void 0) {
+      session = clearSessionTokens(session);
+      await saveSession(canonicalResource, session);
+    }
+    if (!allowInteractive || sessionDiscovery === void 0) {
+      return session;
+    }
+    return authorizeSession(canonicalResource, session, sessionDiscovery, fetch2);
+  }
+  async function refreshSession(resource, session, discovery, fetch2) {
+    assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+    const inFlight = refreshPromises.get(resource);
+    if (inFlight !== void 0) {
+      return inFlight;
+    }
+    const promise = (async () => {
+      try {
+        if (session.tokens?.refreshToken === void 0) {
+          return session;
+        }
+        let refreshAttempted = false;
+        let refreshedTokens;
+        while (true) {
+          try {
+            refreshedTokens = await refreshAccessToken({
+              tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+              clientId: session.client.clientId,
+              clientSecret: session.client.clientSecret,
+              refreshToken: session.tokens.refreshToken,
+              resource,
+              fetch: fetch2,
+              now
+            });
+            break;
+          } catch (error) {
+            if (error instanceof OAuthError && error.error === "invalid_grant") {
+              const clearedSession = clearSessionTokens(session);
+              await saveSession(resource, clearedSession);
+              return clearedSession;
+            }
+            if (shouldReRegisterStoredDynamicClient(error, await loadRegisteredClient(discovery.authorizationServer), false)) {
+              await clearRegisteredClient(discovery.authorizationServer);
+              await clearSession(resource);
+              return null;
+            }
+            if (!refreshAttempted && isRetryableOAuthError(error)) {
+              refreshAttempted = true;
+              continue;
+            }
+            throw error;
+          }
+        }
+        const updatedSession = {
+          ...session,
+          tokens: {
+            ...refreshedTokens,
+            refreshToken: refreshedTokens.refreshToken ?? session.tokens.refreshToken
+          },
+          discovery: toStoredDiscovery(discovery)
+        };
+        await saveSession(resource, updatedSession);
+        return updatedSession;
+      } finally {
+        refreshPromises.delete(resource);
+      }
+    })();
+    refreshPromises.set(resource, promise);
+    return promise;
+  }
+  async function authorizeSession(resource, existingSession, discovery, fetch2) {
+    const inFlight = authorizationPromises.get(resource);
+    if (inFlight !== void 0) {
+      return inFlight;
+    }
+    const promise = (async () => {
+      assertS256PkceSupport(discovery.authorizationServerMetadata);
+      assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
+      let currentSession = existingSession;
+      let transientRetryAttempted = false;
+      let reRegistrationAttempted = false;
+      while (true) {
+        const loopback = await createLoopbackAuthorizationSession({
+          openBrowser: options.browser.openBrowser,
+          readLine: options.browser.readLine,
+          createServer: options.browser.createServer,
+          landingPage: options.browser.landingPage
+        });
+        let resolvedClient = null;
+        try {
+          resolvedClient = await resolveClient(currentSession, discovery, loopback.redirectUri, fetch2);
+          const sessionWithoutTokens = {
+            resource,
+            authorizationServer: discovery.authorizationServer,
+            client: resolvedClient.client,
+            discovery: toStoredDiscovery(discovery)
+          };
+          await saveSession(resource, sessionWithoutTokens);
+          const verifier = generateCodeVerifier();
+          const challenge = generateCodeChallenge(verifier);
+          const authorizationUrl = buildAuthorizationUrl({
+            metadata: discovery.authorizationServerMetadata,
+            resource,
+            clientId: resolvedClient.client.clientId,
+            redirectUri: loopback.redirectUri,
+            codeChallenge: challenge,
+            clientMetadata: getClientMetadata(options.client)
+          });
+          const code = await loopback.waitForCode(authorizationUrl);
+          const tokens = await exchangeAuthorizationCode({
+            tokenEndpoint: requireOwnString(discovery.authorizationServerMetadata, "token_endpoint", "Authorization server metadata"),
+            clientId: resolvedClient.client.clientId,
+            clientSecret: resolvedClient.client.clientSecret,
+            code,
+            codeVerifier: verifier,
+            redirectUri: loopback.redirectUri,
+            resource,
+            fetch: fetch2,
+            now
+          });
+          const session = {
+            ...sessionWithoutTokens,
+            tokens
+          };
+          await saveSession(resource, session);
+          return session;
+        } catch (error) {
+          if (shouldReRegisterStoredDynamicClient(error, resolvedClient, reRegistrationAttempted)) {
+            reRegistrationAttempted = true;
+            await clearRegisteredClient(discovery.authorizationServer);
+            await clearSession(resource);
+            currentSession = null;
+            continue;
+          }
+          if (!transientRetryAttempted && isRetryableOAuthError(error)) {
+            transientRetryAttempted = true;
+            await clearSession(resource);
+            currentSession = null;
+            continue;
+          }
+          throw error;
+        } finally {
+          loopback.close();
+        }
+      }
+    })();
+    const finalPromise = promise.finally(() => {
+      authorizationPromises.delete(resource);
+    });
+    authorizationPromises.set(resource, finalPromise);
+    return finalPromise;
+  }
+  async function resolveClient(existingSession, discovery, redirectUri, fetch2) {
+    const configuredClient = normalizeConfiguredClient(options.client);
+    if (options.client.mode === "static") {
+      if (configuredClient === null) {
+        throw new Error("OAuth client_id must not be blank");
+      }
+      return {
+        kind: "static",
+        fromStoredRegistration: false,
+        client: configuredClient
+      };
+    }
+    const registrationEndpoint = getOwnString2(discovery.authorizationServerMetadata, "registration_endpoint");
+    if (registrationEndpoint === void 0 && configuredClient !== null) {
+      return {
+        kind: "static",
+        fromStoredRegistration: false,
+        client: configuredClient
+      };
+    }
+    const storedClient = await loadRegisteredClient(discovery.authorizationServer);
+    if (storedClient !== null) {
+      return {
+        kind: "dynamic",
+        fromStoredRegistration: true,
+        client: storedClient
+      };
+    }
+    if (registrationEndpoint === void 0) {
+      if (existingSession !== null && existingSession.client.clientId.length > 0) {
+        return {
+          kind: "dynamic",
+          fromStoredRegistration: true,
+          client: existingSession.client
+        };
+      }
+      throw new Error("Authorization server metadata is missing registration_endpoint");
+    }
+    if (existingSession !== null && existingSession.client.clientId.length > 0) {
+      const isConfiguredStaticFallback = configuredClient !== null && existingSession.client.clientId === configuredClient.clientId && existingSession.client.clientSecret === configuredClient.clientSecret;
+      if (!isConfiguredStaticFallback) {
+        await saveRegisteredClient(discovery.authorizationServer, existingSession.client);
+        return {
+          kind: "dynamic",
+          fromStoredRegistration: true,
+          client: existingSession.client
+        };
+      }
+    }
+    const registrationBody = buildClientRegistrationBody(getClientMetadata(options.client), redirectUri);
+    const response = await fetch2(registrationEndpoint, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(registrationBody)
+    });
+    const payload = await readOAuthJsonObjectResponse(response);
+    const clientId = getOwnString2(payload, "client_id");
+    if (clientId === void 0 || clientId.trim().length === 0) {
+      throw new Error("OAuth client registration response missing client_id");
+    }
+    const clientSecret = getOwnString2(payload, "client_secret");
+    const registeredClient = {
+      clientId: clientId.trim(),
+      clientSecret: clientSecret !== void 0 && clientSecret.trim().length > 0 ? clientSecret.trim() : void 0
+    };
+    await saveRegisteredClient(discovery.authorizationServer, registeredClient);
+    return {
+      kind: "dynamic",
+      fromStoredRegistration: false,
+      client: registeredClient
+    };
+  }
+  async function loadSession(resource) {
+    return normalizeLoadedSession(await sessionStore.load(resource));
+  }
+  async function saveSession(resource, session) {
+    await sessionStore.save(resource, session);
+  }
+  async function clearSession(resource) {
+    await sessionStore.clear(resource);
+  }
+  async function loadRegisteredClient(issuer) {
+    if (registeredClients.has(issuer)) {
+      return registeredClients.get(issuer) ?? null;
+    }
+    if (clientStore === null) {
+      return null;
+    }
+    const client = await clientStore.load(issuer);
+    const normalizedClient = client === null ? null : normalizeStoredClient(client);
+    if (client !== null && normalizedClient === null) {
+      await clientStore.clear(issuer);
+      return null;
+    }
+    registeredClients.set(issuer, normalizedClient);
+    return normalizedClient;
+  }
+  async function saveRegisteredClient(issuer, client) {
+    registeredClients.set(issuer, client);
+    if (clientStore !== null) {
+      await clientStore.save(issuer, client);
+    }
+  }
+  async function clearRegisteredClient(issuer) {
+    registeredClients.delete(issuer);
+    if (clientStore !== null) {
+      await clientStore.clear(issuer);
+    }
+  }
+}
+function isProviderOptions(options) {
+  return Object.prototype.hasOwnProperty.call(options, "provider");
+}
+function isExpired(tokens, now) {
+  return tokens.expiresAt !== null && tokens.expiresAt <= now();
+}
+function resolveDiscovery(discovery, session) {
+  if (discovery !== void 0) {
+    return {
+      ...discovery,
+      resource: canonicalizeResourceIndicator(discovery.resource)
+    };
+  }
+  if (session === null) {
+    return void 0;
+  }
+  const metadata = session.discovery.authorizationServerMetadata;
+  const issuer = getOwnString2(metadata, "issuer");
+  const authorizationEndpoint = getOwnString2(metadata, "authorization_endpoint");
+  const tokenEndpoint = getOwnString2(metadata, "token_endpoint");
+  const codeChallengeMethodsSupported = getOwnStringArray(metadata, "code_challenge_methods_supported");
+  if (issuer === void 0 || authorizationEndpoint === void 0 || tokenEndpoint === void 0 || codeChallengeMethodsSupported === void 0 || !codeChallengeMethodsSupported.includes("S256")) {
+    return void 0;
+  }
+  return {
+    resource: canonicalizeResourceIndicator(session.resource),
+    resourceMetadataUrl: session.discovery.resourceMetadataUrl,
+    resourceMetadata: session.discovery.resourceMetadata,
+    authorizationServer: session.authorizationServer,
+    authorizationServerMetadataUrl: "",
+    authorizationServerMetadata: metadata
+  };
+}
+function clearSessionTokens(session) {
+  const nextSession = { ...session };
+  delete nextSession.tokens;
+  return nextSession;
+}
+function hasCachedAccessToken(session) {
+  return session?.tokens?.accessToken !== void 0;
+}
+function normalizeLoadedSession(session) {
+  if (session === null) {
+    return null;
+  }
+  const client = normalizeStoredClient(getOwnEntry6(session, "client"));
+  if (client === null) {
+    return { ...session, client: { clientId: "" }, tokens: void 0 };
+  }
+  return {
+    ...session,
+    client,
+    tokens: normalizeStoredTokens(getOwnEntry6(session, "tokens"))
+  };
+}
+function normalizeStoredClient(value) {
+  if (!isObjectRecord3(value)) {
+    return null;
+  }
+  const clientId = getOwnString2(value, "clientId");
+  if (clientId === void 0 || clientId.trim().length === 0) {
+    return null;
+  }
+  const normalizedClientId = clientId.trim();
+  const clientSecret = getOwnEntry6(value, "clientSecret");
+  if (clientSecret === void 0) {
+    return { clientId: normalizedClientId };
+  }
+  if (typeof clientSecret !== "string" || clientSecret.trim().length === 0) {
+    return null;
+  }
+  const normalizedClientSecret = clientSecret.trim();
+  return { clientId: normalizedClientId, clientSecret: normalizedClientSecret };
+}
+function normalizeStoredTokens(value) {
+  if (value === void 0 || !isObjectRecord3(value)) {
+    return void 0;
+  }
+  const accessToken = getOwnString2(value, "accessToken");
+  const tokenType = getOwnString2(value, "tokenType");
+  const expiresAt = getOwnEntry6(value, "expiresAt");
+  const refreshToken = getOwnEntry6(value, "refreshToken");
+  const scope = getOwnString2(value, "scope");
+  const normalizedAccessToken = accessToken?.trim();
+  const normalizedRefreshToken = typeof refreshToken === "string" ? refreshToken.trim() : void 0;
+  const normalizedScope = scope?.trim();
+  if (accessToken === void 0 || normalizedAccessToken === void 0 || normalizedAccessToken.length === 0 || tokenType !== "Bearer" || !(expiresAt === null || typeof expiresAt === "number" && Number.isSafeInteger(expiresAt) && expiresAt <= MAX_JS_DATE_MS3 && Number.isFinite(new Date(expiresAt).getTime())) || refreshToken !== void 0 && (typeof refreshToken !== "string" || normalizedRefreshToken === void 0 || normalizedRefreshToken.length === 0)) {
+    return void 0;
+  }
+  return {
+    accessToken: normalizedAccessToken,
+    tokenType,
+    expiresAt,
+    ...normalizedRefreshToken === void 0 ? {} : { refreshToken: normalizedRefreshToken },
+    ...normalizedScope === void 0 || normalizedScope.length === 0 ? {} : { scope: normalizedScope }
+  };
+}
+function getClientMetadata(client) {
+  if (client.metadata === void 0) {
+    return void 0;
+  }
+  return {
+    clientName: normalizeOptionalOAuthString(client.metadata.clientName),
+    scope: normalizeOptionalOAuthString(client.metadata.scope),
+    softwareId: normalizeOptionalOAuthString(client.metadata.softwareId),
+    softwareVersion: normalizeOptionalOAuthString(client.metadata.softwareVersion)
+  };
+}
+function normalizeConfiguredClient(client) {
+  const clientId = normalizeOptionalOAuthString(client.clientId);
+  if (clientId === void 0) {
+    return null;
+  }
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret);
+  return clientSecret === void 0 ? { clientId } : { clientId, clientSecret };
+}
+function normalizeOptionalOAuthString(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? void 0 : trimmed;
+}
+function getOwnEntry6(record, key2) {
+  return Object.prototype.hasOwnProperty.call(record, key2) ? record[key2] : void 0;
+}
+function isObjectRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnString2(record, key2) {
+  const value = getOwnEntry6(record, key2);
+  return typeof value === "string" ? value : void 0;
+}
+function requireOwnString(record, key2, label) {
+  const value = getOwnString2(record, key2);
+  if (value === void 0) {
+    throw new Error(`${label} is missing ${key2}`);
+  }
+  return value;
+}
+function getOwnStringArray(record, key2) {
+  const value = getOwnEntry6(record, key2);
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function buildAuthorizationUrl(input) {
+  const authorizationEndpoint = requireOwnString(input.metadata, "authorization_endpoint", "Authorization server metadata");
+  const issuer = requireOwnString(input.metadata, "issuer", "Authorization server metadata");
+  const url = new URL2(authorizationEndpoint);
+  const resource = canonicalizeResourceIndicator(input.resource);
+  const state = createAuthorizationState({
+    issuer,
+    requireIssuer: getOwnEntry6(input.metadata, "authorization_response_iss_parameter_supported") === true
+  });
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", input.clientId);
+  url.searchParams.set("redirect_uri", input.redirectUri);
+  url.searchParams.set("code_challenge", input.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  url.searchParams.set("resource", resource);
+  url.searchParams.set("state", state);
+  if (input.clientMetadata?.scope !== void 0 && input.clientMetadata.scope.length > 0) {
+    url.searchParams.set("scope", input.clientMetadata.scope);
+  }
+  return url.toString();
+}
+function assertS256PkceSupport(metadata) {
+  if (!getOwnStringArray(metadata, "code_challenge_methods_supported")?.includes("S256")) {
+    throw new Error("Authorization server metadata must advertise code_challenge_methods_supported including S256");
+  }
+}
+function normalizeHostname(hostname2) {
+  return hostname2.endsWith(".") ? hostname2.slice(0, -1).toLowerCase() : hostname2.toLowerCase();
+}
+function isLoopbackHostname(hostname2) {
+  const normalizedHostname = normalizeHostname(hostname2);
+  return normalizedHostname === "localhost" || normalizedHostname === "::1" || normalizedHostname.startsWith("127.");
+}
+function assertSecureUrl(value, label) {
+  const url = new URL2(value);
+  if (url.protocol === "https:") {
+    return;
+  }
+  if (url.protocol === "http:" && isLoopbackHostname(url.hostname)) {
+    return;
+  }
+  throw new Error(`${label} must use https unless it targets a loopback host`);
+}
+function assertSecureOAuthFlowEndpoints(metadata) {
+  const authorizationEndpoint = requireOwnString(metadata, "authorization_endpoint", "Authorization server metadata");
+  const tokenEndpoint = requireOwnString(metadata, "token_endpoint", "Authorization server metadata");
+  const registrationEndpoint = getOwnString2(metadata, "registration_endpoint");
+  assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
+  assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
+  assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
+  assertSecureUrl(tokenEndpoint, "Token endpoint");
+  if (registrationEndpoint !== void 0) {
+    assertNoAccessTokenInUrl(registrationEndpoint, "Registration endpoint");
+    assertSecureUrl(registrationEndpoint, "Registration endpoint");
+  }
+}
+function assertNoAccessTokenInUrl(value, label) {
+  const url = value instanceof URL2 ? new URL2(value.toString()) : new URL2(value);
+  if (url.searchParams.has("access_token")) {
+    throw new Error(`${label} must not include access_token in the URI`);
+  }
+}
+function assertRequestMatchesResource(requestUrl, resource) {
+  if (requestUrl !== resource) {
+    throw new Error(`OAuth request URL ${requestUrl} does not match discovered resource ${resource}`);
+  }
+}
+function buildClientRegistrationBody(metadata, redirectUri) {
+  const body = {
+    redirect_uris: [redirectUri],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: "none"
+  };
+  const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
+  const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");
+  const softwareId = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareId");
+  const softwareVersion = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareVersion");
+  if (clientName !== void 0 && clientName.length > 0) {
+    body.client_name = clientName;
+  }
+  if (scope !== void 0 && scope.length > 0) {
+    body.scope = scope;
+  }
+  if (softwareId !== void 0 && softwareId.length > 0) {
+    body.software_id = softwareId;
+  }
+  if (softwareVersion !== void 0 && softwareVersion.length > 0) {
+    body.software_version = softwareVersion;
+  }
+  return body;
+}
+function toStoredDiscovery(discovery) {
+  return {
+    resourceMetadataUrl: discovery.resourceMetadataUrl,
+    resourceMetadata: discovery.resourceMetadata,
+    authorizationServerMetadata: discovery.authorizationServerMetadata
+  };
+}
+function shouldReRegisterStoredDynamicClient(error, client, alreadyAttempted) {
+  if (!(error instanceof OAuthError) || error.error !== "invalid_client" || alreadyAttempted) {
+    return false;
+  }
+  if (client === null) {
+    return false;
+  }
+  if ("kind" in client) {
+    return client.kind === "dynamic" && client.fromStoredRegistration;
+  }
+  return true;
+}
+
+// src/oauth-discovery.ts
+function defaultOAuthMetadataFetch(input, init) {
+  return fetch(input, init);
+}
+function isObjectRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function normalizeHostname2(hostname2) {
+  return hostname2.endsWith(".") ? hostname2.slice(0, -1).toLowerCase() : hostname2.toLowerCase();
+}
+function isLoopbackHostname2(hostname2) {
+  const normalizedHostname = normalizeHostname2(hostname2);
+  return normalizedHostname === "localhost" || normalizedHostname === "::1" || normalizedHostname.startsWith("127.");
+}
+function assertSecureUrl2(url, label) {
+  if (url.protocol === "https:") {
+    return;
+  }
+  if (url.protocol === "http:" && isLoopbackHostname2(url.hostname)) {
+    return;
+  }
+  throw new Error(`${label} must use https unless it targets a loopback host`);
+}
+function validateProtectedResourceMetadata(value, resourceUrl) {
+  if (!isObjectRecord4(value)) {
+    throw new Error("Protected resource metadata must be a JSON object");
+  }
+  if (typeof value.resource !== "string" || value.resource.length === 0) {
+    throw new Error("Protected resource metadata must include a resource string");
+  }
+  const normalizedResource = canonicalizeResourceIndicator(value.resource);
+  if (normalizedResource !== resourceUrl) {
+    throw new Error(
+      `Protected resource metadata resource mismatch: expected ${resourceUrl}, received ${value.resource}`
+    );
+  }
+  if (!isStringArray(value.authorization_servers) || value.authorization_servers.length === 0) {
+    throw new Error(
+      "Protected resource metadata must include a non-empty authorization_servers array"
+    );
+  }
+  return {
+    ...value,
+    resource: normalizedResource
+  };
+}
+function validateAuthorizationServerMetadata(value, issuer) {
+  if (!isObjectRecord4(value)) {
+    throw new Error("Authorization server metadata must be a JSON object");
+  }
+  if (typeof value.issuer !== "string" || value.issuer.length === 0) {
+    throw new Error("Authorization server metadata must include issuer");
+  }
+  if (value.issuer !== issuer) {
+    throw new Error(
+      `Authorization server metadata issuer mismatch: expected ${issuer}, received ${value.issuer}`
+    );
+  }
+  if (typeof value.authorization_endpoint !== "string" || value.authorization_endpoint.length === 0) {
+    throw new Error("Authorization server metadata must include authorization_endpoint");
+  }
+  if (typeof value.token_endpoint !== "string" || value.token_endpoint.length === 0) {
+    throw new Error("Authorization server metadata must include token_endpoint");
+  }
+  if (!isStringArray(value.response_types_supported) || !value.response_types_supported.includes("code")) {
+    throw new Error(
+      "Authorization server metadata must include response_types_supported containing code"
+    );
+  }
+  if (!isStringArray(value.code_challenge_methods_supported) || !value.code_challenge_methods_supported.includes("S256")) {
+    throw new Error(
+      "Authorization server metadata must include code_challenge_methods_supported containing S256"
+    );
+  }
+  return value;
+}
+async function readJsonResponse(response, label) {
+  if (!response.ok) {
+    const statusDescriptor = `${response.status} ${response.statusText}`.trim();
+    throw new Error(`${label} request failed (${statusDescriptor})`);
+  }
+  try {
+    return await response.json();
+  } catch {
+    throw new Error(`${label} response must be valid JSON`);
+  }
+}
+function resolveWellKnownMetadataUrl(inputUrl, suffix) {
+  const url = new URL(typeof inputUrl === "string" ? inputUrl : inputUrl.toString());
+  const resourcePath = url.pathname === "/" ? "" : url.pathname;
+  url.pathname = `/.well-known/${suffix}${resourcePath}`;
+  return url.toString();
+}
+function resolveProtectedResourceMetadataUrl(resourceUrl, resourceMetadataUrl) {
+  const resource = new URL(canonicalizeResourceIndicator(resourceUrl));
+  assertSecureUrl2(resource, "Protected resource URL");
+  if (resourceMetadataUrl !== void 0) {
+    const resolvedResourceMetadataUrl2 = new URL(
+      typeof resourceMetadataUrl === "string" ? resourceMetadataUrl : resourceMetadataUrl.toString(),
+      resource
+    );
+    assertSecureUrl2(resolvedResourceMetadataUrl2, "Protected resource metadata URL");
+    return resolvedResourceMetadataUrl2.toString();
+  }
+  const resolvedResourceMetadataUrl = new URL(
+    resolveWellKnownMetadataUrl(resource, "oauth-protected-resource")
+  );
+  assertSecureUrl2(resolvedResourceMetadataUrl, "Protected resource metadata URL");
+  return resolvedResourceMetadataUrl.toString();
+}
+function normalizeAuthorizationServerIssuer(issuer) {
+  const input = typeof issuer === "string" ? issuer : issuer.toString();
+  const url = new URL(input);
+  if (url.search.length > 0 || url.hash.length > 0) {
+    throw new Error("Authorization server issuer must not include query or fragment");
+  }
+  assertSecureUrl2(url, "Authorization server issuer");
+  if (url.pathname.length > 1 && url.pathname.endsWith("/")) {
+    url.pathname = url.pathname.slice(0, -1);
+  }
+  return url.pathname === "/" ? url.origin : url.toString();
+}
+function resolveAuthorizationServerMetadataUrl(issuer) {
+  return resolveWellKnownMetadataUrl(
+    normalizeAuthorizationServerIssuer(issuer),
+    "oauth-authorization-server"
+  );
+}
+var OAuthMetadataDiscovery = class {
+  fetchImpl;
+  cache;
+  memoryCache = /* @__PURE__ */ new Map();
+  constructor({ fetch: fetch2 = defaultOAuthMetadataFetch, cache } = {}) {
+    this.fetchImpl = fetch2;
+    this.cache = cache;
+  }
+  async discover(resourceUrl, { resourceMetadataUrl } = {}) {
+    const cacheKey = canonicalizeResourceIndicator(resourceUrl);
+    const resourceMetadataLocation = resolveProtectedResourceMetadataUrl(
+      cacheKey,
+      resourceMetadataUrl
+    );
+    const memoryCachedResult = this.memoryCache.get(cacheKey);
+    if (memoryCachedResult !== void 0 && resourceMetadataUrl === void 0) {
+      return memoryCachedResult;
+    }
+    const sharedCachedResult = await this.cache?.get(cacheKey);
+    if (sharedCachedResult !== null && sharedCachedResult !== void 0 && resourceMetadataUrl === void 0) {
+      this.memoryCache.set(cacheKey, sharedCachedResult);
+      return sharedCachedResult;
+    }
+    const resourceMetadataResponse = await this.fetchImpl(resourceMetadataLocation, {
+      method: "GET",
+      headers: {
+        Accept: "application/json"
+      }
+    });
+    const resourceMetadata = validateProtectedResourceMetadata(
+      await readJsonResponse(resourceMetadataResponse, "Protected resource metadata"),
+      cacheKey
+    );
+    const authorizationServerErrors = [];
+    for (const authorizationServer of resourceMetadata.authorization_servers) {
+      const normalizedAuthorizationServer = normalizeAuthorizationServerIssuer(
+        authorizationServer
+      );
+      const authorizationServerMetadataUrl = resolveAuthorizationServerMetadataUrl(normalizedAuthorizationServer);
+      try {
+        const authorizationServerResponse = await this.fetchImpl(authorizationServerMetadataUrl, {
+          method: "GET",
+          headers: {
+            Accept: "application/json"
+          }
+        });
+        const authorizationServerMetadata = validateAuthorizationServerMetadata(
+          await readJsonResponse(
+            authorizationServerResponse,
+            "Authorization server metadata"
+          ),
+          normalizedAuthorizationServer
+        );
+        const result = {
+          resource: resourceMetadata.resource,
+          resourceMetadataUrl: resourceMetadataLocation,
+          resourceMetadata,
+          authorizationServer: normalizedAuthorizationServer,
+          authorizationServerMetadataUrl,
+          authorizationServerMetadata
+        };
+        this.memoryCache.set(cacheKey, result);
+        await this.cache?.set(cacheKey, result);
+        return result;
+      } catch (error) {
+        authorizationServerErrors.push(
+          `${authorizationServerMetadataUrl}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    throw new Error(
+      `Unable to load authorization server metadata for ${cacheKey}: ${authorizationServerErrors.join(
+        "; "
+      )}`
+    );
+  }
+};
+async function discoverOAuthMetadata(resourceUrl, options = {}) {
+  const discovery = new OAuthMetadataDiscovery(options);
+  return discovery.discover(resourceUrl, options);
+}
+function skipOptionalWhitespace(value, start) {
+  let index = start;
+  while (index < value.length && (value[index] === " " || value[index] === "	")) {
+    index += 1;
+  }
+  return index;
+}
+function readToken(value, start) {
+  let index = start;
+  while (index < value.length) {
+    const character = value[index];
+    if (character === " " || character === "	" || character === "," || character === "=" || character === '"') {
+      break;
+    }
+    index += 1;
+  }
+  if (index === start) {
+    return null;
+  }
+  return {
+    token: value.slice(start, index),
+    nextIndex: index
+  };
+}
+function looksLikeAuthParam(value, start) {
+  const token = readToken(value, start);
+  if (token === null) {
+    return false;
+  }
+  return value[skipOptionalWhitespace(value, token.nextIndex)] === "=";
+}
+function isToken68Character(character) {
+  return character >= "a" && character <= "z" || character >= "A" && character <= "Z" || character >= "0" && character <= "9" || character === "-" || character === "." || character === "_" || character === "~" || character === "+" || character === "/";
+}
+function readToken68(value, start) {
+  let nextIndex = start;
+  while (nextIndex < value.length) {
+    const character = value[nextIndex];
+    if (character === "," || character === " " || character === "	") {
+      break;
+    }
+    nextIndex += 1;
+  }
+  const token68 = value.slice(start, nextIndex);
+  if (token68.length === 0) {
+    return null;
+  }
+  let index = 0;
+  while (index < token68.length && isToken68Character(token68[index])) {
+    index += 1;
+  }
+  if (index === 0) {
+    return null;
+  }
+  while (index < token68.length && token68[index] === "=") {
+    index += 1;
+  }
+  if (index !== token68.length) {
+    return null;
+  }
+  return { token68, nextIndex };
+}
+function readQuotedString(value, start) {
+  if (value[start] !== '"') {
+    return null;
+  }
+  let parsedValue = "";
+  let index = start + 1;
+  let escaping = false;
+  while (index < value.length) {
+    const character = value[index];
+    if (escaping) {
+      parsedValue += character;
+      escaping = false;
+      index += 1;
+      continue;
+    }
+    if (character === "\\") {
+      escaping = true;
+      index += 1;
+      continue;
+    }
+    if (character === '"') {
+      return {
+        parsedValue,
+        nextIndex: index + 1
+      };
+    }
+    parsedValue += character;
+    index += 1;
+  }
+  return null;
+}
+function parseAuthParam(value, start) {
+  const token = readToken(value, start);
+  if (token === null) {
+    return null;
+  }
+  let index = skipOptionalWhitespace(value, token.nextIndex);
+  if (value[index] !== "=") {
+    return null;
+  }
+  index = skipOptionalWhitespace(value, index + 1);
+  if (index >= value.length) {
+    return null;
+  }
+  const quotedValue = readQuotedString(value, index);
+  if (quotedValue !== null) {
+    return {
+      name: token.token,
+      value: quotedValue.parsedValue,
+      nextIndex: quotedValue.nextIndex
+    };
+  }
+  let nextIndex = index;
+  while (nextIndex < value.length) {
+    const character = value[nextIndex];
+    if (character === "," || character === " " || character === "	") {
+      break;
+    }
+    nextIndex += 1;
+  }
+  return {
+    name: token.token,
+    value: value.slice(index, nextIndex),
+    nextIndex
+  };
+}
+function parseBearerWwwAuthenticateHeader(headerValue) {
+  if (headerValue === null) {
+    return null;
+  }
+  let index = 0;
+  let firstBearerChallenge = null;
+  while (index < headerValue.length) {
+    index = skipOptionalWhitespace(headerValue, index);
+    while (headerValue[index] === ",") {
+      index = skipOptionalWhitespace(headerValue, index + 1);
+    }
+    const scheme = readToken(headerValue, index);
+    if (scheme === null) {
+      break;
+    }
+    index = skipOptionalWhitespace(headerValue, scheme.nextIndex);
+    const params = /* @__PURE__ */ Object.create(null);
+    if (index < headerValue.length && headerValue[index] !== ",") {
+      const token68 = readToken68(headerValue, index);
+      if (token68 !== null) {
+        index = token68.nextIndex;
+      } else if (looksLikeAuthParam(headerValue, index)) {
+        while (index < headerValue.length) {
+          const parsedParam = parseAuthParam(headerValue, index);
+          if (parsedParam === null) {
+            break;
+          }
+          params[parsedParam.name] = parsedParam.value;
+          index = skipOptionalWhitespace(headerValue, parsedParam.nextIndex);
+          if (headerValue[index] !== ",") {
+            break;
+          }
+          const nextIndex = skipOptionalWhitespace(headerValue, index + 1);
+          if (!looksLikeAuthParam(headerValue, nextIndex)) {
+            index = nextIndex;
+            break;
+          }
+          index = nextIndex;
+        }
+      }
+    }
+    if (scheme.token.toLowerCase() === "bearer") {
+      const challenge = {
+        scheme: "Bearer",
+        params,
+        raw: headerValue
+      };
+      if (Object.keys(params).length > 0) {
+        return challenge;
+      }
+      firstBearerChallenge ??= challenge;
+    }
+    if (headerValue[index] === ",") {
+      index += 1;
+    }
+  }
+  return firstBearerChallenge;
+}
+
+// src/internal.ts
+var MCP_PROTOCOL_VERSION = "2025-03-26";
+var McpClient = class {
+  currentState = "disconnected";
+  currentServerCapabilities = null;
+  currentClientCapabilities = null;
+  currentServerInfo = null;
+  currentInstructions;
+  subscribedResourceUris = /* @__PURE__ */ new Set();
+  activeProgressTokens = /* @__PURE__ */ new Map();
+  options;
+  transport = null;
+  messageLayer = null;
+  constructor(options) {
+    this.options = options;
+  }
+  get state() {
+    return this.currentState;
+  }
+  get serverCapabilities() {
+    return this.currentServerCapabilities === null ? null : structuredClone(this.currentServerCapabilities);
+  }
+  get serverInfo() {
+    return this.currentServerInfo;
+  }
+  get instructions() {
+    return this.currentInstructions;
+  }
+  getMessageLayerOrThrow() {
+    if (this.currentState === "disconnected") {
+      throw new Error("MCP client is disconnected");
+    }
+    if (this.currentState === "closed") {
+      throw new Error("MCP client is closed");
+    }
+    if (this.messageLayer === null) {
+      throw new Error("MCP client is disconnected");
+    }
+    return this.messageLayer;
+  }
+  async connect(transport) {
+    if (this.currentState !== "disconnected" && this.currentState !== "closed") {
+      throw new Error("MCP client is already connected");
+    }
+    this.currentServerCapabilities = null;
+    this.currentClientCapabilities = null;
+    this.currentServerInfo = null;
+    this.currentInstructions = void 0;
+    this.subscribedResourceUris.clear();
+    this.activeProgressTokens.clear();
+    const transportClosedReason = transport.closed.then((closedEvent) => closedEvent.reason).catch(
+      (error) => error instanceof Error ? error : new Error(String(error))
+    );
+    const messageLayer = new JsonRpcMessageLayer(
+      transport.readable,
+      transport.writable,
+      this.options.requestTimeoutMs,
+      transportClosedReason
+    );
+    const {
+      onSamplingRequest,
+      onRootsList,
+      onToolsChanged,
+      onResourcesChanged,
+      onResourceUpdated,
+      onPromptsChanged,
+      onLog,
+      onProgress
+    } = this.options;
+    messageLayer.onRequest("ping", () => ({}));
+    if (onSamplingRequest !== void 0) {
+      messageLayer.onRequest(
+        "sampling/createMessage",
+        (params) => onSamplingRequest(params)
+      );
+    }
+    messageLayer.onNotification("notifications/tools/list_changed", async () => {
+      if (onToolsChanged === void 0 || this.currentServerCapabilities?.tools?.listChanged !== true) {
+        return;
+      }
+      await onToolsChanged();
+    });
+    messageLayer.onNotification("notifications/resources/list_changed", async () => {
+      if (onResourcesChanged === void 0 || this.currentServerCapabilities?.resources?.listChanged !== true) {
+        return;
+      }
+      await onResourcesChanged();
+    });
+    messageLayer.onNotification("notifications/resources/updated", async (params) => {
+      if (onResourceUpdated === void 0) {
+        return;
+      }
+      if (typeof params !== "object" || params === null || Array.isArray(params)) {
+        return;
+      }
+      const { uri } = params;
+      if (typeof uri !== "string" || !this.subscribedResourceUris.has(uri)) {
+        return;
+      }
+      await onResourceUpdated(uri);
+    });
+    messageLayer.onNotification("notifications/prompts/list_changed", async () => {
+      if (onPromptsChanged === void 0 || this.currentServerCapabilities?.prompts?.listChanged !== true) {
+        return;
+      }
+      await onPromptsChanged();
+    });
+    messageLayer.onNotification("notifications/message", async (params) => {
+      if (onLog === void 0 || !isObjectRecord5(params) || !isLogLevel(params.level)) {
+        return;
+      }
+      if (!hasOwn(params, "data")) {
+        return;
+      }
+      const message = {
+        level: params.level,
+        data: params.data
+      };
+      if (params.logger !== void 0) {
+        if (typeof params.logger !== "string") {
+          return;
+        }
+        message.logger = params.logger;
+      }
+      await onLog(message);
+    });
+    messageLayer.onNotification("notifications/progress", async (params) => {
+      if (onProgress === void 0 || !isObjectRecord5(params)) {
+        return;
+      }
+      const { progressToken, progress } = params;
+      if (!isRequestId(progressToken) || typeof progress !== "number" || !this.activeProgressTokens.has(progressToken)) {
+        return;
+      }
+      const progressParams = {
+        progressToken,
+        progress
+      };
+      if (params.total !== void 0) {
+        if (typeof params.total !== "number") {
+          return;
+        }
+        progressParams.total = params.total;
+      }
+      if (params.message !== void 0) {
+        if (typeof params.message !== "string") {
+          return;
+        }
+        progressParams.message = params.message;
+      }
+      await onProgress(progressParams);
+    });
+    messageLayer.onNotification("notifications/cancelled", () => void 0);
+    this.transport = transport;
+    this.messageLayer = messageLayer;
+    this.currentState = "initializing";
+    this.subscribedResourceUris.clear();
+    this.activeProgressTokens.clear();
+    transport.closed.then((closedEvent) => {
+      if (this.transport !== transport) {
+        return;
+      }
+      this.messageLayer?.dispose(closedEvent.reason);
+      this.messageLayer = null;
+      this.transport = null;
+      this.currentState = "closed";
+    }).catch((error) => {
+      if (this.transport !== transport) {
+        return;
+      }
+      const reason = error instanceof Error ? error : new Error(String(error));
+      this.messageLayer?.dispose(reason);
+      this.messageLayer = null;
+      this.transport = null;
+      this.currentState = "closed";
+    });
+    const capabilities = {
+      ...this.options.capabilities ?? {}
+    };
+    if (onSamplingRequest !== void 0 && capabilities.sampling === void 0) {
+      capabilities.sampling = {};
+    }
+    if (onRootsList !== void 0) {
+      capabilities.roots = {
+        ...capabilities.roots ?? {}
+      };
+    }
+    this.currentClientCapabilities = structuredClone(capabilities);
+    try {
+      const initializeResultValue = await messageLayer.sendRequest("initialize", {
+        protocolVersion: MCP_PROTOCOL_VERSION,
+        clientInfo: this.options.clientInfo,
+        capabilities
+      });
+      if (!isInitializeResult(initializeResultValue)) {
+        throw new McpError(ERROR_INVALID_REQUEST, "Invalid initialize result");
+      }
+      const initializeResult = initializeResultValue;
+      if (initializeResult.protocolVersion !== MCP_PROTOCOL_VERSION) {
+        throw new McpError(
+          ERROR_INVALID_REQUEST,
+          `Unsupported protocol version: ${initializeResult.protocolVersion}`
+        );
+      }
+      this.currentServerCapabilities = structuredClone(initializeResult.capabilities);
+      this.currentServerInfo = { ...initializeResult.serverInfo };
+      this.currentInstructions = initializeResult.instructions;
+      if (onRootsList !== void 0) {
+        messageLayer.onRequest("roots/list", async () => ({
+          roots: await onRootsList()
+        }));
+      }
+      messageLayer.sendNotification("notifications/initialized");
+      this.currentState = "ready";
+      return initializeResult;
+    } catch (error) {
+      if (this.transport === transport) {
+        const reason = error instanceof Error ? error : new Error(String(error));
+        messageLayer.dispose(reason);
+        transport.dispose(reason);
+        this.messageLayer = null;
+        this.transport = null;
+        this.currentState = "disconnected";
+      }
+      throw error;
+    }
+  }
+  getServerCapabilitiesOrThrow() {
+    if (this.currentServerCapabilities === null) {
+      throw new Error("MCP client has not completed initialization");
+    }
+    return this.currentServerCapabilities;
+  }
+  async listTools(params = {}) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.tools === void 0) {
+      throw new Error("Server does not support tools");
+    }
+    const requestParams = params.cursor === void 0 ? void 0 : { cursor: params.cursor };
+    const result = await messageLayer.sendRequest("tools/list", requestParams);
+    if (!isToolsListResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid tools/list result");
+    }
+    return result;
+  }
+  async callTool(params, options = {}) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.tools === void 0) {
+      throw new Error("Server does not support tools");
+    }
+    if (options.signal?.aborted) {
+      throw options.signal.reason;
+    }
+    const requestParams = options.progressToken === void 0 ? params : {
+      ...params,
+      _meta: {
+        progressToken: options.progressToken
+      }
+    };
+    if (options.progressToken !== void 0) {
+      this.activeProgressTokens.set(
+        options.progressToken,
+        (this.activeProgressTokens.get(options.progressToken) ?? 0) + 1
+      );
+    }
+    try {
+      let requestId;
+      let cancellationSent = false;
+      const sendCancellationNotification = () => {
+        if (requestId === void 0 || cancellationSent) {
+          return;
+        }
+        cancellationSent = true;
+        messageLayer.sendNotification("notifications/cancelled", { requestId });
+      };
+      const requestPromise = messageLayer.sendRequest("tools/call", requestParams, {
+        onRequestId: (nextRequestId) => {
+          requestId = nextRequestId;
+        },
+        onTimeout: sendCancellationNotification
+      }).then((result) => {
+        if (!isCallToolResult(result)) {
+          throw new McpError(ERROR_INVALID_REQUEST, "Invalid tool result");
+        }
+        return result;
+      });
+      if (options.signal === void 0) {
+        return await requestPromise;
+      }
+      const signal = options.signal;
+      let abortListener;
+      const abortPromise = new Promise((_, reject) => {
+        const rejectWithAbortReason = () => {
+          sendCancellationNotification();
+          if (requestId !== void 0) {
+            messageLayer.cancelRequest(requestId, signal.reason);
+          }
+          reject(signal.reason);
+        };
+        abortListener = rejectWithAbortReason;
+        signal.addEventListener("abort", abortListener, { once: true });
+        if (signal.aborted) {
+          signal.removeEventListener("abort", abortListener);
+          rejectWithAbortReason();
+        }
+      });
+      try {
+        return await Promise.race([requestPromise, abortPromise]);
+      } finally {
+        if (abortListener !== void 0) {
+          signal.removeEventListener("abort", abortListener);
+        }
+      }
+    } finally {
+      if (options.progressToken !== void 0) {
+        const activeCount = this.activeProgressTokens.get(options.progressToken);
+        if (activeCount === 1) {
+          this.activeProgressTokens.delete(options.progressToken);
+        } else if (activeCount !== void 0) {
+          this.activeProgressTokens.set(options.progressToken, activeCount - 1);
+        }
+      }
+    }
+  }
+  async listResources(params = {}) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.resources === void 0) {
+      throw new Error("Server does not support resources");
+    }
+    const requestParams = params.cursor === void 0 ? void 0 : { cursor: params.cursor };
+    const result = await messageLayer.sendRequest("resources/list", requestParams);
+    if (!isResourcesListResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/list result");
+    }
+    return result;
+  }
+  async listResourceTemplates(params = {}) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.resources === void 0) {
+      throw new Error("Server does not support resources");
+    }
+    const requestParams = params.cursor === void 0 ? void 0 : { cursor: params.cursor };
+    const result = await messageLayer.sendRequest("resources/templates/list", requestParams);
+    if (!isResourceTemplatesListResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/templates/list result");
+    }
+    return result;
+  }
+  async readResource(params) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.resources === void 0) {
+      throw new Error("Server does not support resources");
+    }
+    const result = await messageLayer.sendRequest("resources/read", params);
+    if (!isReadResourceResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid resources/read result");
+    }
+    return result;
+  }
+  async subscribe(uri) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.resources?.subscribe !== true) {
+      throw new Error("Server does not support resource subscriptions");
+    }
+    await messageLayer.sendRequest("resources/subscribe", { uri });
+    this.subscribedResourceUris.add(uri);
+  }
+  async unsubscribe(uri) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.resources?.subscribe !== true) {
+      throw new Error("Server does not support resource subscriptions");
+    }
+    await messageLayer.sendRequest("resources/unsubscribe", { uri });
+    this.subscribedResourceUris.delete(uri);
+  }
+  async listPrompts(params = {}) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.prompts === void 0) {
+      throw new Error("Server does not support prompts");
+    }
+    const requestParams = params.cursor === void 0 ? void 0 : { cursor: params.cursor };
+    return await messageLayer.sendRequest("prompts/list", requestParams);
+  }
+  async getPrompt(params) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.prompts === void 0) {
+      throw new Error("Server does not support prompts");
+    }
+    const result = await messageLayer.sendRequest("prompts/get", params);
+    if (!isGetPromptResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid prompts/get result");
+    }
+    return result;
+  }
+  async complete(params) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.completions === void 0) {
+      throw new Error("Server does not support completions");
+    }
+    const result = await messageLayer.sendRequest("completion/complete", params);
+    if (!isCompleteResult(result)) {
+      throw new McpError(ERROR_INVALID_REQUEST, "Invalid completion/complete result");
+    }
+    return result;
+  }
+  async setLogLevel(level) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const serverCapabilities = this.getServerCapabilitiesOrThrow();
+    if (serverCapabilities.logging === void 0) {
+      throw new Error("Server does not support logging");
+    }
+    await messageLayer.sendRequest("logging/setLevel", { level });
+  }
+  async cancel(requestId, reason) {
+    const messageLayer = this.getMessageLayerOrThrow();
+    const params = { requestId };
+    if (reason !== void 0) {
+      params.reason = reason;
+    }
+    messageLayer.sendNotification("notifications/cancelled", params);
+  }
+  async sendRootsChanged() {
+    const messageLayer = this.getMessageLayerOrThrow();
+    if (this.currentClientCapabilities?.roots?.listChanged !== true) {
+      throw new Error("Client did not advertise roots list changes");
+    }
+    messageLayer.sendNotification("notifications/roots/list_changed");
+  }
+  async ping() {
+    const messageLayer = this.getMessageLayerOrThrow();
+    await messageLayer.sendRequest("ping");
+  }
+  async close() {
+    if (this.currentState === "closed") {
+      return;
+    }
+    const closeError = new Error("MCP client closed");
+    this.messageLayer?.dispose(closeError);
+    this.transport?.dispose(closeError);
+    this.messageLayer = null;
+    this.transport = null;
+    this.currentServerCapabilities = null;
+    this.currentClientCapabilities = null;
+    this.currentServerInfo = null;
+    this.currentInstructions = void 0;
+    this.subscribedResourceUris.clear();
+    this.activeProgressTokens.clear();
+    this.currentState = "closed";
+  }
+};
+var ERROR_PARSE = -32700;
+var ERROR_INVALID_REQUEST = -32600;
+var ERROR_METHOD_NOT_FOUND = -32601;
+var ERROR_INVALID_PARAMS = -32602;
+var ERROR_INTERNAL = -32603;
+function createInMemoryTransportPair() {
+  const clientToServer = new PassThrough();
+  const serverToClient = new PassThrough();
+  let disposed = false;
+  let resolveClosed;
+  const closed = new Promise((resolve) => {
+    resolveClosed = resolve;
+  });
+  const resolveClosedOnce = (reason) => {
+    if (resolveClosed === void 0) {
+      return;
+    }
+    const currentResolve = resolveClosed;
+    resolveClosed = void 0;
+    currentResolve({ reason });
+  };
+  const dispose = (reason = new Error("In-memory transport disposed")) => {
+    if (disposed) {
+      return;
+    }
+    disposed = true;
+    if (!clientToServer.destroyed && !clientToServer.writableEnded) {
+      clientToServer.end();
+    }
+    if (!serverToClient.destroyed && !serverToClient.writableEnded) {
+      serverToClient.end();
+    }
+    resolveClosedOnce(reason);
+  };
+  clientToServer.once("error", (error) => {
+    dispose(error instanceof Error ? error : new Error(String(error)));
+  });
+  serverToClient.once("error", (error) => {
+    dispose(error instanceof Error ? error : new Error(String(error)));
+  });
+  return {
+    clientTransport: {
+      readable: serverToClient,
+      writable: clientToServer,
+      closed,
+      dispose
+    },
+    serverTransport: {
+      readable: clientToServer,
+      writable: serverToClient
+    }
+  };
+}
+var SdkTransportAdapter = class {
+  readable;
+  writable;
+  closed;
+  sdkTransport;
+  readStream = new PassThrough();
+  writeStream = new PassThrough();
+  resolveClosed;
+  disposed = false;
+  constructor(sdkTransport) {
+    this.sdkTransport = sdkTransport;
+    this.readable = this.readStream;
+    this.writable = this.writeStream;
+    this.closed = new Promise((resolve) => {
+      this.resolveClosed = resolve;
+    });
+    this.sdkTransport.onmessage = (message) => {
+      this.readStream.write(serializeJsonRpcMessage(message));
+    };
+    this.sdkTransport.onclose = () => {
+      this.dispose(new Error("SDK transport closed"));
+    };
+    this.sdkTransport.onerror = (error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    };
+    this.readStream.once("error", (error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    this.writeStream.once("error", (error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    this.consumeWrittenLines().catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    this.sdkTransport.start().catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+  }
+  dispose(reason = new Error("SDK transport adapter disposed")) {
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    if (!this.writeStream.destroyed && !this.writeStream.writableEnded) {
+      this.writeStream.end();
+    }
+    if (!this.readStream.destroyed && !this.readStream.writableEnded) {
+      this.readStream.end();
+    }
+    if (this.resolveClosed !== void 0) {
+      const resolveClosed = this.resolveClosed;
+      this.resolveClosed = void 0;
+      resolveClosed({ reason });
+    }
+    this.sdkTransport.close().catch(() => void 0);
+  }
+  async consumeWrittenLines() {
+    for await (const line of readLines(this.writeStream)) {
+      if (this.disposed || line.length === 0) {
+        continue;
+      }
+      let parsedMessage;
+      try {
+        parsedMessage = JSON.parse(line);
+      } catch {
+        throw new Error(`Malformed JSON line: ${line}`);
+      }
+      if (typeof parsedMessage !== "object" || parsedMessage === null || Array.isArray(parsedMessage)) {
+        throw new Error(`Malformed JSON line: ${line}`);
+      }
+      await this.sdkTransport.send(parsedMessage);
+    }
+  }
+};
+async function createSdkTestPair(server, createClient) {
+  const { InMemoryTransport: InMemoryTransport2 } = await Promise.resolve().then(() => (init_inMemory(), inMemory_exports));
+  const [clientSdkTransport, serverSdkTransport] = InMemoryTransport2.createLinkedPair();
+  const clientTransport = new SdkTransportAdapter(clientSdkTransport);
+  const serverPromise = server.connect(serverSdkTransport);
+  const client = createClient();
+  try {
+    await client.connect(clientTransport);
+  } catch (error) {
+    clientTransport.dispose(new Error("SDK test pair setup failed"));
+    await clientSdkTransport.close();
+    await serverSdkTransport.close();
+    await serverPromise;
+    throw error;
+  }
+  const cleanup = async () => {
+    await client.close();
+    clientTransport.dispose(new Error("SDK test pair cleanup"));
+    await clientSdkTransport.close();
+    await serverSdkTransport.close();
+    await serverPromise;
+  };
+  return { client, cleanup };
+}
+async function createTestPair(server, createClient) {
+  const { clientTransport, serverTransport } = createInMemoryTransportPair();
+  const serverPromise = server.connect(serverTransport);
+  const client = createClient();
+  try {
+    await client.connect(clientTransport);
+  } catch (error) {
+    clientTransport.dispose(new Error("tiny-stdio-mcp-server test pair setup failed"));
+    await serverPromise;
+    throw error;
+  }
+  const cleanup = async () => {
+    await client.close();
+    clientTransport.dispose(new Error("tiny-stdio-mcp-server test pair cleanup"));
+    await serverPromise;
+  };
+  return { client, cleanup };
+}
+function defaultStdioSpawn(command, args, options) {
+  return spawn2(command, args, options);
+}
+function defaultHttpTransportFetch(input, init) {
+  return fetch(input, init);
+}
+var StdioTransport = class _StdioTransport {
+  readable;
+  writable;
+  closed;
+  child;
+  disposed = false;
+  stderrOutput = "";
+  static STDERR_MAX_LENGTH = 65536;
+  constructor({
+    command,
+    args = [],
+    cwd,
+    env,
+    spawn: spawnProcess = defaultStdioSpawn
+  }) {
+    this.child = spawnProcess(command, args, {
+      cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const child = this.child;
+    this.readable = child.stdout;
+    this.writable = child.stdin;
+    const stderrDecoder = new TextDecoder();
+    child.stderr.on("data", (chunk) => {
+      const decoded = chunk instanceof Uint8Array ? stderrDecoder.decode(chunk, { stream: true }) : `${stderrDecoder.decode()}${String(chunk)}`;
+      this.appendStderrOutput(decoded);
+    });
+    child.stderr.once("end", () => {
+      this.appendStderrOutput(stderrDecoder.decode());
+    });
+    this.closed = new Promise((resolve) => {
+      let settled = false;
+      const resolveClosed = (event) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve(event);
+      };
+      child.once("exit", (code, signal) => {
+        const closedEvent = {
+          reason: new Error("Stdio transport process exited")
+        };
+        if (code !== null) {
+          closedEvent.code = code;
+        }
+        if (signal !== null) {
+          closedEvent.signal = signal;
+        }
+        resolveClosed(closedEvent);
+      });
+      child.once("error", (error) => {
+        const closedEvent = {
+          reason: error instanceof Error ? error : new Error(String(error))
+        };
+        if (child.exitCode !== null) {
+          closedEvent.code = child.exitCode;
+        }
+        if (child.signalCode !== null) {
+          closedEvent.signal = child.signalCode;
+        }
+        resolveClosed(closedEvent);
+      });
+    });
+  }
+  getStderrOutput() {
+    return this.stderrOutput;
+  }
+  appendStderrOutput(chunk) {
+    if (chunk.length === 0) {
+      return;
+    }
+    this.stderrOutput += chunk;
+    if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
+      this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
+    }
+  }
+  dispose(reason = new Error("Stdio transport disposed")) {
+    void reason;
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    if (!this.child.stdin.destroyed && !this.child.stdin.writableEnded) {
+      this.child.stdin.end();
+    }
+    if (this.child.exitCode === null && this.child.signalCode === null && !this.child.killed) {
+      this.child.kill("SIGTERM");
+    }
+  }
+};
+var HttpTransport = class {
+  readable;
+  writable;
+  closed;
+  url;
+  headers;
+  fetchImpl;
+  readStream = new PassThrough();
+  writeStream = new PassThrough();
+  resolveClosed;
+  sessionId;
+  lastEventId;
+  getSseStreamStarted = false;
+  disposed = false;
+  oauthProvider;
+  oauthMetadataDiscovery;
+  inFlightFetchAbortControllers = /* @__PURE__ */ new Set();
+  openSseReaders = /* @__PURE__ */ new Set();
+  constructor({
+    url,
+    headers = {},
+    fetch: fetchImpl = defaultHttpTransportFetch,
+    oauth,
+    oauthDiscoveryCache
+  }) {
+    this.url = url;
+    this.headers = headers;
+    this.fetchImpl = fetchImpl;
+    this.oauthProvider = oauth === void 0 ? void 0 : createOAuthClientProvider(oauth);
+    this.oauthMetadataDiscovery = oauth === void 0 ? void 0 : new OAuthMetadataDiscovery({
+      fetch: (input, init) => this.fetchWithAbort(input, init ?? {}),
+      cache: oauthDiscoveryCache
+    });
+    this.readable = this.readStream;
+    this.writable = this.writeStream;
+    this.closed = new Promise((resolve) => {
+      this.resolveClosed = resolve;
+    });
+    this.readStream.once("error", (error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    this.writeStream.once("error", (error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+    this.consumeWrittenLines().catch((error) => {
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+  }
+  dispose(reason = new Error("HTTP transport disposed")) {
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    this.abortInFlightFetches();
+    this.cancelOpenSseReaders();
+    if (!this.writeStream.destroyed && !this.writeStream.writableEnded) {
+      this.writeStream.end();
+    }
+    if (!this.readStream.destroyed && !this.readStream.writableEnded) {
+      this.readStream.end();
+    }
+    void this.closeWithSessionTermination(reason);
+  }
+  async closeWithSessionTermination(reason) {
+    let closeReason = reason;
+    if (this.sessionId !== void 0) {
+      const sessionId = this.sessionId;
+      this.sessionId = void 0;
+      try {
+        await this.sendSessionTerminationRequest(sessionId);
+      } catch (error) {
+        closeReason = error instanceof Error ? error : new Error(String(error));
+      }
+    }
+    const resolveClosed = this.resolveClosed;
+    this.resolveClosed = void 0;
+    resolveClosed?.({ reason: closeReason });
+  }
+  abortInFlightFetches() {
+    for (const abortController of this.inFlightFetchAbortControllers) {
+      abortController.abort();
+    }
+    this.inFlightFetchAbortControllers.clear();
+  }
+  cancelOpenSseReaders() {
+    for (const reader of this.openSseReaders) {
+      void reader.cancel().catch(() => void 0);
+    }
+    this.openSseReaders.clear();
+  }
+  async fetchWithAbort(input, init) {
+    const abortController = new AbortController();
+    this.inFlightFetchAbortControllers.add(abortController);
+    try {
+      return await this.fetchImpl(input, {
+        ...init,
+        signal: abortController.signal
+      });
+    } finally {
+      this.inFlightFetchAbortControllers.delete(abortController);
+    }
+  }
+  async consumeWrittenLines() {
+    for await (const line of readLines(this.writeStream)) {
+      if (this.disposed || line.length === 0) {
+        continue;
+      }
+      const hasSessionId = this.sessionId !== void 0;
+      const response = await this.fetchWithOAuthRetry({
+        method: "POST",
+        createHeaders: () => this.createPostHeaders(),
+        body: line
+      });
+      if (hasSessionId && response.status === 404) {
+        this.sessionId = void 0;
+        this.dispose(new Error("HTTP transport session expired (404 response)"));
+        return;
+      }
+      await this.throwForPostHttpError(response);
+      this.captureSessionId(response);
+      this.maybeOpenGetSseStream();
+      void this.forwardResponseMessages(response).catch((error) => {
+        this.dispose(error instanceof Error ? error : new Error(String(error)));
+      });
+    }
+  }
+  async createPostHeaders() {
+    const headers = new Headers(this.headers);
+    headers.set("Accept", "application/json, text/event-stream");
+    headers.set("Content-Type", "application/json");
+    if (this.sessionId !== void 0) {
+      headers.set("Mcp-Session-Id", this.sessionId);
+      headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
+    }
+    return this.authorizeRequestHeaders(headers);
+  }
+  async createGetHeaders() {
+    const headers = new Headers(this.headers);
+    headers.set("Accept", "text/event-stream");
+    if (this.sessionId !== void 0) {
+      headers.set("Mcp-Session-Id", this.sessionId);
+      headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
+    }
+    if (this.lastEventId !== void 0) {
+      headers.set("Last-Event-ID", this.lastEventId);
+    }
+    return this.authorizeRequestHeaders(headers);
+  }
+  async createDeleteHeaders(sessionId) {
+    const headers = new Headers(this.headers);
+    headers.set("Mcp-Session-Id", sessionId);
+    headers.set("MCP-Protocol-Version", MCP_PROTOCOL_VERSION);
+    return this.authorizeRequestHeaders(headers);
+  }
+  async authorizeRequestHeaders(headers) {
+    await this.oauthProvider?.authorizeRequest?.({
+      requestUrl: new URL(this.url),
+      headers,
+      fetch: this.fetchImpl
+    });
+    return headers;
+  }
+  captureSessionId(response) {
+    const sessionId = response.headers.get("Mcp-Session-Id");
+    if (sessionId === null || sessionId.length === 0) {
+      return;
+    }
+    if (this.sessionId !== void 0 && this.sessionId !== sessionId) {
+      throw new Error("HTTP transport response changed active session ID");
+    }
+    this.sessionId = sessionId;
+  }
+  maybeOpenGetSseStream() {
+    if (this.disposed || this.sessionId === void 0 || this.getSseStreamStarted) {
+      return;
+    }
+    this.getSseStreamStarted = true;
+    this.consumeGetSseStream().catch((error) => {
+      if (error instanceof HttpTransportGetSseNotSupportedError || this.disposed) {
+        return;
+      }
+      this.dispose(error instanceof Error ? error : new Error(String(error)));
+    });
+  }
+  async sendSessionTerminationRequest(sessionId) {
+    const response = await this.fetchImpl(this.url, {
+      method: "DELETE",
+      headers: await this.createDeleteHeaders(sessionId)
+    });
+    if (response.status === 405 || response.ok) {
+      return;
+    }
+    const responseBody = (await response.text()).trim();
+    const statusDescriptor = `${response.status} ${response.statusText}`.trim();
+    const message = responseBody.length === 0 ? `HTTP transport DELETE failed (${statusDescriptor})` : `HTTP transport DELETE failed (${statusDescriptor}): ${responseBody}`;
+    throw new Error(message);
+  }
+  async consumeGetSseStream() {
+    const response = await this.fetchWithOAuthRetry({
+      method: "GET",
+      createHeaders: () => this.createGetHeaders()
+    });
+    if (response.status === 405) {
+      throw new HttpTransportGetSseNotSupportedError();
+    }
+    if (response.status === 404) {
+      this.sessionId = void 0;
+      throw new Error("HTTP transport session expired (GET 404 response)");
+    }
+    if (!response.ok) {
+      const responseBody = (await response.text()).trim();
+      const statusDescriptor = `${response.status} ${response.statusText}`.trim();
+      const message = responseBody.length === 0 ? `HTTP transport GET failed (${statusDescriptor})` : `HTTP transport GET failed (${statusDescriptor}): ${responseBody}`;
+      throw new Error(message);
+    }
+    const contentType = response.headers.get("Content-Type");
+    if (contentType === null) {
+      return;
+    }
+    if (contentType.toLowerCase().includes("text/event-stream")) {
+      await this.forwardSseResponseMessages(response);
+      this.getSseStreamStarted = false;
+      if (!this.disposed && this.sessionId !== void 0 && this.lastEventId !== void 0) {
+        this.maybeOpenGetSseStream();
+      }
+      return;
+    }
+    return;
+  }
+  async throwForPostHttpError(response) {
+    if (response.status < 400) {
+      return;
+    }
+    const responseBody = (await response.text()).trim();
+    const statusDescriptor = `${response.status} ${response.statusText}`.trim();
+    const message = responseBody.length === 0 ? `HTTP transport POST failed (${statusDescriptor})` : `HTTP transport POST failed (${statusDescriptor}): ${responseBody}`;
+    throw new Error(message);
+  }
+  async maybeHandleUnauthorizedResponse(response) {
+    if (response.status !== 401 || this.oauthProvider === void 0) {
+      return false;
+    }
+    const discoveryClient = this.oauthMetadataDiscovery;
+    if (discoveryClient === void 0) {
+      return false;
+    }
+    const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
+    const resourceMetadataUrl = challenge?.params.resource_metadata;
+    const discovery = await discoveryClient.discover(this.url, {
+      resourceMetadataUrl
+    });
+    const result = await this.oauthProvider.handleUnauthorized({
+      requestUrl: new URL(this.url),
+      response: response.clone(),
+      challenge,
+      discovery,
+      fetch: this.fetchImpl
+    });
+    if (result.action === "retry") {
+      return true;
+    }
+    if (result.error !== void 0) {
+      throw result.error;
+    }
+    return false;
+  }
+  async forwardResponseMessages(response) {
+    if (response.status === 202) {
+      return;
+    }
+    const contentType = response.headers.get("Content-Type");
+    if (contentType === null) {
+      return;
+    }
+    const normalizedContentType = contentType.toLowerCase();
+    if (normalizedContentType.includes("text/event-stream")) {
+      await this.forwardSseResponseMessages(response);
+      return;
+    }
+    if (normalizedContentType.includes("application/json")) {
+      await this.forwardJsonResponseMessage(response);
+      return;
+    }
+    throw new Error("HTTP transport POST returned an unsupported response content type");
+  }
+  async forwardSseResponseMessages(response) {
+    if (response.body === null) {
+      return;
+    }
+    const parser = new SseParser();
+    const decoder = new TextDecoder();
+    const reader = response.body.getReader();
+    this.openSseReaders.add(reader);
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) {
+          break;
+        }
+        if (value === void 0) {
+          continue;
+        }
+        const messages = parser.push(decoder.decode(value, { stream: true }));
+        this.writeSseMessages(messages);
+        this.lastEventId = parser.lastEventId;
+      }
+      const trailingChunk = decoder.decode();
+      if (trailingChunk.length > 0) {
+        this.writeSseMessages(parser.push(trailingChunk));
+        this.lastEventId = parser.lastEventId;
+      }
+      this.writeSseMessages(parser.flush());
+      this.lastEventId = parser.lastEventId;
+    } finally {
+      this.openSseReaders.delete(reader);
+      reader.releaseLock();
+    }
+  }
+  async forwardJsonResponseMessage(response) {
+    const payload = await response.text();
+    if (payload.length === 0) {
+      return;
+    }
+    const parsedPayload = JSON.parse(payload);
+    this.writeReadableLine(JSON.stringify(parsedPayload));
+  }
+  writeSseMessages(messages) {
+    for (const message of messages) {
+      this.writeReadableLine(message.data);
+    }
+  }
+  writeReadableLine(line) {
+    if (this.disposed || this.readStream.destroyed || this.readStream.writableEnded) {
+      return;
+    }
+    this.readStream.write(`${line}
+`);
+  }
+  async fetchWithOAuthRetry(input) {
+    const request = async () => this.fetchWithAbort(this.url, {
+      method: input.method,
+      headers: await input.createHeaders(),
+      body: input.body
+    });
+    let response = await request();
+    if (await this.maybeHandleUnauthorizedResponse(response)) {
+      response = await request();
+    }
+    const oauthError = this.oauthProvider === void 0 ? null : this.readOAuthChallengeError(response);
+    if (oauthError !== null) {
+      throw oauthError;
+    }
+    return response;
+  }
+  readOAuthChallengeError(response) {
+    if (response.status !== 401 && response.status !== 403) {
+      return null;
+    }
+    const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
+    const error = challenge?.params.error;
+    if (error === void 0 || error.length === 0) {
+      return null;
+    }
+    return new OAuthError(
+      {
+        error,
+        error_description: challenge?.params.error_description,
+        error_uri: challenge?.params.error_uri
+      },
+      response.status
+    );
+  }
+};
+var HttpTransportGetSseNotSupportedError = class extends Error {
+  constructor() {
+    super("HTTP transport server does not support GET SSE streams");
+  }
+};
+var McpError = class extends Error {
+  code;
+  constructor(code, message, data) {
+    super(message);
+    this.name = "McpError";
+    this.code = code;
+    if (data !== void 0) {
+      this.data = data;
+    }
+  }
+};
+function serializeJsonRpcMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+function normalizeLine(line) {
+  return line.endsWith("\r") ? line.slice(0, -1) : line;
+}
+async function* readLines(stream) {
+  let buffer = "";
+  const decoder = new TextDecoder();
+  for await (const chunk of stream) {
+    buffer += chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : decoder.decode() + String(chunk);
+    while (true) {
+      const newlineIndex = buffer.indexOf("\n");
+      if (newlineIndex === -1) {
+        break;
+      }
+      const line = buffer.slice(0, newlineIndex);
+      buffer = buffer.slice(newlineIndex + 1);
+      yield normalizeLine(line);
+    }
+  }
+  buffer += decoder.decode();
+  if (buffer.length > 0) {
+    yield normalizeLine(buffer);
+  }
+}
+var SseParser = class {
+  buffer = "";
+  eventType;
+  dataLines = [];
+  eventId = "";
+  hasEventId = false;
+  _lastEventId;
+  get lastEventId() {
+    return this._lastEventId;
+  }
+  push(chunk) {
+    if (chunk.length === 0) {
+      return [];
+    }
+    this.buffer += chunk;
+    const messages = [];
+    while (true) {
+      const newlineIndex = this.buffer.indexOf("\n");
+      if (newlineIndex === -1) {
+        break;
+      }
+      const line = normalizeLine(this.buffer.slice(0, newlineIndex));
+      this.buffer = this.buffer.slice(newlineIndex + 1);
+      this.consumeLine(line, messages);
+    }
+    return messages;
+  }
+  flush() {
+    const messages = [];
+    if (this.buffer.length > 0) {
+      this.consumeLine(normalizeLine(this.buffer), messages);
+      this.buffer = "";
+    }
+    this.emitEvent(messages);
+    return messages;
+  }
+  consumeLine(line, messages) {
+    if (line.length === 0) {
+      this.emitEvent(messages);
+      return;
+    }
+    if (line.startsWith(":")) {
+      return;
+    }
+    const separatorIndex = line.indexOf(":");
+    const field = separatorIndex === -1 ? line : line.slice(0, separatorIndex);
+    const rawValue = separatorIndex === -1 ? "" : line.slice(separatorIndex + 1);
+    const value = rawValue.startsWith(" ") ? rawValue.slice(1) : rawValue;
+    if (field === "event") {
+      this.eventType = value;
+      return;
+    }
+    if (field === "data") {
+      this.dataLines.push(value);
+      return;
+    }
+    if (field === "id") {
+      if (value.includes("\0")) {
+        return;
+      }
+      this.eventId = value;
+      this.hasEventId = true;
+    }
+  }
+  emitEvent(messages) {
+    const eventType = this.eventType ?? "message";
+    if (this.hasEventId) {
+      this._lastEventId = this.eventId;
+    }
+    if (this.dataLines.length === 0 || eventType !== "message") {
+      this.resetEvent();
+      return;
+    }
+    const message = {
+      data: this.dataLines.join("\n")
+    };
+    if (this.hasEventId) {
+      message.id = this.eventId;
+    }
+    messages.push(message);
+    this.resetEvent();
+  }
+  resetEvent() {
+    this.eventType = void 0;
+    this.dataLines = [];
+    this.eventId = "";
+    this.hasEventId = false;
+  }
+};
+var JsonRpcMessageLayer = class {
+  requestTimeoutMs;
+  input;
+  output;
+  inputClosedReason;
+  nextRequestId = 1;
+  disposedError;
+  pendingRequests = /* @__PURE__ */ new Map();
+  activeIncomingRequests = /* @__PURE__ */ new Map();
+  requestHandlers = /* @__PURE__ */ new Map();
+  notificationHandlers = /* @__PURE__ */ new Map();
+  constructor(input, output, requestTimeoutMs = 3e4, inputClosedReason) {
+    if (!Number.isFinite(requestTimeoutMs) || requestTimeoutMs < 0) {
+      throw new Error("requestTimeoutMs must be a non-negative finite number");
+    }
+    this.input = input;
+    this.output = output;
+    this.inputClosedReason = inputClosedReason;
+    this.requestTimeoutMs = requestTimeoutMs;
+    this.consumeInput().catch(() => void 0);
+  }
+  sendNotification(method, params) {
+    if (this.disposedError !== void 0) {
+      throw this.disposedError;
+    }
+    const message = {
+      jsonrpc: "2.0",
+      method
+    };
+    if (params !== void 0) {
+      message.params = params;
+    }
+    this.output.write(serializeJsonRpcMessage(message));
+  }
+  onRequest(method, handler) {
+    this.requestHandlers.set(method, handler);
+  }
+  onNotification(method, handler) {
+    this.notificationHandlers.set(method, handler);
+  }
+  sendRequest(method, params, options = {}) {
+    if (this.disposedError !== void 0) {
+      throw this.disposedError;
+    }
+    const id = this.nextRequestId;
+    this.nextRequestId += 1;
+    const timeoutMs = options.timeoutMs ?? this.requestTimeoutMs;
+    if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+      throw new Error("timeoutMs must be a non-negative finite number");
+    }
+    if (options.onRequestId !== void 0) {
+      options.onRequestId(id);
+    }
+    const message = {
+      jsonrpc: "2.0",
+      id,
+      method
+    };
+    if (params !== void 0) {
+      message.params = params;
+    }
+    return new Promise((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        this.pendingRequests.delete(id);
+        options.onTimeout?.(id);
+        reject(new Error(`JSON-RPC request "${method}" timed out after ${timeoutMs}ms`));
+      }, timeoutMs);
+      this.pendingRequests.set(id, { resolve, reject, timeout });
+      try {
+        this.output.write(serializeJsonRpcMessage(message));
+      } catch (error) {
+        clearTimeout(timeout);
+        this.pendingRequests.delete(id);
+        reject(error);
+      }
+    });
+  }
+  cancelRequest(requestId, reason) {
+    const pending = this.pendingRequests.get(requestId);
+    if (pending === void 0) {
+      return false;
+    }
+    this.pendingRequests.delete(requestId);
+    clearTimeout(pending.timeout);
+    pending.reject(reason);
+    return true;
+  }
+  dispose(reason = new Error("JSON-RPC message layer disposed")) {
+    if (this.disposedError !== void 0) {
+      return;
+    }
+    this.disposedError = reason;
+    for (const pending of this.pendingRequests.values()) {
+      clearTimeout(pending.timeout);
+      pending.reject(reason);
+    }
+    this.pendingRequests.clear();
+    this.activeIncomingRequests.clear();
+  }
+  async consumeInput() {
+    try {
+      for await (const line of readLines(this.input)) {
+        if (this.disposedError !== void 0) {
+          break;
+        }
+        if (line.length === 0) {
+          continue;
+        }
+        let parsedLine;
+        try {
+          parsedLine = JSON.parse(line);
+        } catch {
+          await this.processParsedMessage({
+            type: "invalid",
+            id: null,
+            error: parseError()
+          });
+          continue;
+        }
+        if (Array.isArray(parsedLine)) {
+          for (const message of parsedLine) {
+            if (this.disposedError !== void 0) {
+              break;
+            }
+            await this.processParsedMessage(parseJsonRpcPayload(message));
+          }
+          continue;
+        }
+        await this.processParsedMessage(parseJsonRpcPayload(parsedLine));
+      }
+    } catch (error) {
+      if (this.disposedError === void 0) {
+        this.dispose(
+          error instanceof Error ? error : new Error(`JSON-RPC input stream failed: ${String(error)}`)
+        );
+      }
+      return;
+    }
+    if (this.disposedError === void 0) {
+      const streamClosedReason = await this.resolveInputStreamClosedReason();
+      if (this.disposedError === void 0) {
+        this.dispose(streamClosedReason);
+      }
+    }
+  }
+  async resolveInputStreamClosedReason() {
+    const streamClosedError = new Error("JSON-RPC input stream closed");
+    if (this.inputClosedReason === void 0) {
+      return streamClosedError;
+    }
+    try {
+      return await Promise.race([
+        this.inputClosedReason,
+        new Promise((resolve) => {
+          setTimeout(() => {
+            resolve(streamClosedError);
+          }, 50);
+        })
+      ]);
+    } catch {
+      return streamClosedError;
+    }
+  }
+  async processParsedMessage(parsed) {
+    if (parsed.type === "request") {
+      const handler = this.requestHandlers.get(parsed.message.method);
+      if (handler === void 0) {
+        this.output.write(
+          serializeJsonRpcMessage({
+            jsonrpc: "2.0",
+            id: parsed.message.id,
+            error: {
+              code: ERROR_METHOD_NOT_FOUND,
+              message: `Method not found: ${parsed.message.method}`
+            }
+          })
+        );
+        return;
+      }
+      this.handleIncomingRequest(parsed.message, handler);
+      return;
+    }
+    if (parsed.type === "notification") {
+      if (parsed.message.method === "notifications/cancelled") {
+        this.handleCancellationNotification(parsed.message.params);
+      }
+      const handler = this.notificationHandlers.get(parsed.message.method);
+      if (handler === void 0) {
+        return;
+      }
+      try {
+        await handler(parsed.message.params, {
+          method: parsed.message.method
+        });
+      } catch {
+        return;
+      }
+      return;
+    }
+    if (parsed.type === "invalid") {
+      const errorResponse = {
+        jsonrpc: "2.0",
+        id: parsed.id,
+        error: {
+          code: parsed.error.code,
+          message: parsed.error.message
+        }
+      };
+      if (parsed.error.data !== void 0) {
+        errorResponse.error.data = parsed.error.data;
+      }
+      this.output.write(`${JSON.stringify(errorResponse)}
+`);
+      return;
+    }
+    if (parsed.type !== "response") {
+      return;
+    }
+    const pending = this.pendingRequests.get(parsed.message.id);
+    if (pending === void 0) {
+      return;
+    }
+    this.pendingRequests.delete(parsed.message.id);
+    clearTimeout(pending.timeout);
+    if ("result" in parsed.message) {
+      pending.resolve(parsed.message.result);
+      return;
+    }
+    pending.reject(
+      new McpError(
+        parsed.message.error.code,
+        parsed.message.error.message,
+        parsed.message.error.data
+      )
+    );
+  }
+  handleIncomingRequest(message, handler) {
+    const activeRequest = {
+      cancelled: false
+    };
+    this.activeIncomingRequests.set(message.id, activeRequest);
+    void (async () => {
+      try {
+        const result = await handler(message.params, {
+          id: message.id,
+          method: message.method
+        });
+        if (this.disposedError !== void 0 || activeRequest.cancelled) {
+          return;
+        }
+        this.output.write(
+          serializeJsonRpcMessage({
+            jsonrpc: "2.0",
+            id: message.id,
+            result
+          })
+        );
+      } catch (error) {
+        if (this.disposedError !== void 0 || activeRequest.cancelled) {
+          return;
+        }
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        this.output.write(
+          serializeJsonRpcMessage({
+            jsonrpc: "2.0",
+            id: message.id,
+            error: {
+              code: ERROR_INTERNAL,
+              message: errorMessage
+            }
+          })
+        );
+      } finally {
+        const inFlightRequest = this.activeIncomingRequests.get(message.id);
+        if (inFlightRequest === activeRequest) {
+          this.activeIncomingRequests.delete(message.id);
+        }
+      }
+    })();
+  }
+  handleCancellationNotification(params) {
+    if (!isObjectRecord5(params)) {
+      return;
+    }
+    const requestId = params.requestId;
+    if (!isRequestId(requestId)) {
+      return;
+    }
+    const activeRequest = this.activeIncomingRequests.get(requestId);
+    if (activeRequest === void 0) {
+      return;
+    }
+    activeRequest.cancelled = true;
+    this.activeIncomingRequests.delete(requestId);
+  }
+};
+function isObjectRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isInitializeResult(value) {
+  if (!isObjectRecord5(value) || typeof value.protocolVersion !== "string") {
+    return false;
+  }
+  if (!isServerCapabilities(value.capabilities)) {
+    return false;
+  }
+  if (!isObjectRecord5(value.serverInfo) || typeof value.serverInfo.name !== "string" || value.serverInfo.name.length === 0 || typeof value.serverInfo.version !== "string" || value.serverInfo.version.length === 0) {
+    return false;
+  }
+  return value.instructions === void 0 || typeof value.instructions === "string";
+}
+function isServerCapabilities(value) {
+  if (!isObjectRecord5(value)) {
+    return false;
+  }
+  for (const capability of ["prompts", "resources", "tools", "logging", "completions", "experimental"]) {
+    if (value[capability] !== void 0 && !isObjectRecord5(value[capability])) {
+      return false;
+    }
+  }
+  return true;
+}
+function isCallToolResult(value) {
+  if (!isObjectRecord5(value) || !Array.isArray(value.content)) {
+    return false;
+  }
+  if (value.structuredContent !== void 0 && !isObjectRecord5(value.structuredContent)) {
+    return false;
+  }
+  if (value.isError !== void 0 && typeof value.isError !== "boolean") {
+    return false;
+  }
+  return value.content.every(isContentItem);
+}
+function isToolsListResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.tools) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+}
+function isResourcesListResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.resources) && value.resources.every(isResource) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+}
+function isResourceTemplatesListResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.resourceTemplates) && value.resourceTemplates.every(isResourceTemplate) && (value.nextCursor === void 0 || typeof value.nextCursor === "string");
+}
+function isReadResourceResult(value) {
+  return isObjectRecord5(value) && Array.isArray(value.contents) && value.contents.every(isResourceContents);
+}
+function isGetPromptResult(value) {
+  return isObjectRecord5(value) && (value.description === void 0 || typeof value.description === "string") && Array.isArray(value.messages) && value.messages.every(isPromptMessage);
+}
+function isCompleteResult(value) {
+  return isObjectRecord5(value) && isObjectRecord5(value.completion) && Array.isArray(value.completion.values) && value.completion.values.every((candidate) => typeof candidate === "string") && (value.completion.hasMore === void 0 || typeof value.completion.hasMore === "boolean") && (value.completion.total === void 0 || typeof value.completion.total === "number");
+}
+function isResource(value) {
+  return isObjectRecord5(value) && typeof value.uri === "string" && typeof value.name === "string" && (value.description === void 0 || typeof value.description === "string") && (value.mimeType === void 0 || typeof value.mimeType === "string") && (value.size === void 0 || typeof value.size === "number");
+}
+function isResourceTemplate(value) {
+  return isObjectRecord5(value) && typeof value.uriTemplate === "string" && typeof value.name === "string" && (value.description === void 0 || typeof value.description === "string") && (value.mimeType === void 0 || typeof value.mimeType === "string");
+}
+function isResourceContents(value) {
+  if (!isObjectRecord5(value) || typeof value.uri !== "string") {
+    return false;
+  }
+  if (value.mimeType !== void 0 && typeof value.mimeType !== "string") {
+    return false;
+  }
+  const hasText = value.text !== void 0;
+  const hasBlob = value.blob !== void 0;
+  if (!hasText && !hasBlob) {
+    return false;
+  }
+  return (!hasText || typeof value.text === "string") && (!hasBlob || typeof value.blob === "string");
+}
+function isPromptMessage(value) {
+  return isObjectRecord5(value) && (value.role === "user" || value.role === "assistant") && isContentItem(value.content);
+}
+function isContentItem(value) {
+  if (!isObjectRecord5(value)) {
+    return false;
+  }
+  if (value.type === "text") {
+    return typeof value.text === "string";
+  }
+  if (value.type === "image" || value.type === "audio") {
+    return typeof value.data === "string" && typeof value.mimeType === "string";
+  }
+  if (value.type !== "resource" || !isObjectRecord5(value.resource)) {
+    return false;
+  }
+  return isResourceContents(value.resource);
+}
+function hasOwn(value, property) {
+  return Object.prototype.hasOwnProperty.call(value, property);
+}
+function isRequestId(value) {
+  return typeof value === "string" || typeof value === "number";
+}
+function isLogLevel(value) {
+  return value === "debug" || value === "info" || value === "notice" || value === "warning" || value === "error" || value === "critical" || value === "alert" || value === "emergency";
+}
+function toRequestId(value) {
+  return isRequestId(value) ? value : null;
+}
+function parseError() {
+  return new McpError(ERROR_PARSE, "Parse error");
+}
+function invalidRequest() {
+  return new McpError(ERROR_INVALID_REQUEST, "Invalid Request");
+}
+function isJsonRpcErrorObject(value) {
+  if (!isObjectRecord5(value)) {
+    return false;
+  }
+  if (typeof value.code !== "number" || typeof value.message !== "string") {
+    return false;
+  }
+  return value.data === void 0 || hasOwn(value, "data");
+}
+function parseJsonRpcPayload(parsed) {
+  if (!isObjectRecord5(parsed)) {
+    return {
+      type: "invalid",
+      id: null,
+      error: invalidRequest()
+    };
+  }
+  const id = toRequestId(parsed.id);
+  if (parsed.jsonrpc !== "2.0") {
+    return {
+      type: "invalid",
+      id,
+      error: invalidRequest()
+    };
+  }
+  const hasMethod = hasOwn(parsed, "method");
+  const hasId = hasOwn(parsed, "id");
+  if (hasMethod) {
+    if (typeof parsed.method !== "string") {
+      return {
+        type: "invalid",
+        id,
+        error: invalidRequest()
+      };
+    }
+    if (hasId) {
+      if (!isRequestId(parsed.id)) {
+        return {
+          type: "invalid",
+          id: null,
+          error: invalidRequest()
+        };
+      }
+      const request = {
+        jsonrpc: "2.0",
+        id: parsed.id,
+        method: parsed.method
+      };
+      if (hasOwn(parsed, "params")) {
+        request.params = parsed.params;
+      }
+      return {
+        type: "request",
+        message: request
+      };
+    }
+    const notification = {
+      jsonrpc: "2.0",
+      method: parsed.method
+    };
+    if (hasOwn(parsed, "params")) {
+      notification.params = parsed.params;
+    }
+    return {
+      type: "notification",
+      message: notification
+    };
+  }
+  if (!hasId || !isRequestId(parsed.id)) {
+    return {
+      type: "invalid",
+      id,
+      error: invalidRequest()
+    };
+  }
+  const hasResult = hasOwn(parsed, "result");
+  const hasError = hasOwn(parsed, "error");
+  if (hasResult === hasError) {
+    return {
+      type: "invalid",
+      id: parsed.id,
+      error: invalidRequest()
+    };
+  }
+  if (hasResult) {
+    return {
+      type: "response",
+      message: {
+        jsonrpc: "2.0",
+        id: parsed.id,
+        result: parsed.result
+      }
+    };
+  }
+  if (!isJsonRpcErrorObject(parsed.error)) {
+    return {
+      type: "invalid",
+      id: parsed.id,
+      error: invalidRequest()
+    };
+  }
+  return {
+    type: "response",
+    message: {
+      jsonrpc: "2.0",
+      id: parsed.id,
+      error: parsed.error
+    }
+  };
+}
+export {
+  ERROR_INTERNAL,
+  ERROR_INVALID_PARAMS,
+  ERROR_INVALID_REQUEST,
+  ERROR_METHOD_NOT_FOUND,
+  ERROR_PARSE,
+  HttpTransport,
+  JsonRpcMessageLayer,
+  McpClient,
+  McpError,
+  OAuthMetadataDiscovery,
+  StdioTransport,
+  createInMemoryTransportPair,
+  createSdkTestPair,
+  createTestPair,
+  discoverOAuthMetadata
+};