toolcraft 0.0.749 → 0.0.751

package/node_modules/tiny-mcp-client/dist/index.js

@@ -124,8 +124,7 @@ function assertHttpJsonBudget(text) {
   if (stack.length !== 0) throw new SyntaxError("Unterminated MCP HTTP JSON container");
 }
 
-// src/internal.ts
-import { spawn as spawn2 } from "node:child_process";
+// src/stream.node.ts
 import { PassThrough } from "node:stream";
 
 // src/http-message-validation.ts
@@ -304,6 +303,9 @@ function dialectFor(schema, inherited) {
   return inherited;
 }
 function resolveUri(reference, baseUri) {
+  if (typeof URL === "undefined" && (reference === "" || reference.startsWith("#"))) {
+    return `${withoutFragment(baseUri)}${reference}`;
+  }
   try {
     return new URL(reference, baseUri).href;
   } catch {
@@ -4798,7 +4800,7 @@ async function fetchMcpResponse(fetchImplementation, input, init = {}) {
           abort();
         return;
       }
-      if (response.redirected || response.type === "opaqueredirect") {
+      if (response.redirected || response.type === "opaqueredirect" || response.status >= 300 && response.status < 400) {
         void response.body?.cancel().catch(() => void 0);
         finish(new Error("MCP HTTP redirects are not allowed"));
       } else
@@ -4807,180 +4809,546 @@ async function fetchMcpResponse(fetchImplementation, input, init = {}) {
   });
 }
 
-// ../mcp-oauth/dist/client/default-oauth-client-provider.js
-import { URL as URL2 } from "node:url";
-
-// ../mcp-oauth/dist/client/loopback-authorization.js
-import http from "node:http";
-
-// ../mcp-oauth/dist/client/authorization-state.js
-import crypto3 from "node:crypto";
-function createAuthorizationState(input) {
-  const payload = {
-    v: 1,
-    n: crypto3.randomBytes(16).toString("base64url"),
-    i: input.issuer,
-    r: input.requireIssuer
-  };
-  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+// ../mcp-oauth/dist/client/oauth-form.js
+function createOAuthFormRequest(input) {
+  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
+  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
+    throw new Error("OAuth token endpoint authentication requires a client secret");
+  const body = new URLSearchParams(input.params);
+  const headers = new Headers({ Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" });
+  if (method === "client_secret_basic") {
+    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
+    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
+    headers.set("Authorization", `Basic ${btoa(`${encoded}:${encodedSecret}`)}`);
+  } else {
+    body.set("client_id", input.clientId);
+    if (method === "client_secret_post")
+      body.set("client_secret", input.clientSecret);
+  }
+  return { body, headers };
 }
-function parseAuthorizationState(value) {
-  if (value === null || value.length === 0) {
-    return null;
+
+// ../mcp-oauth/dist/http-response.js
+async function readBoundedResponseText(response, maxBytes, readers, signal) {
+  if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 1))
+    throw new Error("HTTP response byte limit must be a positive safe integer");
+  if (signal?.aborted) {
+    void response.body?.cancel().catch(() => void 0);
+    throw signal.reason;
+  }
+  const length = response.headers.get("Content-Length");
+  if (length !== null && length.length > 0 && [...length].every((character) => character >= "0" && character <= "9") && Number(length) > maxBytes) {
+    void response.body?.cancel().catch(() => void 0);
+    throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
   }
+  if (response.body === null)
+    return "";
+  const reader = response.body.getReader();
+  readers?.add(reader);
+  const abort = () => {
+    void reader.cancel().catch(() => void 0);
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  if (signal?.aborted)
+    abort();
+  const decoder2 = new TextDecoder("utf-8", { fatal: true });
+  let bytes = 0;
+  let text = "";
   try {
-    const decoded = Buffer.from(value, "base64url").toString("utf8");
-    const parsed = JSON.parse(decoded);
-    if (!isObjectRecord2(parsed)) {
-      return null;
-    }
-    const version = getOwnEntry4(parsed, "v");
-    const nonce = getOwnEntry4(parsed, "n");
-    const issuer = getOwnEntry4(parsed, "i");
-    const requireIssuer = getOwnEntry4(parsed, "r");
-    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
-      return null;
+    while (true) {
+      const chunk = await reader.read();
+      signal?.throwIfAborted();
+      if (chunk.done)
+        return text + decoder2.decode();
+      bytes += chunk.value.byteLength;
+      if (bytes > maxBytes)
+        throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
+      text += decoder2.decode(chunk.value, { stream: true });
     }
-    return {
-      issuer,
-      requireIssuer
-    };
-  } catch {
-    return null;
+  } catch (error) {
+    void reader.cancel().catch(() => void 0);
+    throw error;
+  } finally {
+    signal?.removeEventListener("abort", abort);
+    readers?.delete(reader);
+    reader.releaseLock();
   }
 }
-function isObjectRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function getOwnEntry4(record2, key2) {
-  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
-}
 
-// ../mcp-oauth/dist/client/authorization-error.js
-var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
-var OAuthAuthorizationError = class extends Error {
-  error;
-  errorDescription;
+// ../mcp-oauth/dist/client/token-endpoint.js
+var MAX_JS_DATE_MS2 = 864e13;
+var oauthErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthError");
+var OAuthError = class extends Error {
   /** Recognize errors from separately bundled copies of this package. */
   static is(value) {
-    return value instanceof Error && Object.getOwnPropertyDescriptor(value, authorizationErrorBrand)?.value === true;
+    return value instanceof Error && Object.getOwnPropertyDescriptor(value, oauthErrorBrand)?.value === true;
   }
-  constructor(error, errorDescription) {
-    super(`OAuth authorization failed: ${error} \u2014 ${errorDescription}`);
-    this.error = error;
-    this.errorDescription = errorDescription;
-    this.name = "OAuthAuthorizationError";
-    Object.defineProperty(this, authorizationErrorBrand, { value: true });
+  error;
+  errorDescription;
+  errorUri;
+  error_description;
+  error_uri;
+  status;
+  retryable;
+  terminal;
+  /** True only when a complete OAuth error response establishes rejection. */
+  outcomeKnown;
+  constructor(shape, status, outcomeKnown = true) {
+    const description = Object.hasOwn(shape, "error_description") ? shape.error_description : void 0;
+    const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : void 0;
+    super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
+    this.name = "OAuthError";
+    Object.defineProperty(this, oauthErrorBrand, { value: true });
+    this.error = shape.error;
+    this.errorDescription = description;
+    this.errorUri = uri;
+    this.error_description = description;
+    this.error_uri = uri;
+    this.status = status;
+    this.retryable = isRetryableOAuthError(this);
+    this.terminal = !this.retryable;
+    this.outcomeKnown = outcomeKnown;
   }
 };
-
-// ../mcp-oauth/dist/client/loopback-authorization.js
-function snapshotLoopbackAuthorizationOptions(options) {
-  return {
-    ...options,
-    openBrowser: options.openBrowser?.bind(options),
-    readLine: options.readLine?.bind(options),
-    waitForCallback: options.waitForCallback?.bind(options),
-    createServer: options.createServer?.bind(options),
-    callbackPath: options.callbackPath,
-    redirectUri: options.redirectUri,
-    signal: options.signal,
-    timeoutMs: options.timeoutMs,
-    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
-  };
+function isRetryableOAuthError(error) {
+  return error instanceof OAuthError && (error.status >= 500 || error.error === "server_error" || error.error === "temporarily_unavailable");
 }
-async function createLoopbackAuthorizationSession(options = {}) {
-  options = snapshotLoopbackAuthorizationOptions(options);
-  options.signal?.throwIfAborted();
-  const timeoutMs = options.timeoutMs ?? Infinity;
-  if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647))
-    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
-  if (options.waitForCallback !== void 0)
-    return createHostedAuthorizationSession(options, timeoutMs);
-  const target = loopbackTarget(options);
-  const server = options.createServer ? options.createServer() : http.createServer();
-  const controller = new AbortController();
-  let closed = false;
-  let used = false;
-  const callerAbort = () => controller.abort(options.signal?.reason);
-  const teardown = () => {
-    if (closed)
-      return;
-    closed = true;
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", callerAbort);
-    server.closeAllConnections?.();
-    server.close();
-  };
-  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-  timer?.unref?.();
-  controller.signal.addEventListener("abort", teardown, { once: true });
-  options.signal?.addEventListener("abort", callerAbort, { once: true });
-  if (options.signal?.aborted)
-    callerAbort();
-  let port;
-  try {
-    port = await startServer(server, target.port, target.host, controller.signal);
-  } catch (error) {
-    controller.abort(error);
-    throw error;
-  }
-  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
-  return {
-    redirectUri,
-    async waitForCode(authorizationUrl) {
-      controller.signal.throwIfAborted();
-      if (used)
-        throw new Error("OAuth authorization session has already been used");
-      used = true;
-      try {
-        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
-      } finally {
-        clearTimeout(timer);
-      }
+async function exchangeAuthorizationCode(input) {
+  const resource = canonicalizeResourceIndicator(input.resource);
+  return requestTokens({
+    tokenEndpoint: input.tokenEndpoint,
+    clientId: input.clientId,
+    clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
+    params: {
+      grant_type: "authorization_code",
+      code: input.code,
+      code_verifier: input.codeVerifier,
+      redirect_uri: input.redirectUri,
+      resource
     },
-    close() {
-      controller.abort(new Error("OAuth authorization session closed"));
-    }
-  };
+    fetch: input.fetch,
+    signal: input.signal,
+    now: input.now
+  });
 }
-function createHostedAuthorizationSession(options, timeoutMs) {
-  validateAuthorizationRedirect(options);
-  const redirectUri = options.redirectUri, controller = new AbortController();
-  let used = false;
-  const aborted = () => controller.abort(options.signal?.reason);
-  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
-  timer?.unref?.();
-  const cleanup = () => {
-    clearTimeout(timer);
-    options.signal?.removeEventListener("abort", aborted);
-  };
-  controller.signal.addEventListener("abort", cleanup, { once: true });
-  options.signal?.addEventListener("abort", aborted, { once: true });
-  if (options.signal?.aborted)
-    aborted();
-  return {
-    redirectUri,
-    async waitForCode(authorizationUrl) {
-      controller.signal.throwIfAborted();
-      if (used)
-        throw new Error("OAuth authorization session has already been used");
-      used = true;
-      try {
-        const authorization = new URL(authorizationUrl);
-        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
-          throw new Error("OAuth authorization redirect mismatch");
-        const callback = await new Promise((resolve, reject) => {
-          const onAbort = () => reject(controller.signal.reason);
-          controller.signal.addEventListener("abort", onAbort, { once: true });
-          void Promise.resolve().then(() => {
-            controller.signal.throwIfAborted();
-            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
-          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
-        });
-        controller.signal.throwIfAborted();
-        const url = new URL(callback), base = new URL(redirectUri);
-        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32))
+async function refreshAccessToken(input) {
+  const resource = canonicalizeResourceIndicator(input.resource);
+  const refreshToken = input.refreshToken;
+  const tokens = await requestTokens({
+    tokenEndpoint: input.tokenEndpoint,
+    clientId: input.clientId,
+    clientSecret: input.clientSecret,
+    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
+    params: {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      resource
+    },
+    fetch: input.fetch,
+    signal: input.signal,
+    now: input.now
+  });
+  return { ...tokens, refreshToken: tokens.refreshToken ?? refreshToken };
+}
+async function requestTokens(input) {
+  const { body, headers } = createOAuthFormRequest(input);
+  input.signal?.throwIfAborted();
+  const deadline = AbortSignal.timeout(3e4);
+  const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
+  const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
+    method: "POST",
+    headers,
+    body: body.toString(),
+    signal
+  });
+  const payload = await readOAuthJsonObjectResponse(response, signal);
+  const accessToken = getOwnEntry4(payload, "access_token");
+  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
+    throw new Error("OAuth token response missing access_token");
+  }
+  const normalizedAccessToken = accessToken.trim();
+  try {
+    new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
+  } catch {
+    throw new Error("OAuth token response access_token is not a valid HTTP header value");
+  }
+  const tokenType = normalizeBearerTokenType(getOwnEntry4(payload, "token_type"));
+  if (tokenType === null) {
+    throw new Error("OAuth token response missing token_type=Bearer");
+  }
+  const expiresIn = getOwnEntry4(payload, "expires_in");
+  let expiresAt = null;
+  if (expiresIn !== void 0) {
+    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || !Number.isInteger(expiresIn) || expiresIn < 0) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+    const issuedAt = input.now();
+    if (!Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS2)
+      throw new Error("OAuth token response has invalid expires_in");
+    expiresAt = issuedAt + expiresIn * 1e3;
+    if (!Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS2 || !Number.isFinite(new Date(expiresAt).getTime())) {
+      throw new Error("OAuth token response has invalid expires_in");
+    }
+  }
+  const refreshToken = getOwnEntry4(payload, "refresh_token");
+  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
+    throw new Error("OAuth token response has invalid refresh_token");
+  const scope = getOwnEntry4(payload, "scope");
+  const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
+  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
+  if (scope !== void 0 && normalizedScope === void 0)
+    throw new Error("Invalid OAuth scope syntax in token response");
+  return {
+    accessToken: normalizedAccessToken,
+    refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
+    tokenType,
+    expiresAt,
+    scope: normalizedScope === void 0 ? void 0 : normalizedScope
+  };
+}
+async function readOAuthJsonObjectResponse(response, signal) {
+  const fallbackError = createFallbackOAuthError(response.status);
+  let payload;
+  try {
+    payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, void 0, signal));
+  } catch (error) {
+    if (signal?.aborted)
+      throw signal.reason;
+    if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
+      throw error;
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
+    if (!response.ok) {
+      throw fallbackError;
+    }
+    throw new Error("OAuth response must be a JSON object");
+  }
+  const record2 = payload;
+  if (!response.ok) {
+    const error = getOwnEntry4(record2, "error");
+    if (typeof error !== "string" || error.trim() === "")
+      throw fallbackError;
+    throw new OAuthError(readOAuthError(record2), response.status);
+  }
+  return record2;
+}
+function readOAuthError(payload, fallbackError = "server_error") {
+  const error = getOwnEntry4(payload, "error");
+  const errorDescription = getOwnEntry4(payload, "error_description");
+  const errorUri = getOwnEntry4(payload, "error_uri");
+  return {
+    error: typeof error === "string" ? error : fallbackError,
+    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
+    error_uri: typeof errorUri === "string" ? errorUri : void 0
+  };
+}
+function getOwnEntry4(record2, key2) {
+  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+}
+function createFallbackOAuthError(status) {
+  const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
+  return new OAuthError({ error }, status, false);
+}
+function normalizeBearerTokenType(value) {
+  if (typeof value !== "string") {
+    return null;
+  }
+  return value.toLowerCase() === "bearer" ? "Bearer" : null;
+}
+
+// ../mcp-oauth/dist/client/register-client.js
+async function registerOAuthClient(input) {
+  if (new URL(input.redirectUri).protocol === "https:")
+    validateHostedOAuthRedirect(input.redirectUri);
+  else
+    loopbackTarget({ redirectUri: input.redirectUri });
+  const body = JSON.stringify(buildClientRegistrationBody(input.metadata, input.redirectUri, normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? "none"));
+  if (new TextEncoder().encode(body).byteLength > 65536)
+    throw new Error("OAuth registration request is too large");
+  input.signal?.throwIfAborted();
+  const deadline = AbortSignal.timeout(3e4);
+  const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
+  const response = await fetchMcpResponse(input.fetch, input.registrationEndpoint, {
+    method: "POST",
+    headers: { Accept: "application/json", "Content-Type": "application/json" },
+    body,
+    signal
+  });
+  return parseOAuthClientRegistration(await readOAuthJsonObjectResponse(response, signal));
+}
+function getOwnString2(input, key2) {
+  const descriptor = Object.getOwnPropertyDescriptor(input, key2);
+  return descriptor !== void 0 && "value" in descriptor && typeof descriptor.value === "string" ? descriptor.value : void 0;
+}
+function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
+  const body = {
+    redirect_uris: [redirectUri],
+    grant_types: ["authorization_code", "refresh_token"],
+    response_types: ["code"],
+    token_endpoint_auth_method: tokenEndpointAuthMethod
+  };
+  const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
+  const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");
+  const softwareId = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareId");
+  const softwareVersion = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareVersion");
+  if (clientName !== void 0 && clientName.length > 0) {
+    body.client_name = clientName;
+  }
+  if (scope !== void 0 && scope.length > 0) {
+    body.scope = scope;
+  }
+  if (softwareId !== void 0 && softwareId.length > 0) {
+    body.software_id = softwareId;
+  }
+  if (softwareVersion !== void 0 && softwareVersion.length > 0) {
+    body.software_version = softwareVersion;
+  }
+  return body;
+}
+
+// ../mcp-oauth/dist/client/default-oauth-client-provider.js
+import { URL as URL2 } from "node:url";
+
+// ../mcp-oauth/dist/client/loopback-authorization.js
+import http from "node:http";
+
+// ../../node_modules/jose/dist/webapi/util/base64url.js
+var base64url_exports = {};
+__export(base64url_exports, {
+  decode: () => decode,
+  encode: () => encode
+});
+
+// ../../node_modules/jose/dist/webapi/lib/buffer_utils.js
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+var MAX_INT32 = 2 ** 32;
+
+// ../../node_modules/jose/dist/webapi/lib/base64.js
+function encodeBase64(input) {
+  if (Uint8Array.prototype.toBase64) {
+    return input.toBase64();
+  }
+  const CHUNK_SIZE = 32768;
+  const arr = [];
+  for (let i = 0; i < input.length; i += CHUNK_SIZE) {
+    arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+  }
+  return btoa(arr.join(""));
+}
+function decodeBase64(encoded) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(encoded);
+  }
+  const binary = atob(encoded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+
+// ../../node_modules/jose/dist/webapi/util/base64url.js
+function decode(input) {
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(typeof input === "string" ? input : decoder.decode(input), {
+      alphabet: "base64url"
+    });
+  }
+  let encoded = input;
+  if (encoded instanceof Uint8Array) {
+    encoded = decoder.decode(encoded);
+  }
+  encoded = encoded.replace(/-/g, "+").replace(/_/g, "/");
+  try {
+    return decodeBase64(encoded);
+  } catch {
+    throw new TypeError("The input to be decoded is not correctly encoded.");
+  }
+}
+function encode(input) {
+  let unencoded = input;
+  if (typeof unencoded === "string") {
+    unencoded = encoder.encode(unencoded);
+  }
+  if (Uint8Array.prototype.toBase64) {
+    return unencoded.toBase64({ alphabet: "base64url", omitPadding: true });
+  }
+  return encodeBase64(unencoded).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+
+// ../mcp-oauth/dist/client/authorization-state.js
+function createAuthorizationState(input) {
+  const payload = {
+    v: 1,
+    n: base64url_exports.encode(crypto.getRandomValues(new Uint8Array(16))),
+    i: input.issuer,
+    r: input.requireIssuer
+  };
+  return base64url_exports.encode(JSON.stringify(payload));
+}
+function parseAuthorizationState(value) {
+  if (value === null || value.length === 0) {
+    return null;
+  }
+  try {
+    const decoded = new TextDecoder().decode(base64url_exports.decode(value));
+    const parsed = JSON.parse(decoded);
+    if (!isObjectRecord2(parsed)) {
+      return null;
+    }
+    const version = getOwnEntry5(parsed, "v");
+    const nonce = getOwnEntry5(parsed, "n");
+    const issuer = getOwnEntry5(parsed, "i");
+    const requireIssuer = getOwnEntry5(parsed, "r");
+    if (version !== 1 || typeof nonce !== "string" || nonce.length === 0 || typeof issuer !== "string" || issuer.length === 0 || typeof requireIssuer !== "boolean") {
+      return null;
+    }
+    return {
+      issuer,
+      requireIssuer
+    };
+  } catch {
+    return null;
+  }
+}
+function isObjectRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function getOwnEntry5(record2, key2) {
+  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+}
+
+// ../mcp-oauth/dist/client/authorization-error.js
+var authorizationErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthAuthorizationError");
+var OAuthAuthorizationError = class extends Error {
+  error;
+  errorDescription;
+  /** Recognize errors from separately bundled copies of this package. */
+  static is(value) {
+    return value instanceof Error && Object.getOwnPropertyDescriptor(value, authorizationErrorBrand)?.value === true;
+  }
+  constructor(error, errorDescription) {
+    super(`OAuth authorization failed: ${error} \u2014 ${errorDescription}`);
+    this.error = error;
+    this.errorDescription = errorDescription;
+    this.name = "OAuthAuthorizationError";
+    Object.defineProperty(this, authorizationErrorBrand, { value: true });
+  }
+};
+
+// ../mcp-oauth/dist/client/loopback-authorization.js
+function snapshotLoopbackAuthorizationOptions(options) {
+  return {
+    ...options,
+    openBrowser: options.openBrowser?.bind(options),
+    readLine: options.readLine?.bind(options),
+    waitForCallback: options.waitForCallback?.bind(options),
+    createServer: options.createServer?.bind(options),
+    callbackPath: options.callbackPath,
+    redirectUri: options.redirectUri,
+    signal: options.signal,
+    timeoutMs: options.timeoutMs,
+    landingPage: options.landingPage === void 0 ? void 0 : { ...options.landingPage, title: options.landingPage.title, body: options.landingPage.body }
+  };
+}
+async function createLoopbackAuthorizationSession(options = {}) {
+  options = snapshotLoopbackAuthorizationOptions(options);
+  options.signal?.throwIfAborted();
+  const timeoutMs = options.timeoutMs ?? Infinity;
+  if (timeoutMs !== Infinity && (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647))
+    throw new Error("OAuth authorization timeoutMs must be a positive supported timer interval");
+  if (options.waitForCallback !== void 0)
+    return createHostedAuthorizationSession(options, timeoutMs);
+  const target = loopbackTarget(options);
+  const server = options.createServer ? options.createServer() : http.createServer();
+  const controller = new AbortController();
+  let closed = false;
+  let used = false;
+  const callerAbort = () => controller.abort(options.signal?.reason);
+  const teardown = () => {
+    if (closed)
+      return;
+    closed = true;
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", callerAbort);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer?.unref?.();
+  controller.signal.addEventListener("abort", teardown, { once: true });
+  options.signal?.addEventListener("abort", callerAbort, { once: true });
+  if (options.signal?.aborted)
+    callerAbort();
+  let port;
+  try {
+    port = await startServer(server, target.port, target.host, controller.signal);
+  } catch (error) {
+    controller.abort(error);
+    throw error;
+  }
+  const redirectUri = options.redirectUri ?? `http://127.0.0.1:${port}${target.callbackPath}`;
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used)
+        throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        return await waitForAuthorizationCode(server, authorizationUrl, options, target.callbackPath, controller.signal);
+      } finally {
+        clearTimeout(timer);
+      }
+    },
+    close() {
+      controller.abort(new Error("OAuth authorization session closed"));
+    }
+  };
+}
+function createHostedAuthorizationSession(options, timeoutMs) {
+  validateAuthorizationRedirect(options);
+  const redirectUri = options.redirectUri, controller = new AbortController();
+  let used = false;
+  const aborted = () => controller.abort(options.signal?.reason);
+  const timer = timeoutMs === Infinity ? void 0 : setTimeout(() => controller.abort(new Error("OAuth authorization timed out")), timeoutMs);
+  timer?.unref?.();
+  const cleanup = () => {
+    clearTimeout(timer);
+    options.signal?.removeEventListener("abort", aborted);
+  };
+  controller.signal.addEventListener("abort", cleanup, { once: true });
+  options.signal?.addEventListener("abort", aborted, { once: true });
+  if (options.signal?.aborted)
+    aborted();
+  return {
+    redirectUri,
+    async waitForCode(authorizationUrl) {
+      controller.signal.throwIfAborted();
+      if (used)
+        throw new Error("OAuth authorization session has already been used");
+      used = true;
+      try {
+        const authorization = new URL(authorizationUrl);
+        if (authorization.searchParams.getAll("redirect_uri").length !== 1 || authorization.searchParams.get("redirect_uri") !== redirectUri)
+          throw new Error("OAuth authorization redirect mismatch");
+        const callback = await new Promise((resolve, reject) => {
+          const onAbort = () => reject(controller.signal.reason);
+          controller.signal.addEventListener("abort", onAbort, { once: true });
+          void Promise.resolve().then(() => {
+            controller.signal.throwIfAborted();
+            return options.waitForCallback({ authorizationUrl, redirectUri, signal: controller.signal });
+          }).then(resolve, reject).finally(() => controller.signal.removeEventListener("abort", onAbort));
+        });
+        controller.signal.throwIfAborted();
+        const url = new URL(callback), base = new URL(redirectUri);
+        if (url.origin !== base.origin || url.pathname !== base.pathname || url.username || url.password || url.href.includes("#") || [...callback].some((char) => char.codePointAt(0) <= 32))
           throw new Error("OAuth callback redirect mismatch");
         const params = readAuthorizationCallbackParameters(url);
         for (const name of oauthCallbackParameters)
@@ -5189,257 +5557,387 @@ function buildSuccessPage(landingPage) {
   ].join("");
 }
 
-// ../mcp-oauth/dist/client/pkce.js
-import crypto4 from "node:crypto";
-function generateCodeVerifier() {
-  return crypto4.randomBytes(32).toString("base64url");
-}
-function generateCodeChallenge(verifier) {
-  return crypto4.createHash("sha256").update(verifier).digest("base64url");
-}
-
-// ../mcp-oauth/dist/http-response.js
-async function readBoundedResponseText(response, maxBytes, readers, signal) {
-  if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 1))
-    throw new Error("HTTP response byte limit must be a positive safe integer");
-  if (signal?.aborted) {
-    void response.body?.cancel().catch(() => void 0);
-    throw signal.reason;
-  }
-  const length = response.headers.get("Content-Length");
-  if (length !== null && length.length > 0 && [...length].every((character) => character >= "0" && character <= "9") && Number(length) > maxBytes) {
-    void response.body?.cancel().catch(() => void 0);
-    throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
-  }
-  if (response.body === null)
-    return "";
-  const reader = response.body.getReader();
-  readers?.add(reader);
-  const abort = () => {
-    void reader.cancel().catch(() => void 0);
-  };
-  signal?.addEventListener("abort", abort, { once: true });
-  if (signal?.aborted)
-    abort();
-  const decoder = new TextDecoder("utf-8", { fatal: true });
-  let bytes = 0;
-  let text = "";
-  try {
-    while (true) {
-      const chunk = await reader.read();
-      signal?.throwIfAborted();
-      if (chunk.done)
-        return text + decoder.decode();
-      bytes += chunk.value.byteLength;
-      if (bytes > maxBytes)
-        throw new Error(`HTTP response exceeds ${maxBytes} bytes`);
-      text += decoder.decode(chunk.value, { stream: true });
-    }
-  } catch (error) {
-    void reader.cancel().catch(() => void 0);
-    throw error;
-  } finally {
-    signal?.removeEventListener("abort", abort);
-    readers?.delete(reader);
-    reader.releaseLock();
-  }
+// ../../node_modules/@noble/hashes/_u64.js
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
 }
 
-// ../mcp-oauth/dist/client/token-endpoint.js
-var MAX_JS_DATE_MS2 = 864e13;
-var oauthErrorBrand = /* @__PURE__ */ Symbol.for("poe-platform.mcp-oauth.OAuthError");
-var OAuthError = class extends Error {
-  /** Recognize errors from separately bundled copies of this package. */
-  static is(value) {
-    return value instanceof Error && Object.getOwnPropertyDescriptor(value, oauthErrorBrand)?.value === true;
-  }
-  error;
-  errorDescription;
-  errorUri;
-  error_description;
-  error_uri;
-  status;
-  retryable;
-  terminal;
-  /** True only when a complete OAuth error response establishes rejection. */
-  outcomeKnown;
-  constructor(shape, status, outcomeKnown = true) {
-    const description = Object.hasOwn(shape, "error_description") ? shape.error_description : void 0;
-    const uri = Object.hasOwn(shape, "error_uri") ? shape.error_uri : void 0;
-    super(description ?? (outcomeKnown ? shape.error : `OAuth HTTP response did not contain a valid error (HTTP ${status})`));
-    this.name = "OAuthError";
-    Object.defineProperty(this, oauthErrorBrand, { value: true });
-    this.error = shape.error;
-    this.errorDescription = description;
-    this.errorUri = uri;
-    this.error_description = description;
-    this.error_uri = uri;
-    this.status = status;
-    this.retryable = isRetryableOAuthError(this);
-    this.terminal = !this.retryable;
-    this.outcomeKnown = outcomeKnown;
-  }
+// ../../node_modules/@noble/hashes/utils.js
+function isBytes(a) {
+  return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
+}
+var atitle = (title) => title ? `"${title}" ` : "";
+function anumber(n, title = "") {
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
+function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
+  const bytes = isBytes(value);
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
 };
-function isRetryableOAuthError(error) {
-  return error instanceof OAuthError && (error.status >= 500 || error.error === "server_error" || error.error === "temporarily_unavailable");
-}
-async function exchangeAuthorizationCode(input) {
-  const resource = canonicalizeResourceIndicator(input.resource);
-  return requestTokens({
-    tokenEndpoint: input.tokenEndpoint,
-    clientId: input.clientId,
-    clientSecret: input.clientSecret,
-    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
-    params: {
-      grant_type: "authorization_code",
-      code: input.code,
-      code_verifier: input.codeVerifier,
-      redirect_uri: input.redirectUri,
-      resource
-    },
-    fetch: input.fetch,
-    signal: input.signal,
-    now: input.now
-  });
-}
-async function refreshAccessToken(input) {
-  const resource = canonicalizeResourceIndicator(input.resource);
-  return requestTokens({
-    tokenEndpoint: input.tokenEndpoint,
-    clientId: input.clientId,
-    clientSecret: input.clientSecret,
-    tokenEndpointAuthMethod: input.tokenEndpointAuthMethod,
-    params: {
-      grant_type: "refresh_token",
-      refresh_token: input.refreshToken,
-      resource
-    },
-    fetch: input.fetch,
-    signal: input.signal,
-    now: input.now
-  });
+var aopts = (value, label) => {
+  aobject(value, label);
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null)
+    throw new TypeError(`"${label}" expected plain object`);
+  if (Object.hasOwn(value, "__proto__"))
+    throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
+function aexists(instance, checkFinished = true) {
+  if (instance.destroyed)
+    throw new Error("hash was destroyed");
+  if (checkFinished && instance.finished)
+    throw new Error("digest() was already called");
 }
-async function requestTokens(input) {
-  const method = normalizeOAuthTokenEndpointAuthMethod(input.tokenEndpointAuthMethod) ?? (input.clientSecret === void 0 ? "none" : "client_secret_post");
-  if (method !== "none" && (input.clientSecret === void 0 || input.clientSecret.trim() === ""))
-    throw new Error("OAuth token endpoint authentication requires a client secret");
-  const body = new URLSearchParams(input.params);
-  const headers = new Headers({ Accept: "application/json", "Content-Type": "application/x-www-form-urlencoded" });
-  if (method === "client_secret_basic") {
-    const encoded = new URLSearchParams({ credential: input.clientId }).toString().slice("credential=".length);
-    const encodedSecret = new URLSearchParams({ credential: input.clientSecret }).toString().slice("credential=".length);
-    headers.set("Authorization", `Basic ${btoa(`${encoded}:${encodedSecret}`)}`);
-  } else {
-    body.set("client_id", input.clientId);
-    if (method === "client_secret_post")
-      body.set("client_secret", input.clientSecret);
-  }
-  input.signal?.throwIfAborted();
-  const deadline = AbortSignal.timeout(3e4);
-  const signal = input.signal === void 0 ? deadline : AbortSignal.any([input.signal, deadline]);
-  const response = await fetchMcpResponse(input.fetch, input.tokenEndpoint, {
-    method: "POST",
-    headers,
-    body: body.toString(),
-    signal
-  });
-  const payload = await readOAuthJsonObjectResponse(response, signal);
-  const accessToken = getOwnEntry5(payload, "access_token");
-  if (typeof accessToken !== "string" || accessToken.trim().length === 0) {
-    throw new Error("OAuth token response missing access_token");
-  }
-  const normalizedAccessToken = accessToken.trim();
-  try {
-    new Headers({ Authorization: `Bearer ${normalizedAccessToken}` });
-  } catch {
-    throw new Error("OAuth token response access_token is not a valid HTTP header value");
-  }
-  const tokenType = normalizeBearerTokenType(getOwnEntry5(payload, "token_type"));
-  if (tokenType === null) {
-    throw new Error("OAuth token response missing token_type=Bearer");
-  }
-  const expiresIn = getOwnEntry5(payload, "expires_in");
-  let expiresAt = null;
-  if (expiresIn !== void 0) {
-    if (typeof expiresIn !== "number" || !Number.isFinite(expiresIn) || !Number.isInteger(expiresIn) || expiresIn < 0) {
-      throw new Error("OAuth token response has invalid expires_in");
-    }
-    const issuedAt = input.now();
-    if (!Number.isSafeInteger(issuedAt) || Math.abs(issuedAt) > MAX_JS_DATE_MS2)
-      throw new Error("OAuth token response has invalid expires_in");
-    expiresAt = issuedAt + expiresIn * 1e3;
-    if (!Number.isSafeInteger(expiresAt) || expiresAt > MAX_JS_DATE_MS2 || !Number.isFinite(new Date(expiresAt).getTime())) {
-      throw new Error("OAuth token response has invalid expires_in");
-    }
+function aoutput(out, instance) {
+  abytes(out, void 0, "output");
+  const min = instance.outputLen;
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
   }
-  const refreshToken = getOwnEntry5(payload, "refresh_token");
-  if (refreshToken !== void 0 && (typeof refreshToken !== "string" || refreshToken.trim().length === 0))
-    throw new Error("OAuth token response has invalid refresh_token");
-  const scope = getOwnEntry5(payload, "scope");
-  const normalizedRefreshToken = typeof refreshToken === "string" && refreshToken.trim().length > 0 ? refreshToken.trim() : void 0;
-  const normalizedScope = scope === "" ? "" : normalizeOAuthScope(scope);
-  if (scope !== void 0 && normalizedScope === void 0)
-    throw new Error("Invalid OAuth scope syntax in token response");
-  return {
-    accessToken: normalizedAccessToken,
-    refreshToken: normalizedRefreshToken === void 0 ? void 0 : normalizedRefreshToken,
-    tokenType,
-    expiresAt,
-    scope: normalizedScope === void 0 ? void 0 : normalizedScope
-  };
 }
-async function readOAuthJsonObjectResponse(response, signal) {
-  const fallbackError = createFallbackOAuthError(response.status);
-  let payload;
-  try {
-    payload = JSON.parse(await readBoundedResponseText(response, 1024 * 1024, void 0, signal));
-  } catch (error) {
-    if (signal?.aborted)
-      throw signal.reason;
-    if (error instanceof Error && error.message.startsWith("HTTP response exceeds "))
-      throw error;
-    if (!response.ok) {
-      throw fallbackError;
-    }
-    throw new Error("OAuth response must be a JSON object");
-  }
-  if (typeof payload !== "object" || payload === null || Array.isArray(payload)) {
-    if (!response.ok) {
-      throw fallbackError;
-    }
-    throw new Error("OAuth response must be a JSON object");
-  }
-  const record2 = payload;
-  if (!response.ok) {
-    const error = getOwnEntry5(record2, "error");
-    if (typeof error !== "string" || error.trim() === "")
-      throw fallbackError;
-    throw new OAuthError(readOAuthError(record2), response.status);
+function clean(...arrays) {
+  for (let i = 0; i < arrays.length; i++) {
+    arrays[i].fill(0);
   }
-  return record2;
 }
-function readOAuthError(payload, fallbackError = "server_error") {
-  const error = getOwnEntry5(payload, "error");
-  const errorDescription = getOwnEntry5(payload, "error_description");
-  const errorUri = getOwnEntry5(payload, "error_uri");
-  return {
-    error: typeof error === "string" ? error : fallbackError,
-    error_description: typeof errorDescription === "string" ? errorDescription : void 0,
-    error_uri: typeof errorUri === "string" ? errorUri : void 0
-  };
+function createView(arr) {
+  return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
 }
-function getOwnEntry5(record2, key2) {
-  return Object.prototype.hasOwnProperty.call(record2, key2) ? record2[key2] : void 0;
+function rotr(word, shift) {
+  return word << 32 - shift | word >>> shift;
 }
-function createFallbackOAuthError(status) {
-  const error = status === 503 ? "temporarily_unavailable" : status >= 500 ? "server_error" : "invalid_response";
-  return new OAuthError({ error }, status, false);
+function checkOpts(defaults, opts, title = "opts") {
+  aopts(defaults, "defaults");
+  if (opts !== void 0)
+    aopts(opts, title);
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), defaults, opts);
+  return merged;
 }
-function normalizeBearerTokenType(value) {
-  if (typeof value !== "string") {
-    return null;
+function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
+  const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
+  const tmp = hashCons(void 0);
+  hashC.outputLen = tmp.outputLen;
+  hashC.blockLen = tmp.blockLen;
+  hashC.canXOF = tmp.canXOF;
+  hashC.create = (opts) => hashCons(opts);
+  Object.assign(hashC, info);
+  return Object.freeze(hashC);
+}
+var oidNist = (suffix) => ({
+  // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+  // Larger suffix values would need base-128 OID encoding and a different length byte.
+  oid: Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2, suffix])
+});
+
+// ../../node_modules/@noble/hashes/_md.js
+function Chi(a, b, c) {
+  return a & b ^ ~a & c;
+}
+function Maj(a, b, c) {
+  return a & b ^ a & c ^ b & c;
+}
+var HashMD = class {
+  blockLen;
+  outputLen;
+  canXOF = false;
+  padOffset;
+  isLE;
+  // For partial updates less than block size
+  buffer;
+  view;
+  finished = false;
+  length = 0;
+  pos = 0;
+  destroyed = false;
+  constructor(blockLen, outputLen, padOffset, isLE) {
+    this.blockLen = blockLen;
+    this.outputLen = outputLen;
+    this.padOffset = padOffset;
+    this.isLE = isLE;
+    this.buffer = new Uint8Array(blockLen);
+    this.view = createView(this.buffer);
+  }
+  update(data) {
+    aexists(this);
+    abytes(data);
+    const { view, buffer, blockLen } = this;
+    const len = data.length;
+    let processed = false;
+    for (let pos = 0; pos < len; ) {
+      const take = Math.min(blockLen - this.pos, len - pos);
+      if (take === blockLen) {
+        const dataView = createView(data);
+        for (; blockLen <= len - pos; pos += blockLen)
+          this.process(dataView, pos);
+        processed = true;
+        continue;
+      }
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
+      this.pos += take;
+      pos += take;
+      if (this.pos === blockLen) {
+        this.process(view, 0);
+        this.pos = 0;
+        processed = true;
+      }
+    }
+    this.length += data.length;
+    if (processed)
+      this.roundClean();
+    return this;
+  }
+  digestInto(out) {
+    aexists(this);
+    aoutput(out, this);
+    this.finished = true;
+    const { buffer, view, blockLen, isLE } = this;
+    let { pos } = this;
+    buffer[pos++] = 128;
+    buffer.fill(0, pos);
+    if (this.padOffset > blockLen - pos) {
+      this.process(view, 0);
+      buffer.fill(0);
+    }
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
+    this.process(view, 0);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
+    const len = this.outputLen;
+    const outLen = len / 4;
+    const state = this.get();
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
+    for (let i = 0; i < outLen; i++)
+      oview.setUint32(4 * i, state[i], isLE);
+  }
+  digest() {
+    const { buffer, outputLen } = this;
+    this.digestInto(buffer);
+    const res = buffer.slice(0, outputLen);
+    this.destroy();
+    return res;
+  }
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
+    to.destroyed = destroyed;
+    to.finished = finished;
+    to.length = length;
+    to.pos = pos;
+    if (pos)
+      to.buffer.set(buffer);
+    return to;
+  }
+  clone() {
+    return this._cloneInto();
   }
-  return value.toLowerCase() === "bearer" ? "Bearer" : null;
+};
+var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+  1779033703,
+  3144134277,
+  1013904242,
+  2773480762,
+  1359893119,
+  2600822924,
+  528734635,
+  1541459225
+]);
+
+// ../../node_modules/@noble/hashes/sha2.js
+var SHA256_K = /* @__PURE__ */ Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+var SHA2_32B = class extends HashMD {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and makes sha256 3x slower (measured).
+  A = 0;
+  B = 0;
+  C = 0;
+  D = 0;
+  E = 0;
+  F = 0;
+  G = 0;
+  H = 0;
+  constructor(outputLen, IV) {
+    super(64, outputLen, 8, false);
+    this.A = IV[0] | 0;
+    this.B = IV[1] | 0;
+    this.C = IV[2] | 0;
+    this.D = IV[3] | 0;
+    this.E = IV[4] | 0;
+    this.F = IV[5] | 0;
+    this.G = IV[6] | 0;
+    this.H = IV[7] | 0;
+  }
+  get() {
+    const { A, B, C, D, E, F, G, H } = this;
+    return [A, B, C, D, E, F, G, H];
+  }
+  // prettier-ignore
+  set(A, B, C, D, E, F, G, H) {
+    this.A = A | 0;
+    this.B = B | 0;
+    this.C = C | 0;
+    this.D = D | 0;
+    this.E = E | 0;
+    this.F = F | 0;
+    this.G = G | 0;
+    this.H = H | 0;
+  }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
+  process(view, offset) {
+    for (let i = 0; i < 16; i++, offset += 4)
+      SHA256_W[i] = view.getUint32(offset, false);
+    for (let i = 16; i < 64; i++) {
+      const W15 = SHA256_W[i - 15];
+      const W2 = SHA256_W[i - 2];
+      const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+      const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
+      SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
+    }
+    let { A, B, C, D, E, F, G, H } = this;
+    for (let i = 0; i < 64; i++) {
+      const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
+      const T1 = H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i] | 0;
+      const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
+      const T2 = sigma0 + Maj(A, B, C) | 0;
+      H = G;
+      G = F;
+      F = E;
+      E = D + T1 | 0;
+      D = C;
+      C = B;
+      B = A;
+      A = T1 + T2 | 0;
+    }
+    A = A + this.A | 0;
+    B = B + this.B | 0;
+    C = C + this.C | 0;
+    D = D + this.D | 0;
+    E = E + this.E | 0;
+    F = F + this.F | 0;
+    G = G + this.G | 0;
+    H = H + this.H | 0;
+    this.set(A, B, C, D, E, F, G, H);
+  }
+  roundClean() {
+    clean(SHA256_W);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.set(0, 0, 0, 0, 0, 0, 0, 0);
+    clean(this.buffer);
+  }
+};
+var _SHA256 = class extends SHA2_32B {
+  constructor() {
+    super(32, SHA256_IV);
+  }
+};
+var sha256 = /* @__PURE__ */ createHasher(
+  () => new _SHA256(),
+  /* @__PURE__ */ oidNist(1)
+);
+
+// ../mcp-oauth/dist/client/pkce.js
+function generateCodeVerifier() {
+  return base64url_exports.encode(crypto.getRandomValues(new Uint8Array(32)));
+}
+function generateCodeChallenge(verifier) {
+  return base64url_exports.encode(sha256(new TextEncoder().encode(verifier)));
 }
 
 // ../mcp-oauth/dist/client/session-transaction.js
@@ -5657,7 +6155,7 @@ function createDefaultOAuthClientProvider(options) {
   async function ensureAuthorizedSession(resource, discovery, fetch2, allowInteractive, forceRefresh = false, signal, rejectedTokens) {
     signal?.throwIfAborted();
     if (discovery !== void 0) {
-      if (getOwnString2(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer)
+      if (getOwnString3(discovery.authorizationServerMetadata, "issuer") !== discovery.authorizationServer)
         throw new Error("OAuth discovery authorization-server issuer mismatch");
       assertSecureOAuthFlowEndpoints(discovery.authorizationServerMetadata);
     }
@@ -5676,7 +6174,7 @@ function createDefaultOAuthClientProvider(options) {
       if (session !== null && initialGrant?.resource === canonicalResource)
         initialGrantConsumed = true;
       signal?.throwIfAborted();
-      if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource || getOwnString2(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer || discovery !== void 0 && discovery.authorizationServer !== session.authorizationServer)) {
+      if (session !== null && (canonicalizeResourceIndicator(session.resource) !== canonicalResource || getOwnString3(session.discovery.authorizationServerMetadata, "issuer") !== session.authorizationServer || discovery !== void 0 && discovery.authorizationServer !== session.authorizationServer)) {
         await clearSession(canonicalResource);
         session = null;
       }
@@ -5890,7 +6388,7 @@ function createDefaultOAuthClientProvider(options) {
         client: configuredClient
       };
     }
-    const registrationEndpoint = getOwnString2(discovery.authorizationServerMetadata, "registration_endpoint");
+    const registrationEndpoint = getOwnString3(discovery.authorizationServerMetadata, "registration_endpoint");
     let storedClient = await loadRegisteredClient(discovery.authorizationServer);
     const importedClient = existingSession?.client.registrationOwnership === "caller" ? existingSession.client : storedClient?.registrationOwnership === "caller" ? storedClient : void 0;
     if (importedClient !== void 0) {
@@ -5937,21 +6435,15 @@ function createDefaultOAuthClientProvider(options) {
     const registrationMethod = requestedTokenMethod ?? (supported === void 0 ? "none" : ["none", "client_secret_basic", "client_secret_post"].find((method) => supported.includes(method)));
     if (registrationMethod === void 0 || supported !== void 0 && !supported.includes(registrationMethod))
       throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
-    const registrationBody = buildClientRegistrationBody(clientMetadata, redirectUri, registrationMethod);
-    const deadline = AbortSignal.timeout(3e4);
-    const signal = parentSignal === void 0 ? deadline : AbortSignal.any([parentSignal, deadline]);
-    const response = await fetchMcpResponse(fetch2, registrationEndpoint, {
-      method: "POST",
-      headers: {
-        Accept: "application/json",
-        "Content-Type": "application/json"
-      },
-      body: JSON.stringify(registrationBody),
-      signal
+    const registration = await registerOAuthClient({
+      registrationEndpoint,
+      redirectUri,
+      metadata: clientMetadata,
+      tokenEndpointAuthMethod: normalizeOAuthTokenEndpointAuthMethod(registrationMethod),
+      fetch: fetch2,
+      signal: parentSignal
     });
-    const payload = await readOAuthJsonObjectResponse(response, signal);
-    const registration = parseOAuthClientRegistration(payload);
-    const registeredSecret = getOwnString2(registration, "client_secret");
+    const registeredSecret = getOwnString3(registration, "client_secret");
     const responseMethod = normalizeOAuthTokenEndpointAuthMethod(getOwnEntry6(registration, "token_endpoint_auth_method")) ?? requestedTokenMethod ?? (supported === void 0 ? void 0 : normalizeOAuthTokenEndpointAuthMethod(registrationMethod));
     const registeredClient = {
       clientId: registration.client_id.trim(),
@@ -6027,9 +6519,9 @@ function resolveDiscovery(discovery, session) {
     return void 0;
   }
   const metadata = session.discovery.authorizationServerMetadata;
-  const issuer = getOwnString2(metadata, "issuer");
-  const authorizationEndpoint = getOwnString2(metadata, "authorization_endpoint");
-  const tokenEndpoint = getOwnString2(metadata, "token_endpoint");
+  const issuer = getOwnString3(metadata, "issuer");
+  const authorizationEndpoint = getOwnString3(metadata, "authorization_endpoint");
+  const tokenEndpoint = getOwnString3(metadata, "token_endpoint");
   const codeChallengeMethodsSupported = getOwnStringArray(metadata, "code_challenge_methods_supported");
   if (issuer === void 0 || authorizationEndpoint === void 0 || tokenEndpoint === void 0 || codeChallengeMethodsSupported === void 0 || !codeChallengeMethodsSupported.includes("S256")) {
     return void 0;
@@ -6101,8 +6593,8 @@ function normalizeStoredTokens(value) {
   if (value === void 0 || !isObjectRecord3(value)) {
     return void 0;
   }
-  const accessToken = getOwnString2(value, "accessToken");
-  const tokenType = getOwnString2(value, "tokenType");
+  const accessToken = getOwnString3(value, "accessToken");
+  const tokenType = getOwnString3(value, "tokenType");
   const expiresAt = getOwnEntry6(value, "expiresAt");
   const refreshToken = getOwnEntry6(value, "refreshToken");
   const scope = getOwnEntry6(value, "scope");
@@ -6136,7 +6628,7 @@ function normalizeConfiguredClient(client) {
   const clientId = normalizeOptionalOAuthString(client.clientId) ?? registration?.client_id.trim();
   if (clientId === void 0)
     return null;
-  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString2(registration, "client_secret")?.trim());
+  const clientSecret = normalizeOptionalOAuthString(client.clientSecret) ?? (registration === void 0 ? void 0 : getOwnString3(registration, "client_secret")?.trim());
   return normalizeStoredOAuthClient({
     clientId,
     clientSecret,
@@ -6158,12 +6650,12 @@ function getOwnEntry6(record2, key2) {
 function isObjectRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function getOwnString2(record2, key2) {
+function getOwnString3(record2, key2) {
   const value = getOwnEntry6(record2, key2);
   return typeof value === "string" ? value : void 0;
 }
 function requireOwnString(record2, key2, label) {
-  const value = getOwnString2(record2, key2);
+  const value = getOwnString3(record2, key2);
   if (value === void 0) {
     throw new Error(`${label} is missing ${key2}`);
   }
@@ -6225,7 +6717,7 @@ function assertSecureOAuthFlowEndpoints(metadata) {
     throw new Error("Authorization server issuer must not include query or fragment");
   const authorizationEndpoint = requireOwnString(metadata, "authorization_endpoint", "Authorization server metadata");
   const tokenEndpoint = requireOwnString(metadata, "token_endpoint", "Authorization server metadata");
-  const registrationEndpoint = getOwnString2(metadata, "registration_endpoint");
+  const registrationEndpoint = getOwnString3(metadata, "registration_endpoint");
   assertNoAccessTokenInUrl(authorizationEndpoint, "Authorization endpoint");
   assertNoAccessTokenInUrl(tokenEndpoint, "Token endpoint");
   assertSecureUrl(authorizationEndpoint, "Authorization endpoint");
@@ -6247,7 +6739,7 @@ function assertRequestMatchesResource(requestUrl, resource) {
   }
 }
 function assertRegistrationIssuer(client, issuer) {
-  const registrationIssuer = client.registration === void 0 ? void 0 : getOwnString2(client.registration, "issuer");
+  const registrationIssuer = client.registration === void 0 ? void 0 : getOwnString3(client.registration, "issuer");
   if (registrationIssuer !== void 0 && registrationIssuer !== issuer)
     throw new Error("OAuth client registration issuer does not match the authorization server");
 }
@@ -6273,31 +6765,6 @@ function assertTokenEndpointAuthentication(client, metadata) {
   if (supported !== void 0 && !supported.includes(method))
     throw new Error("Authorization server does not support the requested OAuth token endpoint authentication");
 }
-function buildClientRegistrationBody(metadata, redirectUri, tokenEndpointAuthMethod) {
-  const body = {
-    redirect_uris: [redirectUri],
-    grant_types: ["authorization_code", "refresh_token"],
-    response_types: ["code"],
-    token_endpoint_auth_method: tokenEndpointAuthMethod
-  };
-  const clientName = metadata === void 0 ? void 0 : getOwnString2(metadata, "clientName");
-  const scope = metadata === void 0 ? void 0 : getOwnString2(metadata, "scope");
-  const softwareId = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareId");
-  const softwareVersion = metadata === void 0 ? void 0 : getOwnString2(metadata, "softwareVersion");
-  if (clientName !== void 0 && clientName.length > 0) {
-    body.client_name = clientName;
-  }
-  if (scope !== void 0 && scope.length > 0) {
-    body.scope = scope;
-  }
-  if (softwareId !== void 0 && softwareId.length > 0) {
-    body.software_id = softwareId;
-  }
-  if (softwareVersion !== void 0 && softwareVersion.length > 0) {
-    body.software_version = softwareVersion;
-  }
-  return body;
-}
 function toStoredDiscovery(discovery) {
   return {
     resourceMetadataUrl: discovery.resourceMetadataUrl,
@@ -7782,111 +8249,9 @@ var HttpTransportError = class extends Error {
   method;
   rpcMethod;
 };
-function defaultStdioSpawn(command, args, options) {
-  return spawn2(command, args, options);
-}
 function defaultHttpTransportFetch(input, init) {
   return fetch(input, init);
 }
-var StdioTransport = class _StdioTransport {
-  readable;
-  writable;
-  closed;
-  child;
-  disposed = false;
-  stderrOutput = "";
-  static STDERR_MAX_LENGTH = 65536;
-  constructor({
-    command,
-    args = [],
-    cwd,
-    env,
-    spawn: spawnProcess = defaultStdioSpawn
-  }) {
-    this.child = spawnProcess(command, args, {
-      cwd,
-      env,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const child = this.child;
-    this.readable = child.stdout;
-    this.writable = child.stdin;
-    const stderrDecoder = new TextDecoder();
-    child.stderr.on("data", (chunk) => {
-      const decoded = chunk instanceof Uint8Array ? stderrDecoder.decode(chunk, { stream: true }) : `${stderrDecoder.decode()}${String(chunk)}`;
-      this.appendStderrOutput(decoded);
-    });
-    child.stderr.once("end", () => {
-      this.appendStderrOutput(stderrDecoder.decode());
-    });
-    this.closed = new Promise((resolve) => {
-      let settled = false;
-      let streamError;
-      const resolveClosed = (event) => {
-        if (settled) {
-          return;
-        }
-        settled = true;
-        resolve(event);
-      };
-      for (const stream of [child.stdin, child.stdout, child.stderr]) {
-        stream.once("error", (reason) => {
-          streamError ??= reason;
-          this.dispose(reason);
-        });
-      }
-      child.once("exit", (code, signal) => {
-        const closedEvent = {
-          reason: streamError ?? new Error("Stdio transport process exited")
-        };
-        if (code !== null) {
-          closedEvent.code = code;
-        }
-        if (signal !== null) {
-          closedEvent.signal = signal;
-        }
-        resolveClosed(closedEvent);
-      });
-      child.once("error", (error) => {
-        const closedEvent = {
-          reason: error instanceof Error ? error : new Error(String(error))
-        };
-        if (child.exitCode !== null) {
-          closedEvent.code = child.exitCode;
-        }
-        if (child.signalCode !== null) {
-          closedEvent.signal = child.signalCode;
-        }
-        resolveClosed(closedEvent);
-      });
-    });
-  }
-  getStderrOutput() {
-    return this.stderrOutput;
-  }
-  appendStderrOutput(chunk) {
-    if (chunk.length === 0) {
-      return;
-    }
-    this.stderrOutput += chunk;
-    if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
-      this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
-    }
-  }
-  dispose(reason = new Error("Stdio transport disposed")) {
-    void reason;
-    if (this.disposed) {
-      return;
-    }
-    this.disposed = true;
-    if (!this.child.stdin.destroyed && !this.child.stdin.writableEnded) {
-      this.child.stdin.end();
-    }
-    if (this.child.exitCode === null && this.child.signalCode === null && !this.child.killed) {
-      this.child.kill("SIGTERM");
-    }
-  }
-};
 function snapshotHttpTransportHeaders(headers) {
   try {
     return new Headers(headers);
@@ -8465,7 +8830,7 @@ var HttpTransport = class {
       return;
     }
     const parser = new SseParser(this.maxResponseBytes, options.acceptEndpoint);
-    const decoder = new TextDecoder("utf-8", { fatal: true });
+    const decoder2 = new TextDecoder("utf-8", { fatal: true });
     const reader = response.body.getReader();
     this.openResponseReaders.add(reader);
     const abort = () => {
@@ -8483,7 +8848,7 @@ var HttpTransport = class {
         if (value === void 0) {
           continue;
         }
-        const messages = parser.push(decoder.decode(value, { stream: true }));
+        const messages = parser.push(decoder2.decode(value, { stream: true }));
         this.writeSseMessages(messages, context);
         if (context?.completed || options.stopAfterInitialization && this.initializationRequestId === void 0) {
           void reader.cancel().catch(() => void 0);
@@ -8491,7 +8856,7 @@ var HttpTransport = class {
         }
         this.lastEventId = parser.lastEventId ?? this.lastEventId;
       }
-      const trailingChunk = decoder.decode();
+      const trailingChunk = decoder2.decode();
       if (trailingChunk.length > 0) {
         this.writeSseMessages(parser.push(trailingChunk), context);
         this.lastEventId = parser.lastEventId ?? this.lastEventId;
@@ -8655,14 +9020,14 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
   }
   let parts = [];
   let bytes = 0;
-  const decoder = new TextDecoder("utf-8", { fatal: true });
+  const decoder2 = new TextDecoder("utf-8", { fatal: true });
   const append = (part) => {
     bytes += new TextEncoder().encode(part).byteLength;
     if (bytes > maxLineBytes) throw new Error(`Stdio input line byte limit exceeded (${maxLineBytes} bytes)`);
     if (part.length > 0) parts.push(part);
   };
   for await (const chunk of stream) {
-    const text = chunk instanceof Uint8Array ? decoder.decode(chunk, { stream: true }) : decoder.decode() + String(chunk);
+    const text = chunk instanceof Uint8Array ? decoder2.decode(chunk, { stream: true }) : decoder2.decode() + String(chunk);
     let start = 0;
     let newline = text.indexOf("\n", start);
     while (newline !== -1) {
@@ -8675,7 +9040,7 @@ async function* readLines(stream, maxLineBytes = 16 * 1024 * 1024) {
     }
     append(text.slice(start));
   }
-  append(decoder.decode());
+  append(decoder2.decode());
   if (parts.length > 0) yield normalizeLine(parts.join(""));
 }
 var SseParser = class {
@@ -9499,6 +9864,113 @@ function parseJsonRpcPayload(parsed) {
     }
   };
 }
+
+// src/spawn.node.ts
+import { spawn as spawn2 } from "node:child_process";
+
+// src/stdio-transport.ts
+function defaultStdioSpawn(command, args, options) {
+  return spawn2(command, args, options);
+}
+var StdioTransport = class _StdioTransport {
+  readable;
+  writable;
+  closed;
+  child;
+  disposed = false;
+  stderrOutput = "";
+  static STDERR_MAX_LENGTH = 65536;
+  constructor({
+    command,
+    args = [],
+    cwd,
+    env,
+    spawn: spawnProcess = defaultStdioSpawn
+  }) {
+    this.child = spawnProcess(command, args, {
+      cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const child = this.child;
+    this.readable = child.stdout;
+    this.writable = child.stdin;
+    const stderrDecoder = new TextDecoder();
+    child.stderr.on("data", (chunk) => {
+      const decoded = chunk instanceof Uint8Array ? stderrDecoder.decode(chunk, { stream: true }) : `${stderrDecoder.decode()}${String(chunk)}`;
+      this.appendStderrOutput(decoded);
+    });
+    child.stderr.once("end", () => {
+      this.appendStderrOutput(stderrDecoder.decode());
+    });
+    this.closed = new Promise((resolve) => {
+      let settled = false;
+      let streamError;
+      const resolveClosed = (event) => {
+        if (settled) {
+          return;
+        }
+        settled = true;
+        resolve(event);
+      };
+      for (const stream of [child.stdin, child.stdout, child.stderr]) {
+        stream.once("error", (reason) => {
+          streamError ??= reason;
+          this.dispose(reason);
+        });
+      }
+      child.once("exit", (code, signal) => {
+        const closedEvent = {
+          reason: streamError ?? new Error("Stdio transport process exited")
+        };
+        if (code !== null) {
+          closedEvent.code = code;
+        }
+        if (signal !== null) {
+          closedEvent.signal = signal;
+        }
+        resolveClosed(closedEvent);
+      });
+      child.once("error", (error) => {
+        const closedEvent = {
+          reason: error instanceof Error ? error : new Error(String(error))
+        };
+        if (child.exitCode !== null) {
+          closedEvent.code = child.exitCode;
+        }
+        if (child.signalCode !== null) {
+          closedEvent.signal = child.signalCode;
+        }
+        resolveClosed(closedEvent);
+      });
+    });
+  }
+  getStderrOutput() {
+    return this.stderrOutput;
+  }
+  appendStderrOutput(chunk) {
+    if (chunk.length === 0) {
+      return;
+    }
+    this.stderrOutput += chunk;
+    if (this.stderrOutput.length > _StdioTransport.STDERR_MAX_LENGTH) {
+      this.stderrOutput = this.stderrOutput.slice(-_StdioTransport.STDERR_MAX_LENGTH);
+    }
+  }
+  dispose(reason = new Error("Stdio transport disposed")) {
+    void reason;
+    if (this.disposed) {
+      return;
+    }
+    this.disposed = true;
+    if (!this.child.stdin.destroyed && !this.child.stdin.writableEnded) {
+      this.child.stdin.end();
+    }
+    if (this.child.exitCode === null && this.child.signalCode === null && !this.child.killed) {
+      this.child.kill("SIGTERM");
+    }
+  }
+};
 export {
   ERROR_INTERNAL,
   ERROR_INVALID_PARAMS,
@@ -9517,6 +9989,7 @@ export {
   createInMemoryTransportPair,
   createSdkTestPair,
   createTestPair,
+  defaultStdioSpawn,
   discoverOAuthMetadata,
   fetchMcpResponse,
   snapshotHttpTransportHeaders