修改后台权限

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/clients.d.ts

@@ -0,0 +1,19 @@
+import { OAuthClientInformationFull } from '../../shared/auth.js';
+/**
+ * Stores information about registered OAuth clients for this server.
+ */
+export interface OAuthRegisteredClientsStore {
+    /**
+     * Returns information about a registered client, based on its ID.
+     */
+    getClient(clientId: string): OAuthClientInformationFull | undefined | Promise<OAuthClientInformationFull | undefined>;
+    /**
+     * Registers a new client with the server. The client ID and secret will be automatically generated by the library. A modified version of the client information can be returned to reflect specific values enforced by the server.
+     *
+     * NOTE: Implementations should NOT delete expired client secrets in-place. Auth middleware provided by this library will automatically check the `client_secret_expires_at` field and reject requests with expired secrets. Any custom logic for authenticating clients should check the `client_secret_expires_at` field as well.
+     *
+     * If unimplemented, dynamic client registration is unsupported.
+     */
+    registerClient?(client: Omit<OAuthClientInformationFull, 'client_id' | 'client_id_issued_at'>): OAuthClientInformationFull | Promise<OAuthClientInformationFull>;
+}
+//# sourceMappingURL=clients.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/clients.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAElE;;GAEG;AACH,MAAM,WAAW,2BAA2B;IACxC;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,0BAA0B,GAAG,SAAS,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IAEtH;;;;;;OAMG;IACH,cAAc,CAAC,CACX,MAAM,EAAE,IAAI,CAAC,0BAA0B,EAAE,WAAW,GAAG,qBAAqB,CAAC,GAC9E,0BAA0B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;CACvE"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/clients.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=clients.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../../../../src/server/auth/clients.ts"],"names":[],"mappings":""}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/errors.d.ts

@@ -0,0 +1,148 @@
+import { OAuthErrorResponse } from '../../shared/auth.js';
+/**
+ * Base class for all OAuth errors
+ */
+export declare class OAuthError extends Error {
+    readonly errorUri?: string | undefined;
+    static errorCode: string;
+    constructor(message: string, errorUri?: string | undefined);
+    /**
+     * Converts the error to a standard OAuth error response object
+     */
+    toResponseObject(): OAuthErrorResponse;
+    get errorCode(): string;
+}
+/**
+ * Invalid request error - The request is missing a required parameter,
+ * includes an invalid parameter value, includes a parameter more than once,
+ * or is otherwise malformed.
+ */
+export declare class InvalidRequestError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid client error - Client authentication failed (e.g., unknown client, no client
+ * authentication included, or unsupported authentication method).
+ */
+export declare class InvalidClientError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid grant error - The provided authorization grant or refresh token is
+ * invalid, expired, revoked, does not match the redirection URI used in the
+ * authorization request, or was issued to another client.
+ */
+export declare class InvalidGrantError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Unauthorized client error - The authenticated client is not authorized to use
+ * this authorization grant type.
+ */
+export declare class UnauthorizedClientError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Unsupported grant type error - The authorization grant type is not supported
+ * by the authorization server.
+ */
+export declare class UnsupportedGrantTypeError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid scope error - The requested scope is invalid, unknown, malformed, or
+ * exceeds the scope granted by the resource owner.
+ */
+export declare class InvalidScopeError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Access denied error - The resource owner or authorization server denied the request.
+ */
+export declare class AccessDeniedError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Server error - The authorization server encountered an unexpected condition
+ * that prevented it from fulfilling the request.
+ */
+export declare class ServerError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Temporarily unavailable error - The authorization server is currently unable to
+ * handle the request due to a temporary overloading or maintenance of the server.
+ */
+export declare class TemporarilyUnavailableError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Unsupported response type error - The authorization server does not support
+ * obtaining an authorization code using this method.
+ */
+export declare class UnsupportedResponseTypeError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Unsupported token type error - The authorization server does not support
+ * the requested token type.
+ */
+export declare class UnsupportedTokenTypeError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid token error - The access token provided is expired, revoked, malformed,
+ * or invalid for other reasons.
+ */
+export declare class InvalidTokenError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Method not allowed error - The HTTP method used is not allowed for this endpoint.
+ * (Custom, non-standard error)
+ */
+export declare class MethodNotAllowedError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Too many requests error - Rate limit exceeded.
+ * (Custom, non-standard error based on RFC 6585)
+ */
+export declare class TooManyRequestsError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid client metadata error - The client metadata is invalid.
+ * (Custom error for dynamic client registration - RFC 7591)
+ */
+export declare class InvalidClientMetadataError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Insufficient scope error - The request requires higher privileges than provided by the access token.
+ */
+export declare class InsufficientScopeError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * Invalid target error - The requested resource is invalid, missing, unknown, or malformed.
+ * (Custom error for resource indicators - RFC 8707)
+ */
+export declare class InvalidTargetError extends OAuthError {
+    static errorCode: string;
+}
+/**
+ * A utility class for defining one-off error codes
+ */
+export declare class CustomOAuthError extends OAuthError {
+    private readonly customErrorCode;
+    constructor(customErrorCode: string, message: string, errorUri?: string);
+    get errorCode(): string;
+}
+/**
+ * A full list of all OAuthErrors, enabling parsing from error responses
+ */
+export declare const OAUTH_ERRORS: {
+    readonly [x: string]: typeof InvalidRequestError;
+};
+//# sourceMappingURL=errors.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;GAEG;AACH,qBAAa,UAAW,SAAQ,KAAK;aAKb,QAAQ,CAAC,EAAE,MAAM;IAJrC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;gBAGrB,OAAO,EAAE,MAAM,EACC,QAAQ,CAAC,EAAE,MAAM,YAAA;IAMrC;;OAEG;IACH,gBAAgB,IAAI,kBAAkB;IAatC,IAAI,SAAS,IAAI,MAAM,CAEtB;CACJ;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,UAAU;IAC/C,MAAM,CAAC,SAAS,SAAqB;CACxC;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAC9C,MAAM,CAAC,SAAS,SAAoB;CACvC;AAED;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC7C,MAAM,CAAC,SAAS,SAAmB;CACtC;AAED;;;GAGG;AACH,qBAAa,uBAAwB,SAAQ,UAAU;IACnD,MAAM,CAAC,SAAS,SAAyB;CAC5C;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IACrD,MAAM,CAAC,SAAS,SAA4B;CAC/C;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC7C,MAAM,CAAC,SAAS,SAAmB;CACtC;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC7C,MAAM,CAAC,SAAS,SAAmB;CACtC;AAED;;;GAGG;AACH,qBAAa,WAAY,SAAQ,UAAU;IACvC,MAAM,CAAC,SAAS,SAAkB;CACrC;AAED;;;GAGG;AACH,qBAAa,2BAA4B,SAAQ,UAAU;IACvD,MAAM,CAAC,SAAS,SAA6B;CAChD;AAED;;;GAGG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IACxD,MAAM,CAAC,SAAS,SAA+B;CAClD;AAED;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,UAAU;IACrD,MAAM,CAAC,SAAS,SAA4B;CAC/C;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,UAAU;IAC7C,MAAM,CAAC,SAAS,SAAmB;CACtC;AAED;;;GAGG;AACH,qBAAa,qBAAsB,SAAQ,UAAU;IACjD,MAAM,CAAC,SAAS,SAAwB;CAC3C;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,UAAU;IAChD,MAAM,CAAC,SAAS,SAAuB;CAC1C;AAED;;;GAGG;AACH,qBAAa,0BAA2B,SAAQ,UAAU;IACtD,MAAM,CAAC,SAAS,SAA6B;CAChD;AAED;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,UAAU;IAClD,MAAM,CAAC,SAAS,SAAwB;CAC3C;AAED;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,UAAU;IAC9C,MAAM,CAAC,SAAS,SAAoB;CACvC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAExC,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAAf,eAAe,EAAE,MAAM,EACxC,OAAO,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM;IAKrB,IAAI,SAAS,IAAI,MAAM,CAEtB;CACJ;AAED;;GAEG;AACH,eAAO,MAAM,YAAY;;CAkBf,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/errors.js

@@ -0,0 +1,202 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAUTH_ERRORS = exports.CustomOAuthError = exports.InvalidTargetError = exports.InsufficientScopeError = exports.InvalidClientMetadataError = exports.TooManyRequestsError = exports.MethodNotAllowedError = exports.InvalidTokenError = exports.UnsupportedTokenTypeError = exports.UnsupportedResponseTypeError = exports.TemporarilyUnavailableError = exports.ServerError = exports.AccessDeniedError = exports.InvalidScopeError = exports.UnsupportedGrantTypeError = exports.UnauthorizedClientError = exports.InvalidGrantError = exports.InvalidClientError = exports.InvalidRequestError = exports.OAuthError = void 0;
+/**
+ * Base class for all OAuth errors
+ */
+class OAuthError extends Error {
+    constructor(message, errorUri) {
+        super(message);
+        this.errorUri = errorUri;
+        this.name = this.constructor.name;
+    }
+    /**
+     * Converts the error to a standard OAuth error response object
+     */
+    toResponseObject() {
+        const response = {
+            error: this.errorCode,
+            error_description: this.message
+        };
+        if (this.errorUri) {
+            response.error_uri = this.errorUri;
+        }
+        return response;
+    }
+    get errorCode() {
+        return this.constructor.errorCode;
+    }
+}
+exports.OAuthError = OAuthError;
+/**
+ * Invalid request error - The request is missing a required parameter,
+ * includes an invalid parameter value, includes a parameter more than once,
+ * or is otherwise malformed.
+ */
+class InvalidRequestError extends OAuthError {
+}
+exports.InvalidRequestError = InvalidRequestError;
+InvalidRequestError.errorCode = 'invalid_request';
+/**
+ * Invalid client error - Client authentication failed (e.g., unknown client, no client
+ * authentication included, or unsupported authentication method).
+ */
+class InvalidClientError extends OAuthError {
+}
+exports.InvalidClientError = InvalidClientError;
+InvalidClientError.errorCode = 'invalid_client';
+/**
+ * Invalid grant error - The provided authorization grant or refresh token is
+ * invalid, expired, revoked, does not match the redirection URI used in the
+ * authorization request, or was issued to another client.
+ */
+class InvalidGrantError extends OAuthError {
+}
+exports.InvalidGrantError = InvalidGrantError;
+InvalidGrantError.errorCode = 'invalid_grant';
+/**
+ * Unauthorized client error - The authenticated client is not authorized to use
+ * this authorization grant type.
+ */
+class UnauthorizedClientError extends OAuthError {
+}
+exports.UnauthorizedClientError = UnauthorizedClientError;
+UnauthorizedClientError.errorCode = 'unauthorized_client';
+/**
+ * Unsupported grant type error - The authorization grant type is not supported
+ * by the authorization server.
+ */
+class UnsupportedGrantTypeError extends OAuthError {
+}
+exports.UnsupportedGrantTypeError = UnsupportedGrantTypeError;
+UnsupportedGrantTypeError.errorCode = 'unsupported_grant_type';
+/**
+ * Invalid scope error - The requested scope is invalid, unknown, malformed, or
+ * exceeds the scope granted by the resource owner.
+ */
+class InvalidScopeError extends OAuthError {
+}
+exports.InvalidScopeError = InvalidScopeError;
+InvalidScopeError.errorCode = 'invalid_scope';
+/**
+ * Access denied error - The resource owner or authorization server denied the request.
+ */
+class AccessDeniedError extends OAuthError {
+}
+exports.AccessDeniedError = AccessDeniedError;
+AccessDeniedError.errorCode = 'access_denied';
+/**
+ * Server error - The authorization server encountered an unexpected condition
+ * that prevented it from fulfilling the request.
+ */
+class ServerError extends OAuthError {
+}
+exports.ServerError = ServerError;
+ServerError.errorCode = 'server_error';
+/**
+ * Temporarily unavailable error - The authorization server is currently unable to
+ * handle the request due to a temporary overloading or maintenance of the server.
+ */
+class TemporarilyUnavailableError extends OAuthError {
+}
+exports.TemporarilyUnavailableError = TemporarilyUnavailableError;
+TemporarilyUnavailableError.errorCode = 'temporarily_unavailable';
+/**
+ * Unsupported response type error - The authorization server does not support
+ * obtaining an authorization code using this method.
+ */
+class UnsupportedResponseTypeError extends OAuthError {
+}
+exports.UnsupportedResponseTypeError = UnsupportedResponseTypeError;
+UnsupportedResponseTypeError.errorCode = 'unsupported_response_type';
+/**
+ * Unsupported token type error - The authorization server does not support
+ * the requested token type.
+ */
+class UnsupportedTokenTypeError extends OAuthError {
+}
+exports.UnsupportedTokenTypeError = UnsupportedTokenTypeError;
+UnsupportedTokenTypeError.errorCode = 'unsupported_token_type';
+/**
+ * Invalid token error - The access token provided is expired, revoked, malformed,
+ * or invalid for other reasons.
+ */
+class InvalidTokenError extends OAuthError {
+}
+exports.InvalidTokenError = InvalidTokenError;
+InvalidTokenError.errorCode = 'invalid_token';
+/**
+ * Method not allowed error - The HTTP method used is not allowed for this endpoint.
+ * (Custom, non-standard error)
+ */
+class MethodNotAllowedError extends OAuthError {
+}
+exports.MethodNotAllowedError = MethodNotAllowedError;
+MethodNotAllowedError.errorCode = 'method_not_allowed';
+/**
+ * Too many requests error - Rate limit exceeded.
+ * (Custom, non-standard error based on RFC 6585)
+ */
+class TooManyRequestsError extends OAuthError {
+}
+exports.TooManyRequestsError = TooManyRequestsError;
+TooManyRequestsError.errorCode = 'too_many_requests';
+/**
+ * Invalid client metadata error - The client metadata is invalid.
+ * (Custom error for dynamic client registration - RFC 7591)
+ */
+class InvalidClientMetadataError extends OAuthError {
+}
+exports.InvalidClientMetadataError = InvalidClientMetadataError;
+InvalidClientMetadataError.errorCode = 'invalid_client_metadata';
+/**
+ * Insufficient scope error - The request requires higher privileges than provided by the access token.
+ */
+class InsufficientScopeError extends OAuthError {
+}
+exports.InsufficientScopeError = InsufficientScopeError;
+InsufficientScopeError.errorCode = 'insufficient_scope';
+/**
+ * Invalid target error - The requested resource is invalid, missing, unknown, or malformed.
+ * (Custom error for resource indicators - RFC 8707)
+ */
+class InvalidTargetError extends OAuthError {
+}
+exports.InvalidTargetError = InvalidTargetError;
+InvalidTargetError.errorCode = 'invalid_target';
+/**
+ * A utility class for defining one-off error codes
+ */
+class CustomOAuthError extends OAuthError {
+    constructor(customErrorCode, message, errorUri) {
+        super(message, errorUri);
+        this.customErrorCode = customErrorCode;
+    }
+    get errorCode() {
+        return this.customErrorCode;
+    }
+}
+exports.CustomOAuthError = CustomOAuthError;
+/**
+ * A full list of all OAuthErrors, enabling parsing from error responses
+ */
+exports.OAUTH_ERRORS = {
+    [InvalidRequestError.errorCode]: InvalidRequestError,
+    [InvalidClientError.errorCode]: InvalidClientError,
+    [InvalidGrantError.errorCode]: InvalidGrantError,
+    [UnauthorizedClientError.errorCode]: UnauthorizedClientError,
+    [UnsupportedGrantTypeError.errorCode]: UnsupportedGrantTypeError,
+    [InvalidScopeError.errorCode]: InvalidScopeError,
+    [AccessDeniedError.errorCode]: AccessDeniedError,
+    [ServerError.errorCode]: ServerError,
+    [TemporarilyUnavailableError.errorCode]: TemporarilyUnavailableError,
+    [UnsupportedResponseTypeError.errorCode]: UnsupportedResponseTypeError,
+    [UnsupportedTokenTypeError.errorCode]: UnsupportedTokenTypeError,
+    [InvalidTokenError.errorCode]: InvalidTokenError,
+    [MethodNotAllowedError.errorCode]: MethodNotAllowedError,
+    [TooManyRequestsError.errorCode]: TooManyRequestsError,
+    [InvalidClientMetadataError.errorCode]: InvalidClientMetadataError,
+    [InsufficientScopeError.errorCode]: InsufficientScopeError,
+    [InvalidTargetError.errorCode]: InvalidTargetError
+};
+//# sourceMappingURL=errors.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/server/auth/errors.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACH,MAAa,UAAW,SAAQ,KAAK;IAGjC,YACI,OAAe,EACC,QAAiB;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,aAAQ,GAAR,QAAQ,CAAS;QAGjC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,gBAAgB;QACZ,MAAM,QAAQ,GAAuB;YACjC,KAAK,EAAE,IAAI,CAAC,SAAS;YACrB,iBAAiB,EAAE,IAAI,CAAC,OAAO;SAClC,CAAC;QAEF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,OAAO,QAAQ,CAAC;IACpB,CAAC;IAED,IAAI,SAAS;QACT,OAAQ,IAAI,CAAC,WAAiC,CAAC,SAAS,CAAC;IAC7D,CAAC;CACJ;AA9BD,gCA8BC;AAED;;;;GAIG;AACH,MAAa,mBAAoB,SAAQ,UAAU;;AAAnD,kDAEC;AADU,6BAAS,GAAG,iBAAiB,CAAC;AAGzC;;;GAGG;AACH,MAAa,kBAAmB,SAAQ,UAAU;;AAAlD,gDAEC;AADU,4BAAS,GAAG,gBAAgB,CAAC;AAGxC;;;;GAIG;AACH,MAAa,iBAAkB,SAAQ,UAAU;;AAAjD,8CAEC;AADU,2BAAS,GAAG,eAAe,CAAC;AAGvC;;;GAGG;AACH,MAAa,uBAAwB,SAAQ,UAAU;;AAAvD,0DAEC;AADU,iCAAS,GAAG,qBAAqB,CAAC;AAG7C;;;GAGG;AACH,MAAa,yBAA0B,SAAQ,UAAU;;AAAzD,8DAEC;AADU,mCAAS,GAAG,wBAAwB,CAAC;AAGhD;;;GAGG;AACH,MAAa,iBAAkB,SAAQ,UAAU;;AAAjD,8CAEC;AADU,2BAAS,GAAG,eAAe,CAAC;AAGvC;;GAEG;AACH,MAAa,iBAAkB,SAAQ,UAAU;;AAAjD,8CAEC;AADU,2BAAS,GAAG,eAAe,CAAC;AAGvC;;;GAGG;AACH,MAAa,WAAY,SAAQ,UAAU;;AAA3C,kCAEC;AADU,qBAAS,GAAG,cAAc,CAAC;AAGtC;;;GAGG;AACH,MAAa,2BAA4B,SAAQ,UAAU;;AAA3D,kEAEC;AADU,qCAAS,GAAG,yBAAyB,CAAC;AAGjD;;;GAGG;AACH,MAAa,4BAA6B,SAAQ,UAAU;;AAA5D,oEAEC;AADU,sCAAS,GAAG,2BAA2B,CAAC;AAGnD;;;GAGG;AACH,MAAa,yBAA0B,SAAQ,UAAU;;AAAzD,8DAEC;AADU,mCAAS,GAAG,wBAAwB,CAAC;AAGhD;;;GAGG;AACH,MAAa,iBAAkB,SAAQ,UAAU;;AAAjD,8CAEC;AADU,2BAAS,GAAG,eAAe,CAAC;AAGvC;;;GAGG;AACH,MAAa,qBAAsB,SAAQ,UAAU;;AAArD,sDAEC;AADU,+BAAS,GAAG,oBAAoB,CAAC;AAG5C;;;GAGG;AACH,MAAa,oBAAqB,SAAQ,UAAU;;AAApD,oDAEC;AADU,8BAAS,GAAG,mBAAmB,CAAC;AAG3C;;;GAGG;AACH,MAAa,0BAA2B,SAAQ,UAAU;;AAA1D,gEAEC;AADU,oCAAS,GAAG,yBAAyB,CAAC;AAGjD;;GAEG;AACH,MAAa,sBAAuB,SAAQ,UAAU;;AAAtD,wDAEC;AADU,gCAAS,GAAG,oBAAoB,CAAC;AAG5C;;;GAGG;AACH,MAAa,kBAAmB,SAAQ,UAAU;;AAAlD,gDAEC;AADU,4BAAS,GAAG,gBAAgB,CAAC;AAGxC;;GAEG;AACH,MAAa,gBAAiB,SAAQ,UAAU;IAC5C,YACqB,eAAuB,EACxC,OAAe,EACf,QAAiB;QAEjB,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAJR,oBAAe,GAAf,eAAe,CAAQ;IAK5C,CAAC;IAED,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;CACJ;AAZD,4CAYC;AAED;;GAEG;AACU,QAAA,YAAY,GAAG;IACxB,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,mBAAmB;IACpD,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,kBAAkB;IAClD,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;IAChD,CAAC,uBAAuB,CAAC,SAAS,CAAC,EAAE,uBAAuB;IAC5D,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,yBAAyB;IAChE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;IAChD,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;IAChD,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,WAAW;IACpC,CAAC,2BAA2B,CAAC,SAAS,CAAC,EAAE,2BAA2B;IACpE,CAAC,4BAA4B,CAAC,SAAS,CAAC,EAAE,4BAA4B;IACtE,CAAC,yBAAyB,CAAC,SAAS,CAAC,EAAE,yBAAyB;IAChE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,iBAAiB;IAChD,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,qBAAqB;IACxD,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,oBAAoB;IACtD,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE,0BAA0B;IAClE,CAAC,sBAAsB,CAAC,SAAS,CAAC,EAAE,sBAAsB;IAC1D,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,kBAAkB;CAC5C,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/authorize.d.ts

@@ -0,0 +1,13 @@
+import { RequestHandler } from 'express';
+import { OAuthServerProvider } from '../provider.js';
+import { Options as RateLimitOptions } from 'express-rate-limit';
+export type AuthorizationHandlerOptions = {
+    provider: OAuthServerProvider;
+    /**
+     * Rate limiting configuration for the authorization endpoint.
+     * Set to false to disable rate limiting for this endpoint.
+     */
+    rateLimit?: Partial<RateLimitOptions> | false;
+};
+export declare function authorizationHandler({ provider, rateLimit: rateLimitConfig }: AuthorizationHandlerOptions): RequestHandler;
+//# sourceMappingURL=authorize.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/authorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/authorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAa,OAAO,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,MAAM,2BAA2B,GAAG;IACtC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACjD,CAAC;AAqBF,wBAAgB,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,2BAA2B,GAAG,cAAc,CAgH1H"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/authorize.js

@@ -0,0 +1,167 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authorizationHandler = authorizationHandler;
+const z = __importStar(require("zod/v4"));
+const express_1 = __importDefault(require("express"));
+const express_rate_limit_1 = require("express-rate-limit");
+const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
+const errors_js_1 = require("../errors.js");
+// Parameters that must be validated in order to issue redirects.
+const ClientAuthorizationParamsSchema = z.object({
+    client_id: z.string(),
+    redirect_uri: z
+        .string()
+        .optional()
+        .refine(value => value === undefined || URL.canParse(value), { message: 'redirect_uri must be a valid URL' })
+});
+// Parameters that must be validated for a successful authorization request. Failure can be reported to the redirect URI.
+const RequestAuthorizationParamsSchema = z.object({
+    response_type: z.literal('code'),
+    code_challenge: z.string(),
+    code_challenge_method: z.literal('S256'),
+    scope: z.string().optional(),
+    state: z.string().optional(),
+    resource: z.string().url().optional()
+});
+function authorizationHandler({ provider, rateLimit: rateLimitConfig }) {
+    // Create a router to apply middleware
+    const router = express_1.default.Router();
+    router.use((0, allowedMethods_js_1.allowedMethods)(['GET', 'POST']));
+    router.use(express_1.default.urlencoded({ extended: false }));
+    // Apply rate limiting unless explicitly disabled
+    if (rateLimitConfig !== false) {
+        router.use((0, express_rate_limit_1.rateLimit)({
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            max: 100, // 100 requests per windowMs
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for authorization requests').toResponseObject(),
+            ...rateLimitConfig
+        }));
+    }
+    router.all('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        // In the authorization flow, errors are split into two categories:
+        // 1. Pre-redirect errors (direct response with 400)
+        // 2. Post-redirect errors (redirect with error parameters)
+        // Phase 1: Validate client_id and redirect_uri. Any errors here must be direct responses.
+        let client_id, redirect_uri, client;
+        try {
+            const result = ClientAuthorizationParamsSchema.safeParse(req.method === 'POST' ? req.body : req.query);
+            if (!result.success) {
+                throw new errors_js_1.InvalidRequestError(result.error.message);
+            }
+            client_id = result.data.client_id;
+            redirect_uri = result.data.redirect_uri;
+            client = await provider.clientsStore.getClient(client_id);
+            if (!client) {
+                throw new errors_js_1.InvalidClientError('Invalid client_id');
+            }
+            if (redirect_uri !== undefined) {
+                if (!client.redirect_uris.includes(redirect_uri)) {
+                    throw new errors_js_1.InvalidRequestError('Unregistered redirect_uri');
+                }
+            }
+            else if (client.redirect_uris.length === 1) {
+                redirect_uri = client.redirect_uris[0];
+            }
+            else {
+                throw new errors_js_1.InvalidRequestError('redirect_uri must be specified when client has multiple registered URIs');
+            }
+        }
+        catch (error) {
+            // Pre-redirect errors - return direct response
+            //
+            // These don't need to be JSON encoded, as they'll be displayed in a user
+            // agent, but OTOH they all represent exceptional situations (arguably,
+            // "programmer error"), so presenting a nice HTML page doesn't help the
+            // user anyway.
+            if (error instanceof errors_js_1.OAuthError) {
+                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
+                res.status(status).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+            return;
+        }
+        // Phase 2: Validate other parameters. Any errors here should go into redirect responses.
+        let state;
+        try {
+            // Parse and validate authorization parameters
+            const parseResult = RequestAuthorizationParamsSchema.safeParse(req.method === 'POST' ? req.body : req.query);
+            if (!parseResult.success) {
+                throw new errors_js_1.InvalidRequestError(parseResult.error.message);
+            }
+            const { scope, code_challenge, resource } = parseResult.data;
+            state = parseResult.data.state;
+            // Validate scopes
+            let requestedScopes = [];
+            if (scope !== undefined) {
+                requestedScopes = scope.split(' ');
+            }
+            // All validation passed, proceed with authorization
+            await provider.authorize(client, {
+                state,
+                scopes: requestedScopes,
+                redirectUri: redirect_uri,
+                codeChallenge: code_challenge,
+                resource: resource ? new URL(resource) : undefined
+            }, res);
+        }
+        catch (error) {
+            // Post-redirect errors - redirect with error parameters
+            if (error instanceof errors_js_1.OAuthError) {
+                res.redirect(302, createErrorRedirect(redirect_uri, error, state));
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.redirect(302, createErrorRedirect(redirect_uri, serverError, state));
+            }
+        }
+    });
+    return router;
+}
+/**
+ * Helper function to create redirect URL with error parameters
+ */
+function createErrorRedirect(redirectUri, error, state) {
+    const errorUrl = new URL(redirectUri);
+    errorUrl.searchParams.set('error', error.errorCode);
+    errorUrl.searchParams.set('error_description', error.message);
+    if (error.errorUri) {
+        errorUrl.searchParams.set('error_uri', error.errorUri);
+    }
+    if (state) {
+        errorUrl.searchParams.set('state', state);
+    }
+    return errorUrl.href;
+}
+//# sourceMappingURL=authorize.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/authorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.js","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/authorize.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,oDAgHC;AAnJD,0CAA4B;AAC5B,sDAA8B;AAE9B,2DAA4E;AAC5E,uEAAiE;AACjE,4CAAsH;AAWtH,iEAAiE;AACjE,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,kCAAkC,EAAE,CAAC;CACpH,CAAC,CAAC;AAEH,yHAAyH;AACzH,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,qBAAqB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,SAAgB,oBAAoB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAA+B;IACtG,sCAAsC;IACtC,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAc,EAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpD,iDAAiD;IACjD,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CACN,IAAA,8BAAS,EAAC;YACN,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;YACvC,GAAG,EAAE,GAAG,EAAE,4BAA4B;YACtC,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,gCAAoB,CAAC,6DAA6D,CAAC,CAAC,gBAAgB,EAAE;YACnH,GAAG,eAAe;SACrB,CAAC,CACL,CAAC;IACN,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,mEAAmE;QACnE,oDAAoD;QACpD,2DAA2D;QAE3D,0FAA0F;QAC1F,IAAI,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC;QACpC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,+BAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxD,CAAC;YAED,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAClC,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;YAExC,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,8BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,CAAC;YAED,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,+BAAmB,CAAC,2BAA2B,CAAC,CAAC;gBAC/D,CAAC;YACL,CAAC;iBAAM,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3C,YAAY,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;YAC3C,CAAC;iBAAM,CAAC;gBACJ,MAAM,IAAI,+BAAmB,CAAC,yEAAyE,CAAC,CAAC;YAC7G,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,+CAA+C;YAC/C,EAAE;YACF,yEAAyE;YACzE,uEAAuE;YACvE,uEAAuE;YACvE,eAAe;YACf,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;YAED,OAAO;QACX,CAAC;QAED,yFAAyF;QACzF,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACD,8CAA8C;YAC9C,MAAM,WAAW,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC7G,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,+BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;YAC7D,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC;YAE/B,kBAAkB;YAClB,IAAI,eAAe,GAAa,EAAE,CAAC;YACnC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,CAAC;YAED,oDAAoD;YACpD,MAAM,QAAQ,CAAC,SAAS,CACpB,MAAM,EACN;gBACI,KAAK;gBACL,MAAM,EAAE,eAAe;gBACvB,WAAW,EAAE,YAAY;gBACzB,aAAa,EAAE,cAAc;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;aACrD,EACD,GAAG,CACN,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,wDAAwD;YACxD,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACvE,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7E,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,WAAmB,EAAE,KAAiB,EAAE,KAAc;IAC/E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACR,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACzB,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/metadata.d.ts

@@ -0,0 +1,4 @@
+import { RequestHandler } from 'express';
+import { OAuthMetadata, OAuthProtectedResourceMetadata } from '../../../shared/auth.js';
+export declare function metadataHandler(metadata: OAuthMetadata | OAuthProtectedResourceMetadata): RequestHandler;
+//# sourceMappingURL=metadata.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/metadata.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,8BAA8B,EAAE,MAAM,yBAAyB,CAAC;AAIxF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,aAAa,GAAG,8BAA8B,GAAG,cAAc,CAaxG"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/metadata.js

@@ -0,0 +1,21 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.metadataHandler = metadataHandler;
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
+function metadataHandler(metadata) {
+    // Nested router so we can configure middleware and restrict HTTP method
+    const router = express_1.default.Router();
+    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+    router.use((0, cors_1.default)());
+    router.use((0, allowedMethods_js_1.allowedMethods)(['GET', 'OPTIONS']));
+    router.get('/', (req, res) => {
+        res.status(200).json(metadata);
+    });
+    return router;
+}
+//# sourceMappingURL=metadata.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/metadata.ts"],"names":[],"mappings":";;;;;AAKA,0CAaC;AAlBD,sDAAkD;AAElD,gDAAwB;AACxB,uEAAiE;AAEjE,SAAgB,eAAe,CAAC,QAAwD;IACpF,wEAAwE;IACxE,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,IAAA,cAAI,GAAE,CAAC,CAAC;IAEnB,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAc,EAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.d.ts

@@ -0,0 +1,29 @@
+import { RequestHandler } from 'express';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { Options as RateLimitOptions } from 'express-rate-limit';
+export type ClientRegistrationHandlerOptions = {
+    /**
+     * A store used to save information about dynamically registered OAuth clients.
+     */
+    clientsStore: OAuthRegisteredClientsStore;
+    /**
+     * The number of seconds after which to expire issued client secrets, or 0 to prevent expiration of client secrets (not recommended).
+     *
+     * If not set, defaults to 30 days.
+     */
+    clientSecretExpirySeconds?: number;
+    /**
+     * Rate limiting configuration for the client registration endpoint.
+     * Set to false to disable rate limiting for this endpoint.
+     * Registration endpoints are particularly sensitive to abuse and should be rate limited.
+     */
+    rateLimit?: Partial<RateLimitOptions> | false;
+    /**
+     * Whether to generate a client ID before calling the client registration endpoint.
+     *
+     * If not set, defaults to true.
+     */
+    clientIdGeneration?: boolean;
+};
+export declare function clientRegistrationHandler({ clientsStore, clientSecretExpirySeconds, rateLimit: rateLimitConfig, clientIdGeneration }: ClientRegistrationHandlerOptions): RequestHandler;
+//# sourceMappingURL=register.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/register.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIlD,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAa,OAAO,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,MAAM,gCAAgC,GAAG;IAC3C;;OAEG;IACH,YAAY,EAAE,2BAA2B,CAAC;IAE1C;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;IAE9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAChC,CAAC;AAIF,wBAAgB,yBAAyB,CAAC,EACtC,YAAY,EACZ,yBAAgE,EAChE,SAAS,EAAE,eAAe,EAC1B,kBAAyB,EAC5B,EAAE,gCAAgC,GAAG,cAAc,CA0EnD"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientRegistrationHandler = clientRegistrationHandler;
+const express_1 = __importDefault(require("express"));
+const auth_js_1 = require("../../../shared/auth.js");
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const cors_1 = __importDefault(require("cors"));
+const express_rate_limit_1 = require("express-rate-limit");
+const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
+const errors_js_1 = require("../errors.js");
+const DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS = 30 * 24 * 60 * 60; // 30 days
+function clientRegistrationHandler({ clientsStore, clientSecretExpirySeconds = DEFAULT_CLIENT_SECRET_EXPIRY_SECONDS, rateLimit: rateLimitConfig, clientIdGeneration = true }) {
+    if (!clientsStore.registerClient) {
+        throw new Error('Client registration store does not support registering clients');
+    }
+    // Nested router so we can configure middleware and restrict HTTP method
+    const router = express_1.default.Router();
+    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+    router.use((0, cors_1.default)());
+    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
+    router.use(express_1.default.json());
+    // Apply rate limiting unless explicitly disabled - stricter limits for registration
+    if (rateLimitConfig !== false) {
+        router.use((0, express_rate_limit_1.rateLimit)({
+            windowMs: 60 * 60 * 1000, // 1 hour
+            max: 20, // 20 requests per hour - stricter as registration is sensitive
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for client registration requests').toResponseObject(),
+            ...rateLimitConfig
+        }));
+    }
+    router.post('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            const parseResult = auth_js_1.OAuthClientMetadataSchema.safeParse(req.body);
+            if (!parseResult.success) {
+                throw new errors_js_1.InvalidClientMetadataError(parseResult.error.message);
+            }
+            const clientMetadata = parseResult.data;
+            const isPublicClient = clientMetadata.token_endpoint_auth_method === 'none';
+            // Generate client credentials
+            const clientSecret = isPublicClient ? undefined : node_crypto_1.default.randomBytes(32).toString('hex');
+            const clientIdIssuedAt = Math.floor(Date.now() / 1000);
+            // Calculate client secret expiry time
+            const clientsDoExpire = clientSecretExpirySeconds > 0;
+            const secretExpiryTime = clientsDoExpire ? clientIdIssuedAt + clientSecretExpirySeconds : 0;
+            const clientSecretExpiresAt = isPublicClient ? undefined : secretExpiryTime;
+            let clientInfo = {
+                ...clientMetadata,
+                client_secret: clientSecret,
+                client_secret_expires_at: clientSecretExpiresAt
+            };
+            if (clientIdGeneration) {
+                clientInfo.client_id = node_crypto_1.default.randomUUID();
+                clientInfo.client_id_issued_at = clientIdIssuedAt;
+            }
+            clientInfo = await clientsStore.registerClient(clientInfo);
+            res.status(201).json(clientInfo);
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.OAuthError) {
+                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
+                res.status(status).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=register.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/register.ts"],"names":[],"mappings":";;;;;AAuCA,8DA+EC;AAtHD,sDAAkD;AAClD,qDAAgG;AAChG,8DAAiC;AACjC,gDAAwB;AAExB,2DAA4E;AAC5E,uEAAiE;AACjE,4CAAyG;AA8BzG,MAAM,oCAAoC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;AAE1E,SAAgB,yBAAyB,CAAC,EACtC,YAAY,EACZ,yBAAyB,GAAG,oCAAoC,EAChE,SAAS,EAAE,eAAe,EAC1B,kBAAkB,GAAG,IAAI,EACM;IAC/B,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,IAAA,cAAI,GAAE,CAAC,CAAC;IAEnB,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAc,EAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3B,oFAAoF;IACpF,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CACN,IAAA,8BAAS,EAAC;YACN,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,SAAS;YACnC,GAAG,EAAE,EAAE,EAAE,+DAA+D;YACxE,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,gCAAoB,CAAC,mEAAmE,CAAC,CAAC,gBAAgB,EAAE;YACzH,GAAG,eAAe;SACrB,CAAC,CACL,CAAC;IACN,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,mCAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,sCAA0B,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC;YACxC,MAAM,cAAc,GAAG,cAAc,CAAC,0BAA0B,KAAK,MAAM,CAAC;YAE5E,8BAA8B;YAC9B,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACzF,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAEvD,sCAAsC;YACtC,MAAM,eAAe,GAAG,yBAAyB,GAAG,CAAC,CAAC;YACtD,MAAM,gBAAgB,GAAG,eAAe,CAAC,CAAC,CAAC,gBAAgB,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM,qBAAqB,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAE5E,IAAI,UAAU,GAA2E;gBACrF,GAAG,cAAc;gBACjB,aAAa,EAAE,YAAY;gBAC3B,wBAAwB,EAAE,qBAAqB;aAClD,CAAC;YAEF,IAAI,kBAAkB,EAAE,CAAC;gBACrB,UAAU,CAAC,SAAS,GAAG,qBAAM,CAAC,UAAU,EAAE,CAAC;gBAC3C,UAAU,CAAC,mBAAmB,GAAG,gBAAgB,CAAC;YACtD,CAAC;YAED,UAAU,GAAG,MAAM,YAAY,CAAC,cAAe,CAAC,UAAU,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.d.ts

@@ -0,0 +1,13 @@
+import { OAuthServerProvider } from '../provider.js';
+import { RequestHandler } from 'express';
+import { Options as RateLimitOptions } from 'express-rate-limit';
+export type RevocationHandlerOptions = {
+    provider: OAuthServerProvider;
+    /**
+     * Rate limiting configuration for the token revocation endpoint.
+     * Set to false to disable rate limiting for this endpoint.
+     */
+    rateLimit?: Partial<RateLimitOptions> | false;
+};
+export declare function revocationHandler({ provider, rateLimit: rateLimitConfig }: RevocationHandlerOptions): RequestHandler;
+//# sourceMappingURL=revoke.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIlD,OAAO,EAAa,OAAO,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAI5E,MAAM,MAAM,wBAAwB,GAAG;IACnC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACjD,CAAC;AAEF,wBAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,wBAAwB,GAAG,cAAc,CA4DpH"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.revocationHandler = revocationHandler;
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const clientAuth_js_1 = require("../middleware/clientAuth.js");
+const auth_js_1 = require("../../../shared/auth.js");
+const express_rate_limit_1 = require("express-rate-limit");
+const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
+const errors_js_1 = require("../errors.js");
+function revocationHandler({ provider, rateLimit: rateLimitConfig }) {
+    if (!provider.revokeToken) {
+        throw new Error('Auth provider does not support revoking tokens');
+    }
+    // Nested router so we can configure middleware and restrict HTTP method
+    const router = express_1.default.Router();
+    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+    router.use((0, cors_1.default)());
+    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
+    router.use(express_1.default.urlencoded({ extended: false }));
+    // Apply rate limiting unless explicitly disabled
+    if (rateLimitConfig !== false) {
+        router.use((0, express_rate_limit_1.rateLimit)({
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            max: 50, // 50 requests per windowMs
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for token revocation requests').toResponseObject(),
+            ...rateLimitConfig
+        }));
+    }
+    // Authenticate and extract client details
+    router.use((0, clientAuth_js_1.authenticateClient)({ clientsStore: provider.clientsStore }));
+    router.post('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            const parseResult = auth_js_1.OAuthTokenRevocationRequestSchema.safeParse(req.body);
+            if (!parseResult.success) {
+                throw new errors_js_1.InvalidRequestError(parseResult.error.message);
+            }
+            const client = req.client;
+            if (!client) {
+                // This should never happen
+                throw new errors_js_1.ServerError('Internal Server Error');
+            }
+            await provider.revokeToken(client, parseResult.data);
+            res.status(200).json({});
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.OAuthError) {
+                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
+                res.status(status).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=revoke.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/revoke.ts"],"names":[],"mappings":";;;;;AAkBA,8CA4DC;AA7ED,sDAAkD;AAClD,gDAAwB;AACxB,+DAAiE;AACjE,qDAA4E;AAC5E,2DAA4E;AAC5E,uEAAiE;AACjE,4CAAkG;AAWlG,SAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAA4B;IAChG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,IAAA,cAAI,GAAE,CAAC,CAAC;IAEnB,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAc,EAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpD,iDAAiD;IACjD,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CACN,IAAA,8BAAS,EAAC;YACN,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;YACvC,GAAG,EAAE,EAAE,EAAE,2BAA2B;YACpC,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,gCAAoB,CAAC,gEAAgE,CAAC,CAAC,gBAAgB,EAAE;YACtH,GAAG,eAAe;SACrB,CAAC,CACL,CAAC;IACN,CAAC;IAED,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAkB,EAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAExE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,2CAAiC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC1E,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,+BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,2BAA2B;gBAC3B,MAAM,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,QAAQ,CAAC,WAAY,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.d.ts

@@ -0,0 +1,13 @@
+import { RequestHandler } from 'express';
+import { OAuthServerProvider } from '../provider.js';
+import { Options as RateLimitOptions } from 'express-rate-limit';
+export type TokenHandlerOptions = {
+    provider: OAuthServerProvider;
+    /**
+     * Rate limiting configuration for the token endpoint.
+     * Set to false to disable rate limiting for this endpoint.
+     */
+    rateLimit?: Partial<RateLimitOptions> | false;
+};
+export declare function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHandlerOptions): RequestHandler;
+//# sourceMappingURL=token.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/token.ts"],"names":[],"mappings":"AACA,OAAgB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAIrD,OAAO,EAAa,OAAO,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAW5E,MAAM,MAAM,mBAAmB,GAAG;IAC9B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC;CACjD,CAAC;AAmBF,wBAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,mBAAmB,GAAG,cAAc,CA+G1G"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.js

@@ -0,0 +1,136 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tokenHandler = tokenHandler;
+const z = __importStar(require("zod/v4"));
+const express_1 = __importDefault(require("express"));
+const cors_1 = __importDefault(require("cors"));
+const pkce_challenge_1 = require("pkce-challenge");
+const clientAuth_js_1 = require("../middleware/clientAuth.js");
+const express_rate_limit_1 = require("express-rate-limit");
+const allowedMethods_js_1 = require("../middleware/allowedMethods.js");
+const errors_js_1 = require("../errors.js");
+const TokenRequestSchema = z.object({
+    grant_type: z.string()
+});
+const AuthorizationCodeGrantSchema = z.object({
+    code: z.string(),
+    code_verifier: z.string(),
+    redirect_uri: z.string().optional(),
+    resource: z.string().url().optional()
+});
+const RefreshTokenGrantSchema = z.object({
+    refresh_token: z.string(),
+    scope: z.string().optional(),
+    resource: z.string().url().optional()
+});
+function tokenHandler({ provider, rateLimit: rateLimitConfig }) {
+    // Nested router so we can configure middleware and restrict HTTP method
+    const router = express_1.default.Router();
+    // Configure CORS to allow any origin, to make accessible to web-based MCP clients
+    router.use((0, cors_1.default)());
+    router.use((0, allowedMethods_js_1.allowedMethods)(['POST']));
+    router.use(express_1.default.urlencoded({ extended: false }));
+    // Apply rate limiting unless explicitly disabled
+    if (rateLimitConfig !== false) {
+        router.use((0, express_rate_limit_1.rateLimit)({
+            windowMs: 15 * 60 * 1000, // 15 minutes
+            max: 50, // 50 requests per windowMs
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: new errors_js_1.TooManyRequestsError('You have exceeded the rate limit for token requests').toResponseObject(),
+            ...rateLimitConfig
+        }));
+    }
+    // Authenticate and extract client details
+    router.use((0, clientAuth_js_1.authenticateClient)({ clientsStore: provider.clientsStore }));
+    router.post('/', async (req, res) => {
+        res.setHeader('Cache-Control', 'no-store');
+        try {
+            const parseResult = TokenRequestSchema.safeParse(req.body);
+            if (!parseResult.success) {
+                throw new errors_js_1.InvalidRequestError(parseResult.error.message);
+            }
+            const { grant_type } = parseResult.data;
+            const client = req.client;
+            if (!client) {
+                // This should never happen
+                throw new errors_js_1.ServerError('Internal Server Error');
+            }
+            switch (grant_type) {
+                case 'authorization_code': {
+                    const parseResult = AuthorizationCodeGrantSchema.safeParse(req.body);
+                    if (!parseResult.success) {
+                        throw new errors_js_1.InvalidRequestError(parseResult.error.message);
+                    }
+                    const { code, code_verifier, redirect_uri, resource } = parseResult.data;
+                    const skipLocalPkceValidation = provider.skipLocalPkceValidation;
+                    // Perform local PKCE validation unless explicitly skipped
+                    // (e.g. to validate code_verifier in upstream server)
+                    if (!skipLocalPkceValidation) {
+                        const codeChallenge = await provider.challengeForAuthorizationCode(client, code);
+                        if (!(await (0, pkce_challenge_1.verifyChallenge)(code_verifier, codeChallenge))) {
+                            throw new errors_js_1.InvalidGrantError('code_verifier does not match the challenge');
+                        }
+                    }
+                    // Passes the code_verifier to the provider if PKCE validation didn't occur locally
+                    const tokens = await provider.exchangeAuthorizationCode(client, code, skipLocalPkceValidation ? code_verifier : undefined, redirect_uri, resource ? new URL(resource) : undefined);
+                    res.status(200).json(tokens);
+                    break;
+                }
+                case 'refresh_token': {
+                    const parseResult = RefreshTokenGrantSchema.safeParse(req.body);
+                    if (!parseResult.success) {
+                        throw new errors_js_1.InvalidRequestError(parseResult.error.message);
+                    }
+                    const { refresh_token, scope, resource } = parseResult.data;
+                    const scopes = scope?.split(' ');
+                    const tokens = await provider.exchangeRefreshToken(client, refresh_token, scopes, resource ? new URL(resource) : undefined);
+                    res.status(200).json(tokens);
+                    break;
+                }
+                // Additional auth methods will not be added on the server side of the SDK.
+                case 'client_credentials':
+                default:
+                    throw new errors_js_1.UnsupportedGrantTypeError('The grant type is not supported by this authorization server.');
+            }
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.OAuthError) {
+                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
+                res.status(status).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+        }
+    });
+    return router;
+}
+//# sourceMappingURL=token.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/handlers/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../../../src/server/auth/handlers/token.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,oCA+GC;AA1JD,0CAA4B;AAC5B,sDAAkD;AAElD,gDAAwB;AACxB,mDAAiD;AACjD,+DAAiE;AACjE,2DAA4E;AAC5E,uEAAiE;AACjE,4CAOsB;AAWtB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,SAAgB,YAAY,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAuB;IACtF,wEAAwE;IACxE,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,kFAAkF;IAClF,MAAM,CAAC,GAAG,CAAC,IAAA,cAAI,GAAE,CAAC,CAAC;IAEnB,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAc,EAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,iBAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAEpD,iDAAiD;IACjD,IAAI,eAAe,KAAK,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,CACN,IAAA,8BAAS,EAAC;YACN,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,aAAa;YACvC,GAAG,EAAE,EAAE,EAAE,2BAA2B;YACpC,eAAe,EAAE,IAAI;YACrB,aAAa,EAAE,KAAK;YACpB,OAAO,EAAE,IAAI,gCAAoB,CAAC,qDAAqD,CAAC,CAAC,gBAAgB,EAAE;YAC3G,GAAG,eAAe;SACrB,CAAC,CACL,CAAC;IACN,CAAC;IAED,0CAA0C;IAC1C,MAAM,CAAC,GAAG,CAAC,IAAA,kCAAkB,EAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAExE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAE3C,IAAI,CAAC;YACD,MAAM,WAAW,GAAG,kBAAkB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,+BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;YAExC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,2BAA2B;gBAC3B,MAAM,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;YACnD,CAAC;YAED,QAAQ,UAAU,EAAE,CAAC;gBACjB,KAAK,oBAAoB,CAAC,CAAC,CAAC;oBACxB,MAAM,WAAW,GAAG,4BAA4B,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;wBACvB,MAAM,IAAI,+BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC7D,CAAC;oBAED,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;oBAEzE,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC;oBAEjE,0DAA0D;oBAC1D,sDAAsD;oBACtD,IAAI,CAAC,uBAAuB,EAAE,CAAC;wBAC3B,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,6BAA6B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;wBACjF,IAAI,CAAC,CAAC,MAAM,IAAA,gCAAe,EAAC,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;4BACzD,MAAM,IAAI,6BAAiB,CAAC,4CAA4C,CAAC,CAAC;wBAC9E,CAAC;oBACL,CAAC;oBAED,mFAAmF;oBACnF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,yBAAyB,CACnD,MAAM,EACN,IAAI,EACJ,uBAAuB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EACnD,YAAY,EACZ,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;oBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM;gBACV,CAAC;gBAED,KAAK,eAAe,CAAC,CAAC,CAAC;oBACnB,MAAM,WAAW,GAAG,uBAAuB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAChE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;wBACvB,MAAM,IAAI,+BAAmB,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC7D,CAAC;oBAED,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC;oBAE5D,MAAM,MAAM,GAAG,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;oBACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAC9C,MAAM,EACN,aAAa,EACb,MAAM,EACN,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAC3C,CAAC;oBACF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAC7B,MAAM;gBACV,CAAC;gBACD,2EAA2E;gBAC3E,KAAK,oBAAoB,CAAC;gBAC1B;oBACI,MAAM,IAAI,qCAAyB,CAAC,+DAA+D,CAAC,CAAC;YAC7G,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAClB,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.d.ts

@@ -0,0 +1,9 @@
+import { RequestHandler } from 'express';
+/**
+ * Middleware to handle unsupported HTTP methods with a 405 Method Not Allowed response.
+ *
+ * @param allowedMethods Array of allowed HTTP methods for this endpoint (e.g., ['GET', 'POST'])
+ * @returns Express middleware that returns a 405 error if method not in allowed list
+ */
+export declare function allowedMethods(allowedMethods: string[]): RequestHandler;
+//# sourceMappingURL=allowedMethods.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedMethods.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/allowedMethods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAGzC;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,cAAc,CAUvE"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowedMethods = allowedMethods;
+const errors_js_1 = require("../errors.js");
+/**
+ * Middleware to handle unsupported HTTP methods with a 405 Method Not Allowed response.
+ *
+ * @param allowedMethods Array of allowed HTTP methods for this endpoint (e.g., ['GET', 'POST'])
+ * @returns Express middleware that returns a 405 error if method not in allowed list
+ */
+function allowedMethods(allowedMethods) {
+    return (req, res, next) => {
+        if (allowedMethods.includes(req.method)) {
+            next();
+            return;
+        }
+        const error = new errors_js_1.MethodNotAllowedError(`The method ${req.method} is not allowed for this endpoint`);
+        res.status(405).set('Allow', allowedMethods.join(', ')).json(error.toResponseObject());
+    };
+}
+//# sourceMappingURL=allowedMethods.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/allowedMethods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowedMethods.js","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/allowedMethods.ts"],"names":[],"mappings":";;AASA,wCAUC;AAlBD,4CAAqD;AAErD;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,cAAwB;IACnD,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACtB,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC;YACP,OAAO;QACX,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,iCAAqB,CAAC,cAAc,GAAG,CAAC,MAAM,mCAAmC,CAAC,CAAC;QACrG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACN,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.d.ts

@@ -0,0 +1,35 @@
+import { RequestHandler } from 'express';
+import { OAuthTokenVerifier } from '../provider.js';
+import { AuthInfo } from '../types.js';
+export type BearerAuthMiddlewareOptions = {
+    /**
+     * A provider used to verify tokens.
+     */
+    verifier: OAuthTokenVerifier;
+    /**
+     * Optional scopes that the token must have.
+     */
+    requiredScopes?: string[];
+    /**
+     * Optional resource metadata URL to include in WWW-Authenticate header.
+     */
+    resourceMetadataUrl?: string;
+};
+declare module 'express-serve-static-core' {
+    interface Request {
+        /**
+         * Information about the validated access token, if the `requireBearerAuth` middleware was used.
+         */
+        auth?: AuthInfo;
+    }
+}
+/**
+ * Middleware that requires a valid Bearer token in the Authorization header.
+ *
+ * This will validate the token with the auth provider and add the resulting auth info to the request object.
+ *
+ * If resourceMetadataUrl is provided, it will be included in the WWW-Authenticate header
+ * for 401 responses as per the OAuth 2.0 Protected Resource Metadata spec.
+ */
+export declare function requireBearerAuth({ verifier, requiredScopes, resourceMetadataUrl }: BearerAuthMiddlewareOptions): RequestHandler;
+//# sourceMappingURL=bearerAuth.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerAuth.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/bearerAuth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,MAAM,MAAM,2BAA2B,GAAG;IACtC;;OAEG;IACH,QAAQ,EAAE,kBAAkB,CAAC;IAE7B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;OAEG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,OAAO,QAAQ,2BAA2B,CAAC;IACvC,UAAU,OAAO;QACb;;WAEG;QACH,IAAI,CAAC,EAAE,QAAQ,CAAC;KACnB;CACJ;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAmB,EAAE,mBAAmB,EAAE,EAAE,2BAA2B,GAAG,cAAc,CA8DrI"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireBearerAuth = requireBearerAuth;
+const errors_js_1 = require("../errors.js");
+/**
+ * Middleware that requires a valid Bearer token in the Authorization header.
+ *
+ * This will validate the token with the auth provider and add the resulting auth info to the request object.
+ *
+ * If resourceMetadataUrl is provided, it will be included in the WWW-Authenticate header
+ * for 401 responses as per the OAuth 2.0 Protected Resource Metadata spec.
+ */
+function requireBearerAuth({ verifier, requiredScopes = [], resourceMetadataUrl }) {
+    return async (req, res, next) => {
+        try {
+            const authHeader = req.headers.authorization;
+            if (!authHeader) {
+                throw new errors_js_1.InvalidTokenError('Missing Authorization header');
+            }
+            const [type, token] = authHeader.split(' ');
+            if (type.toLowerCase() !== 'bearer' || !token) {
+                throw new errors_js_1.InvalidTokenError("Invalid Authorization header format, expected 'Bearer TOKEN'");
+            }
+            const authInfo = await verifier.verifyAccessToken(token);
+            // Check if token has the required scopes (if any)
+            if (requiredScopes.length > 0) {
+                const hasAllScopes = requiredScopes.every(scope => authInfo.scopes.includes(scope));
+                if (!hasAllScopes) {
+                    throw new errors_js_1.InsufficientScopeError('Insufficient scope');
+                }
+            }
+            // Check if the token is set to expire or if it is expired
+            if (typeof authInfo.expiresAt !== 'number' || isNaN(authInfo.expiresAt)) {
+                throw new errors_js_1.InvalidTokenError('Token has no expiration time');
+            }
+            else if (authInfo.expiresAt < Date.now() / 1000) {
+                throw new errors_js_1.InvalidTokenError('Token has expired');
+            }
+            req.auth = authInfo;
+            next();
+        }
+        catch (error) {
+            // Build WWW-Authenticate header parts
+            const buildWwwAuthHeader = (errorCode, message) => {
+                let header = `Bearer error="${errorCode}", error_description="${message}"`;
+                if (requiredScopes.length > 0) {
+                    header += `, scope="${requiredScopes.join(' ')}"`;
+                }
+                if (resourceMetadataUrl) {
+                    header += `, resource_metadata="${resourceMetadataUrl}"`;
+                }
+                return header;
+            };
+            if (error instanceof errors_js_1.InvalidTokenError) {
+                res.set('WWW-Authenticate', buildWwwAuthHeader(error.errorCode, error.message));
+                res.status(401).json(error.toResponseObject());
+            }
+            else if (error instanceof errors_js_1.InsufficientScopeError) {
+                res.set('WWW-Authenticate', buildWwwAuthHeader(error.errorCode, error.message));
+                res.status(403).json(error.toResponseObject());
+            }
+            else if (error instanceof errors_js_1.ServerError) {
+                res.status(500).json(error.toResponseObject());
+            }
+            else if (error instanceof errors_js_1.OAuthError) {
+                res.status(400).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+        }
+    };
+}
+//# sourceMappingURL=bearerAuth.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/bearerAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearerAuth.js","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/bearerAuth.ts"],"names":[],"mappings":";;AAuCA,8CA8DC;AApGD,4CAAkG;AA8BlG;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,EAAE,QAAQ,EAAE,cAAc,GAAG,EAAE,EAAE,mBAAmB,EAA+B;IACjH,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBACd,MAAM,IAAI,6BAAiB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC5C,MAAM,IAAI,6BAAiB,CAAC,8DAA8D,CAAC,CAAC;YAChG,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAEzD,kDAAkD;YAClD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;gBAEpF,IAAI,CAAC,YAAY,EAAE,CAAC;oBAChB,MAAM,IAAI,kCAAsB,CAAC,oBAAoB,CAAC,CAAC;gBAC3D,CAAC;YACL,CAAC;YAED,0DAA0D;YAC1D,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,6BAAiB,CAAC,8BAA8B,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAChD,MAAM,IAAI,6BAAiB,CAAC,mBAAmB,CAAC,CAAC;YACrD,CAAC;YAED,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YACpB,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,sCAAsC;YACtC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,OAAe,EAAU,EAAE;gBACtE,IAAI,MAAM,GAAG,iBAAiB,SAAS,yBAAyB,OAAO,GAAG,CAAC;gBAC3E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,YAAY,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBACtD,CAAC;gBACD,IAAI,mBAAmB,EAAE,CAAC;oBACtB,MAAM,IAAI,wBAAwB,mBAAmB,GAAG,CAAC;gBAC7D,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC,CAAC;YAEF,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,KAAK,YAAY,kCAAsB,EAAE,CAAC;gBACjD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAChF,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,KAAK,YAAY,uBAAW,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;IACL,CAAC,CAAC;AACN,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.d.ts

@@ -0,0 +1,19 @@
+import { RequestHandler } from 'express';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull } from '../../../shared/auth.js';
+export type ClientAuthenticationMiddlewareOptions = {
+    /**
+     * A store used to read information about registered OAuth clients.
+     */
+    clientsStore: OAuthRegisteredClientsStore;
+};
+declare module 'express-serve-static-core' {
+    interface Request {
+        /**
+         * The authenticated client for this request, if the `authenticateClient` middleware was used.
+         */
+        client?: OAuthClientInformationFull;
+    }
+}
+export declare function authenticateClient({ clientsStore }: ClientAuthenticationMiddlewareOptions): RequestHandler;
+//# sourceMappingURL=clientAuth.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAuth.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/clientAuth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,MAAM,MAAM,qCAAqC,GAAG;IAChD;;OAEG;IACH,YAAY,EAAE,2BAA2B,CAAC;CAC7C,CAAC;AAOF,OAAO,QAAQ,2BAA2B,CAAC;IACvC,UAAU,OAAO;QACb;;WAEG;QACH,MAAM,CAAC,EAAE,0BAA0B,CAAC;KACvC;CACJ;AAED,wBAAgB,kBAAkB,CAAC,EAAE,YAAY,EAAE,EAAE,qCAAqC,GAAG,cAAc,CAoC1G"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.js

@@ -0,0 +1,71 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateClient = authenticateClient;
+const z = __importStar(require("zod/v4"));
+const errors_js_1 = require("../errors.js");
+const ClientAuthenticatedRequestSchema = z.object({
+    client_id: z.string(),
+    client_secret: z.string().optional()
+});
+function authenticateClient({ clientsStore }) {
+    return async (req, res, next) => {
+        try {
+            const result = ClientAuthenticatedRequestSchema.safeParse(req.body);
+            if (!result.success) {
+                throw new errors_js_1.InvalidRequestError(String(result.error));
+            }
+            const { client_id, client_secret } = result.data;
+            const client = await clientsStore.getClient(client_id);
+            if (!client) {
+                throw new errors_js_1.InvalidClientError('Invalid client_id');
+            }
+            if (client.client_secret) {
+                if (!client_secret) {
+                    throw new errors_js_1.InvalidClientError('Client secret is required');
+                }
+                if (client.client_secret !== client_secret) {
+                    throw new errors_js_1.InvalidClientError('Invalid client_secret');
+                }
+                if (client.client_secret_expires_at && client.client_secret_expires_at < Math.floor(Date.now() / 1000)) {
+                    throw new errors_js_1.InvalidClientError('Client secret has expired');
+                }
+            }
+            req.client = client;
+            next();
+        }
+        catch (error) {
+            if (error instanceof errors_js_1.OAuthError) {
+                const status = error instanceof errors_js_1.ServerError ? 500 : 400;
+                res.status(status).json(error.toResponseObject());
+            }
+            else {
+                const serverError = new errors_js_1.ServerError('Internal Server Error');
+                res.status(500).json(serverError.toResponseObject());
+            }
+        }
+    };
+}
+//# sourceMappingURL=clientAuth.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/middleware/clientAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAuth.js","sourceRoot":"","sources":["../../../../../src/server/auth/middleware/clientAuth.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,gDAoCC;AA/DD,0CAA4B;AAI5B,4CAAgG;AAShG,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAWH,SAAgB,kBAAkB,CAAC,EAAE,YAAY,EAAyC;IACtF,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC5B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,IAAI,+BAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;YACjD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,MAAM,IAAI,8BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACtD,CAAC;YACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACvB,IAAI,CAAC,aAAa,EAAE,CAAC;oBACjB,MAAM,IAAI,8BAAkB,CAAC,2BAA2B,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,MAAM,CAAC,aAAa,KAAK,aAAa,EAAE,CAAC;oBACzC,MAAM,IAAI,8BAAkB,CAAC,uBAAuB,CAAC,CAAC;gBAC1D,CAAC;gBACD,IAAI,MAAM,CAAC,wBAAwB,IAAI,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;oBACrG,MAAM,IAAI,8BAAkB,CAAC,2BAA2B,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC;YAED,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,sBAAU,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,KAAK,YAAY,uBAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACJ,MAAM,WAAW,GAAG,IAAI,uBAAW,CAAC,uBAAuB,CAAC,CAAC;gBAC7D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;YACzD,CAAC;QACL,CAAC;IACL,CAAC,CAAC;AACN,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.d.ts

@@ -0,0 +1,68 @@
+import { Response } from 'express';
+import { OAuthRegisteredClientsStore } from './clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../shared/auth.js';
+import { AuthInfo } from './types.js';
+export type AuthorizationParams = {
+    state?: string;
+    scopes?: string[];
+    codeChallenge: string;
+    redirectUri: string;
+    resource?: URL;
+};
+/**
+ * Implements an end-to-end OAuth server.
+ */
+export interface OAuthServerProvider {
+    /**
+     * A store used to read information about registered OAuth clients.
+     */
+    get clientsStore(): OAuthRegisteredClientsStore;
+    /**
+     * Begins the authorization flow, which can either be implemented by this server itself or via redirection to a separate authorization server.
+     *
+     * This server must eventually issue a redirect with an authorization response or an error response to the given redirect URI. Per OAuth 2.1:
+     * - In the successful case, the redirect MUST include the `code` and `state` (if present) query parameters.
+     * - In the error case, the redirect MUST include the `error` query parameter, and MAY include an optional `error_description` query parameter.
+     */
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    /**
+     * Returns the `codeChallenge` that was used when the indicated authorization began.
+     */
+    challengeForAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string): Promise<string>;
+    /**
+     * Exchanges an authorization code for an access token.
+     */
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Exchanges a refresh token for an access token.
+     */
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    /**
+     * Verifies an access token and returns information about it.
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    /**
+     * Revokes an access or refresh token. If unimplemented, token revocation is not supported (not recommended).
+     *
+     * If the given token is invalid or already revoked, this method should do nothing.
+     */
+    revokeToken?(client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest): Promise<void>;
+    /**
+     * Whether to skip local PKCE validation.
+     *
+     * If true, the server will not perform PKCE validation locally and will pass the code_verifier to the upstream server.
+     *
+     * NOTE: This should only be true if the upstream server is performing the actual PKCE validation.
+     */
+    skipLocalPkceValidation?: boolean;
+}
+/**
+ * Slim implementation useful for token verification
+ */
+export interface OAuthTokenVerifier {
+    /**
+     * Verifies an access token and returns information about it.
+     */
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=provider.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,MAAM,mBAAmB,GAAG;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,GAAG,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAChC;;OAEG;IACH,IAAI,YAAY,IAAI,2BAA2B,CAAC;IAEhD;;;;;;OAMG;IACH,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzG;;OAEG;IACH,6BAA6B,CAAC,MAAM,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9G;;OAEG;IACH,yBAAyB,CACrB,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,WAAW,CAAC,CAAC;IAExB;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE,0BAA0B,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAExI;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpD;;;;OAIG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtG;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACvD"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=provider.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../../../src/server/auth/provider.ts"],"names":[],"mappings":""}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/providers/proxyProvider.d.ts

@@ -0,0 +1,49 @@
+import { Response } from 'express';
+import { OAuthRegisteredClientsStore } from '../clients.js';
+import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../../shared/auth.js';
+import { AuthInfo } from '../types.js';
+import { AuthorizationParams, OAuthServerProvider } from '../provider.js';
+import { FetchLike } from '../../../shared/transport.js';
+export type ProxyEndpoints = {
+    authorizationUrl: string;
+    tokenUrl: string;
+    revocationUrl?: string;
+    registrationUrl?: string;
+};
+export type ProxyOptions = {
+    /**
+     * Individual endpoint URLs for proxying specific OAuth operations
+     */
+    endpoints: ProxyEndpoints;
+    /**
+     * Function to verify access tokens and return auth info
+     */
+    verifyAccessToken: (token: string) => Promise<AuthInfo>;
+    /**
+     * Function to fetch client information from the upstream server
+     */
+    getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
+    /**
+     * Custom fetch implementation used for all network requests.
+     */
+    fetch?: FetchLike;
+};
+/**
+ * Implements an OAuth server that proxies requests to another OAuth server.
+ */
+export declare class ProxyOAuthServerProvider implements OAuthServerProvider {
+    protected readonly _endpoints: ProxyEndpoints;
+    protected readonly _verifyAccessToken: (token: string) => Promise<AuthInfo>;
+    protected readonly _getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
+    protected readonly _fetch?: FetchLike;
+    skipLocalPkceValidation: boolean;
+    revokeToken?: (client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest) => Promise<void>;
+    constructor(options: ProxyOptions);
+    get clientsStore(): OAuthRegisteredClientsStore;
+    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
+    challengeForAuthorizationCode(_client: OAuthClientInformationFull, _authorizationCode: string): Promise<string>;
+    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
+    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+}
+//# sourceMappingURL=proxyProvider.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/providers/proxyProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyProvider.d.ts","sourceRoot":"","sources":["../../../../../src/server/auth/providers/proxyProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,2BAA2B,EAAE,MAAM,eAAe,CAAC;AAC5D,OAAO,EACH,0BAA0B,EAE1B,2BAA2B,EAC3B,WAAW,EAEd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAEzD,MAAM,MAAM,cAAc,GAAG;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB;;OAEG;IACH,SAAS,EAAE,cAAc,CAAC;IAE1B;;OAEG;IACH,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExD;;OAEG;IACH,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IAEjF;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC;CACrB,CAAC;AAEF;;GAEG;AACH,qBAAa,wBAAyB,YAAW,mBAAmB;IAChE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,cAAc,CAAC;IAC9C,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5E,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IACrG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAEtC,uBAAuB,UAAQ;IAE/B,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,2BAA2B,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;gBAE9F,OAAO,EAAE,YAAY;IAuCjC,IAAI,YAAY,IAAI,2BAA2B,CAwB9C;IAEK,SAAS,CAAC,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,mBAAmB,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBxG,6BAA6B,CAAC,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAM/G,yBAAyB,CAC3B,MAAM,EAAE,0BAA0B,EAClC,iBAAiB,EAAE,MAAM,EACzB,YAAY,CAAC,EAAE,MAAM,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,WAAW,CAAC;IAwCjB,oBAAoB,CACtB,MAAM,EAAE,0BAA0B,EAClC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,MAAM,EAAE,EACjB,QAAQ,CAAC,EAAE,GAAG,GACf,OAAO,CAAC,WAAW,CAAC;IAoCjB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;CAG5D"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/providers/proxyProvider.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProxyOAuthServerProvider = void 0;
+const auth_js_1 = require("../../../shared/auth.js");
+const errors_js_1 = require("../errors.js");
+/**
+ * Implements an OAuth server that proxies requests to another OAuth server.
+ */
+class ProxyOAuthServerProvider {
+    constructor(options) {
+        this.skipLocalPkceValidation = true;
+        this._endpoints = options.endpoints;
+        this._verifyAccessToken = options.verifyAccessToken;
+        this._getClient = options.getClient;
+        this._fetch = options.fetch;
+        if (options.endpoints?.revocationUrl) {
+            this.revokeToken = async (client, request) => {
+                const revocationUrl = this._endpoints.revocationUrl;
+                if (!revocationUrl) {
+                    throw new Error('No revocation endpoint configured');
+                }
+                const params = new URLSearchParams();
+                params.set('token', request.token);
+                params.set('client_id', client.client_id);
+                if (client.client_secret) {
+                    params.set('client_secret', client.client_secret);
+                }
+                if (request.token_type_hint) {
+                    params.set('token_type_hint', request.token_type_hint);
+                }
+                const response = await (this._fetch ?? fetch)(revocationUrl, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded'
+                    },
+                    body: params.toString()
+                });
+                await response.body?.cancel();
+                if (!response.ok) {
+                    throw new errors_js_1.ServerError(`Token revocation failed: ${response.status}`);
+                }
+            };
+        }
+    }
+    get clientsStore() {
+        const registrationUrl = this._endpoints.registrationUrl;
+        return {
+            getClient: this._getClient,
+            ...(registrationUrl && {
+                registerClient: async (client) => {
+                    const response = await (this._fetch ?? fetch)(registrationUrl, {
+                        method: 'POST',
+                        headers: {
+                            'Content-Type': 'application/json'
+                        },
+                        body: JSON.stringify(client)
+                    });
+                    if (!response.ok) {
+                        await response.body?.cancel();
+                        throw new errors_js_1.ServerError(`Client registration failed: ${response.status}`);
+                    }
+                    const data = await response.json();
+                    return auth_js_1.OAuthClientInformationFullSchema.parse(data);
+                }
+            })
+        };
+    }
+    async authorize(client, params, res) {
+        // Start with required OAuth parameters
+        const targetUrl = new URL(this._endpoints.authorizationUrl);
+        const searchParams = new URLSearchParams({
+            client_id: client.client_id,
+            response_type: 'code',
+            redirect_uri: params.redirectUri,
+            code_challenge: params.codeChallenge,
+            code_challenge_method: 'S256'
+        });
+        // Add optional standard OAuth parameters
+        if (params.state)
+            searchParams.set('state', params.state);
+        if (params.scopes?.length)
+            searchParams.set('scope', params.scopes.join(' '));
+        if (params.resource)
+            searchParams.set('resource', params.resource.href);
+        targetUrl.search = searchParams.toString();
+        res.redirect(targetUrl.toString());
+    }
+    async challengeForAuthorizationCode(_client, _authorizationCode) {
+        // In a proxy setup, we don't store the code challenge ourselves
+        // Instead, we proxy the token request and let the upstream server validate it
+        return '';
+    }
+    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
+        const params = new URLSearchParams({
+            grant_type: 'authorization_code',
+            client_id: client.client_id,
+            code: authorizationCode
+        });
+        if (client.client_secret) {
+            params.append('client_secret', client.client_secret);
+        }
+        if (codeVerifier) {
+            params.append('code_verifier', codeVerifier);
+        }
+        if (redirectUri) {
+            params.append('redirect_uri', redirectUri);
+        }
+        if (resource) {
+            params.append('resource', resource.href);
+        }
+        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: params.toString()
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new errors_js_1.ServerError(`Token exchange failed: ${response.status}`);
+        }
+        const data = await response.json();
+        return auth_js_1.OAuthTokensSchema.parse(data);
+    }
+    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
+        const params = new URLSearchParams({
+            grant_type: 'refresh_token',
+            client_id: client.client_id,
+            refresh_token: refreshToken
+        });
+        if (client.client_secret) {
+            params.set('client_secret', client.client_secret);
+        }
+        if (scopes?.length) {
+            params.set('scope', scopes.join(' '));
+        }
+        if (resource) {
+            params.set('resource', resource.href);
+        }
+        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded'
+            },
+            body: params.toString()
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new errors_js_1.ServerError(`Token refresh failed: ${response.status}`);
+        }
+        const data = await response.json();
+        return auth_js_1.OAuthTokensSchema.parse(data);
+    }
+    async verifyAccessToken(token) {
+        return this._verifyAccessToken(token);
+    }
+}
+exports.ProxyOAuthServerProvider = ProxyOAuthServerProvider;
+//# sourceMappingURL=proxyProvider.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.d.ts

@@ -0,0 +1,101 @@
+import express, { RequestHandler } from 'express';
+import { ClientRegistrationHandlerOptions } from './handlers/register.js';
+import { TokenHandlerOptions } from './handlers/token.js';
+import { AuthorizationHandlerOptions } from './handlers/authorize.js';
+import { RevocationHandlerOptions } from './handlers/revoke.js';
+import { OAuthServerProvider } from './provider.js';
+import { OAuthMetadata } from '../../shared/auth.js';
+export type AuthRouterOptions = {
+    /**
+     * A provider implementing the actual authorization logic for this router.
+     */
+    provider: OAuthServerProvider;
+    /**
+     * The authorization server's issuer identifier, which is a URL that uses the "https" scheme and has no query or fragment components.
+     */
+    issuerUrl: URL;
+    /**
+     * The base URL of the authorization server to use for the metadata endpoints.
+     *
+     * If not provided, the issuer URL will be used as the base URL.
+     */
+    baseUrl?: URL;
+    /**
+     * An optional URL of a page containing human-readable information that developers might want or need to know when using the authorization server.
+     */
+    serviceDocumentationUrl?: URL;
+    /**
+     * An optional list of scopes supported by this authorization server
+     */
+    scopesSupported?: string[];
+    /**
+     * The resource name to be displayed in protected resource metadata
+     */
+    resourceName?: string;
+    /**
+     * The URL of the protected resource (RS) whose metadata we advertise.
+     * If not provided, falls back to `baseUrl` and then to `issuerUrl` (AS=RS).
+     */
+    resourceServerUrl?: URL;
+    authorizationOptions?: Omit<AuthorizationHandlerOptions, 'provider'>;
+    clientRegistrationOptions?: Omit<ClientRegistrationHandlerOptions, 'clientsStore'>;
+    revocationOptions?: Omit<RevocationHandlerOptions, 'provider'>;
+    tokenOptions?: Omit<TokenHandlerOptions, 'provider'>;
+};
+export declare const createOAuthMetadata: (options: {
+    provider: OAuthServerProvider;
+    issuerUrl: URL;
+    baseUrl?: URL;
+    serviceDocumentationUrl?: URL;
+    scopesSupported?: string[];
+}) => OAuthMetadata;
+/**
+ * Installs standard MCP authorization server endpoints, including dynamic client registration and token revocation (if supported).
+ * Also advertises standard authorization server metadata, for easier discovery of supported configurations by clients.
+ * Note: if your MCP server is only a resource server and not an authorization server, use mcpAuthMetadataRouter instead.
+ *
+ * By default, rate limiting is applied to all endpoints to prevent abuse.
+ *
+ * This router MUST be installed at the application root, like so:
+ *
+ *  const app = express();
+ *  app.use(mcpAuthRouter(...));
+ */
+export declare function mcpAuthRouter(options: AuthRouterOptions): RequestHandler;
+export type AuthMetadataOptions = {
+    /**
+     * OAuth Metadata as would be returned from the authorization server
+     * this MCP server relies on
+     */
+    oauthMetadata: OAuthMetadata;
+    /**
+     * The url of the MCP server, for use in protected resource metadata
+     */
+    resourceServerUrl: URL;
+    /**
+     * The url for documentation for the MCP server
+     */
+    serviceDocumentationUrl?: URL;
+    /**
+     * An optional list of scopes supported by this MCP server
+     */
+    scopesSupported?: string[];
+    /**
+     * An optional resource name to display in resource metadata
+     */
+    resourceName?: string;
+};
+export declare function mcpAuthMetadataRouter(options: AuthMetadataOptions): express.Router;
+/**
+ * Helper function to construct the OAuth 2.0 Protected Resource Metadata URL
+ * from a given server URL. This replaces the path with the standard metadata endpoint.
+ *
+ * @param serverUrl - The base URL of the protected resource server
+ * @returns The URL for the OAuth protected resource metadata endpoint
+ *
+ * @example
+ * getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
+ * // Returns: 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
+ */
+export declare function getOAuthProtectedResourceMetadataUrl(serverUrl: URL): string;
+//# sourceMappingURL=router.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/router.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAA6B,gCAAgC,EAAE,MAAM,wBAAwB,CAAC;AACrG,OAAO,EAAgB,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAwB,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,EAAqB,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,aAAa,EAAkC,MAAM,sBAAsB,CAAC;AAUrF,MAAM,MAAM,iBAAiB,GAAG;IAC5B;;OAEG;IACH,QAAQ,EAAE,mBAAmB,CAAC;IAE9B;;OAEG;IACH,SAAS,EAAE,GAAG,CAAC;IAEf;;;;OAIG;IACH,OAAO,CAAC,EAAE,GAAG,CAAC;IAEd;;OAEG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAAC;IAE9B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,GAAG,CAAC;IAGxB,oBAAoB,CAAC,EAAE,IAAI,CAAC,2BAA2B,EAAE,UAAU,CAAC,CAAC;IACrE,yBAAyB,CAAC,EAAE,IAAI,CAAC,gCAAgC,EAAE,cAAc,CAAC,CAAC;IACnF,iBAAiB,CAAC,EAAE,IAAI,CAAC,wBAAwB,EAAE,UAAU,CAAC,CAAC;IAC/D,YAAY,CAAC,EAAE,IAAI,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;CACxD,CAAC;AAeF,eAAO,MAAM,mBAAmB,YAAa;IACzC,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,SAAS,EAAE,GAAG,CAAC;IACf,OAAO,CAAC,EAAE,GAAG,CAAC;IACd,uBAAuB,CAAC,EAAE,GAAG,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,KAAG,aAgCH,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,cAAc,CAyCxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAC9B;;;OAGG;IACH,aAAa,EAAE,aAAa,CAAC;IAE7B;;OAEG;IACH,iBAAiB,EAAE,GAAG,CAAC;IAEvB;;OAEG;IACH,uBAAuB,CAAC,EAAE,GAAG,CAAC;IAE9B;;OAEG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAuBlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oCAAoC,CAAC,SAAS,EAAE,GAAG,GAAG,MAAM,CAI3E"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOAuthMetadata = void 0;
+exports.mcpAuthRouter = mcpAuthRouter;
+exports.mcpAuthMetadataRouter = mcpAuthMetadataRouter;
+exports.getOAuthProtectedResourceMetadataUrl = getOAuthProtectedResourceMetadataUrl;
+const express_1 = __importDefault(require("express"));
+const register_js_1 = require("./handlers/register.js");
+const token_js_1 = require("./handlers/token.js");
+const authorize_js_1 = require("./handlers/authorize.js");
+const revoke_js_1 = require("./handlers/revoke.js");
+const metadata_js_1 = require("./handlers/metadata.js");
+// Check for dev mode flag that allows HTTP issuer URLs (for development/testing only)
+const allowInsecureIssuerUrl = process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';
+if (allowInsecureIssuerUrl) {
+    // eslint-disable-next-line no-console
+    console.warn('MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL is enabled - HTTP issuer URLs are allowed. Do not use in production.');
+}
+const checkIssuerUrl = (issuer) => {
+    // Technically RFC 8414 does not permit a localhost HTTPS exemption, but this will be necessary for ease of testing
+    if (issuer.protocol !== 'https:' && issuer.hostname !== 'localhost' && issuer.hostname !== '127.0.0.1' && !allowInsecureIssuerUrl) {
+        throw new Error('Issuer URL must be HTTPS');
+    }
+    if (issuer.hash) {
+        throw new Error(`Issuer URL must not have a fragment: ${issuer}`);
+    }
+    if (issuer.search) {
+        throw new Error(`Issuer URL must not have a query string: ${issuer}`);
+    }
+};
+const createOAuthMetadata = (options) => {
+    const issuer = options.issuerUrl;
+    const baseUrl = options.baseUrl;
+    checkIssuerUrl(issuer);
+    const authorization_endpoint = '/authorize';
+    const token_endpoint = '/token';
+    const registration_endpoint = options.provider.clientsStore.registerClient ? '/register' : undefined;
+    const revocation_endpoint = options.provider.revokeToken ? '/revoke' : undefined;
+    const metadata = {
+        issuer: issuer.href,
+        service_documentation: options.serviceDocumentationUrl?.href,
+        authorization_endpoint: new URL(authorization_endpoint, baseUrl || issuer).href,
+        response_types_supported: ['code'],
+        code_challenge_methods_supported: ['S256'],
+        token_endpoint: new URL(token_endpoint, baseUrl || issuer).href,
+        token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
+        grant_types_supported: ['authorization_code', 'refresh_token'],
+        scopes_supported: options.scopesSupported,
+        revocation_endpoint: revocation_endpoint ? new URL(revocation_endpoint, baseUrl || issuer).href : undefined,
+        revocation_endpoint_auth_methods_supported: revocation_endpoint ? ['client_secret_post'] : undefined,
+        registration_endpoint: registration_endpoint ? new URL(registration_endpoint, baseUrl || issuer).href : undefined
+    };
+    return metadata;
+};
+exports.createOAuthMetadata = createOAuthMetadata;
+/**
+ * Installs standard MCP authorization server endpoints, including dynamic client registration and token revocation (if supported).
+ * Also advertises standard authorization server metadata, for easier discovery of supported configurations by clients.
+ * Note: if your MCP server is only a resource server and not an authorization server, use mcpAuthMetadataRouter instead.
+ *
+ * By default, rate limiting is applied to all endpoints to prevent abuse.
+ *
+ * This router MUST be installed at the application root, like so:
+ *
+ *  const app = express();
+ *  app.use(mcpAuthRouter(...));
+ */
+function mcpAuthRouter(options) {
+    const oauthMetadata = (0, exports.createOAuthMetadata)(options);
+    const router = express_1.default.Router();
+    router.use(new URL(oauthMetadata.authorization_endpoint).pathname, (0, authorize_js_1.authorizationHandler)({ provider: options.provider, ...options.authorizationOptions }));
+    router.use(new URL(oauthMetadata.token_endpoint).pathname, (0, token_js_1.tokenHandler)({ provider: options.provider, ...options.tokenOptions }));
+    router.use(mcpAuthMetadataRouter({
+        oauthMetadata,
+        // Prefer explicit RS; otherwise fall back to AS baseUrl, then to issuer (back-compat)
+        resourceServerUrl: options.resourceServerUrl ?? options.baseUrl ?? new URL(oauthMetadata.issuer),
+        serviceDocumentationUrl: options.serviceDocumentationUrl,
+        scopesSupported: options.scopesSupported,
+        resourceName: options.resourceName
+    }));
+    if (oauthMetadata.registration_endpoint) {
+        router.use(new URL(oauthMetadata.registration_endpoint).pathname, (0, register_js_1.clientRegistrationHandler)({
+            clientsStore: options.provider.clientsStore,
+            ...options.clientRegistrationOptions
+        }));
+    }
+    if (oauthMetadata.revocation_endpoint) {
+        router.use(new URL(oauthMetadata.revocation_endpoint).pathname, (0, revoke_js_1.revocationHandler)({ provider: options.provider, ...options.revocationOptions }));
+    }
+    return router;
+}
+function mcpAuthMetadataRouter(options) {
+    checkIssuerUrl(new URL(options.oauthMetadata.issuer));
+    const router = express_1.default.Router();
+    const protectedResourceMetadata = {
+        resource: options.resourceServerUrl.href,
+        authorization_servers: [options.oauthMetadata.issuer],
+        scopes_supported: options.scopesSupported,
+        resource_name: options.resourceName,
+        resource_documentation: options.serviceDocumentationUrl?.href
+    };
+    // Serve PRM at the path-specific URL per RFC 9728
+    const rsPath = new URL(options.resourceServerUrl.href).pathname;
+    router.use(`/.well-known/oauth-protected-resource${rsPath === '/' ? '' : rsPath}`, (0, metadata_js_1.metadataHandler)(protectedResourceMetadata));
+    // Always add this for OAuth Authorization Server metadata per RFC 8414
+    router.use('/.well-known/oauth-authorization-server', (0, metadata_js_1.metadataHandler)(options.oauthMetadata));
+    return router;
+}
+/**
+ * Helper function to construct the OAuth 2.0 Protected Resource Metadata URL
+ * from a given server URL. This replaces the path with the standard metadata endpoint.
+ *
+ * @param serverUrl - The base URL of the protected resource server
+ * @returns The URL for the OAuth protected resource metadata endpoint
+ *
+ * @example
+ * getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
+ * // Returns: 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
+ */
+function getOAuthProtectedResourceMetadataUrl(serverUrl) {
+    const u = new URL(serverUrl.href);
+    const rsPath = u.pathname && u.pathname !== '/' ? u.pathname : '';
+    return new URL(`/.well-known/oauth-protected-resource${rsPath}`, u).href;
+}
+//# sourceMappingURL=router.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../../src/server/auth/router.ts"],"names":[],"mappings":";;;;;;AAgIA,sCAyCC;AA8BD,sDAuBC;AAaD,oFAIC;AA/OD,sDAAkD;AAClD,wDAAqG;AACrG,kDAAwE;AACxE,0DAA4F;AAC5F,oDAAmF;AACnF,wDAAyD;AAIzD,sFAAsF;AACtF,MAAM,sBAAsB,GACxB,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,yCAAyC,KAAK,GAAG,CAAC;AACtI,IAAI,sBAAsB,EAAE,CAAC;IACzB,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,gHAAgH,CAAC,CAAC;AACnI,CAAC;AAgDD,MAAM,cAAc,GAAG,CAAC,MAAW,EAAQ,EAAE;IACzC,mHAAmH;IACnH,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChI,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC,CAAC;AAEK,MAAM,mBAAmB,GAAG,CAAC,OAMnC,EAAiB,EAAE;IAChB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,cAAc,CAAC,MAAM,CAAC,CAAC;IAEvB,MAAM,sBAAsB,GAAG,YAAY,CAAC;IAC5C,MAAM,cAAc,GAAG,QAAQ,CAAC;IAChC,MAAM,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjF,MAAM,QAAQ,GAAkB;QAC5B,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,qBAAqB,EAAE,OAAO,CAAC,uBAAuB,EAAE,IAAI;QAE5D,sBAAsB,EAAE,IAAI,GAAG,CAAC,sBAAsB,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI;QAC/E,wBAAwB,EAAE,CAAC,MAAM,CAAC;QAClC,gCAAgC,EAAE,CAAC,MAAM,CAAC;QAE1C,cAAc,EAAE,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI;QAC/D,qCAAqC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACrE,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;QAE9D,gBAAgB,EAAE,OAAO,CAAC,eAAe;QAEzC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC3G,0CAA0C,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS;QAEpG,qBAAqB,EAAE,qBAAqB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACpH,CAAC;IAEF,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAtCW,QAAA,mBAAmB,uBAsC9B;AAEF;;;;;;;;;;;GAWG;AACH,SAAgB,aAAa,CAAC,OAA0B;IACpD,MAAM,aAAa,GAAG,IAAA,2BAAmB,EAAC,OAAO,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,CAAC,GAAG,CACN,IAAI,GAAG,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EACtD,IAAA,mCAAoB,EAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CACxF,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE,IAAA,uBAAY,EAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IAElI,MAAM,CAAC,GAAG,CACN,qBAAqB,CAAC;QAClB,aAAa;QACb,sFAAsF;QACtF,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,OAAO,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC;QAChG,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;QACxD,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,YAAY,EAAE,OAAO,CAAC,YAAY;KACrC,CAAC,CACL,CAAC;IAEF,IAAI,aAAa,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,CACN,IAAI,GAAG,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EACrD,IAAA,uCAAyB,EAAC;YACtB,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY;YAC3C,GAAG,OAAO,CAAC,yBAAyB;SACvC,CAAC,CACL,CAAC;IACN,CAAC;IAED,IAAI,aAAa,CAAC,mBAAmB,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,CACN,IAAI,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EACnD,IAAA,6BAAiB,EAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAClF,CAAC;IACN,CAAC;IAED,OAAO,MAAM,CAAC;AAClB,CAAC;AA8BD,SAAgB,qBAAqB,CAAC,OAA4B;IAC9D,cAAc,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;IAEhC,MAAM,yBAAyB,GAAmC;QAC9D,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,IAAI;QAExC,qBAAqB,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC;QAErD,gBAAgB,EAAE,OAAO,CAAC,eAAe;QACzC,aAAa,EAAE,OAAO,CAAC,YAAY;QACnC,sBAAsB,EAAE,OAAO,CAAC,uBAAuB,EAAE,IAAI;KAChE,CAAC;IAEF,kDAAkD;IAClD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAChE,MAAM,CAAC,GAAG,CAAC,wCAAwC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,IAAA,6BAAe,EAAC,yBAAyB,CAAC,CAAC,CAAC;IAE/H,uEAAuE;IACvE,MAAM,CAAC,GAAG,CAAC,yCAAyC,EAAE,IAAA,6BAAe,EAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAE9F,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,oCAAoC,CAAC,SAAc;IAC/D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,OAAO,IAAI,GAAG,CAAC,wCAAwC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Information about a validated access token, provided to request handlers.
+ */
+export interface AuthInfo {
+    /**
+     * The access token.
+     */
+    token: string;
+    /**
+     * The client ID associated with this token.
+     */
+    clientId: string;
+    /**
+     * Scopes associated with this token.
+     */
+    scopes: string[];
+    /**
+     * When the token expires (in seconds since epoch).
+     */
+    expiresAt?: number;
+    /**
+     * The RFC 8707 resource server identifier for which this token is valid.
+     * If set, this MUST match the MCP server's resource identifier (minus hash fragment).
+     */
+    resource?: URL;
+    /**
+     * Additional data associated with the token.
+     * This field should be used for any additional data that needs to be attached to the auth info.
+     */
+    extra?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,QAAQ;IACrB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,GAAG,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/server/auth/types.ts"],"names":[],"mappings":""}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.d.ts

@@ -0,0 +1,38 @@
+import { AnySchema, SchemaInput } from './zod-compat.js';
+export declare const COMPLETABLE_SYMBOL: unique symbol;
+export type CompleteCallback<T extends AnySchema = AnySchema> = (value: SchemaInput<T>, context?: {
+    arguments?: Record<string, string>;
+}) => SchemaInput<T>[] | Promise<SchemaInput<T>[]>;
+export type CompletableMeta<T extends AnySchema = AnySchema> = {
+    complete: CompleteCallback<T>;
+};
+export type CompletableSchema<T extends AnySchema> = T & {
+    [COMPLETABLE_SYMBOL]: CompletableMeta<T>;
+};
+/**
+ * Wraps a Zod type to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
+ * Works with both Zod v3 and v4 schemas.
+ */
+export declare function completable<T extends AnySchema>(schema: T, complete: CompleteCallback<T>): CompletableSchema<T>;
+/**
+ * Checks if a schema is completable (has completion metadata).
+ */
+export declare function isCompletable(schema: unknown): schema is CompletableSchema<AnySchema>;
+/**
+ * Gets the completer callback from a completable schema, if it exists.
+ */
+export declare function getCompleter<T extends AnySchema>(schema: T): CompleteCallback<T> | undefined;
+/**
+ * Unwraps a completable schema to get the underlying schema.
+ * For backward compatibility with code that called `.unwrap()`.
+ */
+export declare function unwrapCompletable<T extends AnySchema>(schema: CompletableSchema<T>): T;
+export declare enum McpZodTypeKind {
+    Completable = "McpCompletable"
+}
+export interface CompletableDef<T extends AnySchema = AnySchema> {
+    type: T;
+    complete: CompleteCallback<T>;
+    typeName: McpZodTypeKind.Completable;
+}
+//# sourceMappingURL=completable.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completable.d.ts","sourceRoot":"","sources":["../../../src/server/completable.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,kBAAkB,EAAE,OAAO,MAAsC,CAAC;AAE/E,MAAM,MAAM,gBAAgB,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI,CAC5D,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EACrB,OAAO,CAAC,EAAE;IACN,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC,KACA,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAElD,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS,IAAI;IAC3D,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,GAAG;IACrD,CAAC,kBAAkB,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAQ/G;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAErF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS,CAG5F;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,SAAS,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAEtF;AAID,oBAAY,cAAc;IACtB,WAAW,mBAAmB;CACjC;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IAC3D,IAAI,EAAE,CAAC,CAAC;IACR,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,WAAW,CAAC;CACxC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpZodTypeKind = exports.COMPLETABLE_SYMBOL = void 0;
+exports.completable = completable;
+exports.isCompletable = isCompletable;
+exports.getCompleter = getCompleter;
+exports.unwrapCompletable = unwrapCompletable;
+exports.COMPLETABLE_SYMBOL = Symbol.for('mcp.completable');
+/**
+ * Wraps a Zod type to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
+ * Works with both Zod v3 and v4 schemas.
+ */
+function completable(schema, complete) {
+    Object.defineProperty(schema, exports.COMPLETABLE_SYMBOL, {
+        value: { complete },
+        enumerable: false,
+        writable: false,
+        configurable: false
+    });
+    return schema;
+}
+/**
+ * Checks if a schema is completable (has completion metadata).
+ */
+function isCompletable(schema) {
+    return !!schema && typeof schema === 'object' && exports.COMPLETABLE_SYMBOL in schema;
+}
+/**
+ * Gets the completer callback from a completable schema, if it exists.
+ */
+function getCompleter(schema) {
+    const meta = schema[exports.COMPLETABLE_SYMBOL];
+    return meta?.complete;
+}
+/**
+ * Unwraps a completable schema to get the underlying schema.
+ * For backward compatibility with code that called `.unwrap()`.
+ */
+function unwrapCompletable(schema) {
+    return schema;
+}
+// Legacy exports for backward compatibility
+// These types are deprecated but kept for existing code
+var McpZodTypeKind;
+(function (McpZodTypeKind) {
+    McpZodTypeKind["Completable"] = "McpCompletable";
+})(McpZodTypeKind || (exports.McpZodTypeKind = McpZodTypeKind = {}));
+//# sourceMappingURL=completable.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completable.js","sourceRoot":"","sources":["../../../src/server/completable.ts"],"names":[],"mappings":";;;AAuBA,kCAQC;AAKD,sCAEC;AAKD,oCAGC;AAMD,8CAEC;AApDY,QAAA,kBAAkB,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAiB/E;;;GAGG;AACH,SAAgB,WAAW,CAAsB,MAAS,EAAE,QAA6B;IACrF,MAAM,CAAC,cAAc,CAAC,MAAgB,EAAE,0BAAkB,EAAE;QACxD,KAAK,EAAE,EAAE,QAAQ,EAAwB;QACzC,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,OAAO,MAA8B,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,MAAe;IACzC,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,0BAAkB,IAAK,MAAiB,CAAC;AAC9F,CAAC;AAED;;GAEG;AACH,SAAgB,YAAY,CAAsB,MAAS;IACvD,MAAM,IAAI,GAAI,MAAmE,CAAC,0BAAkB,CAAC,CAAC;IACtG,OAAO,IAAI,EAAE,QAA2C,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAsB,MAA4B;IAC/E,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,4CAA4C;AAC5C,wDAAwD;AACxD,IAAY,cAEX;AAFD,WAAY,cAAc;IACtB,gDAA8B,CAAA;AAClC,CAAC,EAFW,cAAc,8BAAd,cAAc,QAEzB"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.d.ts

@@ -0,0 +1,45 @@
+import { Express } from 'express';
+/**
+ * Options for creating an MCP Express application.
+ */
+export interface CreateMcpExpressAppOptions {
+    /**
+     * The hostname to bind to. Defaults to '127.0.0.1'.
+     * When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
+     */
+    host?: string;
+    /**
+     * List of allowed hostnames for DNS rebinding protection.
+     * If provided, host header validation will be applied using this list.
+     * For IPv6, provide addresses with brackets (e.g., '[::1]').
+     *
+     * This is useful when binding to '0.0.0.0' or '::' but still wanting
+     * to restrict which hostnames are allowed.
+     */
+    allowedHosts?: string[];
+}
+/**
+ * Creates an Express application pre-configured for MCP servers.
+ *
+ * When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
+ * DNS rebinding protection middleware is automatically applied to protect against
+ * DNS rebinding attacks on localhost servers.
+ *
+ * @param options - Configuration options
+ * @returns A configured Express application
+ *
+ * @example
+ * ```typescript
+ * // Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
+ * const app = createMcpExpressApp();
+ *
+ * // Custom host - DNS rebinding protection only applied for localhost hosts
+ * const app = createMcpExpressApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
+ * const app = createMcpExpressApp({ host: 'localhost' }); // DNS rebinding protection enabled
+ *
+ * // Custom allowed hosts for non-localhost binding
+ * const app = createMcpExpressApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
+ * ```
+ */
+export declare function createMcpExpressApp(options?: CreateMcpExpressAppOptions): Express;
+//# sourceMappingURL=express.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../../src/server/express.ts"],"names":[],"mappings":"AAAA,OAAgB,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAG3C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACvC;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,OAAO,CA0BrF"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMcpExpressApp = createMcpExpressApp;
+const express_1 = __importDefault(require("express"));
+const hostHeaderValidation_js_1 = require("./middleware/hostHeaderValidation.js");
+/**
+ * Creates an Express application pre-configured for MCP servers.
+ *
+ * When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
+ * DNS rebinding protection middleware is automatically applied to protect against
+ * DNS rebinding attacks on localhost servers.
+ *
+ * @param options - Configuration options
+ * @returns A configured Express application
+ *
+ * @example
+ * ```typescript
+ * // Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
+ * const app = createMcpExpressApp();
+ *
+ * // Custom host - DNS rebinding protection only applied for localhost hosts
+ * const app = createMcpExpressApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
+ * const app = createMcpExpressApp({ host: 'localhost' }); // DNS rebinding protection enabled
+ *
+ * // Custom allowed hosts for non-localhost binding
+ * const app = createMcpExpressApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
+ * ```
+ */
+function createMcpExpressApp(options = {}) {
+    const { host = '127.0.0.1', allowedHosts } = options;
+    const app = (0, express_1.default)();
+    app.use(express_1.default.json());
+    // If allowedHosts is explicitly provided, use that for validation
+    if (allowedHosts) {
+        app.use((0, hostHeaderValidation_js_1.hostHeaderValidation)(allowedHosts));
+    }
+    else {
+        // Apply DNS rebinding protection automatically for localhost hosts
+        const localhostHosts = ['127.0.0.1', 'localhost', '::1'];
+        if (localhostHosts.includes(host)) {
+            app.use((0, hostHeaderValidation_js_1.localhostHostValidation)());
+        }
+        else if (host === '0.0.0.0' || host === '::') {
+            // Warn when binding to all interfaces without DNS rebinding protection
+            // eslint-disable-next-line no-console
+            console.warn(`Warning: Server is binding to ${host} without DNS rebinding protection. ` +
+                'Consider using the allowedHosts option to restrict allowed hosts, ' +
+                'or use authentication to protect your server.');
+        }
+    }
+    return app;
+}
+//# sourceMappingURL=express.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/server/express.ts"],"names":[],"mappings":";;;;;AA+CA,kDA0BC;AAzED,sDAA2C;AAC3C,kFAAqG;AAuBrG;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,mBAAmB,CAAC,UAAsC,EAAE;IACxE,MAAM,EAAE,IAAI,GAAG,WAAW,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAErD,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAExB,kEAAkE;IAClE,IAAI,YAAY,EAAE,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,IAAA,8CAAoB,EAAC,YAAY,CAAC,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACJ,mEAAmE;QACnE,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,CAAC,IAAA,iDAAuB,GAAE,CAAC,CAAC;QACvC,CAAC;aAAM,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAC7C,uEAAuE;YACvE,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACR,iCAAiC,IAAI,qCAAqC;gBACtE,oEAAoE;gBACpE,+CAA+C,CACtD,CAAC;QACN,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.d.ts

@@ -0,0 +1,196 @@
+import { Protocol, type NotificationOptions, type ProtocolOptions, type RequestOptions } from '../shared/protocol.js';
+import { type ClientCapabilities, type CreateMessageRequest, type CreateMessageResult, type CreateMessageResultWithTools, type CreateMessageRequestParamsBase, type CreateMessageRequestParamsWithTools, type ElicitRequestFormParams, type ElicitRequestURLParams, type ElicitResult, type Implementation, type ListRootsRequest, type LoggingMessageNotification, type ResourceUpdatedNotification, type ServerCapabilities, type ServerNotification, type ServerRequest, type ServerResult, type Request, type Notification, type Result } from '../types.js';
+import type { jsonSchemaValidator } from '../validation/types.js';
+import { AnyObjectSchema, SchemaOutput } from './zod-compat.js';
+import { RequestHandlerExtra } from '../shared/protocol.js';
+import { ExperimentalServerTasks } from '../experimental/tasks/server.js';
+export type ServerOptions = ProtocolOptions & {
+    /**
+     * Capabilities to advertise as being supported by this server.
+     */
+    capabilities?: ServerCapabilities;
+    /**
+     * Optional instructions describing how to use the server and its features.
+     */
+    instructions?: string;
+    /**
+     * JSON Schema validator for elicitation response validation.
+     *
+     * The validator is used to validate user input returned from elicitation
+     * requests against the requested schema.
+     *
+     * @default AjvJsonSchemaValidator
+     *
+     * @example
+     * ```typescript
+     * // ajv (default)
+     * const server = new Server(
+     *   { name: 'my-server', version: '1.0.0' },
+     *   {
+     *     capabilities: {}
+     *     jsonSchemaValidator: new AjvJsonSchemaValidator()
+     *   }
+     * );
+     *
+     * // @cfworker/json-schema
+     * const server = new Server(
+     *   { name: 'my-server', version: '1.0.0' },
+     *   {
+     *     capabilities: {},
+     *     jsonSchemaValidator: new CfWorkerJsonSchemaValidator()
+     *   }
+     * );
+     * ```
+     */
+    jsonSchemaValidator?: jsonSchemaValidator;
+};
+/**
+ * An MCP server on top of a pluggable transport.
+ *
+ * This server will automatically respond to the initialization flow as initiated from the client.
+ *
+ * To use with custom types, extend the base Request/Notification/Result types and pass them as type parameters:
+ *
+ * ```typescript
+ * // Custom schemas
+ * const CustomRequestSchema = RequestSchema.extend({...})
+ * const CustomNotificationSchema = NotificationSchema.extend({...})
+ * const CustomResultSchema = ResultSchema.extend({...})
+ *
+ * // Type aliases
+ * type CustomRequest = z.infer<typeof CustomRequestSchema>
+ * type CustomNotification = z.infer<typeof CustomNotificationSchema>
+ * type CustomResult = z.infer<typeof CustomResultSchema>
+ *
+ * // Create typed server
+ * const server = new Server<CustomRequest, CustomNotification, CustomResult>({
+ *   name: "CustomServer",
+ *   version: "1.0.0"
+ * })
+ * ```
+ * @deprecated Use `McpServer` instead for the high-level API. Only use `Server` for advanced use cases.
+ */
+export declare class Server<RequestT extends Request = Request, NotificationT extends Notification = Notification, ResultT extends Result = Result> extends Protocol<ServerRequest | RequestT, ServerNotification | NotificationT, ServerResult | ResultT> {
+    private _serverInfo;
+    private _clientCapabilities?;
+    private _clientVersion?;
+    private _capabilities;
+    private _instructions?;
+    private _jsonSchemaValidator;
+    private _experimental?;
+    /**
+     * Callback for when initialization has fully completed (i.e., the client has sent an `initialized` notification).
+     */
+    oninitialized?: () => void;
+    /**
+     * Initializes this server with the given name and version information.
+     */
+    constructor(_serverInfo: Implementation, options?: ServerOptions);
+    /**
+     * Access experimental features.
+     *
+     * WARNING: These APIs are experimental and may change without notice.
+     *
+     * @experimental
+     */
+    get experimental(): {
+        tasks: ExperimentalServerTasks<RequestT, NotificationT, ResultT>;
+    };
+    private _loggingLevels;
+    private readonly LOG_LEVEL_SEVERITY;
+    private isMessageIgnored;
+    /**
+     * Registers new capabilities. This can only be called before connecting to a transport.
+     *
+     * The new capabilities will be merged with any existing capabilities previously given (e.g., at initialization).
+     */
+    registerCapabilities(capabilities: ServerCapabilities): void;
+    /**
+     * Override request handler registration to enforce server-side validation for tools/call.
+     */
+    setRequestHandler<T extends AnyObjectSchema>(requestSchema: T, handler: (request: SchemaOutput<T>, extra: RequestHandlerExtra<ServerRequest | RequestT, ServerNotification | NotificationT>) => ServerResult | ResultT | Promise<ServerResult | ResultT>): void;
+    protected assertCapabilityForMethod(method: RequestT['method']): void;
+    protected assertNotificationCapability(method: (ServerNotification | NotificationT)['method']): void;
+    protected assertRequestHandlerCapability(method: string): void;
+    protected assertTaskCapability(method: string): void;
+    protected assertTaskHandlerCapability(method: string): void;
+    private _oninitialize;
+    /**
+     * After initialization has completed, this will be populated with the client's reported capabilities.
+     */
+    getClientCapabilities(): ClientCapabilities | undefined;
+    /**
+     * After initialization has completed, this will be populated with information about the client's name and version.
+     */
+    getClientVersion(): Implementation | undefined;
+    private getCapabilities;
+    ping(): Promise<{
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+    }>;
+    /**
+     * Request LLM sampling from the client (without tools).
+     * Returns single content block for backwards compatibility.
+     */
+    createMessage(params: CreateMessageRequestParamsBase, options?: RequestOptions): Promise<CreateMessageResult>;
+    /**
+     * Request LLM sampling from the client with tool support.
+     * Returns content that may be a single block or array (for parallel tool calls).
+     */
+    createMessage(params: CreateMessageRequestParamsWithTools, options?: RequestOptions): Promise<CreateMessageResultWithTools>;
+    /**
+     * Request LLM sampling from the client.
+     * When tools may or may not be present, returns the union type.
+     */
+    createMessage(params: CreateMessageRequest['params'], options?: RequestOptions): Promise<CreateMessageResult | CreateMessageResultWithTools>;
+    /**
+     * Creates an elicitation request for the given parameters.
+     * For backwards compatibility, `mode` may be omitted for form requests and will default to `'form'`.
+     * @param params The parameters for the elicitation request.
+     * @param options Optional request options.
+     * @returns The result of the elicitation request.
+     */
+    elicitInput(params: ElicitRequestFormParams | ElicitRequestURLParams, options?: RequestOptions): Promise<ElicitResult>;
+    /**
+     * Creates a reusable callback that, when invoked, will send a `notifications/elicitation/complete`
+     * notification for the specified elicitation ID.
+     *
+     * @param elicitationId The ID of the elicitation to mark as complete.
+     * @param options Optional notification options. Useful when the completion notification should be related to a prior request.
+     * @returns A function that emits the completion notification when awaited.
+     */
+    createElicitationCompletionNotifier(elicitationId: string, options?: NotificationOptions): () => Promise<void>;
+    listRoots(params?: ListRootsRequest['params'], options?: RequestOptions): Promise<{
+        [x: string]: unknown;
+        roots: {
+            uri: string;
+            name?: string | undefined;
+            _meta?: Record<string, unknown> | undefined;
+        }[];
+        _meta?: {
+            [x: string]: unknown;
+            progressToken?: string | number | undefined;
+            "io.modelcontextprotocol/related-task"?: {
+                taskId: string;
+            } | undefined;
+        } | undefined;
+    }>;
+    /**
+     * Sends a logging message to the client, if connected.
+     * Note: You only need to send the parameters object, not the entire JSON RPC message
+     * @see LoggingMessageNotification
+     * @param params
+     * @param sessionId optional for stateless and backward compatibility
+     */
+    sendLoggingMessage(params: LoggingMessageNotification['params'], sessionId?: string): Promise<void>;
+    sendResourceUpdated(params: ResourceUpdatedNotification['params']): Promise<void>;
+    sendResourceListChanged(): Promise<void>;
+    sendToolListChanged(): Promise<void>;
+    sendPromptListChanged(): Promise<void>;
+}
+//# sourceMappingURL=index.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,QAAQ,EAAE,KAAK,mBAAmB,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACzI,OAAO,EACH,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EAExB,KAAK,4BAA4B,EAEjC,KAAK,8BAA8B,EACnC,KAAK,mCAAmC,EACxC,KAAK,uBAAuB,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAIjB,KAAK,cAAc,EAMnB,KAAK,gBAAgB,EAIrB,KAAK,0BAA0B,EAE/B,KAAK,2BAA2B,EAChC,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,EAQjB,KAAK,OAAO,EACZ,KAAK,YAAY,EACjB,KAAK,MAAM,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAkB,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EACH,eAAe,EAIf,YAAY,EAGf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG;IAC1C;;OAEG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAElC;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CAC7C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,MAAM,CACf,QAAQ,SAAS,OAAO,GAAG,OAAO,EAClC,aAAa,SAAS,YAAY,GAAG,YAAY,EACjD,OAAO,SAAS,MAAM,GAAG,MAAM,CACjC,SAAQ,QAAQ,CAAC,aAAa,GAAG,QAAQ,EAAE,kBAAkB,GAAG,aAAa,EAAE,YAAY,GAAG,OAAO,CAAC;IAiBhG,OAAO,CAAC,WAAW;IAhBvB,OAAO,CAAC,mBAAmB,CAAC,CAAqB;IACjD,OAAO,CAAC,cAAc,CAAC,CAAiB;IACxC,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,aAAa,CAAC,CAAS;IAC/B,OAAO,CAAC,oBAAoB,CAAsB;IAClD,OAAO,CAAC,aAAa,CAAC,CAAuE;IAE7F;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC;IAE3B;;OAEG;gBAES,WAAW,EAAE,cAAc,EACnC,OAAO,CAAC,EAAE,aAAa;IAwB3B;;;;;;OAMG;IACH,IAAI,YAAY,IAAI;QAAE,KAAK,EAAE,uBAAuB,CAAC,QAAQ,EAAE,aAAa,EAAE,OAAO,CAAC,CAAA;KAAE,CAOvF;IAGD,OAAO,CAAC,cAAc,CAA+C;IAGrE,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAA6E;IAGhH,OAAO,CAAC,gBAAgB,CAGtB;IAEF;;;;OAIG;IACI,oBAAoB,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI;IAOnE;;OAEG;IACa,iBAAiB,CAAC,CAAC,SAAS,eAAe,EACvD,aAAa,EAAE,CAAC,EAChB,OAAO,EAAE,CACL,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,EACxB,KAAK,EAAE,mBAAmB,CAAC,aAAa,GAAG,QAAQ,EAAE,kBAAkB,GAAG,aAAa,CAAC,KACvF,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC,GAC9D,IAAI;IAwEP,SAAS,CAAC,yBAAyB,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,IAAI;IA0BrE,SAAS,CAAC,4BAA4B,CAAC,MAAM,EAAE,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI;IA2CpG,SAAS,CAAC,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IA0D9D,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIpD,SAAS,CAAC,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;YAU7C,aAAa;IAgB3B;;OAEG;IACH,qBAAqB,IAAI,kBAAkB,GAAG,SAAS;IAIvD;;OAEG;IACH,gBAAgB,IAAI,cAAc,GAAG,SAAS;IAI9C,OAAO,CAAC,eAAe;IAIjB,IAAI;;;;;;;;;IAIV;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,8BAA8B,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAEnH;;;OAGG;IACG,aAAa,CAAC,MAAM,EAAE,mCAAmC,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAEjI;;;OAGG;IACG,aAAa,CACf,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,EACtC,OAAO,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,mBAAmB,GAAG,4BAA4B,CAAC;IAwD9D;;;;;;OAMG;IACG,WAAW,CAAC,MAAM,EAAE,uBAAuB,GAAG,sBAAsB,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC;IAgD5H;;;;;;;OAOG;IACH,mCAAmC,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;IAiBxG,SAAS,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,EAAE,cAAc;;;;;;;;;;;;;;;IAI7E;;;;;;OAMG;IACG,kBAAkB,CAAC,MAAM,EAAE,0BAA0B,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM;IAQnF,mBAAmB,CAAC,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC;IAOjE,uBAAuB;IAMvB,mBAAmB;IAInB,qBAAqB;CAG9B"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/index.js

@@ -0,0 +1,444 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Server = void 0;
+const protocol_js_1 = require("../shared/protocol.js");
+const types_js_1 = require("../types.js");
+const ajv_provider_js_1 = require("../validation/ajv-provider.js");
+const zod_compat_js_1 = require("./zod-compat.js");
+const server_js_1 = require("../experimental/tasks/server.js");
+const helpers_js_1 = require("../experimental/tasks/helpers.js");
+/**
+ * An MCP server on top of a pluggable transport.
+ *
+ * This server will automatically respond to the initialization flow as initiated from the client.
+ *
+ * To use with custom types, extend the base Request/Notification/Result types and pass them as type parameters:
+ *
+ * ```typescript
+ * // Custom schemas
+ * const CustomRequestSchema = RequestSchema.extend({...})
+ * const CustomNotificationSchema = NotificationSchema.extend({...})
+ * const CustomResultSchema = ResultSchema.extend({...})
+ *
+ * // Type aliases
+ * type CustomRequest = z.infer<typeof CustomRequestSchema>
+ * type CustomNotification = z.infer<typeof CustomNotificationSchema>
+ * type CustomResult = z.infer<typeof CustomResultSchema>
+ *
+ * // Create typed server
+ * const server = new Server<CustomRequest, CustomNotification, CustomResult>({
+ *   name: "CustomServer",
+ *   version: "1.0.0"
+ * })
+ * ```
+ * @deprecated Use `McpServer` instead for the high-level API. Only use `Server` for advanced use cases.
+ */
+class Server extends protocol_js_1.Protocol {
+    /**
+     * Initializes this server with the given name and version information.
+     */
+    constructor(_serverInfo, options) {
+        super(options);
+        this._serverInfo = _serverInfo;
+        // Map log levels by session id
+        this._loggingLevels = new Map();
+        // Map LogLevelSchema to severity index
+        this.LOG_LEVEL_SEVERITY = new Map(types_js_1.LoggingLevelSchema.options.map((level, index) => [level, index]));
+        // Is a message with the given level ignored in the log level set for the given session id?
+        this.isMessageIgnored = (level, sessionId) => {
+            const currentLevel = this._loggingLevels.get(sessionId);
+            return currentLevel ? this.LOG_LEVEL_SEVERITY.get(level) < this.LOG_LEVEL_SEVERITY.get(currentLevel) : false;
+        };
+        this._capabilities = options?.capabilities ?? {};
+        this._instructions = options?.instructions;
+        this._jsonSchemaValidator = options?.jsonSchemaValidator ?? new ajv_provider_js_1.AjvJsonSchemaValidator();
+        this.setRequestHandler(types_js_1.InitializeRequestSchema, request => this._oninitialize(request));
+        this.setNotificationHandler(types_js_1.InitializedNotificationSchema, () => this.oninitialized?.());
+        if (this._capabilities.logging) {
+            this.setRequestHandler(types_js_1.SetLevelRequestSchema, async (request, extra) => {
+                const transportSessionId = extra.sessionId || extra.requestInfo?.headers['mcp-session-id'] || undefined;
+                const { level } = request.params;
+                const parseResult = types_js_1.LoggingLevelSchema.safeParse(level);
+                if (parseResult.success) {
+                    this._loggingLevels.set(transportSessionId, parseResult.data);
+                }
+                return {};
+            });
+        }
+    }
+    /**
+     * Access experimental features.
+     *
+     * WARNING: These APIs are experimental and may change without notice.
+     *
+     * @experimental
+     */
+    get experimental() {
+        if (!this._experimental) {
+            this._experimental = {
+                tasks: new server_js_1.ExperimentalServerTasks(this)
+            };
+        }
+        return this._experimental;
+    }
+    /**
+     * Registers new capabilities. This can only be called before connecting to a transport.
+     *
+     * The new capabilities will be merged with any existing capabilities previously given (e.g., at initialization).
+     */
+    registerCapabilities(capabilities) {
+        if (this.transport) {
+            throw new Error('Cannot register capabilities after connecting to transport');
+        }
+        this._capabilities = (0, protocol_js_1.mergeCapabilities)(this._capabilities, capabilities);
+    }
+    /**
+     * Override request handler registration to enforce server-side validation for tools/call.
+     */
+    setRequestHandler(requestSchema, handler) {
+        const shape = (0, zod_compat_js_1.getObjectShape)(requestSchema);
+        const methodSchema = shape?.method;
+        if (!methodSchema) {
+            throw new Error('Schema is missing a method literal');
+        }
+        // Extract literal value using type-safe property access
+        let methodValue;
+        if ((0, zod_compat_js_1.isZ4Schema)(methodSchema)) {
+            const v4Schema = methodSchema;
+            const v4Def = v4Schema._zod?.def;
+            methodValue = v4Def?.value ?? v4Schema.value;
+        }
+        else {
+            const v3Schema = methodSchema;
+            const legacyDef = v3Schema._def;
+            methodValue = legacyDef?.value ?? v3Schema.value;
+        }
+        if (typeof methodValue !== 'string') {
+            throw new Error('Schema method literal must be a string');
+        }
+        const method = methodValue;
+        if (method === 'tools/call') {
+            const wrappedHandler = async (request, extra) => {
+                const validatedRequest = (0, zod_compat_js_1.safeParse)(types_js_1.CallToolRequestSchema, request);
+                if (!validatedRequest.success) {
+                    const errorMessage = validatedRequest.error instanceof Error ? validatedRequest.error.message : String(validatedRequest.error);
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Invalid tools/call request: ${errorMessage}`);
+                }
+                const { params } = validatedRequest.data;
+                const result = await Promise.resolve(handler(request, extra));
+                // When task creation is requested, validate and return CreateTaskResult
+                if (params.task) {
+                    const taskValidationResult = (0, zod_compat_js_1.safeParse)(types_js_1.CreateTaskResultSchema, result);
+                    if (!taskValidationResult.success) {
+                        const errorMessage = taskValidationResult.error instanceof Error
+                            ? taskValidationResult.error.message
+                            : String(taskValidationResult.error);
+                        throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Invalid task creation result: ${errorMessage}`);
+                    }
+                    return taskValidationResult.data;
+                }
+                // For non-task requests, validate against CallToolResultSchema
+                const validationResult = (0, zod_compat_js_1.safeParse)(types_js_1.CallToolResultSchema, result);
+                if (!validationResult.success) {
+                    const errorMessage = validationResult.error instanceof Error ? validationResult.error.message : String(validationResult.error);
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Invalid tools/call result: ${errorMessage}`);
+                }
+                return validationResult.data;
+            };
+            // Install the wrapped handler
+            return super.setRequestHandler(requestSchema, wrappedHandler);
+        }
+        // Other handlers use default behavior
+        return super.setRequestHandler(requestSchema, handler);
+    }
+    assertCapabilityForMethod(method) {
+        switch (method) {
+            case 'sampling/createMessage':
+                if (!this._clientCapabilities?.sampling) {
+                    throw new Error(`Client does not support sampling (required for ${method})`);
+                }
+                break;
+            case 'elicitation/create':
+                if (!this._clientCapabilities?.elicitation) {
+                    throw new Error(`Client does not support elicitation (required for ${method})`);
+                }
+                break;
+            case 'roots/list':
+                if (!this._clientCapabilities?.roots) {
+                    throw new Error(`Client does not support listing roots (required for ${method})`);
+                }
+                break;
+            case 'ping':
+                // No specific capability required for ping
+                break;
+        }
+    }
+    assertNotificationCapability(method) {
+        switch (method) {
+            case 'notifications/message':
+                if (!this._capabilities.logging) {
+                    throw new Error(`Server does not support logging (required for ${method})`);
+                }
+                break;
+            case 'notifications/resources/updated':
+            case 'notifications/resources/list_changed':
+                if (!this._capabilities.resources) {
+                    throw new Error(`Server does not support notifying about resources (required for ${method})`);
+                }
+                break;
+            case 'notifications/tools/list_changed':
+                if (!this._capabilities.tools) {
+                    throw new Error(`Server does not support notifying of tool list changes (required for ${method})`);
+                }
+                break;
+            case 'notifications/prompts/list_changed':
+                if (!this._capabilities.prompts) {
+                    throw new Error(`Server does not support notifying of prompt list changes (required for ${method})`);
+                }
+                break;
+            case 'notifications/elicitation/complete':
+                if (!this._clientCapabilities?.elicitation?.url) {
+                    throw new Error(`Client does not support URL elicitation (required for ${method})`);
+                }
+                break;
+            case 'notifications/cancelled':
+                // Cancellation notifications are always allowed
+                break;
+            case 'notifications/progress':
+                // Progress notifications are always allowed
+                break;
+        }
+    }
+    assertRequestHandlerCapability(method) {
+        // Task handlers are registered in Protocol constructor before _capabilities is initialized
+        // Skip capability check for task methods during initialization
+        if (!this._capabilities) {
+            return;
+        }
+        switch (method) {
+            case 'completion/complete':
+                if (!this._capabilities.completions) {
+                    throw new Error(`Server does not support completions (required for ${method})`);
+                }
+                break;
+            case 'logging/setLevel':
+                if (!this._capabilities.logging) {
+                    throw new Error(`Server does not support logging (required for ${method})`);
+                }
+                break;
+            case 'prompts/get':
+            case 'prompts/list':
+                if (!this._capabilities.prompts) {
+                    throw new Error(`Server does not support prompts (required for ${method})`);
+                }
+                break;
+            case 'resources/list':
+            case 'resources/templates/list':
+            case 'resources/read':
+                if (!this._capabilities.resources) {
+                    throw new Error(`Server does not support resources (required for ${method})`);
+                }
+                break;
+            case 'tools/call':
+            case 'tools/list':
+                if (!this._capabilities.tools) {
+                    throw new Error(`Server does not support tools (required for ${method})`);
+                }
+                break;
+            case 'tasks/get':
+            case 'tasks/list':
+            case 'tasks/result':
+            case 'tasks/cancel':
+                if (!this._capabilities.tasks) {
+                    throw new Error(`Server does not support tasks capability (required for ${method})`);
+                }
+                break;
+            case 'ping':
+            case 'initialize':
+                // No specific capability required for these methods
+                break;
+        }
+    }
+    assertTaskCapability(method) {
+        (0, helpers_js_1.assertClientRequestTaskCapability)(this._clientCapabilities?.tasks?.requests, method, 'Client');
+    }
+    assertTaskHandlerCapability(method) {
+        // Task handlers are registered in Protocol constructor before _capabilities is initialized
+        // Skip capability check for task methods during initialization
+        if (!this._capabilities) {
+            return;
+        }
+        (0, helpers_js_1.assertToolsCallTaskCapability)(this._capabilities.tasks?.requests, method, 'Server');
+    }
+    async _oninitialize(request) {
+        const requestedVersion = request.params.protocolVersion;
+        this._clientCapabilities = request.params.capabilities;
+        this._clientVersion = request.params.clientInfo;
+        const protocolVersion = types_js_1.SUPPORTED_PROTOCOL_VERSIONS.includes(requestedVersion) ? requestedVersion : types_js_1.LATEST_PROTOCOL_VERSION;
+        return {
+            protocolVersion,
+            capabilities: this.getCapabilities(),
+            serverInfo: this._serverInfo,
+            ...(this._instructions && { instructions: this._instructions })
+        };
+    }
+    /**
+     * After initialization has completed, this will be populated with the client's reported capabilities.
+     */
+    getClientCapabilities() {
+        return this._clientCapabilities;
+    }
+    /**
+     * After initialization has completed, this will be populated with information about the client's name and version.
+     */
+    getClientVersion() {
+        return this._clientVersion;
+    }
+    getCapabilities() {
+        return this._capabilities;
+    }
+    async ping() {
+        return this.request({ method: 'ping' }, types_js_1.EmptyResultSchema);
+    }
+    // Implementation
+    async createMessage(params, options) {
+        // Capability check - only required when tools/toolChoice are provided
+        if (params.tools || params.toolChoice) {
+            if (!this._clientCapabilities?.sampling?.tools) {
+                throw new Error('Client does not support sampling tools capability.');
+            }
+        }
+        // Message structure validation - always validate tool_use/tool_result pairs.
+        // These may appear even without tools/toolChoice in the current request when
+        // a previous sampling request returned tool_use and this is a follow-up with results.
+        if (params.messages.length > 0) {
+            const lastMessage = params.messages[params.messages.length - 1];
+            const lastContent = Array.isArray(lastMessage.content) ? lastMessage.content : [lastMessage.content];
+            const hasToolResults = lastContent.some(c => c.type === 'tool_result');
+            const previousMessage = params.messages.length > 1 ? params.messages[params.messages.length - 2] : undefined;
+            const previousContent = previousMessage
+                ? Array.isArray(previousMessage.content)
+                    ? previousMessage.content
+                    : [previousMessage.content]
+                : [];
+            const hasPreviousToolUse = previousContent.some(c => c.type === 'tool_use');
+            if (hasToolResults) {
+                if (lastContent.some(c => c.type !== 'tool_result')) {
+                    throw new Error('The last message must contain only tool_result content if any is present');
+                }
+                if (!hasPreviousToolUse) {
+                    throw new Error('tool_result blocks are not matching any tool_use from the previous message');
+                }
+            }
+            if (hasPreviousToolUse) {
+                const toolUseIds = new Set(previousContent.filter(c => c.type === 'tool_use').map(c => c.id));
+                const toolResultIds = new Set(lastContent.filter(c => c.type === 'tool_result').map(c => c.toolUseId));
+                if (toolUseIds.size !== toolResultIds.size || ![...toolUseIds].every(id => toolResultIds.has(id))) {
+                    throw new Error('ids of tool_result blocks and tool_use blocks from previous message do not match');
+                }
+            }
+        }
+        // Use different schemas based on whether tools are provided
+        if (params.tools) {
+            return this.request({ method: 'sampling/createMessage', params }, types_js_1.CreateMessageResultWithToolsSchema, options);
+        }
+        return this.request({ method: 'sampling/createMessage', params }, types_js_1.CreateMessageResultSchema, options);
+    }
+    /**
+     * Creates an elicitation request for the given parameters.
+     * For backwards compatibility, `mode` may be omitted for form requests and will default to `'form'`.
+     * @param params The parameters for the elicitation request.
+     * @param options Optional request options.
+     * @returns The result of the elicitation request.
+     */
+    async elicitInput(params, options) {
+        const mode = (params.mode ?? 'form');
+        switch (mode) {
+            case 'url': {
+                if (!this._clientCapabilities?.elicitation?.url) {
+                    throw new Error('Client does not support url elicitation.');
+                }
+                const urlParams = params;
+                return this.request({ method: 'elicitation/create', params: urlParams }, types_js_1.ElicitResultSchema, options);
+            }
+            case 'form': {
+                if (!this._clientCapabilities?.elicitation?.form) {
+                    throw new Error('Client does not support form elicitation.');
+                }
+                const formParams = params.mode === 'form' ? params : { ...params, mode: 'form' };
+                const result = await this.request({ method: 'elicitation/create', params: formParams }, types_js_1.ElicitResultSchema, options);
+                if (result.action === 'accept' && result.content && formParams.requestedSchema) {
+                    try {
+                        const validator = this._jsonSchemaValidator.getValidator(formParams.requestedSchema);
+                        const validationResult = validator(result.content);
+                        if (!validationResult.valid) {
+                            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Elicitation response content does not match requested schema: ${validationResult.errorMessage}`);
+                        }
+                    }
+                    catch (error) {
+                        if (error instanceof types_js_1.McpError) {
+                            throw error;
+                        }
+                        throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Error validating elicitation response: ${error instanceof Error ? error.message : String(error)}`);
+                    }
+                }
+                return result;
+            }
+        }
+    }
+    /**
+     * Creates a reusable callback that, when invoked, will send a `notifications/elicitation/complete`
+     * notification for the specified elicitation ID.
+     *
+     * @param elicitationId The ID of the elicitation to mark as complete.
+     * @param options Optional notification options. Useful when the completion notification should be related to a prior request.
+     * @returns A function that emits the completion notification when awaited.
+     */
+    createElicitationCompletionNotifier(elicitationId, options) {
+        if (!this._clientCapabilities?.elicitation?.url) {
+            throw new Error('Client does not support URL elicitation (required for notifications/elicitation/complete)');
+        }
+        return () => this.notification({
+            method: 'notifications/elicitation/complete',
+            params: {
+                elicitationId
+            }
+        }, options);
+    }
+    async listRoots(params, options) {
+        return this.request({ method: 'roots/list', params }, types_js_1.ListRootsResultSchema, options);
+    }
+    /**
+     * Sends a logging message to the client, if connected.
+     * Note: You only need to send the parameters object, not the entire JSON RPC message
+     * @see LoggingMessageNotification
+     * @param params
+     * @param sessionId optional for stateless and backward compatibility
+     */
+    async sendLoggingMessage(params, sessionId) {
+        if (this._capabilities.logging) {
+            if (!this.isMessageIgnored(params.level, sessionId)) {
+                return this.notification({ method: 'notifications/message', params });
+            }
+        }
+    }
+    async sendResourceUpdated(params) {
+        return this.notification({
+            method: 'notifications/resources/updated',
+            params
+        });
+    }
+    async sendResourceListChanged() {
+        return this.notification({
+            method: 'notifications/resources/list_changed'
+        });
+    }
+    async sendToolListChanged() {
+        return this.notification({ method: 'notifications/tools/list_changed' });
+    }
+    async sendPromptListChanged() {
+        return this.notification({ method: 'notifications/prompts/list_changed' });
+    }
+}
+exports.Server = Server;
+//# sourceMappingURL=index.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.d.ts

@@ -0,0 +1,364 @@
+import { Server, ServerOptions } from './index.js';
+import { AnySchema, AnyObjectSchema, ZodRawShapeCompat, SchemaOutput, ShapeOutput } from './zod-compat.js';
+import { Implementation, CallToolResult, Resource, ListResourcesResult, GetPromptResult, ReadResourceResult, ServerRequest, ServerNotification, ToolAnnotations, LoggingMessageNotification, Result, ToolExecution } from '../types.js';
+import { UriTemplate, Variables } from '../shared/uriTemplate.js';
+import { RequestHandlerExtra } from '../shared/protocol.js';
+import { Transport } from '../shared/transport.js';
+import { ExperimentalMcpServerTasks } from '../experimental/tasks/mcp-server.js';
+import type { ToolTaskHandler } from '../experimental/tasks/interfaces.js';
+/**
+ * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
+ * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
+ * Server instance available via the `server` property.
+ */
+export declare class McpServer {
+    /**
+     * The underlying Server instance, useful for advanced operations like sending notifications.
+     */
+    readonly server: Server;
+    private _registeredResources;
+    private _registeredResourceTemplates;
+    private _registeredTools;
+    private _registeredPrompts;
+    private _experimental?;
+    constructor(serverInfo: Implementation, options?: ServerOptions);
+    /**
+     * Access experimental features.
+     *
+     * WARNING: These APIs are experimental and may change without notice.
+     *
+     * @experimental
+     */
+    get experimental(): {
+        tasks: ExperimentalMcpServerTasks;
+    };
+    /**
+     * Attaches to the given transport, starts it, and starts listening for messages.
+     *
+     * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
+     */
+    connect(transport: Transport): Promise<void>;
+    /**
+     * Closes the connection.
+     */
+    close(): Promise<void>;
+    private _toolHandlersInitialized;
+    private setToolRequestHandlers;
+    /**
+     * Creates a tool error result.
+     *
+     * @param errorMessage - The error message.
+     * @returns The tool error result.
+     */
+    private createToolError;
+    /**
+     * Validates tool input arguments against the tool's input schema.
+     */
+    private validateToolInput;
+    /**
+     * Validates tool output against the tool's output schema.
+     */
+    private validateToolOutput;
+    /**
+     * Executes a tool handler (either regular or task-based).
+     */
+    private executeToolHandler;
+    /**
+     * Handles automatic task polling for tools with taskSupport 'optional'.
+     */
+    private handleAutomaticTaskPolling;
+    private _completionHandlerInitialized;
+    private setCompletionRequestHandler;
+    private handlePromptCompletion;
+    private handleResourceCompletion;
+    private _resourceHandlersInitialized;
+    private setResourceRequestHandlers;
+    private _promptHandlersInitialized;
+    private setPromptRequestHandlers;
+    /**
+     * Registers a resource `name` at a fixed URI, which will use the given callback to respond to read requests.
+     * @deprecated Use `registerResource` instead.
+     */
+    resource(name: string, uri: string, readCallback: ReadResourceCallback): RegisteredResource;
+    /**
+     * Registers a resource `name` at a fixed URI with metadata, which will use the given callback to respond to read requests.
+     * @deprecated Use `registerResource` instead.
+     */
+    resource(name: string, uri: string, metadata: ResourceMetadata, readCallback: ReadResourceCallback): RegisteredResource;
+    /**
+     * Registers a resource `name` with a template pattern, which will use the given callback to respond to read requests.
+     * @deprecated Use `registerResource` instead.
+     */
+    resource(name: string, template: ResourceTemplate, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
+    /**
+     * Registers a resource `name` with a template pattern and metadata, which will use the given callback to respond to read requests.
+     * @deprecated Use `registerResource` instead.
+     */
+    resource(name: string, template: ResourceTemplate, metadata: ResourceMetadata, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
+    /**
+     * Registers a resource with a config object and callback.
+     * For static resources, use a URI string. For dynamic resources, use a ResourceTemplate.
+     */
+    registerResource(name: string, uriOrTemplate: string, config: ResourceMetadata, readCallback: ReadResourceCallback): RegisteredResource;
+    registerResource(name: string, uriOrTemplate: ResourceTemplate, config: ResourceMetadata, readCallback: ReadResourceTemplateCallback): RegisteredResourceTemplate;
+    private _createRegisteredResource;
+    private _createRegisteredResourceTemplate;
+    private _createRegisteredPrompt;
+    private _createRegisteredTool;
+    /**
+     * Registers a zero-argument tool `name`, which will run the given function when the client calls it.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool(name: string, cb: ToolCallback): RegisteredTool;
+    /**
+     * Registers a zero-argument tool `name` (with a description) which will run the given function when the client calls it.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool(name: string, description: string, cb: ToolCallback): RegisteredTool;
+    /**
+     * Registers a tool taking either a parameter schema for validation or annotations for additional metadata.
+     * This unified overload handles both `tool(name, paramsSchema, cb)` and `tool(name, annotations, cb)` cases.
+     *
+     * Note: We use a union type for the second parameter because TypeScript cannot reliably disambiguate
+     * between ToolAnnotations and ZodRawShapeCompat during overload resolution, as both are plain object types.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool<Args extends ZodRawShapeCompat>(name: string, paramsSchemaOrAnnotations: Args | ToolAnnotations, cb: ToolCallback<Args>): RegisteredTool;
+    /**
+     * Registers a tool `name` (with a description) taking either parameter schema or annotations.
+     * This unified overload handles both `tool(name, description, paramsSchema, cb)` and
+     * `tool(name, description, annotations, cb)` cases.
+     *
+     * Note: We use a union type for the third parameter because TypeScript cannot reliably disambiguate
+     * between ToolAnnotations and ZodRawShapeCompat during overload resolution, as both are plain object types.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool<Args extends ZodRawShapeCompat>(name: string, description: string, paramsSchemaOrAnnotations: Args | ToolAnnotations, cb: ToolCallback<Args>): RegisteredTool;
+    /**
+     * Registers a tool with both parameter schema and annotations.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool<Args extends ZodRawShapeCompat>(name: string, paramsSchema: Args, annotations: ToolAnnotations, cb: ToolCallback<Args>): RegisteredTool;
+    /**
+     * Registers a tool with description, parameter schema, and annotations.
+     * @deprecated Use `registerTool` instead.
+     */
+    tool<Args extends ZodRawShapeCompat>(name: string, description: string, paramsSchema: Args, annotations: ToolAnnotations, cb: ToolCallback<Args>): RegisteredTool;
+    /**
+     * Registers a tool with a config object and callback.
+     */
+    registerTool<OutputArgs extends ZodRawShapeCompat | AnySchema, InputArgs extends undefined | ZodRawShapeCompat | AnySchema = undefined>(name: string, config: {
+        title?: string;
+        description?: string;
+        inputSchema?: InputArgs;
+        outputSchema?: OutputArgs;
+        annotations?: ToolAnnotations;
+        _meta?: Record<string, unknown>;
+    }, cb: ToolCallback<InputArgs>): RegisteredTool;
+    /**
+     * Registers a zero-argument prompt `name`, which will run the given function when the client calls it.
+     * @deprecated Use `registerPrompt` instead.
+     */
+    prompt(name: string, cb: PromptCallback): RegisteredPrompt;
+    /**
+     * Registers a zero-argument prompt `name` (with a description) which will run the given function when the client calls it.
+     * @deprecated Use `registerPrompt` instead.
+     */
+    prompt(name: string, description: string, cb: PromptCallback): RegisteredPrompt;
+    /**
+     * Registers a prompt `name` accepting the given arguments, which must be an object containing named properties associated with Zod schemas. When the client calls it, the function will be run with the parsed and validated arguments.
+     * @deprecated Use `registerPrompt` instead.
+     */
+    prompt<Args extends PromptArgsRawShape>(name: string, argsSchema: Args, cb: PromptCallback<Args>): RegisteredPrompt;
+    /**
+     * Registers a prompt `name` (with a description) accepting the given arguments, which must be an object containing named properties associated with Zod schemas. When the client calls it, the function will be run with the parsed and validated arguments.
+     * @deprecated Use `registerPrompt` instead.
+     */
+    prompt<Args extends PromptArgsRawShape>(name: string, description: string, argsSchema: Args, cb: PromptCallback<Args>): RegisteredPrompt;
+    /**
+     * Registers a prompt with a config object and callback.
+     */
+    registerPrompt<Args extends PromptArgsRawShape>(name: string, config: {
+        title?: string;
+        description?: string;
+        argsSchema?: Args;
+    }, cb: PromptCallback<Args>): RegisteredPrompt;
+    /**
+     * Checks if the server is connected to a transport.
+     * @returns True if the server is connected
+     */
+    isConnected(): boolean;
+    /**
+     * Sends a logging message to the client, if connected.
+     * Note: You only need to send the parameters object, not the entire JSON RPC message
+     * @see LoggingMessageNotification
+     * @param params
+     * @param sessionId optional for stateless and backward compatibility
+     */
+    sendLoggingMessage(params: LoggingMessageNotification['params'], sessionId?: string): Promise<void>;
+    /**
+     * Sends a resource list changed event to the client, if connected.
+     */
+    sendResourceListChanged(): void;
+    /**
+     * Sends a tool list changed event to the client, if connected.
+     */
+    sendToolListChanged(): void;
+    /**
+     * Sends a prompt list changed event to the client, if connected.
+     */
+    sendPromptListChanged(): void;
+}
+/**
+ * A callback to complete one variable within a resource template's URI template.
+ */
+export type CompleteResourceTemplateCallback = (value: string, context?: {
+    arguments?: Record<string, string>;
+}) => string[] | Promise<string[]>;
+/**
+ * A resource template combines a URI pattern with optional functionality to enumerate
+ * all resources matching that pattern.
+ */
+export declare class ResourceTemplate {
+    private _callbacks;
+    private _uriTemplate;
+    constructor(uriTemplate: string | UriTemplate, _callbacks: {
+        /**
+         * A callback to list all resources matching this template. This is required to specified, even if `undefined`, to avoid accidentally forgetting resource listing.
+         */
+        list: ListResourcesCallback | undefined;
+        /**
+         * An optional callback to autocomplete variables within the URI template. Useful for clients and users to discover possible values.
+         */
+        complete?: {
+            [variable: string]: CompleteResourceTemplateCallback;
+        };
+    });
+    /**
+     * Gets the URI template pattern.
+     */
+    get uriTemplate(): UriTemplate;
+    /**
+     * Gets the list callback, if one was provided.
+     */
+    get listCallback(): ListResourcesCallback | undefined;
+    /**
+     * Gets the callback for completing a specific URI template variable, if one was provided.
+     */
+    completeCallback(variable: string): CompleteResourceTemplateCallback | undefined;
+}
+export type BaseToolCallback<SendResultT extends Result, Extra extends RequestHandlerExtra<ServerRequest, ServerNotification>, Args extends undefined | ZodRawShapeCompat | AnySchema> = Args extends ZodRawShapeCompat ? (args: ShapeOutput<Args>, extra: Extra) => SendResultT | Promise<SendResultT> : Args extends AnySchema ? (args: SchemaOutput<Args>, extra: Extra) => SendResultT | Promise<SendResultT> : (extra: Extra) => SendResultT | Promise<SendResultT>;
+/**
+ * Callback for a tool handler registered with Server.tool().
+ *
+ * Parameters will include tool arguments, if applicable, as well as other request handler context.
+ *
+ * The callback should return:
+ * - `structuredContent` if the tool has an outputSchema defined
+ * - `content` if the tool does not have an outputSchema
+ * - Both fields are optional but typically one should be provided
+ */
+export type ToolCallback<Args extends undefined | ZodRawShapeCompat | AnySchema = undefined> = BaseToolCallback<CallToolResult, RequestHandlerExtra<ServerRequest, ServerNotification>, Args>;
+/**
+ * Supertype that can handle both regular tools (simple callback) and task-based tools (task handler object).
+ */
+export type AnyToolHandler<Args extends undefined | ZodRawShapeCompat | AnySchema = undefined> = ToolCallback<Args> | ToolTaskHandler<Args>;
+export type RegisteredTool = {
+    title?: string;
+    description?: string;
+    inputSchema?: AnySchema;
+    outputSchema?: AnySchema;
+    annotations?: ToolAnnotations;
+    execution?: ToolExecution;
+    _meta?: Record<string, unknown>;
+    handler: AnyToolHandler<undefined | ZodRawShapeCompat>;
+    enabled: boolean;
+    enable(): void;
+    disable(): void;
+    update<InputArgs extends ZodRawShapeCompat, OutputArgs extends ZodRawShapeCompat>(updates: {
+        name?: string | null;
+        title?: string;
+        description?: string;
+        paramsSchema?: InputArgs;
+        outputSchema?: OutputArgs;
+        annotations?: ToolAnnotations;
+        _meta?: Record<string, unknown>;
+        callback?: ToolCallback<InputArgs>;
+        enabled?: boolean;
+    }): void;
+    remove(): void;
+};
+/**
+ * Additional, optional information for annotating a resource.
+ */
+export type ResourceMetadata = Omit<Resource, 'uri' | 'name'>;
+/**
+ * Callback to list all resources matching a given template.
+ */
+export type ListResourcesCallback = (extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => ListResourcesResult | Promise<ListResourcesResult>;
+/**
+ * Callback to read a resource at a given URI.
+ */
+export type ReadResourceCallback = (uri: URL, extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => ReadResourceResult | Promise<ReadResourceResult>;
+export type RegisteredResource = {
+    name: string;
+    title?: string;
+    metadata?: ResourceMetadata;
+    readCallback: ReadResourceCallback;
+    enabled: boolean;
+    enable(): void;
+    disable(): void;
+    update(updates: {
+        name?: string;
+        title?: string;
+        uri?: string | null;
+        metadata?: ResourceMetadata;
+        callback?: ReadResourceCallback;
+        enabled?: boolean;
+    }): void;
+    remove(): void;
+};
+/**
+ * Callback to read a resource at a given URI, following a filled-in URI template.
+ */
+export type ReadResourceTemplateCallback = (uri: URL, variables: Variables, extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => ReadResourceResult | Promise<ReadResourceResult>;
+export type RegisteredResourceTemplate = {
+    resourceTemplate: ResourceTemplate;
+    title?: string;
+    metadata?: ResourceMetadata;
+    readCallback: ReadResourceTemplateCallback;
+    enabled: boolean;
+    enable(): void;
+    disable(): void;
+    update(updates: {
+        name?: string | null;
+        title?: string;
+        template?: ResourceTemplate;
+        metadata?: ResourceMetadata;
+        callback?: ReadResourceTemplateCallback;
+        enabled?: boolean;
+    }): void;
+    remove(): void;
+};
+type PromptArgsRawShape = ZodRawShapeCompat;
+export type PromptCallback<Args extends undefined | PromptArgsRawShape = undefined> = Args extends PromptArgsRawShape ? (args: ShapeOutput<Args>, extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => GetPromptResult | Promise<GetPromptResult> : (extra: RequestHandlerExtra<ServerRequest, ServerNotification>) => GetPromptResult | Promise<GetPromptResult>;
+export type RegisteredPrompt = {
+    title?: string;
+    description?: string;
+    argsSchema?: AnyObjectSchema;
+    callback: PromptCallback<undefined | PromptArgsRawShape>;
+    enabled: boolean;
+    enable(): void;
+    disable(): void;
+    update<Args extends PromptArgsRawShape>(updates: {
+        name?: string | null;
+        title?: string;
+        description?: string;
+        argsSchema?: Args;
+        callback?: PromptCallback<Args>;
+        enabled?: boolean;
+    }): void;
+    remove(): void;
+};
+export {};
+//# sourceMappingURL=mcp.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/mcp.js

@@ -0,0 +1,918 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceTemplate = exports.McpServer = void 0;
+const index_js_1 = require("./index.js");
+const zod_compat_js_1 = require("./zod-compat.js");
+const zod_json_schema_compat_js_1 = require("./zod-json-schema-compat.js");
+const types_js_1 = require("../types.js");
+const completable_js_1 = require("./completable.js");
+const uriTemplate_js_1 = require("../shared/uriTemplate.js");
+const toolNameValidation_js_1 = require("../shared/toolNameValidation.js");
+const mcp_server_js_1 = require("../experimental/tasks/mcp-server.js");
+const zod_1 = require("zod");
+/**
+ * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
+ * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
+ * Server instance available via the `server` property.
+ */
+class McpServer {
+    constructor(serverInfo, options) {
+        this._registeredResources = {};
+        this._registeredResourceTemplates = {};
+        this._registeredTools = {};
+        this._registeredPrompts = {};
+        this._toolHandlersInitialized = false;
+        this._completionHandlerInitialized = false;
+        this._resourceHandlersInitialized = false;
+        this._promptHandlersInitialized = false;
+        this.server = new index_js_1.Server(serverInfo, options);
+    }
+    /**
+     * Access experimental features.
+     *
+     * WARNING: These APIs are experimental and may change without notice.
+     *
+     * @experimental
+     */
+    get experimental() {
+        if (!this._experimental) {
+            this._experimental = {
+                tasks: new mcp_server_js_1.ExperimentalMcpServerTasks(this)
+            };
+        }
+        return this._experimental;
+    }
+    /**
+     * Attaches to the given transport, starts it, and starts listening for messages.
+     *
+     * The `server` object assumes ownership of the Transport, replacing any callbacks that have already been set, and expects that it is the only user of the Transport instance going forward.
+     */
+    async connect(transport) {
+        return await this.server.connect(transport);
+    }
+    /**
+     * Closes the connection.
+     */
+    async close() {
+        await this.server.close();
+    }
+    setToolRequestHandlers() {
+        if (this._toolHandlersInitialized) {
+            return;
+        }
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.ListToolsRequestSchema));
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.CallToolRequestSchema));
+        this.server.registerCapabilities({
+            tools: {
+                listChanged: true
+            }
+        });
+        this.server.setRequestHandler(types_js_1.ListToolsRequestSchema, () => ({
+            tools: Object.entries(this._registeredTools)
+                .filter(([, tool]) => tool.enabled)
+                .map(([name, tool]) => {
+                const toolDefinition = {
+                    name,
+                    title: tool.title,
+                    description: tool.description,
+                    inputSchema: (() => {
+                        const obj = (0, zod_compat_js_1.normalizeObjectSchema)(tool.inputSchema);
+                        return obj
+                            ? (0, zod_json_schema_compat_js_1.toJsonSchemaCompat)(obj, {
+                                strictUnions: true,
+                                pipeStrategy: 'input'
+                            })
+                            : EMPTY_OBJECT_JSON_SCHEMA;
+                    })(),
+                    annotations: tool.annotations,
+                    execution: tool.execution,
+                    _meta: tool._meta
+                };
+                if (tool.outputSchema) {
+                    const obj = (0, zod_compat_js_1.normalizeObjectSchema)(tool.outputSchema);
+                    if (obj) {
+                        toolDefinition.outputSchema = (0, zod_json_schema_compat_js_1.toJsonSchemaCompat)(obj, {
+                            strictUnions: true,
+                            pipeStrategy: 'output'
+                        });
+                    }
+                }
+                return toolDefinition;
+            })
+        }));
+        this.server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request, extra) => {
+            try {
+                const tool = this._registeredTools[request.params.name];
+                if (!tool) {
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Tool ${request.params.name} not found`);
+                }
+                if (!tool.enabled) {
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Tool ${request.params.name} disabled`);
+                }
+                const isTaskRequest = !!request.params.task;
+                const taskSupport = tool.execution?.taskSupport;
+                const isTaskHandler = 'createTask' in tool.handler;
+                // Validate task hint configuration
+                if ((taskSupport === 'required' || taskSupport === 'optional') && !isTaskHandler) {
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Tool ${request.params.name} has taskSupport '${taskSupport}' but was not registered with registerToolTask`);
+                }
+                // Handle taskSupport 'required' without task augmentation
+                if (taskSupport === 'required' && !isTaskRequest) {
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.MethodNotFound, `Tool ${request.params.name} requires task augmentation (taskSupport: 'required')`);
+                }
+                // Handle taskSupport 'optional' without task augmentation - automatic polling
+                if (taskSupport === 'optional' && !isTaskRequest && isTaskHandler) {
+                    return await this.handleAutomaticTaskPolling(tool, request, extra);
+                }
+                // Normal execution path
+                const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+                const result = await this.executeToolHandler(tool, args, extra);
+                // Return CreateTaskResult immediately for task requests
+                if (isTaskRequest) {
+                    return result;
+                }
+                // Validate output schema for non-task requests
+                await this.validateToolOutput(tool, result, request.params.name);
+                return result;
+            }
+            catch (error) {
+                if (error instanceof types_js_1.McpError) {
+                    if (error.code === types_js_1.ErrorCode.UrlElicitationRequired) {
+                        throw error; // Return the error to the caller without wrapping in CallToolResult
+                    }
+                }
+                return this.createToolError(error instanceof Error ? error.message : String(error));
+            }
+        });
+        this._toolHandlersInitialized = true;
+    }
+    /**
+     * Creates a tool error result.
+     *
+     * @param errorMessage - The error message.
+     * @returns The tool error result.
+     */
+    createToolError(errorMessage) {
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: errorMessage
+                }
+            ],
+            isError: true
+        };
+    }
+    /**
+     * Validates tool input arguments against the tool's input schema.
+     */
+    async validateToolInput(tool, args, toolName) {
+        if (!tool.inputSchema) {
+            return undefined;
+        }
+        // Try to normalize to object schema first (for raw shapes and object schemas)
+        // If that fails, use the schema directly (for union/intersection/etc)
+        const inputObj = (0, zod_compat_js_1.normalizeObjectSchema)(tool.inputSchema);
+        const schemaToParse = inputObj ?? tool.inputSchema;
+        const parseResult = await (0, zod_compat_js_1.safeParseAsync)(schemaToParse, args);
+        if (!parseResult.success) {
+            const error = 'error' in parseResult ? parseResult.error : 'Unknown error';
+            const errorMessage = (0, zod_compat_js_1.getParseErrorMessage)(error);
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${errorMessage}`);
+        }
+        return parseResult.data;
+    }
+    /**
+     * Validates tool output against the tool's output schema.
+     */
+    async validateToolOutput(tool, result, toolName) {
+        if (!tool.outputSchema) {
+            return;
+        }
+        // Only validate CallToolResult, not CreateTaskResult
+        if (!('content' in result)) {
+            return;
+        }
+        if (result.isError) {
+            return;
+        }
+        if (!result.structuredContent) {
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Output validation error: Tool ${toolName} has an output schema but no structured content was provided`);
+        }
+        // if the tool has an output schema, validate structured content
+        const outputObj = (0, zod_compat_js_1.normalizeObjectSchema)(tool.outputSchema);
+        const parseResult = await (0, zod_compat_js_1.safeParseAsync)(outputObj, result.structuredContent);
+        if (!parseResult.success) {
+            const error = 'error' in parseResult ? parseResult.error : 'Unknown error';
+            const errorMessage = (0, zod_compat_js_1.getParseErrorMessage)(error);
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Output validation error: Invalid structured content for tool ${toolName}: ${errorMessage}`);
+        }
+    }
+    /**
+     * Executes a tool handler (either regular or task-based).
+     */
+    async executeToolHandler(tool, args, extra) {
+        const handler = tool.handler;
+        const isTaskHandler = 'createTask' in handler;
+        if (isTaskHandler) {
+            if (!extra.taskStore) {
+                throw new Error('No task store provided.');
+            }
+            const taskExtra = { ...extra, taskStore: extra.taskStore };
+            if (tool.inputSchema) {
+                const typedHandler = handler;
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                return await Promise.resolve(typedHandler.createTask(args, taskExtra));
+            }
+            else {
+                const typedHandler = handler;
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                return await Promise.resolve(typedHandler.createTask(taskExtra));
+            }
+        }
+        if (tool.inputSchema) {
+            const typedHandler = handler;
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            return await Promise.resolve(typedHandler(args, extra));
+        }
+        else {
+            const typedHandler = handler;
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            return await Promise.resolve(typedHandler(extra));
+        }
+    }
+    /**
+     * Handles automatic task polling for tools with taskSupport 'optional'.
+     */
+    async handleAutomaticTaskPolling(tool, request, extra) {
+        if (!extra.taskStore) {
+            throw new Error('No task store provided for task-capable tool.');
+        }
+        // Validate input and create task
+        const args = await this.validateToolInput(tool, request.params.arguments, request.params.name);
+        const handler = tool.handler;
+        const taskExtra = { ...extra, taskStore: extra.taskStore };
+        const createTaskResult = args // undefined only if tool.inputSchema is undefined
+            ? await Promise.resolve(handler.createTask(args, taskExtra))
+            : // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                await Promise.resolve(handler.createTask(taskExtra));
+        // Poll until completion
+        const taskId = createTaskResult.task.taskId;
+        let task = createTaskResult.task;
+        const pollInterval = task.pollInterval ?? 5000;
+        while (task.status !== 'completed' && task.status !== 'failed' && task.status !== 'cancelled') {
+            await new Promise(resolve => setTimeout(resolve, pollInterval));
+            const updatedTask = await extra.taskStore.getTask(taskId);
+            if (!updatedTask) {
+                throw new types_js_1.McpError(types_js_1.ErrorCode.InternalError, `Task ${taskId} not found during polling`);
+            }
+            task = updatedTask;
+        }
+        // Return the final result
+        return (await extra.taskStore.getTaskResult(taskId));
+    }
+    setCompletionRequestHandler() {
+        if (this._completionHandlerInitialized) {
+            return;
+        }
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.CompleteRequestSchema));
+        this.server.registerCapabilities({
+            completions: {}
+        });
+        this.server.setRequestHandler(types_js_1.CompleteRequestSchema, async (request) => {
+            switch (request.params.ref.type) {
+                case 'ref/prompt':
+                    (0, types_js_1.assertCompleteRequestPrompt)(request);
+                    return this.handlePromptCompletion(request, request.params.ref);
+                case 'ref/resource':
+                    (0, types_js_1.assertCompleteRequestResourceTemplate)(request);
+                    return this.handleResourceCompletion(request, request.params.ref);
+                default:
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Invalid completion reference: ${request.params.ref}`);
+            }
+        });
+        this._completionHandlerInitialized = true;
+    }
+    async handlePromptCompletion(request, ref) {
+        const prompt = this._registeredPrompts[ref.name];
+        if (!prompt) {
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Prompt ${ref.name} not found`);
+        }
+        if (!prompt.enabled) {
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Prompt ${ref.name} disabled`);
+        }
+        if (!prompt.argsSchema) {
+            return EMPTY_COMPLETION_RESULT;
+        }
+        const promptShape = (0, zod_compat_js_1.getObjectShape)(prompt.argsSchema);
+        const field = promptShape?.[request.params.argument.name];
+        if (!(0, completable_js_1.isCompletable)(field)) {
+            return EMPTY_COMPLETION_RESULT;
+        }
+        const completer = (0, completable_js_1.getCompleter)(field);
+        if (!completer) {
+            return EMPTY_COMPLETION_RESULT;
+        }
+        const suggestions = await completer(request.params.argument.value, request.params.context);
+        return createCompletionResult(suggestions);
+    }
+    async handleResourceCompletion(request, ref) {
+        const template = Object.values(this._registeredResourceTemplates).find(t => t.resourceTemplate.uriTemplate.toString() === ref.uri);
+        if (!template) {
+            if (this._registeredResources[ref.uri]) {
+                // Attempting to autocomplete a fixed resource URI is not an error in the spec (but probably should be).
+                return EMPTY_COMPLETION_RESULT;
+            }
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Resource template ${request.params.ref.uri} not found`);
+        }
+        const completer = template.resourceTemplate.completeCallback(request.params.argument.name);
+        if (!completer) {
+            return EMPTY_COMPLETION_RESULT;
+        }
+        const suggestions = await completer(request.params.argument.value, request.params.context);
+        return createCompletionResult(suggestions);
+    }
+    setResourceRequestHandlers() {
+        if (this._resourceHandlersInitialized) {
+            return;
+        }
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.ListResourcesRequestSchema));
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.ListResourceTemplatesRequestSchema));
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.ReadResourceRequestSchema));
+        this.server.registerCapabilities({
+            resources: {
+                listChanged: true
+            }
+        });
+        this.server.setRequestHandler(types_js_1.ListResourcesRequestSchema, async (request, extra) => {
+            const resources = Object.entries(this._registeredResources)
+                .filter(([_, resource]) => resource.enabled)
+                .map(([uri, resource]) => ({
+                uri,
+                name: resource.name,
+                ...resource.metadata
+            }));
+            const templateResources = [];
+            for (const template of Object.values(this._registeredResourceTemplates)) {
+                if (!template.resourceTemplate.listCallback) {
+                    continue;
+                }
+                const result = await template.resourceTemplate.listCallback(extra);
+                for (const resource of result.resources) {
+                    templateResources.push({
+                        ...template.metadata,
+                        // the defined resource metadata should override the template metadata if present
+                        ...resource
+                    });
+                }
+            }
+            return { resources: [...resources, ...templateResources] };
+        });
+        this.server.setRequestHandler(types_js_1.ListResourceTemplatesRequestSchema, async () => {
+            const resourceTemplates = Object.entries(this._registeredResourceTemplates).map(([name, template]) => ({
+                name,
+                uriTemplate: template.resourceTemplate.uriTemplate.toString(),
+                ...template.metadata
+            }));
+            return { resourceTemplates };
+        });
+        this.server.setRequestHandler(types_js_1.ReadResourceRequestSchema, async (request, extra) => {
+            const uri = new URL(request.params.uri);
+            // First check for exact resource match
+            const resource = this._registeredResources[uri.toString()];
+            if (resource) {
+                if (!resource.enabled) {
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Resource ${uri} disabled`);
+                }
+                return resource.readCallback(uri, extra);
+            }
+            // Then check templates
+            for (const template of Object.values(this._registeredResourceTemplates)) {
+                const variables = template.resourceTemplate.uriTemplate.match(uri.toString());
+                if (variables) {
+                    return template.readCallback(uri, variables, extra);
+                }
+            }
+            throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Resource ${uri} not found`);
+        });
+        this._resourceHandlersInitialized = true;
+    }
+    setPromptRequestHandlers() {
+        if (this._promptHandlersInitialized) {
+            return;
+        }
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.ListPromptsRequestSchema));
+        this.server.assertCanSetRequestHandler(getMethodValue(types_js_1.GetPromptRequestSchema));
+        this.server.registerCapabilities({
+            prompts: {
+                listChanged: true
+            }
+        });
+        this.server.setRequestHandler(types_js_1.ListPromptsRequestSchema, () => ({
+            prompts: Object.entries(this._registeredPrompts)
+                .filter(([, prompt]) => prompt.enabled)
+                .map(([name, prompt]) => {
+                return {
+                    name,
+                    title: prompt.title,
+                    description: prompt.description,
+                    arguments: prompt.argsSchema ? promptArgumentsFromSchema(prompt.argsSchema) : undefined
+                };
+            })
+        }));
+        this.server.setRequestHandler(types_js_1.GetPromptRequestSchema, async (request, extra) => {
+            const prompt = this._registeredPrompts[request.params.name];
+            if (!prompt) {
+                throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Prompt ${request.params.name} not found`);
+            }
+            if (!prompt.enabled) {
+                throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Prompt ${request.params.name} disabled`);
+            }
+            if (prompt.argsSchema) {
+                const argsObj = (0, zod_compat_js_1.normalizeObjectSchema)(prompt.argsSchema);
+                const parseResult = await (0, zod_compat_js_1.safeParseAsync)(argsObj, request.params.arguments);
+                if (!parseResult.success) {
+                    const error = 'error' in parseResult ? parseResult.error : 'Unknown error';
+                    const errorMessage = (0, zod_compat_js_1.getParseErrorMessage)(error);
+                    throw new types_js_1.McpError(types_js_1.ErrorCode.InvalidParams, `Invalid arguments for prompt ${request.params.name}: ${errorMessage}`);
+                }
+                const args = parseResult.data;
+                const cb = prompt.callback;
+                return await Promise.resolve(cb(args, extra));
+            }
+            else {
+                const cb = prompt.callback;
+                // eslint-disable-next-line @typescript-eslint/no-explicit-any
+                return await Promise.resolve(cb(extra));
+            }
+        });
+        this._promptHandlersInitialized = true;
+    }
+    resource(name, uriOrTemplate, ...rest) {
+        let metadata;
+        if (typeof rest[0] === 'object') {
+            metadata = rest.shift();
+        }
+        const readCallback = rest[0];
+        if (typeof uriOrTemplate === 'string') {
+            if (this._registeredResources[uriOrTemplate]) {
+                throw new Error(`Resource ${uriOrTemplate} is already registered`);
+            }
+            const registeredResource = this._createRegisteredResource(name, undefined, uriOrTemplate, metadata, readCallback);
+            this.setResourceRequestHandlers();
+            this.sendResourceListChanged();
+            return registeredResource;
+        }
+        else {
+            if (this._registeredResourceTemplates[name]) {
+                throw new Error(`Resource template ${name} is already registered`);
+            }
+            const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, undefined, uriOrTemplate, metadata, readCallback);
+            this.setResourceRequestHandlers();
+            this.sendResourceListChanged();
+            return registeredResourceTemplate;
+        }
+    }
+    registerResource(name, uriOrTemplate, config, readCallback) {
+        if (typeof uriOrTemplate === 'string') {
+            if (this._registeredResources[uriOrTemplate]) {
+                throw new Error(`Resource ${uriOrTemplate} is already registered`);
+            }
+            const registeredResource = this._createRegisteredResource(name, config.title, uriOrTemplate, config, readCallback);
+            this.setResourceRequestHandlers();
+            this.sendResourceListChanged();
+            return registeredResource;
+        }
+        else {
+            if (this._registeredResourceTemplates[name]) {
+                throw new Error(`Resource template ${name} is already registered`);
+            }
+            const registeredResourceTemplate = this._createRegisteredResourceTemplate(name, config.title, uriOrTemplate, config, readCallback);
+            this.setResourceRequestHandlers();
+            this.sendResourceListChanged();
+            return registeredResourceTemplate;
+        }
+    }
+    _createRegisteredResource(name, title, uri, metadata, readCallback) {
+        const registeredResource = {
+            name,
+            title,
+            metadata,
+            readCallback,
+            enabled: true,
+            disable: () => registeredResource.update({ enabled: false }),
+            enable: () => registeredResource.update({ enabled: true }),
+            remove: () => registeredResource.update({ uri: null }),
+            update: updates => {
+                if (typeof updates.uri !== 'undefined' && updates.uri !== uri) {
+                    delete this._registeredResources[uri];
+                    if (updates.uri)
+                        this._registeredResources[updates.uri] = registeredResource;
+                }
+                if (typeof updates.name !== 'undefined')
+                    registeredResource.name = updates.name;
+                if (typeof updates.title !== 'undefined')
+                    registeredResource.title = updates.title;
+                if (typeof updates.metadata !== 'undefined')
+                    registeredResource.metadata = updates.metadata;
+                if (typeof updates.callback !== 'undefined')
+                    registeredResource.readCallback = updates.callback;
+                if (typeof updates.enabled !== 'undefined')
+                    registeredResource.enabled = updates.enabled;
+                this.sendResourceListChanged();
+            }
+        };
+        this._registeredResources[uri] = registeredResource;
+        return registeredResource;
+    }
+    _createRegisteredResourceTemplate(name, title, template, metadata, readCallback) {
+        const registeredResourceTemplate = {
+            resourceTemplate: template,
+            title,
+            metadata,
+            readCallback,
+            enabled: true,
+            disable: () => registeredResourceTemplate.update({ enabled: false }),
+            enable: () => registeredResourceTemplate.update({ enabled: true }),
+            remove: () => registeredResourceTemplate.update({ name: null }),
+            update: updates => {
+                if (typeof updates.name !== 'undefined' && updates.name !== name) {
+                    delete this._registeredResourceTemplates[name];
+                    if (updates.name)
+                        this._registeredResourceTemplates[updates.name] = registeredResourceTemplate;
+                }
+                if (typeof updates.title !== 'undefined')
+                    registeredResourceTemplate.title = updates.title;
+                if (typeof updates.template !== 'undefined')
+                    registeredResourceTemplate.resourceTemplate = updates.template;
+                if (typeof updates.metadata !== 'undefined')
+                    registeredResourceTemplate.metadata = updates.metadata;
+                if (typeof updates.callback !== 'undefined')
+                    registeredResourceTemplate.readCallback = updates.callback;
+                if (typeof updates.enabled !== 'undefined')
+                    registeredResourceTemplate.enabled = updates.enabled;
+                this.sendResourceListChanged();
+            }
+        };
+        this._registeredResourceTemplates[name] = registeredResourceTemplate;
+        // If the resource template has any completion callbacks, enable completions capability
+        const variableNames = template.uriTemplate.variableNames;
+        const hasCompleter = Array.isArray(variableNames) && variableNames.some(v => !!template.completeCallback(v));
+        if (hasCompleter) {
+            this.setCompletionRequestHandler();
+        }
+        return registeredResourceTemplate;
+    }
+    _createRegisteredPrompt(name, title, description, argsSchema, callback) {
+        const registeredPrompt = {
+            title,
+            description,
+            argsSchema: argsSchema === undefined ? undefined : (0, zod_compat_js_1.objectFromShape)(argsSchema),
+            callback,
+            enabled: true,
+            disable: () => registeredPrompt.update({ enabled: false }),
+            enable: () => registeredPrompt.update({ enabled: true }),
+            remove: () => registeredPrompt.update({ name: null }),
+            update: updates => {
+                if (typeof updates.name !== 'undefined' && updates.name !== name) {
+                    delete this._registeredPrompts[name];
+                    if (updates.name)
+                        this._registeredPrompts[updates.name] = registeredPrompt;
+                }
+                if (typeof updates.title !== 'undefined')
+                    registeredPrompt.title = updates.title;
+                if (typeof updates.description !== 'undefined')
+                    registeredPrompt.description = updates.description;
+                if (typeof updates.argsSchema !== 'undefined')
+                    registeredPrompt.argsSchema = (0, zod_compat_js_1.objectFromShape)(updates.argsSchema);
+                if (typeof updates.callback !== 'undefined')
+                    registeredPrompt.callback = updates.callback;
+                if (typeof updates.enabled !== 'undefined')
+                    registeredPrompt.enabled = updates.enabled;
+                this.sendPromptListChanged();
+            }
+        };
+        this._registeredPrompts[name] = registeredPrompt;
+        // If any argument uses a Completable schema, enable completions capability
+        if (argsSchema) {
+            const hasCompletable = Object.values(argsSchema).some(field => {
+                const inner = field instanceof zod_1.ZodOptional ? field._def?.innerType : field;
+                return (0, completable_js_1.isCompletable)(inner);
+            });
+            if (hasCompletable) {
+                this.setCompletionRequestHandler();
+            }
+        }
+        return registeredPrompt;
+    }
+    _createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, execution, _meta, handler) {
+        // Validate tool name according to SEP specification
+        (0, toolNameValidation_js_1.validateAndWarnToolName)(name);
+        const registeredTool = {
+            title,
+            description,
+            inputSchema: getZodSchemaObject(inputSchema),
+            outputSchema: getZodSchemaObject(outputSchema),
+            annotations,
+            execution,
+            _meta,
+            handler: handler,
+            enabled: true,
+            disable: () => registeredTool.update({ enabled: false }),
+            enable: () => registeredTool.update({ enabled: true }),
+            remove: () => registeredTool.update({ name: null }),
+            update: updates => {
+                if (typeof updates.name !== 'undefined' && updates.name !== name) {
+                    if (typeof updates.name === 'string') {
+                        (0, toolNameValidation_js_1.validateAndWarnToolName)(updates.name);
+                    }
+                    delete this._registeredTools[name];
+                    if (updates.name)
+                        this._registeredTools[updates.name] = registeredTool;
+                }
+                if (typeof updates.title !== 'undefined')
+                    registeredTool.title = updates.title;
+                if (typeof updates.description !== 'undefined')
+                    registeredTool.description = updates.description;
+                if (typeof updates.paramsSchema !== 'undefined')
+                    registeredTool.inputSchema = (0, zod_compat_js_1.objectFromShape)(updates.paramsSchema);
+                if (typeof updates.outputSchema !== 'undefined')
+                    registeredTool.outputSchema = (0, zod_compat_js_1.objectFromShape)(updates.outputSchema);
+                if (typeof updates.callback !== 'undefined')
+                    registeredTool.handler = updates.callback;
+                if (typeof updates.annotations !== 'undefined')
+                    registeredTool.annotations = updates.annotations;
+                if (typeof updates._meta !== 'undefined')
+                    registeredTool._meta = updates._meta;
+                if (typeof updates.enabled !== 'undefined')
+                    registeredTool.enabled = updates.enabled;
+                this.sendToolListChanged();
+            }
+        };
+        this._registeredTools[name] = registeredTool;
+        this.setToolRequestHandlers();
+        this.sendToolListChanged();
+        return registeredTool;
+    }
+    /**
+     * tool() implementation. Parses arguments passed to overrides defined above.
+     */
+    tool(name, ...rest) {
+        if (this._registeredTools[name]) {
+            throw new Error(`Tool ${name} is already registered`);
+        }
+        let description;
+        let inputSchema;
+        let outputSchema;
+        let annotations;
+        // Tool properties are passed as separate arguments, with omissions allowed.
+        // Support for this style is frozen as of protocol version 2025-03-26. Future additions
+        // to tool definition should *NOT* be added.
+        if (typeof rest[0] === 'string') {
+            description = rest.shift();
+        }
+        // Handle the different overload combinations
+        if (rest.length > 1) {
+            // We have at least one more arg before the callback
+            const firstArg = rest[0];
+            if (isZodRawShapeCompat(firstArg)) {
+                // We have a params schema as the first arg
+                inputSchema = rest.shift();
+                // Check if the next arg is potentially annotations
+                if (rest.length > 1 && typeof rest[0] === 'object' && rest[0] !== null && !isZodRawShapeCompat(rest[0])) {
+                    // Case: tool(name, paramsSchema, annotations, cb)
+                    // Or: tool(name, description, paramsSchema, annotations, cb)
+                    annotations = rest.shift();
+                }
+            }
+            else if (typeof firstArg === 'object' && firstArg !== null) {
+                // Not a ZodRawShapeCompat, so must be annotations in this position
+                // Case: tool(name, annotations, cb)
+                // Or: tool(name, description, annotations, cb)
+                annotations = rest.shift();
+            }
+        }
+        const callback = rest[0];
+        return this._createRegisteredTool(name, undefined, description, inputSchema, outputSchema, annotations, { taskSupport: 'forbidden' }, undefined, callback);
+    }
+    /**
+     * Registers a tool with a config object and callback.
+     */
+    registerTool(name, config, cb) {
+        if (this._registeredTools[name]) {
+            throw new Error(`Tool ${name} is already registered`);
+        }
+        const { title, description, inputSchema, outputSchema, annotations, _meta } = config;
+        return this._createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, { taskSupport: 'forbidden' }, _meta, cb);
+    }
+    prompt(name, ...rest) {
+        if (this._registeredPrompts[name]) {
+            throw new Error(`Prompt ${name} is already registered`);
+        }
+        let description;
+        if (typeof rest[0] === 'string') {
+            description = rest.shift();
+        }
+        let argsSchema;
+        if (rest.length > 1) {
+            argsSchema = rest.shift();
+        }
+        const cb = rest[0];
+        const registeredPrompt = this._createRegisteredPrompt(name, undefined, description, argsSchema, cb);
+        this.setPromptRequestHandlers();
+        this.sendPromptListChanged();
+        return registeredPrompt;
+    }
+    /**
+     * Registers a prompt with a config object and callback.
+     */
+    registerPrompt(name, config, cb) {
+        if (this._registeredPrompts[name]) {
+            throw new Error(`Prompt ${name} is already registered`);
+        }
+        const { title, description, argsSchema } = config;
+        const registeredPrompt = this._createRegisteredPrompt(name, title, description, argsSchema, cb);
+        this.setPromptRequestHandlers();
+        this.sendPromptListChanged();
+        return registeredPrompt;
+    }
+    /**
+     * Checks if the server is connected to a transport.
+     * @returns True if the server is connected
+     */
+    isConnected() {
+        return this.server.transport !== undefined;
+    }
+    /**
+     * Sends a logging message to the client, if connected.
+     * Note: You only need to send the parameters object, not the entire JSON RPC message
+     * @see LoggingMessageNotification
+     * @param params
+     * @param sessionId optional for stateless and backward compatibility
+     */
+    async sendLoggingMessage(params, sessionId) {
+        return this.server.sendLoggingMessage(params, sessionId);
+    }
+    /**
+     * Sends a resource list changed event to the client, if connected.
+     */
+    sendResourceListChanged() {
+        if (this.isConnected()) {
+            this.server.sendResourceListChanged();
+        }
+    }
+    /**
+     * Sends a tool list changed event to the client, if connected.
+     */
+    sendToolListChanged() {
+        if (this.isConnected()) {
+            this.server.sendToolListChanged();
+        }
+    }
+    /**
+     * Sends a prompt list changed event to the client, if connected.
+     */
+    sendPromptListChanged() {
+        if (this.isConnected()) {
+            this.server.sendPromptListChanged();
+        }
+    }
+}
+exports.McpServer = McpServer;
+/**
+ * A resource template combines a URI pattern with optional functionality to enumerate
+ * all resources matching that pattern.
+ */
+class ResourceTemplate {
+    constructor(uriTemplate, _callbacks) {
+        this._callbacks = _callbacks;
+        this._uriTemplate = typeof uriTemplate === 'string' ? new uriTemplate_js_1.UriTemplate(uriTemplate) : uriTemplate;
+    }
+    /**
+     * Gets the URI template pattern.
+     */
+    get uriTemplate() {
+        return this._uriTemplate;
+    }
+    /**
+     * Gets the list callback, if one was provided.
+     */
+    get listCallback() {
+        return this._callbacks.list;
+    }
+    /**
+     * Gets the callback for completing a specific URI template variable, if one was provided.
+     */
+    completeCallback(variable) {
+        return this._callbacks.complete?.[variable];
+    }
+}
+exports.ResourceTemplate = ResourceTemplate;
+const EMPTY_OBJECT_JSON_SCHEMA = {
+    type: 'object',
+    properties: {}
+};
+/**
+ * Checks if a value looks like a Zod schema by checking for parse/safeParse methods.
+ */
+function isZodTypeLike(value) {
+    return (value !== null &&
+        typeof value === 'object' &&
+        'parse' in value &&
+        typeof value.parse === 'function' &&
+        'safeParse' in value &&
+        typeof value.safeParse === 'function');
+}
+/**
+ * Checks if an object is a Zod schema instance (v3 or v4).
+ *
+ * Zod schemas have internal markers:
+ * - v3: `_def` property
+ * - v4: `_zod` property
+ *
+ * This includes transformed schemas like z.preprocess(), z.transform(), z.pipe().
+ */
+function isZodSchemaInstance(obj) {
+    return '_def' in obj || '_zod' in obj || isZodTypeLike(obj);
+}
+/**
+ * Checks if an object is a "raw shape" - a plain object where values are Zod schemas.
+ *
+ * Raw shapes are used as shorthand: `{ name: z.string() }` instead of `z.object({ name: z.string() })`.
+ *
+ * IMPORTANT: This must NOT match actual Zod schema instances (like z.preprocess, z.pipe),
+ * which have internal properties that could be mistaken for schema values.
+ */
+function isZodRawShapeCompat(obj) {
+    if (typeof obj !== 'object' || obj === null) {
+        return false;
+    }
+    // If it's already a Zod schema instance, it's NOT a raw shape
+    if (isZodSchemaInstance(obj)) {
+        return false;
+    }
+    // Empty objects are valid raw shapes (tools with no parameters)
+    if (Object.keys(obj).length === 0) {
+        return true;
+    }
+    // A raw shape has at least one property that is a Zod schema
+    return Object.values(obj).some(isZodTypeLike);
+}
+/**
+ * Converts a provided Zod schema to a Zod object if it is a ZodRawShapeCompat,
+ * otherwise returns the schema as is.
+ */
+function getZodSchemaObject(schema) {
+    if (!schema) {
+        return undefined;
+    }
+    if (isZodRawShapeCompat(schema)) {
+        return (0, zod_compat_js_1.objectFromShape)(schema);
+    }
+    return schema;
+}
+function promptArgumentsFromSchema(schema) {
+    const shape = (0, zod_compat_js_1.getObjectShape)(schema);
+    if (!shape)
+        return [];
+    return Object.entries(shape).map(([name, field]) => {
+        // Get description - works for both v3 and v4
+        const description = (0, zod_compat_js_1.getSchemaDescription)(field);
+        // Check if optional - works for both v3 and v4
+        const isOptional = (0, zod_compat_js_1.isSchemaOptional)(field);
+        return {
+            name,
+            description,
+            required: !isOptional
+        };
+    });
+}
+function getMethodValue(schema) {
+    const shape = (0, zod_compat_js_1.getObjectShape)(schema);
+    const methodSchema = shape?.method;
+    if (!methodSchema) {
+        throw new Error('Schema is missing a method literal');
+    }
+    // Extract literal value - works for both v3 and v4
+    const value = (0, zod_compat_js_1.getLiteralValue)(methodSchema);
+    if (typeof value === 'string') {
+        return value;
+    }
+    throw new Error('Schema method literal must be a string');
+}
+function createCompletionResult(suggestions) {
+    return {
+        completion: {
+            values: suggestions.slice(0, 100),
+            total: suggestions.length,
+            hasMore: suggestions.length > 100
+        }
+    };
+}
+const EMPTY_COMPLETION_RESULT = {
+    completion: {
+        values: [],
+        hasMore: false
+    }
+};
+//# sourceMappingURL=mcp.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/middleware/hostHeaderValidation.d.ts

@@ -0,0 +1,32 @@
+import { RequestHandler } from 'express';
+/**
+ * Express middleware for DNS rebinding protection.
+ * Validates Host header hostname (port-agnostic) against an allowed list.
+ *
+ * This is particularly important for servers without authorization or HTTPS,
+ * such as localhost servers or development servers. DNS rebinding attacks can
+ * bypass same-origin policy by manipulating DNS to point a domain to a
+ * localhost address, allowing malicious websites to access your local server.
+ *
+ * @param allowedHostnames - List of allowed hostnames (without ports).
+ *   For IPv6, provide the address with brackets (e.g., '[::1]').
+ * @returns Express middleware function
+ *
+ * @example
+ * ```typescript
+ * const middleware = hostHeaderValidation(['localhost', '127.0.0.1', '[::1]']);
+ * app.use(middleware);
+ * ```
+ */
+export declare function hostHeaderValidation(allowedHostnames: string[]): RequestHandler;
+/**
+ * Convenience middleware for localhost DNS rebinding protection.
+ * Allows only localhost, 127.0.0.1, and [::1] (IPv6 localhost) hostnames.
+ *
+ * @example
+ * ```typescript
+ * app.use(localhostHostValidation());
+ * ```
+ */
+export declare function localhostHostValidation(): RequestHandler;
+//# sourceMappingURL=hostHeaderValidation.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/middleware/hostHeaderValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHeaderValidation.d.ts","sourceRoot":"","sources":["../../../../src/server/middleware/hostHeaderValidation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,cAAc,CA4C/E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,IAAI,cAAc,CAExD"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/middleware/hostHeaderValidation.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hostHeaderValidation = hostHeaderValidation;
+exports.localhostHostValidation = localhostHostValidation;
+/**
+ * Express middleware for DNS rebinding protection.
+ * Validates Host header hostname (port-agnostic) against an allowed list.
+ *
+ * This is particularly important for servers without authorization or HTTPS,
+ * such as localhost servers or development servers. DNS rebinding attacks can
+ * bypass same-origin policy by manipulating DNS to point a domain to a
+ * localhost address, allowing malicious websites to access your local server.
+ *
+ * @param allowedHostnames - List of allowed hostnames (without ports).
+ *   For IPv6, provide the address with brackets (e.g., '[::1]').
+ * @returns Express middleware function
+ *
+ * @example
+ * ```typescript
+ * const middleware = hostHeaderValidation(['localhost', '127.0.0.1', '[::1]']);
+ * app.use(middleware);
+ * ```
+ */
+function hostHeaderValidation(allowedHostnames) {
+    return (req, res, next) => {
+        const hostHeader = req.headers.host;
+        if (!hostHeader) {
+            res.status(403).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: 'Missing Host header'
+                },
+                id: null
+            });
+            return;
+        }
+        // Use URL API to parse hostname (handles IPv4, IPv6, and regular hostnames)
+        let hostname;
+        try {
+            hostname = new URL(`http://${hostHeader}`).hostname;
+        }
+        catch {
+            res.status(403).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: `Invalid Host header: ${hostHeader}`
+                },
+                id: null
+            });
+            return;
+        }
+        if (!allowedHostnames.includes(hostname)) {
+            res.status(403).json({
+                jsonrpc: '2.0',
+                error: {
+                    code: -32000,
+                    message: `Invalid Host: ${hostname}`
+                },
+                id: null
+            });
+            return;
+        }
+        next();
+    };
+}
+/**
+ * Convenience middleware for localhost DNS rebinding protection.
+ * Allows only localhost, 127.0.0.1, and [::1] (IPv6 localhost) hostnames.
+ *
+ * @example
+ * ```typescript
+ * app.use(localhostHostValidation());
+ * ```
+ */
+function localhostHostValidation() {
+    return hostHeaderValidation(['localhost', '127.0.0.1', '[::1]']);
+}
+//# sourceMappingURL=hostHeaderValidation.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/middleware/hostHeaderValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hostHeaderValidation.js","sourceRoot":"","sources":["../../../../src/server/middleware/hostHeaderValidation.ts"],"names":[],"mappings":";;AAqBA,oDA4CC;AAWD,0DAEC;AA5ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,gBAA0B;IAC3D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACvD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QACpC,IAAI,CAAC,UAAU,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACH,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,qBAAqB;iBACjC;gBACD,EAAE,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACD,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACH,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,wBAAwB,UAAU,EAAE;iBAChD;gBACD,EAAE,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACjB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE;oBACH,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,iBAAiB,QAAQ,EAAE;iBACvC;gBACD,EAAE,EAAE,IAAI;aACX,CAAC,CAAC;YACH,OAAO;QACX,CAAC;QACD,IAAI,EAAE,CAAC;IACX,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,uBAAuB;IACnC,OAAO,oBAAoB,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AACrE,CAAC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/sse.d.ts

@@ -0,0 +1,82 @@
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { Transport } from '../shared/transport.js';
+import { JSONRPCMessage, MessageExtraInfo } from '../types.js';
+import { AuthInfo } from './auth/types.js';
+/**
+ * Configuration options for SSEServerTransport.
+ */
+export interface SSEServerTransportOptions {
+    /**
+     * List of allowed host header values for DNS rebinding protection.
+     * If not specified, host validation is disabled.
+     * @deprecated Use the `hostHeaderValidation` middleware from `@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js` instead,
+     * or use `createMcpExpressApp` from `@modelcontextprotocol/sdk/server/express.js` which includes localhost protection by default.
+     */
+    allowedHosts?: string[];
+    /**
+     * List of allowed origin header values for DNS rebinding protection.
+     * If not specified, origin validation is disabled.
+     * @deprecated Use the `hostHeaderValidation` middleware from `@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js` instead,
+     * or use `createMcpExpressApp` from `@modelcontextprotocol/sdk/server/express.js` which includes localhost protection by default.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured).
+     * Default is false for backwards compatibility.
+     * @deprecated Use the `hostHeaderValidation` middleware from `@modelcontextprotocol/sdk/server/middleware/hostHeaderValidation.js` instead,
+     * or use `createMcpExpressApp` from `@modelcontextprotocol/sdk/server/express.js` which includes localhost protection by default.
+     */
+    enableDnsRebindingProtection?: boolean;
+}
+/**
+ * Server transport for SSE: this will send messages over an SSE connection and receive messages from HTTP POST requests.
+ *
+ * This transport is only available in Node.js environments.
+ * @deprecated SSEServerTransport is deprecated. Use StreamableHTTPServerTransport instead.
+ */
+export declare class SSEServerTransport implements Transport {
+    private _endpoint;
+    private res;
+    private _sseResponse?;
+    private _sessionId;
+    private _options;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage, extra?: MessageExtraInfo) => void;
+    /**
+     * Creates a new SSE server transport, which will direct the client to POST messages to the relative or absolute URL identified by `_endpoint`.
+     */
+    constructor(_endpoint: string, res: ServerResponse, options?: SSEServerTransportOptions);
+    /**
+     * Validates request headers for DNS rebinding protection.
+     * @returns Error message if validation fails, undefined if validation passes.
+     */
+    private validateRequestHeaders;
+    /**
+     * Handles the initial SSE connection request.
+     *
+     * This should be called when a GET request is made to establish the SSE stream.
+     */
+    start(): Promise<void>;
+    /**
+     * Handles incoming POST messages.
+     *
+     * This should be called when a POST request is made to send a message to the server.
+     */
+    handlePostMessage(req: IncomingMessage & {
+        auth?: AuthInfo;
+    }, res: ServerResponse, parsedBody?: unknown): Promise<void>;
+    /**
+     * Handle a client message, regardless of how it arrived. This can be used to inform the server of messages that arrive via a means different than HTTP POST.
+     */
+    handleMessage(message: unknown, extra?: MessageExtraInfo): Promise<void>;
+    close(): Promise<void>;
+    send(message: JSONRPCMessage): Promise<void>;
+    /**
+     * Returns the session ID for this transport.
+     *
+     * This can be used to route incoming POST requests.
+     */
+    get sessionId(): string;
+}
+//# sourceMappingURL=sse.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/sse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.d.ts","sourceRoot":"","sources":["../../../src/server/sse.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAwB,gBAAgB,EAAe,MAAM,aAAa,CAAC;AAGlG,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAK3C;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACtC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,SAAS;IAY5C,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,GAAG;IAZf,OAAO,CAAC,YAAY,CAAC,CAAiB;IACtC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAExE;;OAEG;gBAES,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,cAAc,EAC3B,OAAO,CAAC,EAAE,yBAAyB;IAMvC;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAyB9B;;;;OAIG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA8B5B;;;;OAIG;IACG,iBAAiB,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAuD7H;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAMtB,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAQlD;;;;OAIG;IACH,IAAI,SAAS,IAAI,MAAM,CAEtB;CACJ"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/sse.js

@@ -0,0 +1,172 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SSEServerTransport = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_tls_1 = require("node:tls");
+const types_js_1 = require("../types.js");
+const raw_body_1 = __importDefault(require("raw-body"));
+const content_type_1 = __importDefault(require("content-type"));
+const node_url_1 = require("node:url");
+const MAXIMUM_MESSAGE_SIZE = '4mb';
+/**
+ * Server transport for SSE: this will send messages over an SSE connection and receive messages from HTTP POST requests.
+ *
+ * This transport is only available in Node.js environments.
+ * @deprecated SSEServerTransport is deprecated. Use StreamableHTTPServerTransport instead.
+ */
+class SSEServerTransport {
+    /**
+     * Creates a new SSE server transport, which will direct the client to POST messages to the relative or absolute URL identified by `_endpoint`.
+     */
+    constructor(_endpoint, res, options) {
+        this._endpoint = _endpoint;
+        this.res = res;
+        this._sessionId = (0, node_crypto_1.randomUUID)();
+        this._options = options || { enableDnsRebindingProtection: false };
+    }
+    /**
+     * Validates request headers for DNS rebinding protection.
+     * @returns Error message if validation fails, undefined if validation passes.
+     */
+    validateRequestHeaders(req) {
+        // Skip validation if protection is not enabled
+        if (!this._options.enableDnsRebindingProtection) {
+            return undefined;
+        }
+        // Validate Host header if allowedHosts is configured
+        if (this._options.allowedHosts && this._options.allowedHosts.length > 0) {
+            const hostHeader = req.headers.host;
+            if (!hostHeader || !this._options.allowedHosts.includes(hostHeader)) {
+                return `Invalid Host header: ${hostHeader}`;
+            }
+        }
+        // Validate Origin header if allowedOrigins is configured
+        if (this._options.allowedOrigins && this._options.allowedOrigins.length > 0) {
+            const originHeader = req.headers.origin;
+            if (originHeader && !this._options.allowedOrigins.includes(originHeader)) {
+                return `Invalid Origin header: ${originHeader}`;
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Handles the initial SSE connection request.
+     *
+     * This should be called when a GET request is made to establish the SSE stream.
+     */
+    async start() {
+        if (this._sseResponse) {
+            throw new Error('SSEServerTransport already started! If using Server class, note that connect() calls start() automatically.');
+        }
+        this.res.writeHead(200, {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        });
+        // Send the endpoint event
+        // Use a dummy base URL because this._endpoint is relative.
+        // This allows using URL/URLSearchParams for robust parameter handling.
+        const dummyBase = 'http://localhost'; // Any valid base works
+        const endpointUrl = new node_url_1.URL(this._endpoint, dummyBase);
+        endpointUrl.searchParams.set('sessionId', this._sessionId);
+        // Reconstruct the relative URL string (pathname + search + hash)
+        const relativeUrlWithSession = endpointUrl.pathname + endpointUrl.search + endpointUrl.hash;
+        this.res.write(`event: endpoint\ndata: ${relativeUrlWithSession}\n\n`);
+        this._sseResponse = this.res;
+        this.res.on('close', () => {
+            this._sseResponse = undefined;
+            this.onclose?.();
+        });
+    }
+    /**
+     * Handles incoming POST messages.
+     *
+     * This should be called when a POST request is made to send a message to the server.
+     */
+    async handlePostMessage(req, res, parsedBody) {
+        if (!this._sseResponse) {
+            const message = 'SSE connection not established';
+            res.writeHead(500).end(message);
+            throw new Error(message);
+        }
+        // Validate request headers for DNS rebinding protection
+        const validationError = this.validateRequestHeaders(req);
+        if (validationError) {
+            res.writeHead(403).end(validationError);
+            this.onerror?.(new Error(validationError));
+            return;
+        }
+        const authInfo = req.auth;
+        const host = req.headers.host;
+        const protocol = req.socket instanceof node_tls_1.TLSSocket ? 'https' : 'http';
+        const fullUrl = host && req.url ? new node_url_1.URL(req.url, `${protocol}://${host}`) : undefined;
+        const requestInfo = {
+            headers: req.headers,
+            url: fullUrl
+        };
+        let body;
+        try {
+            const ct = content_type_1.default.parse(req.headers['content-type'] ?? '');
+            if (ct.type !== 'application/json') {
+                throw new Error(`Unsupported content-type: ${ct.type}`);
+            }
+            body =
+                parsedBody ??
+                    (await (0, raw_body_1.default)(req, {
+                        limit: MAXIMUM_MESSAGE_SIZE,
+                        encoding: ct.parameters.charset ?? 'utf-8'
+                    }));
+        }
+        catch (error) {
+            res.writeHead(400).end(String(error));
+            this.onerror?.(error);
+            return;
+        }
+        try {
+            await this.handleMessage(typeof body === 'string' ? JSON.parse(body) : body, { requestInfo, authInfo });
+        }
+        catch {
+            res.writeHead(400).end(`Invalid message: ${body}`);
+            return;
+        }
+        res.writeHead(202).end('Accepted');
+    }
+    /**
+     * Handle a client message, regardless of how it arrived. This can be used to inform the server of messages that arrive via a means different than HTTP POST.
+     */
+    async handleMessage(message, extra) {
+        let parsedMessage;
+        try {
+            parsedMessage = types_js_1.JSONRPCMessageSchema.parse(message);
+        }
+        catch (error) {
+            this.onerror?.(error);
+            throw error;
+        }
+        this.onmessage?.(parsedMessage, extra);
+    }
+    async close() {
+        this._sseResponse?.end();
+        this._sseResponse = undefined;
+        this.onclose?.();
+    }
+    async send(message) {
+        if (!this._sseResponse) {
+            throw new Error('Not connected');
+        }
+        this._sseResponse.write(`event: message\ndata: ${JSON.stringify(message)}\n\n`);
+    }
+    /**
+     * Returns the session ID for this transport.
+     *
+     * This can be used to route incoming POST requests.
+     */
+    get sessionId() {
+        return this._sessionId;
+    }
+}
+exports.SSEServerTransport = SSEServerTransport;
+//# sourceMappingURL=sse.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sse.js","sourceRoot":"","sources":["../../../src/server/sse.ts"],"names":[],"mappings":";;;;;;AAAA,6CAAyC;AAEzC,uCAAqC;AAErC,0CAAkG;AAClG,wDAAkC;AAClC,gEAAuC;AAEvC,uCAA+B;AAE/B,MAAM,oBAAoB,GAAG,KAAK,CAAC;AA+BnC;;;;;GAKG;AACH,MAAa,kBAAkB;IAQ3B;;OAEG;IACH,YACY,SAAiB,EACjB,GAAmB,EAC3B,OAAmC;QAF3B,cAAS,GAAT,SAAS,CAAQ;QACjB,QAAG,GAAH,GAAG,CAAgB;QAG3B,IAAI,CAAC,UAAU,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,GAAG,OAAO,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,sBAAsB,CAAC,GAAoB;QAC/C,+CAA+C;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,4BAA4B,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACrB,CAAC;QAED,qDAAqD;QACrD,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;gBAClE,OAAO,wBAAwB,UAAU,EAAE,CAAC;YAChD,CAAC;QACL,CAAC;QAED,yDAAyD;QACzD,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YACxC,IAAI,YAAY,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvE,OAAO,0BAA0B,YAAY,EAAE,CAAC;YACpD,CAAC;QACL,CAAC;QAED,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK;QACP,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;QACnI,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACpB,cAAc,EAAE,mBAAmB;YACnC,eAAe,EAAE,wBAAwB;YACzC,UAAU,EAAE,YAAY;SAC3B,CAAC,CAAC;QAEH,0BAA0B;QAC1B,2DAA2D;QAC3D,uEAAuE;QACvE,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,uBAAuB;QAC7D,MAAM,WAAW,GAAG,IAAI,cAAG,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACvD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAE3D,iEAAiE;QACjE,MAAM,sBAAsB,GAAG,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC;QAE5F,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,0BAA0B,sBAAsB,MAAM,CAAC,CAAC;QAEvE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAA0C,EAAE,GAAmB,EAAE,UAAoB;QACzG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,OAAO,GAAG,gCAAgC,CAAC;YACjD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,wDAAwD;QACxD,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACzD,IAAI,eAAe,EAAE,CAAC;YAClB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YAC3C,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAyB,GAAG,CAAC,IAAI,CAAC;QAEhD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,YAAY,oBAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,cAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAExF,MAAM,WAAW,GAAgB;YAC7B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,EAAE,OAAO;SACf,CAAC;QAEF,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,EAAE,GAAG,sBAAW,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI;gBACA,UAAU;oBACV,CAAC,MAAM,IAAA,kBAAU,EAAC,GAAG,EAAE;wBACnB,KAAK,EAAE,oBAAoB;wBAC3B,QAAQ,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO;qBAC7C,CAAC,CAAC,CAAC;QACZ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAc,CAAC,CAAC;YAC/B,OAAO;QACX,CAAC;QAED,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5G,CAAC;QAAC,MAAM,CAAC;YACL,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;YACnD,OAAO;QACX,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,OAAgB,EAAE,KAAwB;QAC1D,IAAI,aAA6B,CAAC;QAClC,IAAI,CAAC;YACD,aAAa,GAAG,+BAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,EAAE,CAAC,KAAc,CAAC,CAAC;YAC/B,MAAM,KAAK,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK;QACP,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAC9B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;CACJ;AArLD,gDAqLC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/stdio.d.ts

@@ -0,0 +1,28 @@
+import { Readable, Writable } from 'node:stream';
+import { JSONRPCMessage } from '../types.js';
+import { Transport } from '../shared/transport.js';
+/**
+ * Server transport for stdio: this communicates with an MCP client by reading from the current process' stdin and writing to stdout.
+ *
+ * This transport is only available in Node.js environments.
+ */
+export declare class StdioServerTransport implements Transport {
+    private _stdin;
+    private _stdout;
+    private _readBuffer;
+    private _started;
+    constructor(_stdin?: Readable, _stdout?: Writable);
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage) => void;
+    _ondata: (chunk: Buffer) => void;
+    _onerror: (error: Error) => void;
+    /**
+     * Starts listening for messages on stdin.
+     */
+    start(): Promise<void>;
+    private processReadBuffer;
+    close(): Promise<void>;
+    send(message: JSONRPCMessage): Promise<void>;
+}
+//# sourceMappingURL=stdio.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/stdio.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/server/stdio.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD;;;;GAIG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IAK9C,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,OAAO;IALnB,OAAO,CAAC,WAAW,CAAgC;IACnD,OAAO,CAAC,QAAQ,CAAS;gBAGb,MAAM,GAAE,QAAwB,EAChC,OAAO,GAAE,QAAyB;IAG9C,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC;IAG9C,OAAO,UAAW,MAAM,UAGtB;IACF,QAAQ,UAAW,KAAK,UAEtB;IAEF;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,iBAAiB;IAenB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkB5B,IAAI,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;CAU/C"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/stdio.js

@@ -0,0 +1,82 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StdioServerTransport = void 0;
+const node_process_1 = __importDefault(require("node:process"));
+const stdio_js_1 = require("../shared/stdio.js");
+/**
+ * Server transport for stdio: this communicates with an MCP client by reading from the current process' stdin and writing to stdout.
+ *
+ * This transport is only available in Node.js environments.
+ */
+class StdioServerTransport {
+    constructor(_stdin = node_process_1.default.stdin, _stdout = node_process_1.default.stdout) {
+        this._stdin = _stdin;
+        this._stdout = _stdout;
+        this._readBuffer = new stdio_js_1.ReadBuffer();
+        this._started = false;
+        // Arrow functions to bind `this` properly, while maintaining function identity.
+        this._ondata = (chunk) => {
+            this._readBuffer.append(chunk);
+            this.processReadBuffer();
+        };
+        this._onerror = (error) => {
+            this.onerror?.(error);
+        };
+    }
+    /**
+     * Starts listening for messages on stdin.
+     */
+    async start() {
+        if (this._started) {
+            throw new Error('StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.');
+        }
+        this._started = true;
+        this._stdin.on('data', this._ondata);
+        this._stdin.on('error', this._onerror);
+    }
+    processReadBuffer() {
+        while (true) {
+            try {
+                const message = this._readBuffer.readMessage();
+                if (message === null) {
+                    break;
+                }
+                this.onmessage?.(message);
+            }
+            catch (error) {
+                this.onerror?.(error);
+            }
+        }
+    }
+    async close() {
+        // Remove our event listeners first
+        this._stdin.off('data', this._ondata);
+        this._stdin.off('error', this._onerror);
+        // Check if we were the only data listener
+        const remainingDataListeners = this._stdin.listenerCount('data');
+        if (remainingDataListeners === 0) {
+            // Only pause stdin if we were the only listener
+            // This prevents interfering with other parts of the application that might be using stdin
+            this._stdin.pause();
+        }
+        // Clear the buffer and notify closure
+        this._readBuffer.clear();
+        this.onclose?.();
+    }
+    send(message) {
+        return new Promise(resolve => {
+            const json = (0, stdio_js_1.serializeMessage)(message);
+            if (this._stdout.write(json)) {
+                resolve();
+            }
+            else {
+                this._stdout.once('drain', resolve);
+            }
+        });
+    }
+}
+exports.StdioServerTransport = StdioServerTransport;
+//# sourceMappingURL=stdio.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/stdio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/server/stdio.ts"],"names":[],"mappings":";;;;;;AAAA,gEAAmC;AAEnC,iDAAkE;AAIlE;;;;GAIG;AACH,MAAa,oBAAoB;IAI7B,YACY,SAAmB,sBAAO,CAAC,KAAK,EAChC,UAAoB,sBAAO,CAAC,MAAM;QADlC,WAAM,GAAN,MAAM,CAA0B;QAChC,YAAO,GAAP,OAAO,CAA2B;QALtC,gBAAW,GAAe,IAAI,qBAAU,EAAE,CAAC;QAC3C,aAAQ,GAAG,KAAK,CAAC;QAWzB,gFAAgF;QAChF,YAAO,GAAG,CAAC,KAAa,EAAE,EAAE;YACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,aAAQ,GAAG,CAAC,KAAY,EAAE,EAAE;YACxB,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC,CAAC;IAbC,CAAC;IAeJ;;OAEG;IACH,KAAK,CAAC,KAAK;QACP,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CACX,+GAA+G,CAClH,CAAC;QACN,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAEO,iBAAiB;QACrB,OAAO,IAAI,EAAE,CAAC;YACV,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;gBAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACnB,MAAM;gBACV,CAAC;gBAED,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,EAAE,CAAC,KAAc,CAAC,CAAC;YACnC,CAAC;QACL,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACP,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAExC,0CAA0C;QAC1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,sBAAsB,KAAK,CAAC,EAAE,CAAC;YAC/B,gDAAgD;YAChD,0FAA0F;YAC1F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,sCAAsC;QACtC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,OAAuB;QACxB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;YACzB,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,OAAO,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,CAAC;YACd,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAhFD,oDAgFC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Node.js HTTP Streamable HTTP Server Transport
+ *
+ * This is a thin wrapper around `WebStandardStreamableHTTPServerTransport` that provides
+ * compatibility with Node.js HTTP server (IncomingMessage/ServerResponse).
+ *
+ * For web-standard environments (Cloudflare Workers, Deno, Bun), use `WebStandardStreamableHTTPServerTransport` directly.
+ */
+import { IncomingMessage, ServerResponse } from 'node:http';
+import { Transport } from '../shared/transport.js';
+import { AuthInfo } from './auth/types.js';
+import { MessageExtraInfo, JSONRPCMessage, RequestId } from '../types.js';
+import { WebStandardStreamableHTTPServerTransportOptions, EventStore, StreamId, EventId } from './webStandardStreamableHttp.js';
+export type { EventStore, StreamId, EventId };
+/**
+ * Configuration options for StreamableHTTPServerTransport
+ *
+ * This is an alias for WebStandardStreamableHTTPServerTransportOptions for backward compatibility.
+ */
+export type StreamableHTTPServerTransportOptions = WebStandardStreamableHTTPServerTransportOptions;
+/**
+ * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
+ * It supports both SSE streaming and direct HTTP responses.
+ *
+ * This is a wrapper around `WebStandardStreamableHTTPServerTransport` that provides Node.js HTTP compatibility.
+ * It uses the `@hono/node-server` library to convert between Node.js HTTP and Web Standard APIs.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Using with pre-parsed request body
+ * app.post('/mcp', (req, res) => {
+ *   transport.handleRequest(req, res, req.body);
+ * });
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+export declare class StreamableHTTPServerTransport implements Transport {
+    private _webStandardTransport;
+    private _requestListener;
+    private _requestContext;
+    constructor(options?: StreamableHTTPServerTransportOptions);
+    /**
+     * Gets the session ID for this transport instance.
+     */
+    get sessionId(): string | undefined;
+    /**
+     * Sets callback for when the transport is closed.
+     */
+    set onclose(handler: (() => void) | undefined);
+    get onclose(): (() => void) | undefined;
+    /**
+     * Sets callback for transport errors.
+     */
+    set onerror(handler: ((error: Error) => void) | undefined);
+    get onerror(): ((error: Error) => void) | undefined;
+    /**
+     * Sets callback for incoming messages.
+     */
+    set onmessage(handler: ((message: JSONRPCMessage, extra?: MessageExtraInfo) => void) | undefined);
+    get onmessage(): ((message: JSONRPCMessage, extra?: MessageExtraInfo) => void) | undefined;
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    start(): Promise<void>;
+    /**
+     * Closes the transport and all active connections.
+     */
+    close(): Promise<void>;
+    /**
+     * Sends a JSON-RPC message through the transport.
+     */
+    send(message: JSONRPCMessage, options?: {
+        relatedRequestId?: RequestId;
+    }): Promise<void>;
+    /**
+     * Handles an incoming HTTP request, whether GET or POST.
+     *
+     * This method converts Node.js HTTP objects to Web Standard Request/Response
+     * and delegates to the underlying WebStandardStreamableHTTPServerTransport.
+     *
+     * @param req - Node.js IncomingMessage, optionally with auth property from middleware
+     * @param res - Node.js ServerResponse
+     * @param parsedBody - Optional pre-parsed body from body-parser middleware
+     */
+    handleRequest(req: IncomingMessage & {
+        auth?: AuthInfo;
+    }, res: ServerResponse, parsedBody?: unknown): Promise<void>;
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId: RequestId): void;
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream(): void;
+}
+//# sourceMappingURL=streamableHttp.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttp.d.ts","sourceRoot":"","sources":["../../../src/server/streamableHttp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC1E,OAAO,EAEH,+CAA+C,EAC/C,UAAU,EACV,QAAQ,EACR,OAAO,EACV,MAAM,gCAAgC,CAAC;AAGxC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAE9C;;;;GAIG;AACH,MAAM,MAAM,oCAAoC,GAAG,+CAA+C,CAAC;AAEnG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBAAa,6BAA8B,YAAW,SAAS;IAC3D,OAAO,CAAC,qBAAqB,CAA2C;IACxE,OAAO,CAAC,gBAAgB,CAAwC;IAEhE,OAAO,CAAC,eAAe,CAAkF;gBAE7F,OAAO,GAAE,oCAAyC;IAoB9D;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,EAE5C;IAED,IAAI,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAEtC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAExD;IAED,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,EAE/F;IAED,IAAI,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC,GAAG,SAAS,CAEzF;IAED;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9F;;;;;;;;;OASG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG;QAAE,IAAI,CAAC,EAAE,QAAQ,CAAA;KAAE,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBzH;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAI1C;;;OAGG;IACH,wBAAwB,IAAI,IAAI;CAGnC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Node.js HTTP Streamable HTTP Server Transport
+ *
+ * This is a thin wrapper around `WebStandardStreamableHTTPServerTransport` that provides
+ * compatibility with Node.js HTTP server (IncomingMessage/ServerResponse).
+ *
+ * For web-standard environments (Cloudflare Workers, Deno, Bun), use `WebStandardStreamableHTTPServerTransport` directly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StreamableHTTPServerTransport = void 0;
+const node_server_1 = require("@hono/node-server");
+const webStandardStreamableHttp_js_1 = require("./webStandardStreamableHttp.js");
+/**
+ * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
+ * It supports both SSE streaming and direct HTTP responses.
+ *
+ * This is a wrapper around `WebStandardStreamableHTTPServerTransport` that provides Node.js HTTP compatibility.
+ * It uses the `@hono/node-server` library to convert between Node.js HTTP and Web Standard APIs.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new StreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Using with pre-parsed request body
+ * app.post('/mcp', (req, res) => {
+ *   transport.handleRequest(req, res, req.body);
+ * });
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+class StreamableHTTPServerTransport {
+    constructor(options = {}) {
+        // Store auth and parsedBody per request for passing through to handleRequest
+        this._requestContext = new WeakMap();
+        this._webStandardTransport = new webStandardStreamableHttp_js_1.WebStandardStreamableHTTPServerTransport(options);
+        // Create a request listener that wraps the web standard transport
+        // getRequestListener converts Node.js HTTP to Web Standard and properly handles SSE streaming
+        // overrideGlobalObjects: false prevents Hono from overwriting global Response, which would
+        // break frameworks like Next.js whose response classes extend the native Response
+        this._requestListener = (0, node_server_1.getRequestListener)(async (webRequest) => {
+            // Get context if available (set during handleRequest)
+            const context = this._requestContext.get(webRequest);
+            return this._webStandardTransport.handleRequest(webRequest, {
+                authInfo: context?.authInfo,
+                parsedBody: context?.parsedBody
+            });
+        }, { overrideGlobalObjects: false });
+    }
+    /**
+     * Gets the session ID for this transport instance.
+     */
+    get sessionId() {
+        return this._webStandardTransport.sessionId;
+    }
+    /**
+     * Sets callback for when the transport is closed.
+     */
+    set onclose(handler) {
+        this._webStandardTransport.onclose = handler;
+    }
+    get onclose() {
+        return this._webStandardTransport.onclose;
+    }
+    /**
+     * Sets callback for transport errors.
+     */
+    set onerror(handler) {
+        this._webStandardTransport.onerror = handler;
+    }
+    get onerror() {
+        return this._webStandardTransport.onerror;
+    }
+    /**
+     * Sets callback for incoming messages.
+     */
+    set onmessage(handler) {
+        this._webStandardTransport.onmessage = handler;
+    }
+    get onmessage() {
+        return this._webStandardTransport.onmessage;
+    }
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    async start() {
+        return this._webStandardTransport.start();
+    }
+    /**
+     * Closes the transport and all active connections.
+     */
+    async close() {
+        return this._webStandardTransport.close();
+    }
+    /**
+     * Sends a JSON-RPC message through the transport.
+     */
+    async send(message, options) {
+        return this._webStandardTransport.send(message, options);
+    }
+    /**
+     * Handles an incoming HTTP request, whether GET or POST.
+     *
+     * This method converts Node.js HTTP objects to Web Standard Request/Response
+     * and delegates to the underlying WebStandardStreamableHTTPServerTransport.
+     *
+     * @param req - Node.js IncomingMessage, optionally with auth property from middleware
+     * @param res - Node.js ServerResponse
+     * @param parsedBody - Optional pre-parsed body from body-parser middleware
+     */
+    async handleRequest(req, res, parsedBody) {
+        // Store context for this request to pass through auth and parsedBody
+        // We need to intercept the request creation to attach this context
+        const authInfo = req.auth;
+        // Create a custom handler that includes our context
+        // overrideGlobalObjects: false prevents Hono from overwriting global Response, which would
+        // break frameworks like Next.js whose response classes extend the native Response
+        const handler = (0, node_server_1.getRequestListener)(async (webRequest) => {
+            return this._webStandardTransport.handleRequest(webRequest, {
+                authInfo,
+                parsedBody
+            });
+        }, { overrideGlobalObjects: false });
+        // Delegate to the request listener which handles all the Node.js <-> Web Standard conversion
+        // including proper SSE streaming support
+        await handler(req, res);
+    }
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId) {
+        this._webStandardTransport.closeSSEStream(requestId);
+    }
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream() {
+        this._webStandardTransport.closeStandaloneSSEStream();
+    }
+}
+exports.StreamableHTTPServerTransport = StreamableHTTPServerTransport;
+//# sourceMappingURL=streamableHttp.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/streamableHttp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"streamableHttp.js","sourceRoot":"","sources":["../../../src/server/streamableHttp.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAGH,mDAAuD;AAIvD,iFAMwC;AAYxC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAa,6BAA6B;IAMtC,YAAY,UAAgD,EAAE;QAH9D,6EAA6E;QACrE,oBAAe,GAAoE,IAAI,OAAO,EAAE,CAAC;QAGrG,IAAI,CAAC,qBAAqB,GAAG,IAAI,uEAAwC,CAAC,OAAO,CAAC,CAAC;QAEnF,kEAAkE;QAClE,8FAA8F;QAC9F,2FAA2F;QAC3F,kFAAkF;QAClF,IAAI,CAAC,gBAAgB,GAAG,IAAA,gCAAkB,EACtC,KAAK,EAAE,UAAmB,EAAE,EAAE;YAC1B,sDAAsD;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrD,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,EAAE;gBACxD,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,UAAU,EAAE,OAAO,EAAE,UAAU;aAClC,CAAC,CAAC;QACP,CAAC,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACnC,CAAC;IACN,CAAC;IAED;;OAEG;IACH,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAAiC;QACzC,IAAI,CAAC,qBAAqB,CAAC,OAAO,GAAG,OAAO,CAAC;IACjD,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,OAAO,CAAC,OAA6C;QACrD,IAAI,CAAC,qBAAqB,CAAC,OAAO,GAAG,OAAO,CAAC;IACjD,CAAC;IAED,IAAI,OAAO;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,IAAI,SAAS,CAAC,OAAkF;QAC5F,IAAI,CAAC,qBAAqB,CAAC,SAAS,GAAG,OAAO,CAAC;IACnD,CAAC;IAED,IAAI,SAAS;QACT,OAAO,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;IAChD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACP,OAAO,IAAI,CAAC,qBAAqB,CAAC,KAAK,EAAE,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAuB,EAAE,OAA0C;QAC1E,OAAO,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,aAAa,CAAC,GAA0C,EAAE,GAAmB,EAAE,UAAoB;QACrG,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;QAE1B,oDAAoD;QACpD,2FAA2F;QAC3F,kFAAkF;QAClF,MAAM,OAAO,GAAG,IAAA,gCAAkB,EAC9B,KAAK,EAAE,UAAmB,EAAE,EAAE;YAC1B,OAAO,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,EAAE;gBACxD,QAAQ;gBACR,UAAU;aACb,CAAC,CAAC;QACP,CAAC,EACD,EAAE,qBAAqB,EAAE,KAAK,EAAE,CACnC,CAAC;QAEF,6FAA6F;QAC7F,yCAAyC;QACzC,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,SAAoB;QAC/B,IAAI,CAAC,qBAAqB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED;;;OAGG;IACH,wBAAwB;QACpB,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,CAAC;IAC1D,CAAC;CACJ;AAzID,sEAyIC"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/webStandardStreamableHttp.d.ts

@@ -0,0 +1,268 @@
+/**
+ * Web Standards Streamable HTTP Server Transport
+ *
+ * This is the core transport implementation using Web Standard APIs (Request, Response, ReadableStream).
+ * It can run on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * For Node.js Express/HTTP compatibility, use `StreamableHTTPServerTransport` which wraps this transport.
+ */
+import { Transport } from '../shared/transport.js';
+import { AuthInfo } from './auth/types.js';
+import { MessageExtraInfo, JSONRPCMessage, RequestId } from '../types.js';
+export type StreamId = string;
+export type EventId = string;
+/**
+ * Interface for resumability support via event storage
+ */
+export interface EventStore {
+    /**
+     * Stores an event for later retrieval
+     * @param streamId ID of the stream the event belongs to
+     * @param message The JSON-RPC message to store
+     * @returns The generated event ID for the stored event
+     */
+    storeEvent(streamId: StreamId, message: JSONRPCMessage): Promise<EventId>;
+    /**
+     * Get the stream ID associated with a given event ID.
+     * @param eventId The event ID to look up
+     * @returns The stream ID, or undefined if not found
+     *
+     * Optional: If not provided, the SDK will use the streamId returned by
+     * replayEventsAfter for stream mapping.
+     */
+    getStreamIdForEventId?(eventId: EventId): Promise<StreamId | undefined>;
+    replayEventsAfter(lastEventId: EventId, { send }: {
+        send: (eventId: EventId, message: JSONRPCMessage) => Promise<void>;
+    }): Promise<StreamId>;
+}
+/**
+ * Configuration options for WebStandardStreamableHTTPServerTransport
+ */
+export interface WebStandardStreamableHTTPServerTransportOptions {
+    /**
+     * Function that generates a session ID for the transport.
+     * The session ID SHOULD be globally unique and cryptographically secure (e.g., a securely generated UUID, a JWT, or a cryptographic hash)
+     *
+     * If not provided, session management is disabled (stateless mode).
+     */
+    sessionIdGenerator?: () => string;
+    /**
+     * A callback for session initialization events
+     * This is called when the server initializes a new session.
+     * Useful in cases when you need to register multiple mcp sessions
+     * and need to keep track of them.
+     * @param sessionId The generated session ID
+     */
+    onsessioninitialized?: (sessionId: string) => void | Promise<void>;
+    /**
+     * A callback for session close events
+     * This is called when the server closes a session due to a DELETE request.
+     * Useful in cases when you need to clean up resources associated with the session.
+     * Note that this is different from the transport closing, if you are handling
+     * HTTP requests from multiple nodes you might want to close each
+     * WebStandardStreamableHTTPServerTransport after a request is completed while still keeping the
+     * session open/running.
+     * @param sessionId The session ID that was closed
+     */
+    onsessionclosed?: (sessionId: string) => void | Promise<void>;
+    /**
+     * If true, the server will return JSON responses instead of starting an SSE stream.
+     * This can be useful for simple request/response scenarios without streaming.
+     * Default is false (SSE streams are preferred).
+     */
+    enableJsonResponse?: boolean;
+    /**
+     * Event store for resumability support
+     * If provided, resumability will be enabled, allowing clients to reconnect and resume messages
+     */
+    eventStore?: EventStore;
+    /**
+     * List of allowed host header values for DNS rebinding protection.
+     * If not specified, host validation is disabled.
+     * @deprecated Use external middleware for host validation instead.
+     */
+    allowedHosts?: string[];
+    /**
+     * List of allowed origin header values for DNS rebinding protection.
+     * If not specified, origin validation is disabled.
+     * @deprecated Use external middleware for origin validation instead.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Enable DNS rebinding protection (requires allowedHosts and/or allowedOrigins to be configured).
+     * Default is false for backwards compatibility.
+     * @deprecated Use external middleware for DNS rebinding protection instead.
+     */
+    enableDnsRebindingProtection?: boolean;
+    /**
+     * Retry interval in milliseconds to suggest to clients in SSE retry field.
+     * When set, the server will send a retry field in SSE priming events to control
+     * client reconnection timing for polling behavior.
+     */
+    retryInterval?: number;
+}
+/**
+ * Options for handling a request
+ */
+export interface HandleRequestOptions {
+    /**
+     * Pre-parsed request body. If provided, the transport will use this instead of parsing req.json().
+     * Useful when using body-parser middleware that has already parsed the body.
+     */
+    parsedBody?: unknown;
+    /**
+     * Authentication info from middleware. If provided, will be passed to message handlers.
+     */
+    authInfo?: AuthInfo;
+}
+/**
+ * Server transport for Web Standards Streamable HTTP: this implements the MCP Streamable HTTP transport specification
+ * using Web Standard APIs (Request, Response, ReadableStream).
+ *
+ * This transport works on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => crypto.randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Hono.js usage
+ * app.all('/mcp', async (c) => {
+ *   return transport.handleRequest(c.req.raw);
+ * });
+ *
+ * // Cloudflare Workers usage
+ * export default {
+ *   async fetch(request: Request): Promise<Response> {
+ *     return transport.handleRequest(request);
+ *   }
+ * };
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+export declare class WebStandardStreamableHTTPServerTransport implements Transport {
+    private sessionIdGenerator;
+    private _started;
+    private _hasHandledRequest;
+    private _streamMapping;
+    private _requestToStreamMapping;
+    private _requestResponseMap;
+    private _initialized;
+    private _enableJsonResponse;
+    private _standaloneSseStreamId;
+    private _eventStore?;
+    private _onsessioninitialized?;
+    private _onsessionclosed?;
+    private _allowedHosts?;
+    private _allowedOrigins?;
+    private _enableDnsRebindingProtection;
+    private _retryInterval?;
+    sessionId?: string;
+    onclose?: () => void;
+    onerror?: (error: Error) => void;
+    onmessage?: (message: JSONRPCMessage, extra?: MessageExtraInfo) => void;
+    constructor(options?: WebStandardStreamableHTTPServerTransportOptions);
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    start(): Promise<void>;
+    /**
+     * Helper to create a JSON error response
+     */
+    private createJsonErrorResponse;
+    /**
+     * Validates request headers for DNS rebinding protection.
+     * @returns Error response if validation fails, undefined if validation passes.
+     */
+    private validateRequestHeaders;
+    /**
+     * Handles an incoming HTTP request, whether GET, POST, or DELETE
+     * Returns a Response object (Web Standard)
+     */
+    handleRequest(req: Request, options?: HandleRequestOptions): Promise<Response>;
+    /**
+     * Writes a priming event to establish resumption capability.
+     * Only sends if eventStore is configured (opt-in for resumability) and
+     * the client's protocol version supports empty SSE data (>= 2025-11-25).
+     */
+    private writePrimingEvent;
+    /**
+     * Handles GET requests for SSE stream
+     */
+    private handleGetRequest;
+    /**
+     * Replays events that would have been sent after the specified event ID
+     * Only used when resumability is enabled
+     */
+    private replayEvents;
+    /**
+     * Writes an event to an SSE stream via controller with proper formatting
+     */
+    private writeSSEEvent;
+    /**
+     * Handles unsupported requests (PUT, PATCH, etc.)
+     */
+    private handleUnsupportedRequest;
+    /**
+     * Handles POST requests containing JSON-RPC messages
+     */
+    private handlePostRequest;
+    /**
+     * Handles DELETE requests to terminate sessions
+     */
+    private handleDeleteRequest;
+    /**
+     * Validates session ID for non-initialization requests.
+     * Returns Response error if invalid, undefined otherwise
+     */
+    private validateSession;
+    /**
+     * Validates the MCP-Protocol-Version header on incoming requests.
+     *
+     * For initialization: Version negotiation handles unknown versions gracefully
+     * (server responds with its supported version).
+     *
+     * For subsequent requests with MCP-Protocol-Version header:
+     * - Accept if in supported list
+     * - 400 if unsupported
+     *
+     * For HTTP requests without the MCP-Protocol-Version header:
+     * - Accept and default to the version negotiated at initialization
+     */
+    private validateProtocolVersion;
+    close(): Promise<void>;
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId: RequestId): void;
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream(): void;
+    send(message: JSONRPCMessage, options?: {
+        relatedRequestId?: RequestId;
+    }): Promise<void>;
+}
+//# sourceMappingURL=webStandardStreamableHttp.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/webStandardStreamableHttp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webStandardStreamableHttp.d.ts","sourceRoot":"","sources":["../../../src/server/webStandardStreamableHttp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EACH,gBAAgB,EAMhB,cAAc,EAEd,SAAS,EAGZ,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAC9B,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC;AAE7B;;GAEG;AACH,MAAM,WAAW,UAAU;IACvB;;;;;OAKG;IACH,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1E;;;;;;;OAOG;IACH,qBAAqB,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;IAExE,iBAAiB,CACb,WAAW,EAAE,OAAO,EACpB,EACI,IAAI,EACP,EAAE;QACC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;KACtE,GACF,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxB;AAgBD;;GAEG;AACH,MAAM,WAAW,+CAA+C;IAC5D;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,MAAM,CAAC;IAElC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IAExB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAEvC;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;OAEG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,wCAAyC,YAAW,SAAS;IAEtE,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,kBAAkB,CAAkB;IAC5C,OAAO,CAAC,cAAc,CAAyC;IAC/D,OAAO,CAAC,uBAAuB,CAAqC;IACpE,OAAO,CAAC,mBAAmB,CAA6C;IACxE,OAAO,CAAC,YAAY,CAAkB;IACtC,OAAO,CAAC,mBAAmB,CAAkB;IAC7C,OAAO,CAAC,sBAAsB,CAAyB;IACvD,OAAO,CAAC,WAAW,CAAC,CAAa;IACjC,OAAO,CAAC,qBAAqB,CAAC,CAA8C;IAC5E,OAAO,CAAC,gBAAgB,CAAC,CAA8C;IACvE,OAAO,CAAC,aAAa,CAAC,CAAW;IACjC,OAAO,CAAC,eAAe,CAAC,CAAW;IACnC,OAAO,CAAC,6BAA6B,CAAU;IAC/C,OAAO,CAAC,cAAc,CAAC,CAAS;IAEhC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;gBAE5D,OAAO,GAAE,+CAAoD;IAYzE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IA6B9B;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,QAAQ,CAAC;IA0BpF;;;;OAIG;YACW,iBAAiB;IA0B/B;;OAEG;YACW,gBAAgB;IA6E9B;;;OAGG;YACW,YAAY;IAmF1B;;OAEG;IACH,OAAO,CAAC,aAAa;IAqBrB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAqBhC;;OAEG;YACW,iBAAiB;IAqN/B;;OAEG;YACW,mBAAmB;IAejC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA6BvB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,uBAAuB;IAmBzB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B;;;;OAIG;IACH,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAU1C;;;OAGG;IACH,wBAAwB,IAAI,IAAI;IAO1B,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAiGjG"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/webStandardStreamableHttp.js

@@ -0,0 +1,755 @@
+"use strict";
+/**
+ * Web Standards Streamable HTTP Server Transport
+ *
+ * This is the core transport implementation using Web Standard APIs (Request, Response, ReadableStream).
+ * It can run on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * For Node.js Express/HTTP compatibility, use `StreamableHTTPServerTransport` which wraps this transport.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebStandardStreamableHTTPServerTransport = void 0;
+const types_js_1 = require("../types.js");
+/**
+ * Server transport for Web Standards Streamable HTTP: this implements the MCP Streamable HTTP transport specification
+ * using Web Standard APIs (Request, Response, ReadableStream).
+ *
+ * This transport works on any runtime that supports Web Standards: Node.js 18+, Cloudflare Workers, Deno, Bun, etc.
+ *
+ * Usage example:
+ *
+ * ```typescript
+ * // Stateful mode - server sets the session ID
+ * const statefulTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: () => crypto.randomUUID(),
+ * });
+ *
+ * // Stateless mode - explicitly set session ID to undefined
+ * const statelessTransport = new WebStandardStreamableHTTPServerTransport({
+ *   sessionIdGenerator: undefined,
+ * });
+ *
+ * // Hono.js usage
+ * app.all('/mcp', async (c) => {
+ *   return transport.handleRequest(c.req.raw);
+ * });
+ *
+ * // Cloudflare Workers usage
+ * export default {
+ *   async fetch(request: Request): Promise<Response> {
+ *     return transport.handleRequest(request);
+ *   }
+ * };
+ * ```
+ *
+ * In stateful mode:
+ * - Session ID is generated and included in response headers
+ * - Session ID is always included in initialization responses
+ * - Requests with invalid session IDs are rejected with 404 Not Found
+ * - Non-initialization requests without a session ID are rejected with 400 Bad Request
+ * - State is maintained in-memory (connections, message history)
+ *
+ * In stateless mode:
+ * - No Session ID is included in any responses
+ * - No session validation is performed
+ */
+class WebStandardStreamableHTTPServerTransport {
+    constructor(options = {}) {
+        this._started = false;
+        this._hasHandledRequest = false;
+        this._streamMapping = new Map();
+        this._requestToStreamMapping = new Map();
+        this._requestResponseMap = new Map();
+        this._initialized = false;
+        this._enableJsonResponse = false;
+        this._standaloneSseStreamId = '_GET_stream';
+        this.sessionIdGenerator = options.sessionIdGenerator;
+        this._enableJsonResponse = options.enableJsonResponse ?? false;
+        this._eventStore = options.eventStore;
+        this._onsessioninitialized = options.onsessioninitialized;
+        this._onsessionclosed = options.onsessionclosed;
+        this._allowedHosts = options.allowedHosts;
+        this._allowedOrigins = options.allowedOrigins;
+        this._enableDnsRebindingProtection = options.enableDnsRebindingProtection ?? false;
+        this._retryInterval = options.retryInterval;
+    }
+    /**
+     * Starts the transport. This is required by the Transport interface but is a no-op
+     * for the Streamable HTTP transport as connections are managed per-request.
+     */
+    async start() {
+        if (this._started) {
+            throw new Error('Transport already started');
+        }
+        this._started = true;
+    }
+    /**
+     * Helper to create a JSON error response
+     */
+    createJsonErrorResponse(status, code, message, options) {
+        const error = { code, message };
+        if (options?.data !== undefined) {
+            error.data = options.data;
+        }
+        return new Response(JSON.stringify({
+            jsonrpc: '2.0',
+            error,
+            id: null
+        }), {
+            status,
+            headers: {
+                'Content-Type': 'application/json',
+                ...options?.headers
+            }
+        });
+    }
+    /**
+     * Validates request headers for DNS rebinding protection.
+     * @returns Error response if validation fails, undefined if validation passes.
+     */
+    validateRequestHeaders(req) {
+        // Skip validation if protection is not enabled
+        if (!this._enableDnsRebindingProtection) {
+            return undefined;
+        }
+        // Validate Host header if allowedHosts is configured
+        if (this._allowedHosts && this._allowedHosts.length > 0) {
+            const hostHeader = req.headers.get('host');
+            if (!hostHeader || !this._allowedHosts.includes(hostHeader)) {
+                const error = `Invalid Host header: ${hostHeader}`;
+                this.onerror?.(new Error(error));
+                return this.createJsonErrorResponse(403, -32000, error);
+            }
+        }
+        // Validate Origin header if allowedOrigins is configured
+        if (this._allowedOrigins && this._allowedOrigins.length > 0) {
+            const originHeader = req.headers.get('origin');
+            if (originHeader && !this._allowedOrigins.includes(originHeader)) {
+                const error = `Invalid Origin header: ${originHeader}`;
+                this.onerror?.(new Error(error));
+                return this.createJsonErrorResponse(403, -32000, error);
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Handles an incoming HTTP request, whether GET, POST, or DELETE
+     * Returns a Response object (Web Standard)
+     */
+    async handleRequest(req, options) {
+        // In stateless mode (no sessionIdGenerator), each request must use a fresh transport.
+        // Reusing a stateless transport causes message ID collisions between clients.
+        if (!this.sessionIdGenerator && this._hasHandledRequest) {
+            throw new Error('Stateless transport cannot be reused across requests. Create a new transport per request.');
+        }
+        this._hasHandledRequest = true;
+        // Validate request headers for DNS rebinding protection
+        const validationError = this.validateRequestHeaders(req);
+        if (validationError) {
+            return validationError;
+        }
+        switch (req.method) {
+            case 'POST':
+                return this.handlePostRequest(req, options);
+            case 'GET':
+                return this.handleGetRequest(req);
+            case 'DELETE':
+                return this.handleDeleteRequest(req);
+            default:
+                return this.handleUnsupportedRequest();
+        }
+    }
+    /**
+     * Writes a priming event to establish resumption capability.
+     * Only sends if eventStore is configured (opt-in for resumability) and
+     * the client's protocol version supports empty SSE data (>= 2025-11-25).
+     */
+    async writePrimingEvent(controller, encoder, streamId, protocolVersion) {
+        if (!this._eventStore) {
+            return;
+        }
+        // Priming events have empty data which older clients cannot handle.
+        // Only send priming events to clients with protocol version >= 2025-11-25
+        // which includes the fix for handling empty SSE data.
+        if (protocolVersion < '2025-11-25') {
+            return;
+        }
+        const primingEventId = await this._eventStore.storeEvent(streamId, {});
+        let primingEvent = `id: ${primingEventId}\ndata: \n\n`;
+        if (this._retryInterval !== undefined) {
+            primingEvent = `id: ${primingEventId}\nretry: ${this._retryInterval}\ndata: \n\n`;
+        }
+        controller.enqueue(encoder.encode(primingEvent));
+    }
+    /**
+     * Handles GET requests for SSE stream
+     */
+    async handleGetRequest(req) {
+        // The client MUST include an Accept header, listing text/event-stream as a supported content type.
+        const acceptHeader = req.headers.get('accept');
+        if (!acceptHeader?.includes('text/event-stream')) {
+            this.onerror?.(new Error('Not Acceptable: Client must accept text/event-stream'));
+            return this.createJsonErrorResponse(406, -32000, 'Not Acceptable: Client must accept text/event-stream');
+        }
+        // If an Mcp-Session-Id is returned by the server during initialization,
+        // clients using the Streamable HTTP transport MUST include it
+        // in the Mcp-Session-Id header on all of their subsequent HTTP requests.
+        const sessionError = this.validateSession(req);
+        if (sessionError) {
+            return sessionError;
+        }
+        const protocolError = this.validateProtocolVersion(req);
+        if (protocolError) {
+            return protocolError;
+        }
+        // Handle resumability: check for Last-Event-ID header
+        if (this._eventStore) {
+            const lastEventId = req.headers.get('last-event-id');
+            if (lastEventId) {
+                return this.replayEvents(lastEventId);
+            }
+        }
+        // Check if there's already an active standalone SSE stream for this session
+        if (this._streamMapping.get(this._standaloneSseStreamId) !== undefined) {
+            // Only one GET SSE stream is allowed per session
+            this.onerror?.(new Error('Conflict: Only one SSE stream is allowed per session'));
+            return this.createJsonErrorResponse(409, -32000, 'Conflict: Only one SSE stream is allowed per session');
+        }
+        const encoder = new TextEncoder();
+        let streamController;
+        // Create a ReadableStream with a controller we can use to push SSE events
+        const readable = new ReadableStream({
+            start: controller => {
+                streamController = controller;
+            },
+            cancel: () => {
+                // Stream was cancelled by client
+                this._streamMapping.delete(this._standaloneSseStreamId);
+            }
+        });
+        const headers = {
+            'Content-Type': 'text/event-stream',
+            'Cache-Control': 'no-cache, no-transform',
+            Connection: 'keep-alive'
+        };
+        // After initialization, always include the session ID if we have one
+        if (this.sessionId !== undefined) {
+            headers['mcp-session-id'] = this.sessionId;
+        }
+        // Store the stream mapping with the controller for pushing data
+        this._streamMapping.set(this._standaloneSseStreamId, {
+            controller: streamController,
+            encoder,
+            cleanup: () => {
+                this._streamMapping.delete(this._standaloneSseStreamId);
+                try {
+                    streamController.close();
+                }
+                catch {
+                    // Controller might already be closed
+                }
+            }
+        });
+        return new Response(readable, { headers });
+    }
+    /**
+     * Replays events that would have been sent after the specified event ID
+     * Only used when resumability is enabled
+     */
+    async replayEvents(lastEventId) {
+        if (!this._eventStore) {
+            this.onerror?.(new Error('Event store not configured'));
+            return this.createJsonErrorResponse(400, -32000, 'Event store not configured');
+        }
+        try {
+            // If getStreamIdForEventId is available, use it for conflict checking
+            let streamId;
+            if (this._eventStore.getStreamIdForEventId) {
+                streamId = await this._eventStore.getStreamIdForEventId(lastEventId);
+                if (!streamId) {
+                    this.onerror?.(new Error('Invalid event ID format'));
+                    return this.createJsonErrorResponse(400, -32000, 'Invalid event ID format');
+                }
+                // Check conflict with the SAME streamId we'll use for mapping
+                if (this._streamMapping.get(streamId) !== undefined) {
+                    this.onerror?.(new Error('Conflict: Stream already has an active connection'));
+                    return this.createJsonErrorResponse(409, -32000, 'Conflict: Stream already has an active connection');
+                }
+            }
+            const headers = {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache, no-transform',
+                Connection: 'keep-alive'
+            };
+            if (this.sessionId !== undefined) {
+                headers['mcp-session-id'] = this.sessionId;
+            }
+            // Create a ReadableStream with controller for SSE
+            const encoder = new TextEncoder();
+            let streamController;
+            const readable = new ReadableStream({
+                start: controller => {
+                    streamController = controller;
+                },
+                cancel: () => {
+                    // Stream was cancelled by client
+                    // Cleanup will be handled by the mapping
+                }
+            });
+            // Replay events - returns the streamId for backwards compatibility
+            const replayedStreamId = await this._eventStore.replayEventsAfter(lastEventId, {
+                send: async (eventId, message) => {
+                    const success = this.writeSSEEvent(streamController, encoder, message, eventId);
+                    if (!success) {
+                        this.onerror?.(new Error('Failed replay events'));
+                        try {
+                            streamController.close();
+                        }
+                        catch {
+                            // Controller might already be closed
+                        }
+                    }
+                }
+            });
+            this._streamMapping.set(replayedStreamId, {
+                controller: streamController,
+                encoder,
+                cleanup: () => {
+                    this._streamMapping.delete(replayedStreamId);
+                    try {
+                        streamController.close();
+                    }
+                    catch {
+                        // Controller might already be closed
+                    }
+                }
+            });
+            return new Response(readable, { headers });
+        }
+        catch (error) {
+            this.onerror?.(error);
+            return this.createJsonErrorResponse(500, -32000, 'Error replaying events');
+        }
+    }
+    /**
+     * Writes an event to an SSE stream via controller with proper formatting
+     */
+    writeSSEEvent(controller, encoder, message, eventId) {
+        try {
+            let eventData = `event: message\n`;
+            // Include event ID if provided - this is important for resumability
+            if (eventId) {
+                eventData += `id: ${eventId}\n`;
+            }
+            eventData += `data: ${JSON.stringify(message)}\n\n`;
+            controller.enqueue(encoder.encode(eventData));
+            return true;
+        }
+        catch (error) {
+            this.onerror?.(error);
+            return false;
+        }
+    }
+    /**
+     * Handles unsupported requests (PUT, PATCH, etc.)
+     */
+    handleUnsupportedRequest() {
+        this.onerror?.(new Error('Method not allowed.'));
+        return new Response(JSON.stringify({
+            jsonrpc: '2.0',
+            error: {
+                code: -32000,
+                message: 'Method not allowed.'
+            },
+            id: null
+        }), {
+            status: 405,
+            headers: {
+                Allow: 'GET, POST, DELETE',
+                'Content-Type': 'application/json'
+            }
+        });
+    }
+    /**
+     * Handles POST requests containing JSON-RPC messages
+     */
+    async handlePostRequest(req, options) {
+        try {
+            // Validate the Accept header
+            const acceptHeader = req.headers.get('accept');
+            // The client MUST include an Accept header, listing both application/json and text/event-stream as supported content types.
+            if (!acceptHeader?.includes('application/json') || !acceptHeader.includes('text/event-stream')) {
+                this.onerror?.(new Error('Not Acceptable: Client must accept both application/json and text/event-stream'));
+                return this.createJsonErrorResponse(406, -32000, 'Not Acceptable: Client must accept both application/json and text/event-stream');
+            }
+            const ct = req.headers.get('content-type');
+            if (!ct || !ct.includes('application/json')) {
+                this.onerror?.(new Error('Unsupported Media Type: Content-Type must be application/json'));
+                return this.createJsonErrorResponse(415, -32000, 'Unsupported Media Type: Content-Type must be application/json');
+            }
+            // Build request info from headers and URL
+            const requestInfo = {
+                headers: Object.fromEntries(req.headers.entries()),
+                url: new URL(req.url)
+            };
+            let rawMessage;
+            if (options?.parsedBody !== undefined) {
+                rawMessage = options.parsedBody;
+            }
+            else {
+                try {
+                    rawMessage = await req.json();
+                }
+                catch {
+                    this.onerror?.(new Error('Parse error: Invalid JSON'));
+                    return this.createJsonErrorResponse(400, -32700, 'Parse error: Invalid JSON');
+                }
+            }
+            let messages;
+            // handle batch and single messages
+            try {
+                if (Array.isArray(rawMessage)) {
+                    messages = rawMessage.map(msg => types_js_1.JSONRPCMessageSchema.parse(msg));
+                }
+                else {
+                    messages = [types_js_1.JSONRPCMessageSchema.parse(rawMessage)];
+                }
+            }
+            catch {
+                this.onerror?.(new Error('Parse error: Invalid JSON-RPC message'));
+                return this.createJsonErrorResponse(400, -32700, 'Parse error: Invalid JSON-RPC message');
+            }
+            // Check if this is an initialization request
+            // https://spec.modelcontextprotocol.io/specification/2025-03-26/basic/lifecycle/
+            const isInitializationRequest = messages.some(types_js_1.isInitializeRequest);
+            if (isInitializationRequest) {
+                // If it's a server with session management and the session ID is already set we should reject the request
+                // to avoid re-initialization.
+                if (this._initialized && this.sessionId !== undefined) {
+                    this.onerror?.(new Error('Invalid Request: Server already initialized'));
+                    return this.createJsonErrorResponse(400, -32600, 'Invalid Request: Server already initialized');
+                }
+                if (messages.length > 1) {
+                    this.onerror?.(new Error('Invalid Request: Only one initialization request is allowed'));
+                    return this.createJsonErrorResponse(400, -32600, 'Invalid Request: Only one initialization request is allowed');
+                }
+                this.sessionId = this.sessionIdGenerator?.();
+                this._initialized = true;
+                // If we have a session ID and an onsessioninitialized handler, call it immediately
+                // This is needed in cases where the server needs to keep track of multiple sessions
+                if (this.sessionId && this._onsessioninitialized) {
+                    await Promise.resolve(this._onsessioninitialized(this.sessionId));
+                }
+            }
+            if (!isInitializationRequest) {
+                // If an Mcp-Session-Id is returned by the server during initialization,
+                // clients using the Streamable HTTP transport MUST include it
+                // in the Mcp-Session-Id header on all of their subsequent HTTP requests.
+                const sessionError = this.validateSession(req);
+                if (sessionError) {
+                    return sessionError;
+                }
+                // Mcp-Protocol-Version header is required for all requests after initialization.
+                const protocolError = this.validateProtocolVersion(req);
+                if (protocolError) {
+                    return protocolError;
+                }
+            }
+            // check if it contains requests
+            const hasRequests = messages.some(types_js_1.isJSONRPCRequest);
+            if (!hasRequests) {
+                // if it only contains notifications or responses, return 202
+                for (const message of messages) {
+                    this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo });
+                }
+                return new Response(null, { status: 202 });
+            }
+            // The default behavior is to use SSE streaming
+            // but in some cases server will return JSON responses
+            const streamId = crypto.randomUUID();
+            // Extract protocol version for priming event decision.
+            // For initialize requests, get from request params.
+            // For other requests, get from header (already validated).
+            const initRequest = messages.find(m => (0, types_js_1.isInitializeRequest)(m));
+            const clientProtocolVersion = initRequest
+                ? initRequest.params.protocolVersion
+                : (req.headers.get('mcp-protocol-version') ?? types_js_1.DEFAULT_NEGOTIATED_PROTOCOL_VERSION);
+            if (this._enableJsonResponse) {
+                // For JSON response mode, return a Promise that resolves when all responses are ready
+                return new Promise(resolve => {
+                    this._streamMapping.set(streamId, {
+                        resolveJson: resolve,
+                        cleanup: () => {
+                            this._streamMapping.delete(streamId);
+                        }
+                    });
+                    for (const message of messages) {
+                        if ((0, types_js_1.isJSONRPCRequest)(message)) {
+                            this._requestToStreamMapping.set(message.id, streamId);
+                        }
+                    }
+                    for (const message of messages) {
+                        this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo });
+                    }
+                });
+            }
+            // SSE streaming mode - use ReadableStream with controller for more reliable data pushing
+            const encoder = new TextEncoder();
+            let streamController;
+            const readable = new ReadableStream({
+                start: controller => {
+                    streamController = controller;
+                },
+                cancel: () => {
+                    // Stream was cancelled by client
+                    this._streamMapping.delete(streamId);
+                }
+            });
+            const headers = {
+                'Content-Type': 'text/event-stream',
+                'Cache-Control': 'no-cache',
+                Connection: 'keep-alive'
+            };
+            // After initialization, always include the session ID if we have one
+            if (this.sessionId !== undefined) {
+                headers['mcp-session-id'] = this.sessionId;
+            }
+            // Store the response for this request to send messages back through this connection
+            // We need to track by request ID to maintain the connection
+            for (const message of messages) {
+                if ((0, types_js_1.isJSONRPCRequest)(message)) {
+                    this._streamMapping.set(streamId, {
+                        controller: streamController,
+                        encoder,
+                        cleanup: () => {
+                            this._streamMapping.delete(streamId);
+                            try {
+                                streamController.close();
+                            }
+                            catch {
+                                // Controller might already be closed
+                            }
+                        }
+                    });
+                    this._requestToStreamMapping.set(message.id, streamId);
+                }
+            }
+            // Write priming event if event store is configured (after mapping is set up)
+            await this.writePrimingEvent(streamController, encoder, streamId, clientProtocolVersion);
+            // handle each message
+            for (const message of messages) {
+                // Build closeSSEStream callback for requests when eventStore is configured
+                // AND client supports resumability (protocol version >= 2025-11-25).
+                // Old clients can't resume if the stream is closed early because they
+                // didn't receive a priming event with an event ID.
+                let closeSSEStream;
+                let closeStandaloneSSEStream;
+                if ((0, types_js_1.isJSONRPCRequest)(message) && this._eventStore && clientProtocolVersion >= '2025-11-25') {
+                    closeSSEStream = () => {
+                        this.closeSSEStream(message.id);
+                    };
+                    closeStandaloneSSEStream = () => {
+                        this.closeStandaloneSSEStream();
+                    };
+                }
+                this.onmessage?.(message, { authInfo: options?.authInfo, requestInfo, closeSSEStream, closeStandaloneSSEStream });
+            }
+            // The server SHOULD NOT close the SSE stream before sending all JSON-RPC responses
+            // This will be handled by the send() method when responses are ready
+            return new Response(readable, { status: 200, headers });
+        }
+        catch (error) {
+            // return JSON-RPC formatted error
+            this.onerror?.(error);
+            return this.createJsonErrorResponse(400, -32700, 'Parse error', { data: String(error) });
+        }
+    }
+    /**
+     * Handles DELETE requests to terminate sessions
+     */
+    async handleDeleteRequest(req) {
+        const sessionError = this.validateSession(req);
+        if (sessionError) {
+            return sessionError;
+        }
+        const protocolError = this.validateProtocolVersion(req);
+        if (protocolError) {
+            return protocolError;
+        }
+        await Promise.resolve(this._onsessionclosed?.(this.sessionId));
+        await this.close();
+        return new Response(null, { status: 200 });
+    }
+    /**
+     * Validates session ID for non-initialization requests.
+     * Returns Response error if invalid, undefined otherwise
+     */
+    validateSession(req) {
+        if (this.sessionIdGenerator === undefined) {
+            // If the sessionIdGenerator ID is not set, the session management is disabled
+            // and we don't need to validate the session ID
+            return undefined;
+        }
+        if (!this._initialized) {
+            // If the server has not been initialized yet, reject all requests
+            this.onerror?.(new Error('Bad Request: Server not initialized'));
+            return this.createJsonErrorResponse(400, -32000, 'Bad Request: Server not initialized');
+        }
+        const sessionId = req.headers.get('mcp-session-id');
+        if (!sessionId) {
+            // Non-initialization requests without a session ID should return 400 Bad Request
+            this.onerror?.(new Error('Bad Request: Mcp-Session-Id header is required'));
+            return this.createJsonErrorResponse(400, -32000, 'Bad Request: Mcp-Session-Id header is required');
+        }
+        if (sessionId !== this.sessionId) {
+            // Reject requests with invalid session ID with 404 Not Found
+            this.onerror?.(new Error('Session not found'));
+            return this.createJsonErrorResponse(404, -32001, 'Session not found');
+        }
+        return undefined;
+    }
+    /**
+     * Validates the MCP-Protocol-Version header on incoming requests.
+     *
+     * For initialization: Version negotiation handles unknown versions gracefully
+     * (server responds with its supported version).
+     *
+     * For subsequent requests with MCP-Protocol-Version header:
+     * - Accept if in supported list
+     * - 400 if unsupported
+     *
+     * For HTTP requests without the MCP-Protocol-Version header:
+     * - Accept and default to the version negotiated at initialization
+     */
+    validateProtocolVersion(req) {
+        const protocolVersion = req.headers.get('mcp-protocol-version');
+        if (protocolVersion !== null && !types_js_1.SUPPORTED_PROTOCOL_VERSIONS.includes(protocolVersion)) {
+            this.onerror?.(new Error(`Bad Request: Unsupported protocol version: ${protocolVersion}` +
+                ` (supported versions: ${types_js_1.SUPPORTED_PROTOCOL_VERSIONS.join(', ')})`));
+            return this.createJsonErrorResponse(400, -32000, `Bad Request: Unsupported protocol version: ${protocolVersion} (supported versions: ${types_js_1.SUPPORTED_PROTOCOL_VERSIONS.join(', ')})`);
+        }
+        return undefined;
+    }
+    async close() {
+        // Close all SSE connections
+        this._streamMapping.forEach(({ cleanup }) => {
+            cleanup();
+        });
+        this._streamMapping.clear();
+        // Clear any pending responses
+        this._requestResponseMap.clear();
+        this.onclose?.();
+    }
+    /**
+     * Close an SSE stream for a specific request, triggering client reconnection.
+     * Use this to implement polling behavior during long-running operations -
+     * client will reconnect after the retry interval specified in the priming event.
+     */
+    closeSSEStream(requestId) {
+        const streamId = this._requestToStreamMapping.get(requestId);
+        if (!streamId)
+            return;
+        const stream = this._streamMapping.get(streamId);
+        if (stream) {
+            stream.cleanup();
+        }
+    }
+    /**
+     * Close the standalone GET SSE stream, triggering client reconnection.
+     * Use this to implement polling behavior for server-initiated notifications.
+     */
+    closeStandaloneSSEStream() {
+        const stream = this._streamMapping.get(this._standaloneSseStreamId);
+        if (stream) {
+            stream.cleanup();
+        }
+    }
+    async send(message, options) {
+        let requestId = options?.relatedRequestId;
+        if ((0, types_js_1.isJSONRPCResultResponse)(message) || (0, types_js_1.isJSONRPCErrorResponse)(message)) {
+            // If the message is a response, use the request ID from the message
+            requestId = message.id;
+        }
+        // Check if this message should be sent on the standalone SSE stream (no request ID)
+        // Ignore notifications from tools (which have relatedRequestId set)
+        // Those will be sent via dedicated response SSE streams
+        if (requestId === undefined) {
+            // For standalone SSE streams, we can only send requests and notifications
+            if ((0, types_js_1.isJSONRPCResultResponse)(message) || (0, types_js_1.isJSONRPCErrorResponse)(message)) {
+                throw new Error('Cannot send a response on a standalone SSE stream unless resuming a previous client request');
+            }
+            // Generate and store event ID if event store is provided
+            // Store even if stream is disconnected so events can be replayed on reconnect
+            let eventId;
+            if (this._eventStore) {
+                // Stores the event and gets the generated event ID
+                eventId = await this._eventStore.storeEvent(this._standaloneSseStreamId, message);
+            }
+            const standaloneSse = this._streamMapping.get(this._standaloneSseStreamId);
+            if (standaloneSse === undefined) {
+                // Stream is disconnected - event is stored for replay, nothing more to do
+                return;
+            }
+            // Send the message to the standalone SSE stream
+            if (standaloneSse.controller && standaloneSse.encoder) {
+                this.writeSSEEvent(standaloneSse.controller, standaloneSse.encoder, message, eventId);
+            }
+            return;
+        }
+        // Get the response for this request
+        const streamId = this._requestToStreamMapping.get(requestId);
+        if (!streamId) {
+            throw new Error(`No connection established for request ID: ${String(requestId)}`);
+        }
+        const stream = this._streamMapping.get(streamId);
+        if (!this._enableJsonResponse && stream?.controller && stream?.encoder) {
+            // For SSE responses, generate event ID if event store is provided
+            let eventId;
+            if (this._eventStore) {
+                eventId = await this._eventStore.storeEvent(streamId, message);
+            }
+            // Write the event to the response stream
+            this.writeSSEEvent(stream.controller, stream.encoder, message, eventId);
+        }
+        if ((0, types_js_1.isJSONRPCResultResponse)(message) || (0, types_js_1.isJSONRPCErrorResponse)(message)) {
+            this._requestResponseMap.set(requestId, message);
+            const relatedIds = Array.from(this._requestToStreamMapping.entries())
+                .filter(([_, sid]) => sid === streamId)
+                .map(([id]) => id);
+            // Check if we have responses for all requests using this connection
+            const allResponsesReady = relatedIds.every(id => this._requestResponseMap.has(id));
+            if (allResponsesReady) {
+                if (!stream) {
+                    throw new Error(`No connection established for request ID: ${String(requestId)}`);
+                }
+                if (this._enableJsonResponse && stream.resolveJson) {
+                    // All responses ready, send as JSON
+                    const headers = {
+                        'Content-Type': 'application/json'
+                    };
+                    if (this.sessionId !== undefined) {
+                        headers['mcp-session-id'] = this.sessionId;
+                    }
+                    const responses = relatedIds.map(id => this._requestResponseMap.get(id));
+                    if (responses.length === 1) {
+                        stream.resolveJson(new Response(JSON.stringify(responses[0]), { status: 200, headers }));
+                    }
+                    else {
+                        stream.resolveJson(new Response(JSON.stringify(responses), { status: 200, headers }));
+                    }
+                }
+                else {
+                    // End the SSE stream
+                    stream.cleanup();
+                }
+                // Clean up
+                for (const id of relatedIds) {
+                    this._requestResponseMap.delete(id);
+                    this._requestToStreamMapping.delete(id);
+                }
+            }
+        }
+    }
+}
+exports.WebStandardStreamableHTTPServerTransport = WebStandardStreamableHTTPServerTransport;
+//# sourceMappingURL=webStandardStreamableHttp.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.d.ts

@@ -0,0 +1,84 @@
+import type * as z3 from 'zod/v3';
+import type * as z4 from 'zod/v4/core';
+export type AnySchema = z3.ZodTypeAny | z4.$ZodType;
+export type AnyObjectSchema = z3.AnyZodObject | z4.$ZodObject | AnySchema;
+export type ZodRawShapeCompat = Record<string, AnySchema>;
+export interface ZodV3Internal {
+    _def?: {
+        typeName?: string;
+        value?: unknown;
+        values?: unknown[];
+        shape?: Record<string, AnySchema> | (() => Record<string, AnySchema>);
+        description?: string;
+    };
+    shape?: Record<string, AnySchema> | (() => Record<string, AnySchema>);
+    value?: unknown;
+}
+export interface ZodV4Internal {
+    _zod?: {
+        def?: {
+            type?: string;
+            value?: unknown;
+            values?: unknown[];
+            shape?: Record<string, AnySchema> | (() => Record<string, AnySchema>);
+        };
+    };
+    value?: unknown;
+}
+export type SchemaOutput<S> = S extends z3.ZodTypeAny ? z3.infer<S> : S extends z4.$ZodType ? z4.output<S> : never;
+export type SchemaInput<S> = S extends z3.ZodTypeAny ? z3.input<S> : S extends z4.$ZodType ? z4.input<S> : never;
+/**
+ * Infers the output type from a ZodRawShapeCompat (raw shape object).
+ * Maps over each key in the shape and infers the output type from each schema.
+ */
+export type ShapeOutput<Shape extends ZodRawShapeCompat> = {
+    [K in keyof Shape]: SchemaOutput<Shape[K]>;
+};
+export declare function isZ4Schema(s: AnySchema): s is z4.$ZodType;
+export declare function objectFromShape(shape: ZodRawShapeCompat): AnyObjectSchema;
+export declare function safeParse<S extends AnySchema>(schema: S, data: unknown): {
+    success: true;
+    data: SchemaOutput<S>;
+} | {
+    success: false;
+    error: unknown;
+};
+export declare function safeParseAsync<S extends AnySchema>(schema: S, data: unknown): Promise<{
+    success: true;
+    data: SchemaOutput<S>;
+} | {
+    success: false;
+    error: unknown;
+}>;
+export declare function getObjectShape(schema: AnyObjectSchema | undefined): Record<string, AnySchema> | undefined;
+/**
+ * Normalizes a schema to an object schema. Handles both:
+ * - Already-constructed object schemas (v3 or v4)
+ * - Raw shapes that need to be wrapped into object schemas
+ */
+export declare function normalizeObjectSchema(schema: AnySchema | ZodRawShapeCompat | undefined): AnyObjectSchema | undefined;
+/**
+ * Safely extracts an error message from a parse result error.
+ * Zod errors can have different structures, so we handle various cases.
+ */
+export declare function getParseErrorMessage(error: unknown): string;
+/**
+ * Gets the description from a schema, if available.
+ * Works with both Zod v3 and v4.
+ *
+ * Both versions expose a `.description` getter that returns the description
+ * from their respective internal storage (v3: _def, v4: globalRegistry).
+ */
+export declare function getSchemaDescription(schema: AnySchema): string | undefined;
+/**
+ * Checks if a schema is optional.
+ * Works with both Zod v3 and v4.
+ */
+export declare function isSchemaOptional(schema: AnySchema): boolean;
+/**
+ * Gets the literal value from a schema, if it's a literal schema.
+ * Works with both Zod v3 and v4.
+ * Returns undefined if the schema is not a literal or the value cannot be determined.
+ */
+export declare function getLiteralValue(schema: AnySchema): unknown;
+//# sourceMappingURL=zod-compat.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-compat.d.ts","sourceRoot":"","sources":["../../../src/server/zod-compat.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,KAAK,EAAE,MAAM,QAAQ,CAAC;AAClC,OAAO,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAMvC,MAAM,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,QAAQ,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,EAAE,CAAC,YAAY,GAAG,EAAE,CAAC,UAAU,GAAG,SAAS,CAAC;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;AAI1D,MAAM,WAAW,aAAa;IAC1B,IAAI,CAAC,EAAE;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QACtE,WAAW,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACtE,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC1B,IAAI,CAAC,EAAE;QACH,GAAG,CAAC,EAAE;YACF,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,KAAK,CAAC,EAAE,OAAO,CAAC;YAChB,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;SACzE,CAAC;KACL,CAAC;IACF,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAGD,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEnH,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;AAEjH;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,iBAAiB,IAAI;KACtD,CAAC,IAAI,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;CAC7C,CAAC;AAGF,wBAAgB,UAAU,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAIzD;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAWzE;AAGD,wBAAgB,SAAS,CAAC,CAAC,SAAS,SAAS,EACzC,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACd;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAS/E;AAED,wBAAsB,cAAc,CAAC,CAAC,SAAS,SAAS,EACpD,MAAM,EAAE,CAAC,EACT,IAAI,EAAE,OAAO,GACd,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CASxF;AAGD,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAyBzG;AAGD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAiDpH;AAGD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAoB3D;AAGD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAE1E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAW3D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAwB1D"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js

@@ -0,0 +1,244 @@
+"use strict";
+// zod-compat.ts
+// ----------------------------------------------------
+// Unified types + helpers to accept Zod v3 and v4 (Mini)
+// ----------------------------------------------------
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isZ4Schema = isZ4Schema;
+exports.objectFromShape = objectFromShape;
+exports.safeParse = safeParse;
+exports.safeParseAsync = safeParseAsync;
+exports.getObjectShape = getObjectShape;
+exports.normalizeObjectSchema = normalizeObjectSchema;
+exports.getParseErrorMessage = getParseErrorMessage;
+exports.getSchemaDescription = getSchemaDescription;
+exports.isSchemaOptional = isSchemaOptional;
+exports.getLiteralValue = getLiteralValue;
+const z3rt = __importStar(require("zod/v3"));
+const z4mini = __importStar(require("zod/v4-mini"));
+// --- Runtime detection ---
+function isZ4Schema(s) {
+    // Present on Zod 4 (Classic & Mini) schemas; absent on Zod 3
+    const schema = s;
+    return !!schema._zod;
+}
+// --- Schema construction ---
+function objectFromShape(shape) {
+    const values = Object.values(shape);
+    if (values.length === 0)
+        return z4mini.object({}); // default to v4 Mini
+    const allV4 = values.every(isZ4Schema);
+    const allV3 = values.every(s => !isZ4Schema(s));
+    if (allV4)
+        return z4mini.object(shape);
+    if (allV3)
+        return z3rt.object(shape);
+    throw new Error('Mixed Zod versions detected in object shape.');
+}
+// --- Unified parsing ---
+function safeParse(schema, data) {
+    if (isZ4Schema(schema)) {
+        // Mini exposes top-level safeParse
+        const result = z4mini.safeParse(schema, data);
+        return result;
+    }
+    const v3Schema = schema;
+    const result = v3Schema.safeParse(data);
+    return result;
+}
+async function safeParseAsync(schema, data) {
+    if (isZ4Schema(schema)) {
+        // Mini exposes top-level safeParseAsync
+        const result = await z4mini.safeParseAsync(schema, data);
+        return result;
+    }
+    const v3Schema = schema;
+    const result = await v3Schema.safeParseAsync(data);
+    return result;
+}
+// --- Shape extraction ---
+function getObjectShape(schema) {
+    if (!schema)
+        return undefined;
+    // Zod v3 exposes `.shape`; Zod v4 keeps the shape on `_zod.def.shape`
+    let rawShape;
+    if (isZ4Schema(schema)) {
+        const v4Schema = schema;
+        rawShape = v4Schema._zod?.def?.shape;
+    }
+    else {
+        const v3Schema = schema;
+        rawShape = v3Schema.shape;
+    }
+    if (!rawShape)
+        return undefined;
+    if (typeof rawShape === 'function') {
+        try {
+            return rawShape();
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return rawShape;
+}
+// --- Schema normalization ---
+/**
+ * Normalizes a schema to an object schema. Handles both:
+ * - Already-constructed object schemas (v3 or v4)
+ * - Raw shapes that need to be wrapped into object schemas
+ */
+function normalizeObjectSchema(schema) {
+    if (!schema)
+        return undefined;
+    // First check if it's a raw shape (Record<string, AnySchema>)
+    // Raw shapes don't have _def or _zod properties and aren't schemas themselves
+    if (typeof schema === 'object') {
+        // Check if it's actually a ZodRawShapeCompat (not a schema instance)
+        // by checking if it lacks schema-like internal properties
+        const asV3 = schema;
+        const asV4 = schema;
+        // If it's not a schema instance (no _def or _zod), it might be a raw shape
+        if (!asV3._def && !asV4._zod) {
+            // Check if all values are schemas (heuristic to confirm it's a raw shape)
+            const values = Object.values(schema);
+            if (values.length > 0 &&
+                values.every(v => typeof v === 'object' &&
+                    v !== null &&
+                    (v._def !== undefined ||
+                        v._zod !== undefined ||
+                        typeof v.parse === 'function'))) {
+                return objectFromShape(schema);
+            }
+        }
+    }
+    // If we get here, it should be an AnySchema (not a raw shape)
+    // Check if it's already an object schema
+    if (isZ4Schema(schema)) {
+        // Check if it's a v4 object
+        const v4Schema = schema;
+        const def = v4Schema._zod?.def;
+        if (def && (def.type === 'object' || def.shape !== undefined)) {
+            return schema;
+        }
+    }
+    else {
+        // Check if it's a v3 object
+        const v3Schema = schema;
+        if (v3Schema.shape !== undefined) {
+            return schema;
+        }
+    }
+    return undefined;
+}
+// --- Error message extraction ---
+/**
+ * Safely extracts an error message from a parse result error.
+ * Zod errors can have different structures, so we handle various cases.
+ */
+function getParseErrorMessage(error) {
+    if (error && typeof error === 'object') {
+        // Try common error structures
+        if ('message' in error && typeof error.message === 'string') {
+            return error.message;
+        }
+        if ('issues' in error && Array.isArray(error.issues) && error.issues.length > 0) {
+            const firstIssue = error.issues[0];
+            if (firstIssue && typeof firstIssue === 'object' && 'message' in firstIssue) {
+                return String(firstIssue.message);
+            }
+        }
+        // Fallback: try to stringify the error
+        try {
+            return JSON.stringify(error);
+        }
+        catch {
+            return String(error);
+        }
+    }
+    return String(error);
+}
+// --- Schema metadata access ---
+/**
+ * Gets the description from a schema, if available.
+ * Works with both Zod v3 and v4.
+ *
+ * Both versions expose a `.description` getter that returns the description
+ * from their respective internal storage (v3: _def, v4: globalRegistry).
+ */
+function getSchemaDescription(schema) {
+    return schema.description;
+}
+/**
+ * Checks if a schema is optional.
+ * Works with both Zod v3 and v4.
+ */
+function isSchemaOptional(schema) {
+    if (isZ4Schema(schema)) {
+        const v4Schema = schema;
+        return v4Schema._zod?.def?.type === 'optional';
+    }
+    const v3Schema = schema;
+    // v3 has isOptional() method
+    if (typeof schema.isOptional === 'function') {
+        return schema.isOptional();
+    }
+    return v3Schema._def?.typeName === 'ZodOptional';
+}
+/**
+ * Gets the literal value from a schema, if it's a literal schema.
+ * Works with both Zod v3 and v4.
+ * Returns undefined if the schema is not a literal or the value cannot be determined.
+ */
+function getLiteralValue(schema) {
+    if (isZ4Schema(schema)) {
+        const v4Schema = schema;
+        const def = v4Schema._zod?.def;
+        if (def) {
+            // Try various ways to get the literal value
+            if (def.value !== undefined)
+                return def.value;
+            if (Array.isArray(def.values) && def.values.length > 0) {
+                return def.values[0];
+            }
+        }
+    }
+    const v3Schema = schema;
+    const def = v3Schema._def;
+    if (def) {
+        if (def.value !== undefined)
+            return def.value;
+        if (Array.isArray(def.values) && def.values.length > 0) {
+            return def.values[0];
+        }
+    }
+    // Fallback: check for direct value property (some Zod versions)
+    const directValue = schema.value;
+    if (directValue !== undefined)
+        return directValue;
+    return undefined;
+}
+//# sourceMappingURL=zod-compat.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.d.ts

@@ -0,0 +1,12 @@
+import { AnySchema, AnyObjectSchema } from './zod-compat.js';
+type JsonSchema = Record<string, unknown>;
+type CommonOpts = {
+    strictUnions?: boolean;
+    pipeStrategy?: 'input' | 'output';
+    target?: 'jsonSchema7' | 'draft-7' | 'jsonSchema2019-09' | 'draft-2020-12';
+};
+export declare function toJsonSchemaCompat(schema: AnyObjectSchema, opts?: CommonOpts): JsonSchema;
+export declare function getMethodLiteral(schema: AnyObjectSchema): string;
+export declare function parseWithCompat(schema: AnySchema, data: unknown): unknown;
+export {};
+//# sourceMappingURL=zod-json-schema-compat.d.ts.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-json-schema-compat.d.ts","sourceRoot":"","sources":["../../../src/server/zod-json-schema-compat.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,SAAS,EAAE,eAAe,EAA0D,MAAM,iBAAiB,CAAC;AAGrH,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG1C,KAAK,UAAU,GAAG;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,CAAC;CAC9E,CAAC;AASF,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAczF;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAahE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAMzE"}

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js

@@ -0,0 +1,79 @@
+"use strict";
+// zod-json-schema-compat.ts
+// ----------------------------------------------------
+// JSON Schema conversion for both Zod v3 and Zod v4 (Mini)
+// v3 uses your vendored converter; v4 uses Mini's toJSONSchema
+// ----------------------------------------------------
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toJsonSchemaCompat = toJsonSchemaCompat;
+exports.getMethodLiteral = getMethodLiteral;
+exports.parseWithCompat = parseWithCompat;
+const z4mini = __importStar(require("zod/v4-mini"));
+const zod_compat_js_1 = require("./zod-compat.js");
+const zod_to_json_schema_1 = require("zod-to-json-schema");
+function mapMiniTarget(t) {
+    if (!t)
+        return 'draft-7';
+    if (t === 'jsonSchema7' || t === 'draft-7')
+        return 'draft-7';
+    if (t === 'jsonSchema2019-09' || t === 'draft-2020-12')
+        return 'draft-2020-12';
+    return 'draft-7'; // fallback
+}
+function toJsonSchemaCompat(schema, opts) {
+    if ((0, zod_compat_js_1.isZ4Schema)(schema)) {
+        // v4 branch — use Mini's built-in toJSONSchema
+        return z4mini.toJSONSchema(schema, {
+            target: mapMiniTarget(opts?.target),
+            io: opts?.pipeStrategy ?? 'input'
+        });
+    }
+    // v3 branch — use vendored converter
+    return (0, zod_to_json_schema_1.zodToJsonSchema)(schema, {
+        strictUnions: opts?.strictUnions ?? true,
+        pipeStrategy: opts?.pipeStrategy ?? 'input'
+    });
+}
+function getMethodLiteral(schema) {
+    const shape = (0, zod_compat_js_1.getObjectShape)(schema);
+    const methodSchema = shape?.method;
+    if (!methodSchema) {
+        throw new Error('Schema is missing a method literal');
+    }
+    const value = (0, zod_compat_js_1.getLiteralValue)(methodSchema);
+    if (typeof value !== 'string') {
+        throw new Error('Schema method literal must be a string');
+    }
+    return value;
+}
+function parseWithCompat(schema, data) {
+    const result = (0, zod_compat_js_1.safeParse)(schema, data);
+    if (!result.success) {
+        throw result.error;
+    }
+    return result.data;
+}
+//# sourceMappingURL=zod-json-schema-compat.js.map

node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-json-schema-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-json-schema-compat.js","sourceRoot":"","sources":["../../../src/server/zod-json-schema-compat.ts"],"names":[],"mappings":";AAAA,4BAA4B;AAC5B,uDAAuD;AACvD,2DAA2D;AAC3D,+DAA+D;AAC/D,uDAAuD;;;;;;;;;;;;;;;;;;;;;;;;;AA0BvD,gDAcC;AAED,4CAaC;AAED,0CAMC;AA1DD,oDAAsC;AAEtC,mDAAqH;AACrH,2DAAqD;AAWrD,SAAS,aAAa,CAAC,CAAmC;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,IAAI,CAAC,KAAK,aAAa,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC,KAAK,mBAAmB,IAAI,CAAC,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IAC/E,OAAO,SAAS,CAAC,CAAC,WAAW;AACjC,CAAC;AAED,SAAgB,kBAAkB,CAAC,MAAuB,EAAE,IAAiB;IACzE,IAAI,IAAA,0BAAU,EAAC,MAAM,CAAC,EAAE,CAAC;QACrB,+CAA+C;QAC/C,OAAO,MAAM,CAAC,YAAY,CAAC,MAAsB,EAAE;YAC/C,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC;YACnC,EAAE,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO;SACpC,CAAe,CAAC;IACrB,CAAC;IAED,qCAAqC;IACrC,OAAO,IAAA,oCAAe,EAAC,MAAuB,EAAE;QAC5C,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,IAAI;QACxC,YAAY,EAAE,IAAI,EAAE,YAAY,IAAI,OAAO;KAC9C,CAAe,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB,CAAC,MAAuB;IACpD,MAAM,KAAK,GAAG,IAAA,8BAAc,EAAC,MAAM,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,EAAE,MAA+B,CAAC;IAC5D,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,IAAA,+BAAe,EAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAgB,eAAe,CAAC,MAAiB,EAAE,IAAa;IAC5D,MAAM,MAAM,GAAG,IAAA,yBAAS,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC"}