@agentcomms/whatsapp 0.17.0 → 0.18.1

package/THIRD_PARTY_LICENSES

@@ -8,7 +8,7 @@ Generated by scripts/third-party-licenses.mjs from the 15 packages the bundler p
 
 
 ----------------------------------------------------------------------------------------------------
-@modelcontextprotocol/client@2.0.0 — MIT
+@modelcontextprotocol/client@2.3.1 — Apache-2.0
   https://modelcontextprotocol.io
 ----------------------------------------------------------------------------------------------------
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -228,7 +228,7 @@ Documentation in this project (excluding specifications) is licensed under
 CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ----------------------------------------------------------------------------------------------------
-@modelcontextprotocol/core@2.0.0 — MIT
+@modelcontextprotocol/core@2.3.1 — Apache-2.0
   https://modelcontextprotocol.io
 ----------------------------------------------------------------------------------------------------
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -448,7 +448,7 @@ Documentation in this project (excluding specifications) is licensed under
 CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ----------------------------------------------------------------------------------------------------
-@modelcontextprotocol/server@2.0.0 — MIT
+@modelcontextprotocol/server@2.3.1 — Apache-2.0
   https://modelcontextprotocol.io
 ----------------------------------------------------------------------------------------------------
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -816,7 +816,7 @@ pkce-challenge@5.0.1 — MIT
 ----------------------------------------------------------------------------------------------------
 MIT License
 
-Copyright (c) 2019 
+Copyright (c) 2019
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -836,7 +836,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ----------------------------------------------------------------------------------------------------
-postal-mime@3.0.0 — MIT-0
+postal-mime@4.0.5 — MIT-0
   https://postal-mime.postalsys.com
 ----------------------------------------------------------------------------------------------------
 Copyright (c) 2021-2025 Andris Reinman

package/dist/cli.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { $ as exemptFromUpdateGate, A as requireAccount, B as PATH_OPTIONS, Ct as writeResult, Et as VERSION, F as expandSource, G as approveAndWaitSentence, H as absoluteSearchPath, J as childEnvironment, K as approveChangeAtTerminal, L as CHANNEL_SERVERS, M as storeIdentity, N as checkStorePath, O as PLATFORM, P as defaultStorePath, Q as escapeForDisplay, R as CommsError, S as chatRefOf, St as withFileLock, U as agentMarker, W as approvalsOf, X as colorEnabled, Y as cliHandoffs, Z as commandPathOf, _ as WhatsAppContext, a as CHAT_KINDS, at as lookupName, b as requireSupportedNode, c as searchMessages, ct as openCore, dt as renderInstall, et as gatedChangeAtTerminal, f as draftMessage, ft as renderPrune, gt as serverPruneChange, ht as serverInstallChange, i as probeStore, it as isCommsError, j as requireNamedConfig, k as newWhatsAppAccount, l as Presenter, lt as paint, m as listKey, mt as runCommand, nt as handoffText, o as listChats, ot as nameAvailable, p as Visibility, pt as resolvePaths, q as canPrompt, r as whatsappStatus, rt as installExitStatus, s as readChat, st as nameShapeProblem, t as syncAccount, tt as handoffSentence, u as innerText, ut as pathOverridesFromCliOptions, v as WhatsAppIndex, vt as truncateDisplay, wt as CALLER, xt as windowsSystemProgram, yt as updateGateAtTerminal, z as EXIT_CODES } from "./sync-7LwbofMr.mjs";
+import { $ as exemptFromUpdateGate, A as requireAccount, B as PATH_OPTIONS, Ct as writeResult, Et as VERSION, F as expandSource, G as approveAndWaitSentence, H as absoluteSearchPath, J as childEnvironment, K as approveChangeAtTerminal, L as CHANNEL_SERVERS, M as storeIdentity, N as checkStorePath, O as PLATFORM, P as defaultStorePath, Q as escapeForDisplay, R as CommsError, S as chatRefOf, St as withFileLock, U as agentMarker, W as approvalsOf, X as colorEnabled, Y as cliHandoffs, Z as commandPathOf, _ as WhatsAppContext, a as CHAT_KINDS, at as lookupName, b as requireSupportedNode, c as searchMessages, ct as openCore, dt as renderInstall, et as gatedChangeAtTerminal, f as draftMessage, ft as renderPrune, gt as serverPruneChange, ht as serverInstallChange, i as probeStore, it as isCommsError, j as requireNamedConfig, k as newWhatsAppAccount, l as Presenter, lt as paint, m as listKey, mt as runCommand, nt as handoffText, o as listChats, ot as nameAvailable, p as Visibility, pt as resolvePaths, q as canPrompt, r as whatsappStatus, rt as installExitStatus, s as readChat, st as nameShapeProblem, t as syncAccount, tt as handoffSentence, u as innerText, ut as pathOverridesFromCliOptions, v as WhatsAppIndex, vt as truncateDisplay, wt as CALLER, xt as windowsSystemProgram, yt as updateGateAtTerminal, z as EXIT_CODES } from "./sync-q1U9jYX3.mjs";
 import { rm } from "node:fs/promises";
 import path, { delimiter, join } from "node:path";
 import { stripVTControlCharacters } from "node:util";
@@ -3582,7 +3582,7 @@ a macOS dialog may be waiting) · 77 permission needed (macOS privacy) · 78 con
 		ran = true;
 		exitCode = await runCommand(output(), async () => {
 			requireSupportedNode();
-			await (deps.startMcp ?? (await import("./stdio-entry-ZWI-4ayI.mjs")).startWhatsAppStdioServer)({
+			await (deps.startMcp ?? (await import("./stdio-entry-DeaLN63P.mjs")).startWhatsAppStdioServer)({
 				env,
 				platform,
 				...deps,

package/dist/{dist-COPefvtq-COGS2a-K.mjs → dist-C7DG2LdL-l0mj9_dH.mjs}

@@ -1,5 +1,5 @@
-import { A as stampErrorBrands, C as mergeCapabilities, D as runInputRequiredFlow, E as resolveInputRequiredDriverConfig, M as ListChangedOptionsBaseSchema, N as SERVER_INFO_META_KEY, O as scanXMcpHeaderDeclarations, P as SUBSCRIPTION_ID_META_KEY, S as legacyProtocolVersions, T as parseSchema, _ as isJSONRPCErrorResponse, b as isModernProtocolVersion, c as SdkErrorCode, d as __commonJSMin, f as __toESM, g as declaredDialect, h as codecForVersion, i as ProtocolErrorCode, j as DiscoverResultSchema, l as SdkHttpError, m as buildMcpParamHeaders, n as Protocol, o as SUPPORTED_MODERN_PROTOCOL_VERSIONS, p as brandedHasInstance, r as ProtocolError, s as SdkError, t as MODERN_WIRE_REVISION, u as UnsupportedProtocolVersionError, v as isJSONRPCRequest, w as modernProtocolVersions, x as isSpecType, y as isJSONRPCResultResponse } from "./src-D_zzAWoS-BhK0GFdq-oo-8IJem.mjs";
-//#region ../core/dist/dist-COPefvtq.mjs
+import { A as stampErrorBrands, C as mergeCapabilities, D as runInputRequiredFlow, E as resolveInputRequiredDriverConfig, M as ListChangedOptionsBaseSchema, N as SERVER_INFO_META_KEY, O as scanXMcpHeaderDeclarations, P as SUBSCRIPTION_ID_META_KEY, S as legacyProtocolVersions, T as parseSchema, _ as isJSONRPCErrorResponse, b as isModernProtocolVersion, c as SdkErrorCode, d as __commonJSMin, f as __toESM, g as declaredDialect, h as codecForVersion, i as ProtocolErrorCode, j as DiscoverResultSchema, l as SdkHttpError, m as buildMcpParamHeaders, n as Protocol, o as SUPPORTED_MODERN_PROTOCOL_VERSIONS, p as brandedHasInstance, r as ProtocolError, s as SdkError, t as MODERN_WIRE_REVISION, u as UnsupportedProtocolVersionError, v as isJSONRPCRequest, w as modernProtocolVersions, x as isSpecType, y as isJSONRPCResultResponse } from "./src-WCy6ifGf-DXrNj-15-D0oRtifb.mjs";
+//#region ../core/dist/dist-C7DG2LdL.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -7241,10 +7241,12 @@ var RegistrationRejectedError = class extends OAuthClientFlowError {
 };
 /**
 * Thrown by the token-exchange and refresh paths when the resolved token
-* endpoint is not `https:` and is not a loopback host (SEP-2207). This is a
-* configuration error — re-authorizing cannot fix it — so it intentionally does
-* **not** extend `OAuthError` and `auth()`'s refresh branch rethrows it instead
-* of falling through to a fresh `/authorize` redirect.
+* endpoint is not `https:` and is not a loopback host. The MCP authorization
+* specification requires authorization server endpoints to use HTTPS; loopback
+* hosts are exempt here for local development. This is a configuration error —
+* re-authorizing cannot fix it — so it intentionally does **not** extend
+* `OAuthError` and `auth()`'s refresh branch rethrows it instead of falling
+* through to a fresh `/authorize` redirect.
 */
 var InsecureTokenEndpointError = class extends OAuthClientFlowError {
 	static {
@@ -7253,7 +7255,7 @@ var InsecureTokenEndpointError = class extends OAuthClientFlowError {
 	/** The token endpoint URL that was rejected. */
 	tokenEndpoint;
 	constructor(tokenEndpoint) {
-		super(`Refusing to send credentials to non-https token endpoint '${tokenEndpoint}'. OAuth token requests MUST use TLS (localhost / 127.0.0.1 / ::1 are exempt).`);
+		super(`Refusing to send credentials to non-https token endpoint '${tokenEndpoint}'. OAuth token requests MUST use TLS (localhost / *.localhost / 127.0.0.1 / ::1 are exempt).`);
 		this.tokenEndpoint = tokenEndpoint;
 	}
 };
@@ -7278,21 +7280,25 @@ var InsecureTokenEndpointError = class extends OAuthClientFlowError {
 * `requiredScope`, which appears in the error message).
 */
 /**
-* Thrown by `auth()` on the authorization-code callback leg when the
-* authorization server resolved by discovery differs from the one recorded in
-* `discoveryState()` at redirect time. The `authorization_code` and PKCE
-* `code_verifier` are bound to the AS that minted the code (RFC 7636); sending
-* them to a different AS's token endpoint is a credential-exfiltration vector.
+* Thrown by `auth()` and `fetchToken()` when the authorization server in use differs
+* from the one a credential is bound to and the flow cannot simply start over:
 *
-* This is the only runtime check left in the SEP-2352 model — stored tokens and
-* client credentials are protected structurally by the `issuer` stamp instead.
+* - on the authorization-code callback leg, when it differs from the one recorded
+*   in `discoveryState()` at redirect time — the `authorization_code` and PKCE
+*   `code_verifier` are bound to the AS that minted the code (RFC 7636);
+* - for client information whose `issuer` stamp names a different authorization
+*   server on a provider that cannot re-register (no `saveClientInformation()`,
+*   e.g. the bundled static-credential providers); `fetchToken()` throws for any provider.
+*
+* Stored tokens and re-registrable client information are protected structurally
+* by the `issuer` stamp instead (they read back as absent).
 */
 var AuthorizationServerMismatchError = class extends OAuthClientFlowError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.AuthorizationServerMismatchError" });
 	}
 	constructor(recordedIssuer, currentIssuer) {
-		super(`Authorization server changed between redirect and callback (redirected to ${JSON.stringify(recordedIssuer)}, callback resolved ${JSON.stringify(currentIssuer)}); refusing to send authorization_code/code_verifier to a different token endpoint`);
+		super(`Authorization server mismatch: credentials are bound to ${JSON.stringify(recordedIssuer)} but this call resolved ${JSON.stringify(currentIssuer)}; refusing to present them to a different authorization server`);
 		this.recordedIssuer = recordedIssuer;
 		this.currentIssuer = currentIssuer;
 	}
@@ -7902,6 +7908,10 @@ function classifyProbeOutcome(outcome, context) {
 		case "rpc-error": return classifyRpcError(outcome, context);
 		case "http-error": return classifyHttpError(outcome, context);
 		case "network-error": return classifyNetworkError(outcome.error, context);
+		case "unusable-reply": return {
+			kind: "error",
+			error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: the server answered with an unusable reply (${describeError(outcome.error)})`, { cause: outcome.error }, { cause: outcome.error })
+		};
 		case "auth-required": return {
 			kind: "error",
 			error: outcome.error
@@ -7992,7 +8002,7 @@ function classifyNetworkError(error, context) {
 	if (context.environment === "browser" && isOpaqueFetchTypeError(error)) return { kind: "legacy" };
 	return {
 		kind: "error",
-		error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error)}`, { cause: error })
+		error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: ${describeError(error)}`, { cause: error }, { cause: error })
 	};
 }
 function isOpaqueFetchTypeError(error) {
@@ -8236,6 +8246,11 @@ function buildProbeRequest(id, protocolVersion, clientInfo, capabilities) {
 		}) }
 	};
 }
+/** True for what the transport throws when the probe was answered 2xx without a usable reply. */
+function isUnusableReplyError(error) {
+	if (error instanceof SdkError && error.code === SdkErrorCode.ClientHttpUnexpectedContent) return true;
+	return error instanceof Error && error.name === "SyntaxError";
+}
 function normalizeReply(reply, timeoutMs) {
 	switch (reply.kind) {
 		case "response": return reply.error === void 0 ? {
@@ -8260,6 +8275,10 @@ function normalizeReply(reply, timeoutMs) {
 					statusText: error.data.statusText
 				};
 			}
+			if (isUnusableReplyError(error)) return {
+				kind: "unusable-reply",
+				error
+			};
 			return {
 				kind: "network-error",
 				error
@@ -9142,7 +9161,7 @@ var Client = class extends Protocol {
 		}, options);
 		const hit = await this._serveFromCache("prompts/list", void 0, options);
 		if (hit !== void 0) return hit;
-		return this._listAllPages("prompts/list", params, options, (acc, page) => acc.prompts.push(...page.prompts));
+		return this._listAllPages("prompts/list", params, options, (r) => r.prompts);
 	}
 	/**
 	* Lists available resources.
@@ -9181,7 +9200,7 @@ var Client = class extends Protocol {
 		}, options);
 		const hit = await this._serveFromCache("resources/list", void 0, options);
 		if (hit !== void 0) return hit;
-		return this._listAllPages("resources/list", params, options, (acc, page) => acc.resources.push(...page.resources));
+		return this._listAllPages("resources/list", params, options, (r) => r.resources);
 	}
 	/**
 	* Lists available resource URI templates for dynamic resources.
@@ -9206,7 +9225,7 @@ var Client = class extends Protocol {
 		}, options);
 		const hit = await this._serveFromCache("resources/templates/list", void 0, options);
 		if (hit !== void 0) return hit;
-		return this._listAllPages("resources/templates/list", params, options, (acc, page) => acc.resourceTemplates.push(...page.resourceTemplates));
+		return this._listAllPages("resources/templates/list", params, options, (r) => r.resourceTemplates);
 	}
 	/**
 	* Walk every page of a paginated list verb, aggregate, and write ONE
@@ -9214,8 +9233,7 @@ var Client = class extends Protocol {
 	* methods' no-`cursor` auto-aggregate path. Page 1's result object is
 	* mutated in place (its items array is extended; `nextCursor` is
 	* cleared); page-1 metadata (`ttlMs`, `cacheScope`, `_meta`) is preserved.
-	* A `nextCursor` that repeats stops the walk (defence against a
-	* non-converging server, mcp.d's `drainList` guard);
+	* A page with the same items and `nextCursor` as the previous page ends the walk;
 	* {@linkcode ClientOptions.listMaxPages} is a hard cap — hitting it
 	* throws, so a partial aggregate is never cached. The
 	* captured-generation guard skips the write when a `list_changed` landed
@@ -9230,7 +9248,7 @@ var Client = class extends Protocol {
 	* trace context) supplied to the public `list*()` reaches every wire
 	* request the walk issues.
 	*/
-	async _listAllPages(method, baseParams, options, append, finalize) {
+	async _listAllPages(method, baseParams, options, items, finalize) {
 		const bypass = options?.cacheMode === "bypass";
 		const generation = this._cache.captureGeneration(method);
 		const acc = await this.request({
@@ -9238,14 +9256,13 @@ var Client = class extends Protocol {
 			...baseParams && { params: { ...baseParams } }
 		}, options);
 		let cursor = acc.nextCursor;
-		const seen = /* @__PURE__ */ new Set();
+		let previous = acc;
 		let pages = 1;
-		while (cursor !== void 0 && !seen.has(cursor)) {
+		while (cursor !== void 0) {
 			if (this._listMaxPages !== 0 && pages >= this._listMaxPages) throw new SdkError(SdkErrorCode.ListPaginationExceeded, `${method}: exceeded listMaxPages (${this._listMaxPages}); server pagination did not terminate`, {
 				method,
 				listMaxPages: this._listMaxPages
 			});
-			seen.add(cursor);
 			const page = await this.request({
 				method,
 				params: {
@@ -9253,7 +9270,9 @@ var Client = class extends Protocol {
 					cursor
 				}
 			}, options);
-			append(acc, page);
+			if (page.nextCursor === cursor && JSON.stringify(items(page)) === JSON.stringify(items(previous))) break;
+			items(acc).push(...items(page));
+			previous = page;
 			cursor = page.nextCursor;
 			pages++;
 		}
@@ -9514,19 +9533,22 @@ var Client = class extends Protocol {
 				notifications: filter
 			}
 		};
+		const routeSendFailure = (error) => {
+			settle({
+				cause: "remote",
+				error: error instanceof Error ? error : new Error(String(error))
+			});
+		};
 		try {
-			await this.transport.send(jsonrpcRequest, {
+			this.transport.send(jsonrpcRequest, {
 				requestSignal: requestAbort.signal,
 				onRequestStreamEnd: () => settle({
 					cause: "remote",
 					error: /* @__PURE__ */ new Error("subscriptions/listen: stream ended")
 				})
-			});
+			}).catch(routeSendFailure);
 		} catch (error) {
-			settle({
-				cause: "remote",
-				error: error instanceof Error ? error : new Error(String(error))
-			});
+			routeSendFailure(error);
 		}
 		return {
 			honoredFilter: await opening,
@@ -9778,7 +9800,7 @@ var Client = class extends Protocol {
 		}
 		const hit = await this._serveFromCache("tools/list", void 0, options);
 		if (hit !== void 0) return hit;
-		return this._listAllPages("tools/list", params, options, (acc, page) => acc.tools.push(...page.tools), (acc) => this._excludeInvalidXMcpHeaderTools(acc));
+		return this._listAllPages("tools/list", params, options, (r) => r.tools, (acc) => this._excludeInvalidXMcpHeaderTools(acc));
 	}
 	/**
 	* SEP-2243 (protocol revision 2026-07-28): a Streamable HTTP client MUST