@caplets/core 0.18.2 → 0.18.3

package/dist/{completion-L23s2FGB.js → completion-Cq1z7ci2.js}

@@ -1,4 +1,4 @@
-import { Ct as resolveProjectConfigPath, Mt as __exportAll, Ot as CapletsError, St as resolveProjectCapletsRoot, bt as resolveCapletsRoot, gt as loadConfigWithSources, vt as DEFAULT_AUTH_DIR, xt as resolveConfigPath, yt as DEFAULT_COMPLETION_CACHE_DIR } from "./options-bnsSREid.js";
+import { Ct as resolveProjectConfigPath, Mt as __exportAll, Ot as CapletsError, St as resolveProjectCapletsRoot, bt as resolveCapletsRoot, gt as loadConfigWithSources, vt as DEFAULT_AUTH_DIR, xt as resolveConfigPath, yt as DEFAULT_COMPLETION_CACHE_DIR } from "./options-j9p3L3r1.js";
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { createHash } from "node:crypto";

package/dist/index.js

@@ -1,8 +1,8 @@
-import { $ as assertCompleteRequestPrompt, A as CreateMessageResultSchema, At as toSafeError, B as JSONRPCMessageSchema, C as AjvJsonSchemaValidator, D as CallToolRequestSchema, Dt as CAPLETS_ERROR_CODES, E as toJsonSchemaCompat, Et as SERVER_ID_PATTERN, F as EmptyResultSchema, G as ListRootsResultSchema, H as ListPromptsRequestSchema, I as ErrorCode, J as McpError, K as ListToolsRequestSchema, L as GetPromptRequestSchema, M as CreateTaskResultSchema, Nt as __require, O as CallToolResultSchema, Ot as CapletsError, P as ElicitResultSchema, Pt as __toESM, R as InitializeRequestSchema, S as assertToolsCallTaskCapability, St as resolveProjectCapletsRoot, T as mergeCapabilities, Tt as validateCapletFile, U as ListResourceTemplatesRequestSchema, V as LATEST_PROTOCOL_VERSION, W as ListResourcesRequestSchema, X as SUPPORTED_PROTOCOL_VERSIONS, Y as ReadResourceRequestSchema, Z as SetLevelRequestSchema, _t as parseConfig, a as resolveCapletsServer, at as getLiteralValue, bt as resolveCapletsRoot, c as ServerRegistry, ct as getSchemaDescription, d as runOAuthFlow, dt as normalizeObjectSchema, et as assertCompleteRequestResourceTemplate, f as startGenericOAuthFlow, ft as objectFromShape, g as readTokenBundle, gt as loadConfigWithSources, h as isTokenBundleExpired, ht as loadConfig, i as resolveCapletsMode, it as isJSONRPCResultResponse, j as CreateMessageResultWithToolsSchema, jt as __commonJSMin, k as CompleteRequestSchema, kt as redactSecrets, l as capabilityDescription, lt as isSchemaOptional, m as deleteTokenBundle, mt as safeParseAsync, nt as isJSONRPCErrorResponse, o as CapletsEngine, ot as getObjectShape, p as startOAuthFlow, pt as safeParse, q as LoggingLevelSchema, r as parseServerBaseUrl, rt as isJSONRPCRequest, s as handleServerTool, st as getParseErrorMessage, t as controlUrlForBase, tt as isInitializeRequest, u as runGenericOAuthFlow, ut as isZ4Schema, v as ReadBuffer, w as Protocol, wt as discoverCapletFiles, x as assertClientRequestTaskCapability, xt as resolveConfigPath, y as serializeMessage, z as InitializedNotificationSchema } from "./options-bnsSREid.js";
+import { $ as assertCompleteRequestPrompt, A as CreateMessageResultSchema, At as toSafeError, B as JSONRPCMessageSchema, C as AjvJsonSchemaValidator, D as CallToolRequestSchema, Dt as CAPLETS_ERROR_CODES, E as toJsonSchemaCompat, Et as SERVER_ID_PATTERN, F as EmptyResultSchema, G as ListRootsResultSchema, H as ListPromptsRequestSchema, I as ErrorCode, J as McpError, K as ListToolsRequestSchema, L as GetPromptRequestSchema, M as CreateTaskResultSchema, Nt as __require, O as CallToolResultSchema, Ot as CapletsError, P as ElicitResultSchema, Pt as __toESM, R as InitializeRequestSchema, S as assertToolsCallTaskCapability, St as resolveProjectCapletsRoot, T as mergeCapabilities, Tt as validateCapletFile, U as ListResourceTemplatesRequestSchema, V as LATEST_PROTOCOL_VERSION, W as ListResourcesRequestSchema, X as SUPPORTED_PROTOCOL_VERSIONS, Y as ReadResourceRequestSchema, Z as SetLevelRequestSchema, _t as parseConfig, a as resolveCapletsServer, at as getLiteralValue, bt as resolveCapletsRoot, c as ServerRegistry, ct as getSchemaDescription, d as runOAuthFlow, dt as normalizeObjectSchema, et as assertCompleteRequestResourceTemplate, f as startGenericOAuthFlow, ft as objectFromShape, g as readTokenBundle, gt as loadConfigWithSources, h as isTokenBundleExpired, ht as loadConfig, i as resolveCapletsMode, it as isJSONRPCResultResponse, j as CreateMessageResultWithToolsSchema, jt as __commonJSMin, k as CompleteRequestSchema, kt as redactSecrets, l as capabilityDescription, lt as isSchemaOptional, m as deleteTokenBundle, mt as safeParseAsync, nt as isJSONRPCErrorResponse, o as CapletsEngine, ot as getObjectShape, p as startOAuthFlow, pt as safeParse, q as LoggingLevelSchema, r as parseServerBaseUrl, rt as isJSONRPCRequest, s as handleServerTool, st as getParseErrorMessage, t as controlUrlForBase, tt as isInitializeRequest, u as runGenericOAuthFlow, ut as isZ4Schema, v as ReadBuffer, w as Protocol, wt as discoverCapletFiles, x as assertClientRequestTaskCapability, xt as resolveConfigPath, y as serializeMessage, z as InitializedNotificationSchema } from "./options-j9p3L3r1.js";
 import { A as url, C as object, D as string, b as literal, d as ZodOptional, o as generatedToolInputSchema, s as generatedToolInputSchemaForCaplet } from "./generated-tool-input-schema-BYoyY-l-.js";
-import { a as formatCapletList, c as resolveCliConfigPaths, l as cliCommands, n as completionScript, o as formatConfigPaths, s as listCaplets, t as completeCliWords, u as completionShells } from "./completion-L23s2FGB.js";
-import { accessSync, chmodSync, closeSync, constants, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
-import { basename, dirname, join, parse, relative, resolve } from "node:path";
+import { a as formatCapletList, c as resolveCliConfigPaths, l as cliCommands, n as completionScript, o as formatConfigPaths, s as listCaplets, t as completeCliWords, u as completionShells } from "./completion-Cq1z7ci2.js";
+import { accessSync, chmodSync, closeSync, constants, copyFileSync, cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, writeFileSync, writeSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
 import { execFileSync } from "node:child_process";
 import process$1, { stdin, stdout } from "node:process";
 import { tmpdir } from "node:os";
@@ -1320,7 +1320,7 @@ const EMPTY_COMPLETION_RESULT = { completion: {
 } };
 //#endregion
 //#region package.json
-var version = "0.18.2";
+var version = "0.18.3";
 //#endregion
 //#region src/serve/session.ts
 var CapletsMcpSession = class {
@@ -5192,12 +5192,14 @@ function rejectCrossKindDestinationCollision(plan, destinationRoot) {
 function installPlan(caplet, options) {
 	const isDirectory = basename(caplet.path) === "CAPLET.md";
 	const sourcePath = isDirectory ? dirname(caplet.path) : caplet.path;
+	const sourceBoundary = dirname(sourcePath);
 	const sourcePathRelative = relative(options.repoRoot, sourcePath);
 	const destination = isDirectory ? join(options.destinationRoot, caplet.id) : join(options.destinationRoot, `${caplet.id}.md`);
 	return {
 		id: caplet.id,
 		source: `${options.sourceId}#${sourcePathRelative}`,
 		sourcePath,
+		sourceBoundary,
 		destination,
 		kind: isDirectory ? "directory" : "file"
 	};
@@ -5259,16 +5261,40 @@ function removeInstallPath(path, label, force) {
 }
 function copyInstallPath(plan) {
 	try {
+		if (plan.kind === "directory") {
+			copyDirectoryCaplet(plan.sourcePath, plan.destination, realpathSync(plan.sourceBoundary));
+			return;
+		}
 		cpSync(plan.sourcePath, plan.destination, {
-			recursive: plan.kind === "directory",
+			recursive: false,
 			force: false,
 			errorOnExist: true
 		});
 	} catch (error) {
+		if (error instanceof CapletsError) throw error;
 		if (isFsError(error, "EEXIST") || isFsError(error, "EISDIR")) throw new CapletsError("CONFIG_EXISTS", `Caplet ${plan.id} already exists at ${plan.destination}; pass --force to overwrite it`, toSafeError(error));
 		throw new CapletsError("CONFIG_INVALID", `Could not install Caplet ${plan.id} to ${plan.destination}`, toSafeError(error));
 	}
 }
+function copyDirectoryCaplet(source, destination, sourceBoundary, seenDirectories = /* @__PURE__ */ new Set()) {
+	const resolvedSource = lstatSync(source).isSymbolicLink() ? resolveDirectoryCapletSymlink(source, sourceBoundary) : source;
+	if (statSync(resolvedSource).isDirectory()) {
+		const realDirectory = realpathSync(resolvedSource);
+		if (seenDirectories.has(realDirectory)) throw new CapletsError("CONFIG_INVALID", `Directory Caplet symlink ${source} creates a copy cycle`);
+		const childSeenDirectories = new Set(seenDirectories);
+		childSeenDirectories.add(realDirectory);
+		mkdirSync(destination);
+		for (const entry of readdirSync(resolvedSource)) copyDirectoryCaplet(join(resolvedSource, entry), join(destination, entry), sourceBoundary, childSeenDirectories);
+		return;
+	}
+	copyFileSync(resolvedSource, destination);
+}
+function resolveDirectoryCapletSymlink(source, sourceBoundary) {
+	const target = readlinkSync(source);
+	const resolvedTarget = realpathSync(isAbsolute(target) ? target : resolve(dirname(source), target));
+	if (resolvedTarget !== sourceBoundary && !resolvedTarget.startsWith(`${sourceBoundary}${sep}`)) throw new CapletsError("CONFIG_INVALID", `Directory Caplet symlink ${source} resolves outside source Caplets boundary`);
+	return resolvedTarget;
+}
 function isFsError(error, code) {
 	return typeof error === "object" && error !== null && "code" in error && error.code === code;
 }

package/dist/native.js

@@ -1,4 +1,4 @@
-import { Ot as CapletsError, Q as ToolListChangedNotificationSchema, _ as StreamableHTTPClientTransport, a as resolveCapletsServer, b as Client, i as resolveCapletsMode, l as capabilityDescription, n as mcpUrlForBase, o as CapletsEngine } from "./options-bnsSREid.js";
+import { Ot as CapletsError, Q as ToolListChangedNotificationSchema, _ as StreamableHTTPClientTransport, a as resolveCapletsServer, b as Client, i as resolveCapletsMode, l as capabilityDescription, n as mcpUrlForBase, o as CapletsEngine } from "./options-j9p3L3r1.js";
 import { a as generatedToolInputJsonSchemaForCaplet, i as generatedToolInputJsonSchema, l as operations, o as generatedToolInputSchema } from "./generated-tool-input-schema-BYoyY-l-.js";
 //#region src/native/options.ts
 const DEFAULT_POLL_INTERVAL_MS = 3e4;

package/dist/{options-bnsSREid.js → options-j9p3L3r1.js}

@@ -52655,8 +52655,21 @@ async function loadOpenApiSource(endpoint, authDir) {
 	if (endpoint.specPath) return endpoint.specPath;
 	if (!endpoint.specUrl) throw new CapletsError("CONFIG_INVALID", `${endpoint.server} is missing OpenAPI spec source`);
 	if (!endpoint.baseUrl) throw new CapletsError("CONFIG_INVALID", `${endpoint.server} must configure baseUrl when using remote specUrl`);
-	const response = await fetchWithLimit(endpoint.specUrl, endpoint.requestTimeoutMs, shouldSendSpecAuth(endpoint) ? authHeaders(endpoint, authDir) : {});
-	return JSON.parse(response);
+	return parseOpenApiSourceText(await fetchWithLimit(endpoint.specUrl, endpoint.requestTimeoutMs, shouldSendSpecAuth(endpoint) ? authHeaders(endpoint, authDir) : {}));
+}
+function parseOpenApiSourceText(source) {
+	let parsed;
+	try {
+		parsed = JSON.parse(source);
+	} catch (jsonError) {
+		try {
+			parsed = (0, import_dist$1.parse)(source);
+		} catch {
+			throw jsonError instanceof Error ? jsonError : new Error(String(jsonError));
+		}
+	}
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("OpenAPI source must parse to an object");
+	return parsed;
 }
 function extractOperations(endpoint, document) {
 	const operations = [];
@@ -52674,6 +52687,7 @@ function extractOperations(endpoint, document) {
 			const requestBody = requestBodyFor(operation);
 			const outputSchema = outputSchemaFor(operation);
 			const baseUrl = endpoint.baseUrl ?? firstServerUrl(document);
+			const staticHeaders = staticHeaderDefaultsFor(endpoint, parameters);
 			validateOperationBaseUrl(endpoint, baseUrl);
 			operations.push({
 				name,
@@ -52681,15 +52695,32 @@ function extractOperations(endpoint, document) {
 				path,
 				...typeof operation.summary === "string" ? { summary: operation.summary } : {},
 				...typeof operation.description === "string" ? { description: operation.description } : {},
-				inputSchema: inputSchemaFor(parameters, requestBody),
+				inputSchema: inputSchemaFor(parameters, requestBody, staticHeaders),
 				...outputSchema ? { outputSchema } : {},
 				...requestBody?.contentType ? { requestBodyContentType: requestBody.contentType } : {},
-				...baseUrl ? { baseUrl } : {}
+				...baseUrl ? { baseUrl } : {},
+				...Object.keys(staticHeaders).length ? { staticHeaders } : {}
 			});
 		}
 	}
 	return operations.sort((left, right) => left.name.localeCompare(right.name));
 }
+function staticHeaderDefaultsFor(endpoint, parameters) {
+	const configuredHeaderNames = configuredAuthHeaderNames(endpoint);
+	const headers = {};
+	for (const parameter of parameters) {
+		if (parameter?.in !== "header" || typeof parameter.name !== "string") continue;
+		const normalized = parameter.name.toLowerCase();
+		if (configuredHeaderNames.has(normalized) || FORBIDDEN_ARGUMENT_HEADERS.has(normalized) && normalized !== "accept") continue;
+		const defaultValue = parameter.schema?.default;
+		if ([
+			"string",
+			"number",
+			"boolean"
+		].includes(typeof defaultValue)) headers[parameter.name] = String(defaultValue);
+	}
+	return headers;
+}
 function requestBodyFor(operation) {
 	const requestBody = operation.requestBody;
 	if (!requestBody || typeof requestBody !== "object") return;
@@ -52750,19 +52781,20 @@ function structuredOutputSchema(bodySchema) {
 		}
 	};
 }
-function inputSchemaFor(parameters, requestBody) {
+function inputSchemaFor(parameters, requestBody, staticHeaders = {}) {
 	const schema = {
 		type: "object",
 		additionalProperties: false,
 		properties: {}
 	};
 	const required = [];
+	const protectedStaticHeaders = new Set(Object.keys(staticHeaders).map((key) => key.toLowerCase()).filter((key) => FORBIDDEN_ARGUMENT_HEADERS.has(key)));
 	for (const location of [
 		"path",
 		"query",
 		"header"
 	]) {
-		const locationParameters = parameters.filter((parameter) => parameter?.in === location);
+		const locationParameters = parameters.filter((parameter) => parameter?.in === location && !(location === "header" && protectedStaticHeaders.has(parameter.name?.toLowerCase())));
 		if (locationParameters.length === 0) continue;
 		const nestedRequired = locationParameters.filter((parameter) => parameter.required === true || location === "path").map((parameter) => parameter.name);
 		schema.properties[location] = {
@@ -52801,7 +52833,8 @@ function buildRequest(endpoint, operation, args, authDir) {
 	for (const [key, value] of Object.entries(asRecord(args.query))) if (value !== void 0 && value !== null) url.searchParams.append(key, serializeHttpValue("query", key, value));
 	const headers = new Headers();
 	applyAuth(headers, endpoint, authDir);
-	const configuredHeaderNames = endpoint.auth.type === "headers" ? new Set(Object.keys(endpoint.auth.headers).map((key) => key.toLowerCase())) : /* @__PURE__ */ new Set();
+	const configuredHeaderNames = configuredAuthHeaderNames(endpoint);
+	for (const [key, value] of Object.entries(operation.staticHeaders ?? {})) if (!headers.has(key) && !configuredHeaderNames.has(key.toLowerCase())) headers.set(key, value);
 	for (const [key, value] of Object.entries(asRecord(args.header))) if (value !== void 0 && value !== null) {
 		const normalized = key.toLowerCase();
 		if (FORBIDDEN_ARGUMENT_HEADERS.has(normalized) || configuredHeaderNames.has(normalized)) throw new CapletsError("REQUEST_INVALID", `Header ${key} cannot be supplied by arguments`);
@@ -52847,6 +52880,9 @@ function asRecord(value) {
 function applyAuth(headers, endpoint, authDir) {
 	for (const [key, value] of Object.entries(authHeaders(endpoint, authDir))) headers.set(key, value);
 }
+function configuredAuthHeaderNames(endpoint) {
+	return endpoint.auth.type === "headers" ? new Set(Object.keys(endpoint.auth.headers).map((key) => key.toLowerCase())) : /* @__PURE__ */ new Set();
+}
 function authHeaders(endpoint, authDir) {
 	switch (endpoint.auth.type) {
 		case "none": return {};
@@ -53853,7 +53889,7 @@ var CapletsEngine = class {
 		}
 	}
 	async completeCliWords(words) {
-		const { completeCliWords } = await import("./completion-L23s2FGB.js").then((n) => n.r);
+		const { completeCliWords } = await import("./completion-Cq1z7ci2.js").then((n) => n.r);
 		return await completeCliWords(words, {
 			config: this.registry.config,
 			managers: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caplets/core",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Core runtime library for Caplets progressive disclosure gateways.",
   "keywords": [
     "caplets",
@@ -53,6 +53,7 @@
     "hono": "^4.12.21",
     "vfile": "^6.0.3",
     "vfile-matter": "^5.0.1",
+    "yaml": "^2.9.0",
     "zod": "^4.4.3"
   },
   "devDependencies": {