@code-yeongyu/senpi 2026.7.30 → 2026.7.31-2

package/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js

@@ -119,6 +119,20 @@ export function normalizeObjectSchema(schema) {
     }
     return undefined;
 }
+function getDotPath(path) {
+    if (path.length === 0) {
+        return 'object root';
+    }
+    return path.reduce((acc, seg, index) => {
+        if (index === 0) {
+            return String(seg);
+        }
+        if (typeof seg === 'number') {
+            return `${acc}[${seg}]`;
+        }
+        return `${acc}.${seg}`;
+    }, '');
+}
 // --- Error message extraction ---
 /**
  * Safely extracts an error message from a parse result error.
@@ -126,16 +140,21 @@ export function normalizeObjectSchema(schema) {
  */
 export function getParseErrorMessage(error) {
     if (error && typeof error === 'object') {
+        // When present, prioritize zod issues and format as a message and path
+        if ('issues' in error && Array.isArray(error.issues) && error.issues.length > 0) {
+            return error.issues
+                .map((i) => {
+                if (!i.path?.length) {
+                    return i.message;
+                }
+                return `${i.message} at ${getDotPath(i.path)}`;
+            })
+                .join('\n');
+        }
         // Try common error structures
         if ('message' in error && typeof error.message === 'string') {
             return error.message;
         }
-        if ('issues' in error && Array.isArray(error.issues) && error.issues.length > 0) {
-            const firstIssue = error.issues[0];
-            if (firstIssue && typeof firstIssue === 'object' && 'message' in firstIssue) {
-                return String(firstIssue.message);
-            }
-        }
         // Fallback: try to stringify the error
         try {
             return JSON.stringify(error);

package/node_modules/@modelcontextprotocol/sdk/dist/esm/server/zod-compat.js.map

@@ -1 +1 @@
-{"version":3,"file":"zod-compat.js","sourceRoot":"","sources":["../../../src/server/zod-compat.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,uDAAuD;AACvD,yDAAyD;AACzD,uDAAuD;AAKvD,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AA8CtC,4BAA4B;AAC5B,MAAM,UAAU,UAAU,CAAC,CAAY;IACnC,6DAA6D;IAC7D,MAAM,MAAM,GAAG,CAA6B,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,eAAe,CAAC,KAAwB;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;IAExE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAoC,CAAC,CAAC;IACtE,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAsC,CAAC,CAAC;IAEtE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACpE,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,SAAS,CACrB,MAAS,EACT,IAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,MAAuF,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAuB,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,MAAuF,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,MAAS,EACT,IAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,MAAuF,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAuB,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,MAAuF,CAAC;AACnG,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAAC,MAAmC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,sEAAsE;IACtE,IAAI,QAAmF,CAAC;IAExF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;IACzC,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC;YACD,OAAO,QAAQ,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,+BAA+B;AAC/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiD;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,8DAA8D;IAC9D,8EAA8E;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAkC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAkC,CAAC;QAEhD,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3B,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IACI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACjB,MAAM,CAAC,KAAK,CACR,CAAC,CAAC,EAAE,CACA,OAAO,CAAC,KAAK,QAAQ;oBACrB,CAAC,KAAK,IAAI;oBACV,CAAE,CAA8B,CAAC,IAAI,KAAK,SAAS;wBAC9C,CAA8B,CAAC,IAAI,KAAK,SAAS;wBAClD,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,CAAC,CAClE,EACH,CAAC;gBACC,OAAO,eAAe,CAAC,MAA2B,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,yCAAyC;IACzC,IAAI,UAAU,CAAC,MAAmB,CAAC,EAAE,CAAC;QAClC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAyB,CAAC;QACrC,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,MAAyB,CAAC;QACrC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,mCAAmC;AACnC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,8BAA8B;QAC9B,IAAI,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC;QACD,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;gBAC1E,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QACD,uCAAuC;QACvC,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,iCAAiC;AACjC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IAClD,OAAQ,MAAmC,CAAC,WAAW,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAC9C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAkC,CAAC;IACpD,6BAA6B;IAC7B,IAAI,OAAQ,MAAyC,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAQ,MAAwC,CAAC,UAAU,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,aAAa,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,IAAI,GAAG,EAAE,CAAC;YACN,4CAA4C;YAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAkC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1B,IAAI,GAAG,EAAE,CAAC;QACN,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IACD,gEAAgE;IAChE,MAAM,WAAW,GAAI,MAA8B,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,OAAO,SAAS,CAAC;AACrB,CAAC"}
+{"version":3,"file":"zod-compat.js","sourceRoot":"","sources":["../../../src/server/zod-compat.ts"],"names":[],"mappings":"AAAA,gBAAgB;AAChB,uDAAuD;AACvD,yDAAyD;AACzD,uDAAuD;AAKvD,OAAO,KAAK,IAAI,MAAM,QAAQ,CAAC;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AA8CtC,4BAA4B;AAC5B,MAAM,UAAU,UAAU,CAAC,CAAY;IACnC,6DAA6D;IAC7D,MAAM,MAAM,GAAG,CAA6B,CAAC;IAC7C,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,eAAe,CAAC,KAAwB;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;IAExE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,IAAI,KAAK;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAoC,CAAC,CAAC;IACtE,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,KAAsC,CAAC,CAAC;IAEtE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACpE,CAAC;AAED,0BAA0B;AAC1B,MAAM,UAAU,SAAS,CACrB,MAAS,EACT,IAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,MAAuF,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAuB,CAAC;IACzC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,MAAuF,CAAC;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,MAAS,EACT,IAAa;IAEb,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzD,OAAO,MAAuF,CAAC;IACnG,CAAC;IACD,MAAM,QAAQ,GAAG,MAAuB,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,MAAuF,CAAC;AACnG,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,cAAc,CAAC,MAAmC;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,sEAAsE;IACtE,IAAI,QAAmF,CAAC;IAExF,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;IACzC,CAAC;SAAM,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC;YACD,OAAO,QAAQ,EAAE,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED,+BAA+B;AAC/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAiD;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,8DAA8D;IAC9D,8EAA8E;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC7B,qEAAqE;QACrE,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAkC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAkC,CAAC;QAEhD,2EAA2E;QAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3B,0EAA0E;YAC1E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IACI,MAAM,CAAC,MAAM,GAAG,CAAC;gBACjB,MAAM,CAAC,KAAK,CACR,CAAC,CAAC,EAAE,CACA,OAAO,CAAC,KAAK,QAAQ;oBACrB,CAAC,KAAK,IAAI;oBACV,CAAE,CAA8B,CAAC,IAAI,KAAK,SAAS;wBAC9C,CAA8B,CAAC,IAAI,KAAK,SAAS;wBAClD,OAAQ,CAAyB,CAAC,KAAK,KAAK,UAAU,CAAC,CAClE,EACH,CAAC;gBACC,OAAO,eAAe,CAAC,MAA2B,CAAC,CAAC;YACxD,CAAC;QACL,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,yCAAyC;IACzC,IAAI,UAAU,CAAC,MAAmB,CAAC,EAAE,CAAC;QAClC,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;YAC5D,OAAO,MAAyB,CAAC;QACrC,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,4BAA4B;QAC5B,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,MAAyB,CAAC;QACrC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,IAAyB;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACnC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC;QAC5B,CAAC;QACD,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAC;AACX,CAAC;AAED,mCAAmC;AACnC;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAC/C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,uEAAuE;QACvE,IAAI,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9E,OAAO,KAAK,CAAC,MAAM;iBACd,GAAG,CAAC,CAAC,CAAkD,EAAE,EAAE;gBACxD,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAClB,OAAO,CAAC,CAAC,OAAO,CAAC;gBACrB,CAAC;gBACD,OAAO,GAAG,CAAC,CAAC,OAAO,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,8BAA8B;QAC9B,IAAI,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC;QACD,uCAAuC;QACvC,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,iCAAiC;AACjC;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiB;IAClD,OAAQ,MAAmC,CAAC,WAAW,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiB;IAC9C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,KAAK,UAAU,CAAC;IACnD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAkC,CAAC;IACpD,6BAA6B;IAC7B,IAAI,OAAQ,MAAyC,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAQ,MAAwC,CAAC,UAAU,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,KAAK,aAAa,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC7C,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAkC,CAAC;QACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC;QAC/B,IAAI,GAAG,EAAE,CAAC;YACN,4CAA4C;YAC5C,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;YAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;QACL,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,MAAkC,CAAC;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC1B,IAAI,GAAG,EAAE,CAAC;QACN,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;IACL,CAAC;IACD,gEAAgE;IAChE,MAAM,WAAW,GAAI,MAA8B,CAAC,KAAK,CAAC;IAC1D,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,WAAW,CAAC;IAClD,OAAO,SAAS,CAAC;AACrB,CAAC"}

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Extracts the media type (the lowercased `type/subtype` pair, without
+ * parameters) from a raw `Content-Type` header value, or `undefined` when the
+ * header is missing or empty.
+ *
+ * Content-Type comparisons must use the parsed media type, never a substring
+ * search of the raw header: a value like `text/plain; a=application/json`
+ * contains the substring `application/json` but its media type is
+ * `text/plain`, and case variants or parameters make naive string comparison
+ * wrong in both directions.
+ *
+ * "Essence" is the WHATWG MIME Sniffing standard's term for the bare
+ * `type/subtype` pair (https://mimesniff.spec.whatwg.org/#mime-type-essence);
+ * the Fetch standard's request classification is defined against it
+ * (https://fetch.spec.whatwg.org/#cors-safelisted-request-header).
+ *
+ * Parsing is RFC 9110 (`content-type` package) first. When the parameter
+ * section is malformed (`application/json;`, `application/json; charset=`),
+ * browsers and most HTTP stacks still derive the media type from the segment
+ * before the first `;` — the fallback matches that widely-implemented
+ * behavior, so a header whose media type is unambiguous is not rejected for
+ * a sloppy parameter section.
+ */
+export declare function mediaTypeEssence(header: string | null | undefined): string | undefined;
+/**
+ * Whether a raw `Content-Type` header value denotes `application/json`.
+ * Parameters (for example `charset=utf-8`) are allowed and ignored; malformed
+ * parameter sections do not reject a header whose media type is unambiguously
+ * `application/json` (see `mediaTypeEssence` for the exact grammar).
+ */
+export declare function isJsonContentType(header: string | null | undefined): boolean;
+//# sourceMappingURL=mediaType.d.ts.map

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mediaType.d.ts","sourceRoot":"","sources":["../../../src/shared/mediaType.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAiBtF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAM5E"}

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js

@@ -0,0 +1,57 @@
+import contentType from 'content-type';
+/**
+ * Extracts the media type (the lowercased `type/subtype` pair, without
+ * parameters) from a raw `Content-Type` header value, or `undefined` when the
+ * header is missing or empty.
+ *
+ * Content-Type comparisons must use the parsed media type, never a substring
+ * search of the raw header: a value like `text/plain; a=application/json`
+ * contains the substring `application/json` but its media type is
+ * `text/plain`, and case variants or parameters make naive string comparison
+ * wrong in both directions.
+ *
+ * "Essence" is the WHATWG MIME Sniffing standard's term for the bare
+ * `type/subtype` pair (https://mimesniff.spec.whatwg.org/#mime-type-essence);
+ * the Fetch standard's request classification is defined against it
+ * (https://fetch.spec.whatwg.org/#cors-safelisted-request-header).
+ *
+ * Parsing is RFC 9110 (`content-type` package) first. When the parameter
+ * section is malformed (`application/json;`, `application/json; charset=`),
+ * browsers and most HTTP stacks still derive the media type from the segment
+ * before the first `;` — the fallback matches that widely-implemented
+ * behavior, so a header whose media type is unambiguous is not rejected for
+ * a sloppy parameter section.
+ */
+export function mediaTypeEssence(header) {
+    if (!header) {
+        return undefined;
+    }
+    try {
+        return contentType.parse(header).type;
+    }
+    catch {
+        const essence = (header.split(';', 1)[0] ?? '').trim().toLowerCase();
+        // A comma in the parameter tail of an unparseable value indicates
+        // joined duplicate headers — ambiguous, so no essence at all (keeps
+        // duplicate-header handling uniform whether or not the first copy
+        // carries parameters).
+        if (essence === '' || header.slice(essence.length).includes(',')) {
+            return undefined;
+        }
+        return essence;
+    }
+}
+/**
+ * Whether a raw `Content-Type` header value denotes `application/json`.
+ * Parameters (for example `charset=utf-8`) are allowed and ignored; malformed
+ * parameter sections do not reject a header whose media type is unambiguously
+ * `application/json` (see `mediaTypeEssence` for the exact grammar).
+ */
+export function isJsonContentType(header) {
+    // Fast path: the exact literal is what SDK clients send on every POST.
+    if (header === 'application/json') {
+        return true;
+    }
+    return mediaTypeEssence(header) === 'application/json';
+}
+//# sourceMappingURL=mediaType.js.map

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/mediaType.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mediaType.js","sourceRoot":"","sources":["../../../src/shared/mediaType.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,cAAc,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAiC;IAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrE,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,uBAAuB;QACvB,IAAI,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAiC;IAC/D,uEAAuE;IACvE,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,CAAC,KAAK,kBAAkB,CAAC;AAC3D,CAAC"}

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.d.ts

@@ -1,9 +1,14 @@
 import { JSONRPCMessage } from '../types.js';
+export declare const STDIO_DEFAULT_MAX_BUFFER_SIZE: number;
 /**
  * Buffers a continuous stdio stream into discrete JSON-RPC messages.
  */
 export declare class ReadBuffer {
     private _buffer?;
+    private _maxBufferSize;
+    constructor(options?: {
+        maxBufferSize?: number;
+    });
     append(chunk: Buffer): void;
     readMessage(): JSONRPCMessage | null;
     clear(): void;

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/shared/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAC;AAEnE;;GAEG;AACH,qBAAa,UAAU;IACnB,OAAO,CAAC,OAAO,CAAC,CAAS;IAEzB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3B,WAAW,IAAI,cAAc,GAAG,IAAI;IAepC,KAAK,IAAI,IAAI;CAGhB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEhE"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../../../src/shared/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAwB,MAAM,aAAa,CAAC;AAEnE,eAAO,MAAM,6BAA6B,QAAmB,CAAC;AAE9D;;GAEG;AACH,qBAAa,UAAU;IACnB,OAAO,CAAC,OAAO,CAAC,CAAS;IACzB,OAAO,CAAC,cAAc,CAAS;gBAEnB,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE;IAIhD,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAS3B,WAAW,IAAI,cAAc,GAAG,IAAI;IAepC,KAAK,IAAI,IAAI;CAGhB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAE/D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEhE"}

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js

@@ -1,9 +1,18 @@
 import { JSONRPCMessageSchema } from '../types.js';
+export const STDIO_DEFAULT_MAX_BUFFER_SIZE = 10 * 1024 * 1024;
 /**
  * Buffers a continuous stdio stream into discrete JSON-RPC messages.
  */
 export class ReadBuffer {
+    constructor(options) {
+        this._maxBufferSize = options?.maxBufferSize ?? STDIO_DEFAULT_MAX_BUFFER_SIZE;
+    }
     append(chunk) {
+        const newSize = (this._buffer?.length ?? 0) + chunk.length;
+        if (newSize > this._maxBufferSize) {
+            this.clear();
+            throw new Error(`ReadBuffer exceeded maximum size of ${this._maxBufferSize} bytes`);
+        }
         this._buffer = this._buffer ? Buffer.concat([this._buffer, chunk]) : chunk;
     }
     readMessage() {

package/node_modules/@modelcontextprotocol/sdk/dist/esm/shared/stdio.js.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/shared/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnE;;GAEG;AACH,MAAM,OAAO,UAAU;IAGnB,MAAM,CAAC,KAAa;QAChB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAED,WAAW;QACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC7B,CAAC;CACJ;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC3C,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"stdio.js","sourceRoot":"","sources":["../../../src/shared/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9D;;GAEG;AACH,MAAM,OAAO,UAAU;IAInB,YAAY,OAAoC;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,EAAE,aAAa,IAAI,6BAA6B,CAAC;IAClF,CAAC;IAED,MAAM,CAAC,KAAa;QAChB,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,cAAc,QAAQ,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,CAAC;IAED,WAAW;QACP,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED,KAAK;QACD,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;IAC7B,CAAC;CACJ;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC3C,OAAO,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB;IACpD,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC"}

package/node_modules/@modelcontextprotocol/sdk/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/sdk",
-    "version": "1.29.0",
+    "version": "1.30.0",
     "description": "Model Context Protocol implementation for TypeScript",
     "license": "MIT",
     "author": "Anthropic, PBC (https://anthropic.com)",
@@ -88,7 +88,8 @@
         "lint": "eslint src/ && prettier --check .",
         "lint:fix": "eslint src/ --fix && prettier --write .",
         "check": "npm run typecheck && npm run lint",
-        "test": "vitest run",
+        "test": "vitest run --exclude \"test/e2e/**\"",
+        "test:e2e": "vitest run test/e2e",
         "test:watch": "vitest",
         "start": "npm run server",
         "server": "tsx watch --clear-screen=false scripts/cli.ts server",
@@ -100,7 +101,7 @@
         "test:conformance:client:all": "npx @modelcontextprotocol/conformance client --command 'npx tsx test/conformance/src/everythingClient.ts' --suite all --expected-failures test/conformance/conformance-baseline.yml"
     },
     "dependencies": {
-        "@hono/node-server": "^1.19.9",
+        "@hono/node-server": "^1.19.9 || ^2.0.5",
         "ajv": "^8.17.1",
         "ajv-formats": "^3.0.1",
         "content-type": "^1.0.5",

package/node_modules/brace-expansion/README.md

@@ -64,6 +64,18 @@ const expansions = expand('{1..100}'.repeat(5), {
 // expansions.length will be 100, not 100^5
 ```
 
+The `options` object can also provide a `maxLength` value to cap the
+total number of characters across all expansions. This is limited to
+`4_000_000` by default, to prevent memory exhaustion from inputs whose
+result count stays under `max` while each result grows very long.
+
+```js
+const expansions = expand('{a,b}'.repeat(1500), {
+  maxLength: 100,
+})
+// the combined length of expansions will not exceed 100 characters
+```
+
 Valid expansions are:
 
 ```js

package/node_modules/brace-expansion/dist/commonjs/index.d.ts

@@ -1,6 +1,8 @@
 export declare const EXPANSION_MAX = 100000;
+export declare const EXPANSION_MAX_LENGTH = 4000000;
 export type BraceExpansionOptions = {
     max?: number;
+    maxLength?: number;
 };
 export declare function expand(str: string, options?: BraceExpansionOptions): string[];
 //# sourceMappingURL=index.d.ts.map

package/node_modules/brace-expansion/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,aAAa,SAAU,CAAA;AAwDpC,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,YAkBtE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,aAAa,SAAU,CAAA;AAYpC,eAAO,MAAM,oBAAoB,UAAY,CAAA;AAwD7C,MAAM,MAAM,qBAAqB,GAAG;IAClC,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,qBAA0B,YAkBtE"}

package/node_modules/brace-expansion/dist/commonjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -19,6 +19,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -68,7 +79,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -78,7 +89,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -92,25 +103,112 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        N.push(c);
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -123,89 +221,43 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
+        }
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
-                }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
-            }
-        }
-        else {
-            N = [];
+            values = [];
             for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
-                }
+                values.push.apply(values, expand_(n[j], max, maxLength, false));
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map