@fruggr/zendesk-mcp-server 3.1.2 → 3.2.0

package/dist/THIRD-PARTY-NOTICES.md

@@ -30,7 +30,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/core@2.1.0
+## @modelcontextprotocol/core@2.2.0
 
 License: MIT
 
@@ -476,7 +476,7 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/server@2.1.0
+## @modelcontextprotocol/server@2.2.0
 
 License: MIT
 

package/dist/{http-CmtU-oNu.js → http-CUsGYeuV.js}

@@ -504,7 +504,7 @@ var getRequestListener = (fetchCallback, options = {}) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.1.0_hono@4.13.9/node_modules/@modelcontextprotocol/node/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.2.0_hono@4.13.9/node_modules/@modelcontextprotocol/node/dist/index.mjs
 /**
 * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
 * It supports both SSE streaming and direct HTTP responses.
@@ -2264,82 +2264,6 @@ function decodeJwt(jwt) {
 	return result;
 }
 //#endregion
-//#region src/auth/server/expiring-map.ts
-/**
-* An in-memory map whose entries lapse after their own TTL. Expired entries are
-* swept on every `set`, so the map stays bounded by what was set within the
-* longest TTL, with no timer to hold the process open.
-*/
-const createExpiringMap = () => {
-	const entries = /* @__PURE__ */ new Map();
-	const get = (key) => {
-		const entry = entries.get(key);
-		return entry && entry.expiresAt > Date.now() ? entry.value : void 0;
-	};
-	return {
-		set: (key, value, ttlMs) => {
-			const now = Date.now();
-			for (const [k, entry] of entries) if (entry.expiresAt <= now) entries.delete(k);
-			entries.set(key, {
-				value,
-				expiresAt: now + ttlMs
-			});
-		},
-		get,
-		/** Read and forget: a pending value is used at most once. */
-		take: (key) => {
-			const value = get(key);
-			entries.delete(key);
-			return value;
-		},
-		/** Live and not-yet-swept entries. */
-		size: () => entries.size
-	};
-};
-//#endregion
-//#region src/auth/server/consent.ts
-const hostOf = (uri) => {
-	try {
-		return new URL(uri).host;
-	} catch {
-		return uri;
-	}
-};
-const SCOPE_LABELS = {
-	read: "Read your Zendesk data",
-	write: "Create and change Zendesk data on your behalf"
-};
-/**
-* The MCP consent screen, shown once per client that is not trusted (DCR,
-* unknown CIMD, loopback redirects). Names the client, the scopes and where the
-* code goes, per the spec's UI requirements. Every interpolated value is
-* escaped: the client name comes from a document anyone can publish.
-*/
-const renderConsentPage = (view) => {
-	const name = escapeHtml(view.clientName ?? view.clientId);
-	const scopes = view.scopes.map((scope) => `<li>${escapeHtml(SCOPE_LABELS[scope] ?? scope)}</li>`).join("");
-	const action = `/interaction/${encodeURIComponent(view.uid)}`;
-	return [
-		"<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">",
-		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
-		"<title>Authorize access to Zendesk</title>",
-		"<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem;line-height:1.5}",
-		"code{word-break:break-all}button{font:inherit;padding:.5rem 1.25rem;margin-right:.5rem}</style>",
-		"</head><body>",
-		`<h1>Allow ${name} to use your Zendesk account?</h1>`,
-		`<p><strong>${name}</strong> is asking to act as you on <strong>${escapeHtml(view.subdomain)}.zendesk.com</strong>:</p>`,
-		`<ul>${scopes}</ul>`,
-		`<p>After you allow it, you are sent back to <strong>${escapeHtml(hostOf(view.redirectUri))}</strong>`,
-		` (<code>${escapeHtml(view.redirectUri)}</code>). Only continue if you started this connection yourself.</p>`,
-		`<p>Client id: <code>${escapeHtml(view.clientId)}</code></p>`,
-		`<form method="post" action="${action}/confirm" style="display:inline"><button type="submit">Allow</button></form>`,
-		`<form method="post" action="${action}/abort" style="display:inline"><button type="submit">Deny</button></form>`,
-		"</body></html>"
-	].join("");
-};
-/** Plain error page for a failed sign-in. ASCII message, escaped. */
-const renderErrorPage = (title, detail) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head><body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p></body></html>`;
-//#endregion
 //#region src/auth/server/trusted-clients.ts
 /**
 * Which CIMD clients skip our consent screen, and the fetch shim applied to CIMD
@@ -2425,6 +2349,184 @@ const createCimdFetch = (baseFetch) => async (url, options) => {
 	});
 };
 //#endregion
+//#region src/auth/server/cimd-documents.ts
+/** How long a kept copy may stand in for its document, after it was kept. */
+const LAST_GOOD_TTL_S = 604800;
+const STALE_MAX_AGE_S = 60;
+const CIMD_FETCH_HINT = "A client document, or a URL it names, could not be fetched: the client cannot sign in or refresh unless a last good copy is served. See https://github.com/fruggr/zendesk-mcp-server/blob/main/docs/troubleshooting.md#http-the-log-shows-oauth_client_fetch_failed";
+const isTransientFailure = (status) => status === 403 || status === 408 || status === 429 || status >= 500;
+const messageOf = (err) => {
+	if (!(err instanceof Error)) return String(err);
+	return err.cause instanceof Error ? `${err.message}: ${err.cause.message}` : err.message;
+};
+const ownDocument = async (response, url) => {
+	const parsed = await response.json().catch(() => void 0);
+	return parsed?.client_id === url ? parsed : void 0;
+};
+/**
+* A copy is kept when a token is issued, from the client oidc-provider built
+* and validated: an unauthenticated caller can make the server fetch any URL,
+* but not write to the grant store, and a rejected document is never kept.
+*/
+const createCimdDocuments = (baseFetch, { lastGood, logger }) => {
+	const rewrite = createCimdFetch(baseFetch);
+	const stale = /* @__PURE__ */ new Set();
+	const kept = (url) => lastGood.get(url).catch((err) => {
+		logger.warn("oauth_cimd_last_good_read_failed", {
+			url,
+			error: messageOf(err)
+		});
+	});
+	const report = (url, failure, copy) => {
+		logger.warn("oauth_client_fetch_failed", {
+			url,
+			...failure,
+			fallback: copy ? "last_good" : "none",
+			...copy && { ageS: Math.floor((Date.now() - copy.fetchedAt) / 1e3) },
+			hint: CIMD_FETCH_HINT
+		});
+	};
+	const serve = (url, copy) => {
+		stale.add(url);
+		return Response.json(copy.document, { headers: { "cache-control": `max-age=${STALE_MAX_AGE_S}` } });
+	};
+	const fallBack = async (url, failure, failed) => {
+		const copy = await kept(url);
+		report(url, failure, copy);
+		if (!copy) return void 0;
+		await failed?.body?.cancel();
+		return serve(url, copy);
+	};
+	const succeeded = async (url, response) => {
+		if (await ownDocument(response.clone(), url) && response.status === 200) {
+			stale.delete(url);
+			return response;
+		}
+		const copy = await kept(url);
+		if (!copy) return response;
+		report(url, {
+			status: response.status,
+			error: "not a client document"
+		}, copy);
+		await response.body?.cancel();
+		return serve(url, copy);
+	};
+	const fetch = async (input, init) => {
+		const url = String(input);
+		let response;
+		try {
+			response = await rewrite(input, init);
+		} catch (err) {
+			const copy = await fallBack(url, { error: messageOf(err) });
+			if (copy) return copy;
+			throw err;
+		}
+		if (response.ok) return succeeded(url, response);
+		if (!isTransientFailure(response.status)) {
+			logger.debug("oauth_client_fetch_failed", {
+				url,
+				status: response.status,
+				fallback: "none"
+			});
+			return response;
+		}
+		return await fallBack(url, { status: response.status }, response) ?? response;
+	};
+	return {
+		fetch,
+		granted: async (client) => {
+			if (client.clientIdMetadataDocument !== true || stale.has(client.clientId)) return;
+			try {
+				await lastGood.set(client.clientId, {
+					document: client.metadata(),
+					fetchedAt: Date.now()
+				}, LAST_GOOD_TTL_S);
+			} catch (err) {
+				logger.warn("oauth_cimd_last_good_store_failed", {
+					url: client.clientId,
+					error: messageOf(err)
+				});
+			}
+		}
+	};
+};
+//#endregion
+//#region src/auth/server/expiring-map.ts
+/**
+* An in-memory map whose entries lapse after their own TTL. Expired entries are
+* swept on every `set`, so the map stays bounded by what was set within the
+* longest TTL, with no timer to hold the process open.
+*/
+const createExpiringMap = () => {
+	const entries = /* @__PURE__ */ new Map();
+	const get = (key) => {
+		const entry = entries.get(key);
+		return entry && entry.expiresAt > Date.now() ? entry.value : void 0;
+	};
+	return {
+		set: (key, value, ttlMs) => {
+			const now = Date.now();
+			for (const [k, entry] of entries) if (entry.expiresAt <= now) entries.delete(k);
+			entries.set(key, {
+				value,
+				expiresAt: now + ttlMs
+			});
+		},
+		get,
+		/** Read and forget: a pending value is used at most once. */
+		take: (key) => {
+			const value = get(key);
+			entries.delete(key);
+			return value;
+		},
+		/** Live and not-yet-swept entries. */
+		size: () => entries.size
+	};
+};
+//#endregion
+//#region src/auth/server/consent.ts
+const hostOf = (uri) => {
+	try {
+		return new URL(uri).host;
+	} catch {
+		return uri;
+	}
+};
+const SCOPE_LABELS = {
+	read: "Read your Zendesk data",
+	write: "Create and change Zendesk data on your behalf"
+};
+/**
+* The MCP consent screen, shown once per client that is not trusted (DCR,
+* unknown CIMD, loopback redirects). Names the client, the scopes and where the
+* code goes, per the spec's UI requirements. Every interpolated value is
+* escaped: the client name comes from a document anyone can publish.
+*/
+const renderConsentPage = (view) => {
+	const name = escapeHtml(view.clientName ?? view.clientId);
+	const scopes = view.scopes.map((scope) => `<li>${escapeHtml(SCOPE_LABELS[scope] ?? scope)}</li>`).join("");
+	const action = `/interaction/${encodeURIComponent(view.uid)}`;
+	return [
+		"<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\">",
+		"<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">",
+		"<title>Authorize access to Zendesk</title>",
+		"<style>body{font-family:system-ui,sans-serif;max-width:32rem;margin:3rem auto;padding:0 1rem;line-height:1.5}",
+		"code{word-break:break-all}button{font:inherit;padding:.5rem 1.25rem;margin-right:.5rem}</style>",
+		"</head><body>",
+		`<h1>Allow ${name} to use your Zendesk account?</h1>`,
+		`<p><strong>${name}</strong> is asking to act as you on <strong>${escapeHtml(view.subdomain)}.zendesk.com</strong>:</p>`,
+		`<ul>${scopes}</ul>`,
+		`<p>After you allow it, you are sent back to <strong>${escapeHtml(hostOf(view.redirectUri))}</strong>`,
+		` (<code>${escapeHtml(view.redirectUri)}</code>). Only continue if you started this connection yourself.</p>`,
+		`<p>Client id: <code>${escapeHtml(view.clientId)}</code></p>`,
+		`<form method="post" action="${action}/confirm" style="display:inline"><button type="submit">Allow</button></form>`,
+		`<form method="post" action="${action}/abort" style="display:inline"><button type="submit">Deny</button></form>`,
+		"</body></html>"
+	].join("");
+};
+/** Plain error page for a failed sign-in. ASCII message, escaped. */
+const renderErrorPage = (title, detail) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>Sign-in failed</title></head><body><h1>${escapeHtml(title)}</h1><p>${escapeHtml(detail)}</p></body></html>`;
+//#endregion
 //#region src/auth/server/upstream.ts
 /**
 * Zendesk as the upstream identity provider, through the same public PKCE client
@@ -35898,13 +36000,12 @@ const buildProvider = (options) => {
 	const { ring, resource } = options;
 	const [current] = ring;
 	const scopes = options.allowWrite ? RESOURCE_SCOPES.join(" ") : "read";
-	const baseFetch = options.fetch ?? ((url, init) => globalThis.fetch(url, init));
 	const provider = new lib_default(options.issuer, {
 		adapter: options.adapter,
 		jwks: { keys: ring.map((set) => set.signingJwk) },
 		cookies: { keys: ring.map((set) => set.cookieKey) },
 		clients: [],
-		fetch: createCimdFetch(baseFetch),
+		fetch: options.cimdDocuments.fetch,
 		scopes: options.allowWrite ? [...RESOURCE_SCOPES, "offline_access"] : ["read", "offline_access"],
 		clientDefaults: {
 			grant_types: ["authorization_code", "refresh_token"],
@@ -36109,6 +36210,10 @@ const createAuthorizationServer = (options) => {
 			hint: "Revoked in this process only. Fix the store before restarting: its next successful write persists the removal."
 		});
 	};
+	const cimdDocuments = createCimdDocuments(options.fetch ?? ((url, init) => globalThis.fetch(url, init)), {
+		lastGood: createSealedCollection(persistent, "CimdDocument", ring),
+		logger
+	});
 	const provider = buildProvider({
 		issuer,
 		resource,
@@ -36118,7 +36223,10 @@ const createAuthorizationServer = (options) => {
 		allowWrite: !config.readOnly,
 		isAllowedOrigin: options.isAllowedOrigin,
 		behindProxy: config.publicUrl?.startsWith("https:") === true,
-		fetch: options.fetch
+		cimdDocuments
+	});
+	provider.on("grant.success", (ctx) => {
+		if (ctx.oidc.client) cimdDocuments.granted(ctx.oidc.client);
 	});
 	provider.on("server_error", (_ctx, err) => {
 		logger.error("oauth_server_error", { error: err.message });

package/dist/index.js

@@ -7832,7 +7832,7 @@ const loadConfig = (argv = process.argv.slice(2)) => {
 	});
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -7864,7 +7864,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
 /**
 * Canonical `$schema` URIs per supported dialect (http + https variants, trailing-`#` stripped).
 */
@@ -9447,7 +9447,8 @@ const OAuthTokensSchema = object({
 	token_type: string$2(),
 	expires_in: number$1().optional(),
 	scope: string$2().optional(),
-	refresh_token: string$2().optional()
+	refresh_token: string$2().optional(),
+	issuer: string$2().optional().catch(void 0)
 }).strip();
 /**
 * RFC 8693 §2.2.1 Token Exchange response for ID-JAG tokens.
@@ -9504,7 +9505,8 @@ const OAuthClientInformationSchema = object({
 	client_id: string$2(),
 	client_secret: string$2().optional(),
 	client_id_issued_at: number$2().optional(),
-	client_secret_expires_at: number$2().optional()
+	client_secret_expires_at: number$2().optional(),
+	issuer: string$2().optional().catch(void 0)
 }).strip();
 /**
 * RFC 7591 OAuth 2.0 Dynamic Client Registration full response (client information plus metadata)
@@ -9525,7 +9527,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token_type_hint: string$2().optional()
 }).strip();
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/src-D-y6h4N7.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
 /**
 * Cross-bundle `instanceof` support for the SDK error classes.
 *
@@ -13486,6 +13488,8 @@ const rev2026Codec = {
 			const rawInputRequests = raw["inputRequests"];
 			const inputRequests = isPlainObject$4(rawInputRequests) ? rawInputRequests : {};
 			const requestState = raw["requestState"];
+			const metaParse = raw["_meta"] === void 0 ? void 0 : buildSchemas2026().ResultMetaSchema.safeParse(raw["_meta"]);
+			const meta = metaParse?.success ? metaParse.data : void 0;
 			if (Object.keys(inputRequests).length === 0 && typeof requestState !== "string") return {
 				kind: "invalid",
 				error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: input_required carries neither inputRequests nor requestState (every input_required result must include at least one of the two)`, {
@@ -13496,7 +13500,8 @@ const rev2026Codec = {
 			return {
 				kind: "input_required",
 				inputRequests,
-				...typeof requestState === "string" && { requestState }
+				...typeof requestState === "string" && { requestState },
+				...meta !== void 0 && { _meta: meta }
 			};
 		}
 		if (rawResultType !== "complete") return {
@@ -15230,7 +15235,7 @@ var Protocol = class {
 	* Emits a notification, which is a one-way message that does not expect a response.
 	*/
 	async notification(notification, options) {
-		return this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
+		return await this._notificationViaCodec(this._resolveOutboundCodec(notification.method), notification, options);
 	}
 	/**
 	* The notification funnel proper, keyed by the resolved era codec —
@@ -15399,7 +15404,8 @@ function manualInputRequiredValue(decoded) {
 	return {
 		resultType: "input_required",
 		inputRequests: decoded.inputRequests,
-		...decoded.requestState !== void 0 && { requestState: decoded.requestState }
+		...decoded.requestState !== void 0 && { requestState: decoded.requestState },
+		...decoded._meta !== void 0 && { _meta: decoded._meta }
 	};
 }
 /*!
@@ -15889,7 +15895,7 @@ function normalizeRawShapeSchema(schema) {
 	return schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -23024,7 +23030,7 @@ var AjvJsonSchemaValidator = class {
 };
 import_ajv.Ajv;
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/mcp-Dw2OlZ1f.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -24595,7 +24601,7 @@ function unwrapOptionalSchema(schema) {
 	return schema.def?.innerType ?? schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
 /** Default upper bound, in bytes, on a request body read by the HTTP entry points (4 MiB). */
 const DEFAULT_MAX_REQUEST_BODY_SIZE = 4194304;
 /** Upper bound on the number of messages accepted in one JSON-RPC batch array. */
@@ -106621,7 +106627,7 @@ const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized
 	return server;
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.1.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 /**
 * Marks a stdout `'error'` listener that a closed transport left attached purely to
 * swallow late write failures (see {@link StdioServerTransport.close}). A fresh
@@ -107085,7 +107091,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
-	const { startHttpTransport } = await import("./http-CmtU-oNu.js");
+	const { startHttpTransport } = await import("./http-CUsGYeuV.js");
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:a9f47cd2-b8c5-5fd6-81ac-b68c56a7a7f0",
+  "serialNumber": "urn:uuid:b370c80f-c327-5c78-b90b-e161da6f00fc",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/%40fruggr/zendesk-mcp-server@3.1.2",
+      "bom-ref": "pkg:npm/%40fruggr/zendesk-mcp-server@3.2.0",
       "name": "@fruggr/zendesk-mcp-server",
-      "version": "3.1.2",
-      "purl": "pkg:npm/%40fruggr/zendesk-mcp-server@3.1.2"
+      "version": "3.2.0",
+      "purl": "pkg:npm/%40fruggr/zendesk-mcp-server@3.2.0"
     }
   },
   "components": [
@@ -27,10 +27,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/%40modelcontextprotocol/core@2.1.0",
+      "bom-ref": "pkg:npm/%40modelcontextprotocol/core@2.2.0",
       "name": "@modelcontextprotocol/core",
-      "version": "2.1.0",
-      "purl": "pkg:npm/%40modelcontextprotocol/core@2.1.0",
+      "version": "2.2.0",
+      "purl": "pkg:npm/%40modelcontextprotocol/core@2.2.0",
       "licenses": [
         {
           "expression": "MIT"
@@ -51,10 +51,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/%40modelcontextprotocol/server@2.1.0",
+      "bom-ref": "pkg:npm/%40modelcontextprotocol/server@2.2.0",
       "name": "@modelcontextprotocol/server",
-      "version": "2.1.0",
-      "purl": "pkg:npm/%40modelcontextprotocol/server@2.1.0",
+      "version": "2.2.0",
+      "purl": "pkg:npm/%40modelcontextprotocol/server@2.2.0",
       "licenses": [
         {
           "expression": "MIT"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruggr/zendesk-mcp-server",
-  "version": "3.1.2",
+  "version": "3.2.0",
   "mcpName": "io.github.fruggr/zendesk-mcp-server",
   "description": "Deep Zendesk MCP server for your AI assistant: search, draft, update and translate Help Center articles and manage Support tickets end to end — comments, triage and image attachments.",
   "type": "module",
@@ -75,9 +75,9 @@
   "packageManager": "pnpm@12.5.1+sha512.e3f305bc784a2bc89f5ad3b6138889470fae8d2af5f36b61216ec91c2c3d64089775f9de38aac331044ea40f245cb0d5666392dfdf65824e1907ef6a2c62de5f",
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
-    "@modelcontextprotocol/client": "2.1.0",
+    "@modelcontextprotocol/client": "2.2.0",
     "@modelcontextprotocol/node": "2.1.0",
-    "@modelcontextprotocol/server": "2.1.0",
+    "@modelcontextprotocol/server": "2.2.0",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.0",