@fruggr/zendesk-mcp-server 3.3.0 → 3.3.1

package/dist/THIRD-PARTY-NOTICES.md

@@ -30,9 +30,9 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## @modelcontextprotocol/core@2.2.0
+## @modelcontextprotocol/core@2.3.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -253,9 +253,9 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/node@2.1.0
+## @modelcontextprotocol/node@2.1.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -476,9 +476,9 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 ```
 
-## @modelcontextprotocol/server@2.2.0
+## @modelcontextprotocol/server@2.3.1
 
-License: MIT
+License: Apache-2.0
 
 ```
 The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0.
@@ -2629,7 +2629,7 @@ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 ```
 
-## mdast-util-find-and-replace@3.0.2
+## mdast-util-find-and-replace@3.0.3
 
 License: MIT
 

package/dist/{http-GIKJdf05.js → http-BYYYoQaK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { _ as __toESM, a as zendeskGet, d as createStartupError, f as errnoCode, g as __require, h as __exportAll, i as WebStandardStreamableHTTPServerTransport, l as getOAuthUrls, m as __commonJSMin, o as REQUEST_TIMEOUT_MS, r as silentLogger, s as deadlineSignal, t as createMcpServer, u as STARTUP_DOCS } from "./index.js";
-import { d as escapeHtml, l as requestedScope, n as configDir, o as generateCodeChallenge, s as generateCodeVerifier, u as supportedScopes } from "./token-persistence-BeetFqPF.js";
+import { _ as __commonJSMin, a as verifyBearerToken, b as __toESM, c as zendeskGet, f as getOAuthUrls, h as errnoCode, i as WebStandardStreamableHTTPServerTransport, l as REQUEST_TIMEOUT_MS, m as createStartupError, o as OAuthError, p as STARTUP_DOCS, r as silentLogger, s as OAuthErrorCode, t as createMcpServer, u as deadlineSignal, v as __exportAll, y as __require } from "./index.js";
+import { d as escapeHtml, l as requestedScope, n as configDir, o as generateCodeChallenge, s as generateCodeVerifier, u as supportedScopes } from "./token-persistence-BUHh23BM.js";
 import * as util$1 from "node:util";
 import { format, inspect } from "node:util";
 import * as crypto$2 from "node:crypto";
@@ -16,7 +16,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { accessSync, chmodSync, constants, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from "node:fs";
 import { Http2ServerRequest, constants as constants$1 } from "http2";
 import crypto$1 from "crypto";
-//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.12/node_modules/@hono/node-server/dist/index.mjs
+//#region node_modules/.pnpm/@hono+node-server@1.19.17_hono@4.13.13/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
 	constructor(message, options) {
 		super(message, options);
@@ -504,7 +504,7 @@ var getRequestListener = (fetchCallback, options = {}) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.0_@modelcontextprotocol+server@2.2.0_hono@4.13.12/node_modules/@modelcontextprotocol/node/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+node@2.1.1_@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/node/dist/index.mjs
 /**
 * Server transport for Streamable HTTP: this implements the MCP Streamable HTTP transport specification.
 * It supports both SSE streaming and direct HTTP responses.
@@ -543,8 +543,12 @@ var getRequestListener = (fetchCallback, options = {}) => {
 *
 * @example Using with a pre-parsed request body (e.g. Express)
 * ```ts source="./streamableHttp.examples.ts#NodeStreamableHTTPServerTransport_express"
-* app.post('/mcp', (req, res) => {
-*     transport.handleRequest(req, res, req.body);
+* app.post('/mcp', async (req, res) => {
+*     // Stateless example: create a server and a transport per request.
+*     const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*     const transport = new NodeStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*     await server.connect(transport);
+*     await transport.handleRequest(req, res, req.body);
 * });
 * ```
 */
@@ -36178,16 +36182,16 @@ const resolveMasterSecret = (input, logger = silentLogger) => {
 //#endregion
 //#region src/auth/server/authorization-server.ts
 const decoder = new TextDecoder();
-const asVerified = (claims, issuer, resource) => {
-	const audiences = Array.isArray(claims.aud) ? claims.aud : [claims.aud];
-	if (!(claims.iss === issuer && audiences.includes(resource) && typeof claims.exp === "number" && claims.exp * 1e3 > Date.now() && typeof claims.zd === "string" && typeof claims.gid === "string")) return void 0;
+const asVerified = (claims, issuer) => {
+	if (!(claims.iss === issuer && typeof claims.exp === "number" && typeof claims.zd === "string" && typeof claims.gid === "string")) return void 0;
 	return {
 		zendeskAccessToken: claims.zd,
 		grantId: claims.gid,
 		clientId: String(claims.client_id),
 		subject: String(claims.sub),
 		canWrite: typeof claims.scope === "string" && claims.scope.split(" ").includes("write"),
-		expiresAt: claims.exp
+		expiresAt: claims.exp,
+		resource: typeof claims.aud === "string" ? claims.aud : void 0
 	};
 };
 const createAuthorizationServer = (options) => {
@@ -36252,7 +36256,7 @@ const createAuthorizationServer = (options) => {
 		const keySet = ring.find((set) => set.accessToken.kid === kid);
 		if (!keySet) return void 0;
 		const { plaintext } = await compactDecrypt(bearer, keySet.accessToken.key);
-		return asVerified(JSON.parse(decoder.decode(plaintext)), issuer, resource);
+		return asVerified(JSON.parse(decoder.decode(plaintext)), issuer);
 	};
 	return {
 		issuer,
@@ -36414,11 +36418,36 @@ const resolvePublicUrl = (config, logger = silentLogger) => {
 	return `http://${config.host}:${config.port}`;
 };
 const MISSING_BEARER_MESSAGE = "Missing or invalid access token. Sign in through this server: its OAuth authorization server is named in the protected resource metadata.";
-const extractBearer = (request) => {
+const SPACES = / +/;
+/**
+* The access token on this request, or `undefined` when it must be refused.
+* The SDK parses the header and checks the audience against our `/mcp`
+* resource (`expectedResource`) and the expiry; decrypting and every other
+* claim stay with the authorization server.
+*/
+const authenticate = async (request, as) => {
 	const header = request.headers["authorization"];
-	if (typeof header !== "string") return void 0;
-	if (!header.toLowerCase().startsWith("bearer ")) return void 0;
-	return header.slice(7).trim();
+	const verifier = { verifyAccessToken: async (bearer) => {
+		const token = await as.verifyAccessToken(bearer);
+		if (!token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid access token");
+		return {
+			token: bearer,
+			clientId: token.clientId,
+			scopes: [],
+			expiresAt: token.expiresAt,
+			...token.resource && URL.canParse(token.resource) && { resource: new URL(token.resource) },
+			extra: { verified: token }
+		};
+	} };
+	try {
+		const normalized = typeof header === "string" ? header.replace(SPACES, " ") : void 0;
+		return (await verifyBearerToken(normalized, {
+			verifier,
+			expectedResource: new URL(as.resource)
+		})).extra?.["verified"];
+	} catch {
+		return;
+	}
 };
 const PROTECTED_RESOURCE_PATHS = ["/.well-known/oauth-protected-resource/mcp", "/.well-known/oauth-protected-resource"];
 const sendJson = (res, status, body) => {
@@ -36572,8 +36601,7 @@ const startHttpTransport = async (config, logger = silentLogger, options = {}) =
 		await transport.handleRequest(req, res, body);
 	};
 	const handleMcpRequest = async (req, res, as) => {
-		const bearer = extractBearer(req);
-		const token = bearer ? await as.verifyAccessToken(bearer) : void 0;
+		const token = await authenticate(req, as);
 		if (!token) {
 			sendUnauthorized(res, as.issuer);
 			return;

package/dist/index.js

@@ -7546,6 +7546,92 @@ const isStartupError = (err) => err instanceof Error && err.name === "StartupErr
 /** The errno code of a failed filesystem call, for the message. */
 const errnoCode = (err) => err?.code ?? "unknown error";
 //#endregion
+//#region src/utils/validation.ts
+const formatPath = (path) => path.map(String).join(".");
+const formatIssue$1 = (issue) => issue.path.length > 0 ? `${formatPath(issue.path)}: ${issue.message}` : issue.message;
+/**
+* `path: message` per issue, joined by `; ` since zod messages carry commas.
+* Ours rather than the SDK's (not exported): one wording for every mode and for
+* startup config errors, stable across SDK bumps.
+*/
+const formatIssues = (issues) => issues.map(formatIssue$1).join("; ");
+const unwrap$1 = (node) => node._zod.def.innerType ? unwrap$1(node._zod.def.innerType) : node;
+/**
+* Keys declared by the object at `path`, or undefined when no plain object sits
+* there (a record, say, whose keys zod checks against an enum).
+*/
+const keysAt = (node, path) => {
+	const { def } = unwrap$1(node)._zod;
+	if (path.length === 0) return def.shape && Object.keys(def.shape);
+	const [head, ...rest] = path;
+	const child = typeof head === "number" ? def.element : def.shape?.[String(head)];
+	return child && keysAt(child, rest);
+};
+const keyList = (keys) => [...keys].sort().join(", ") || "(none)";
+/** One sentence per object holding unknown keys, the top level first. */
+const unknownKeysMessage = (schema, issues, topLevelKeys) => [...issues].sort((a, b) => a.path.length - b.path.length).map(({ path, keys }) => {
+	if (path.length === 0) return `Unknown parameter(s): ${keys.join(", ")}. Valid parameters: ${topLevelKeys}.`;
+	const parent = formatPath(path);
+	const unknown = `Unknown parameter(s): ${keys.map((key) => `${parent}.${key}`).join(", ")}.`;
+	const valid = keysAt(schema, path);
+	return valid ? `${unknown} Valid parameters for ${parent}: ${keyList(valid)}.` : unknown;
+}).join(" ");
+/**
+* Build a strict validator for a tool's input schema, computing the strict
+* schema and the valid-key list once at construction rather than per call.
+*
+* Zod objects default to `strip`, which silently drops unknown keys. That hid
+* #100: a caller passing `per_page` to list_tickets (whose parameter is
+* `page_size`) had the key dropped, so a large unpaginated page came back. The
+* validator rejects unknown keys and names both the offending ones and the
+* valid parameters, so a misremembered name fails loudly. Any other failure is
+* one `path: message` per issue (#206). When both occur only the unknown keys
+* are reported: a guessed name is the one error a caller cannot spot by
+* re-reading its own arguments.
+*/
+const createStrictValidator = (schema, strict = schema.strict()) => {
+	const topLevelKeys = keyList(Object.keys(schema.shape));
+	return (params) => {
+		const result = strict.safeParse(params);
+		if (result.success) return {
+			success: true,
+			data: result.data
+		};
+		const unknownKeyIssues = result.error.issues.filter((issue) => issue.code === "unrecognized_keys");
+		return {
+			success: false,
+			message: unknownKeyIssues.length > 0 ? unknownKeysMessage(schema, unknownKeyIssues, topLevelKeys) : `Invalid parameter(s): ${formatIssues(result.error.issues)}`
+		};
+	};
+};
+/** The proxy dispatch path (namespace/single modes): throws the validator's message. */
+const createStrictParamsParser = (schema) => {
+	const validate = createStrictValidator(schema);
+	return (params) => {
+		const result = validate(params);
+		if (!result.success) throw new Error(result.message);
+		return result.data;
+	};
+};
+/**
+* The same validator as a Standard Schema, for `all` mode: the SDK calls this
+* `validate` and prints our pathless issue after its own prefix, so all three
+* modes word an error alike. The JSON Schema is zod's own, untouched.
+*/
+const toStrictStandardSchema = (schema) => {
+	const strict = schema.strict();
+	const validate = createStrictValidator(schema, strict);
+	return { "~standard": {
+		version: 1,
+		vendor: "zendesk-mcp-server",
+		validate: (value) => {
+			const result = validate(value);
+			return result.success ? { value: result.data } : { issues: [{ message: result.message }] };
+		},
+		jsonSchema: strict["~standard"].jsonSchema
+	} };
+};
+//#endregion
 //#region src/config.ts
 const ToolMode = _enum([
 	"single",
@@ -7790,7 +7876,7 @@ const parseStrict = (args) => {
 const validated = (input) => {
 	const result = ConfigSchema.safeParse(input);
 	if (result.success) return result.data;
-	throw createStartupError(`${result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; ")}.`, STARTUP_DOCS.cliReference, result.error);
+	throw createStartupError(`${formatIssues(result.error.issues)}.`, STARTUP_DOCS.cliReference, result.error);
 };
 const parseCliArgs = (args) => {
 	const { values, positionals } = parseStrict(args);
@@ -8240,7 +8326,7 @@ const createBrandSubdomainResolver = (subdomain, getToken) => {
 	};
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/chunk-Br0eD_fh.mjs
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -8272,7 +8358,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 	enumerable: true
 }) : target, mod));
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/dialects-DoSzNhcb.mjs
 /**
 * Canonical `$schema` URIs per supported dialect (http + https variants, trailing-`#` stripped).
 */
@@ -9935,7 +10021,7 @@ const OAuthTokenRevocationRequestSchema = object({
 	token_type_hint: string$2().optional()
 }).strip();
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/src-BHSMhZ_W.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/src-Cqbh3MYc.mjs
 /**
 * Cross-bundle `instanceof` support for the SDK error classes.
 *
@@ -12990,7 +13076,7 @@ function build() {
 	const subscriptionsListenParamsShape = { notifications: SubscriptionFilterSchema$1 };
 	const SubscriptionsListenRequestSchema$1 = wireRequest("subscriptions/listen", subscriptionsListenParamsShape);
 	/**
-	* Anchor SubscriptionsListenResultMeta — required subscriptionId stamp on
+	* Anchor SubscriptionsListenResultMetaObject — required subscriptionId stamp on
 	* the graceful-close result. Extends `ResultMetaObject` since spec PR
 	* #3002 (composed, so the serverInfo key and its leniency stay single-sourced).
 	*/
@@ -13263,7 +13349,8 @@ function build() {
 		ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
 		ReadResourceResultResponseSchema: wireResultResponse(union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
 		CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+		SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
 	};
 }
 let memo;
@@ -14007,6 +14094,10 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
 	return ALL_CODECS.some((codec) => codec.hasNotificationMethod(method));
 }
+/** The names SEP-2663 re-defines for the Tasks extension on the era that removed them from core. */
+function isExtensionReusedRequestMethod(method) {
+	return method === "tasks/get" || method === "tasks/cancel";
+}
 const ALL_CODECS = [rev2025Codec, rev2026Codec];
 var schemas_exports = /* @__PURE__ */ __exportAll({
 	AnnotationsSchema: () => AnnotationsSchema,
@@ -15039,6 +15130,8 @@ var Protocol = class {
 	_transport;
 	_requestMessageId = 0;
 	_requestHandlers = /* @__PURE__ */ new Map();
+	/** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+	_customSchemaRequestMethods = /* @__PURE__ */ new Set();
 	_requestHandlerAbortControllers = /* @__PURE__ */ new Map();
 	_notificationHandlers = /* @__PURE__ */ new Map();
 	_responseHandlers = /* @__PURE__ */ new Map();
@@ -15316,7 +15409,7 @@ var Protocol = class {
 				return;
 			}
 		}
-		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method)) {
+		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
 			sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
 			return;
 		}
@@ -15449,8 +15542,11 @@ var Protocol = class {
 	}
 	request(request, schemaOrOptions, maybeOptions) {
 		const codec = this._resolveOutboundCodec(request.method);
+		if (isStandardSchema(schemaOrOptions)) {
+			if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec, request.method);
+			return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
+		}
 		this._assertOutboundRequestInEra(codec, request.method);
-		if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
 		const validate = codecResultValidator(codec, request.method);
 		if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
 		return this._requestWithSchemaViaCodec(codec, request, validate, schemaOrOptions);
@@ -15694,6 +15790,8 @@ var Protocol = class {
 			return maybeHandler(parsed.data, ctx);
 		};
 		else throw new TypeError("setRequestHandler: handler is required");
+		if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+		else this._customSchemaRequestMethods.add(method);
 		this._requestHandlers.set(method, this._wrapHandler(method, stored));
 	}
 	/**
@@ -15722,6 +15820,7 @@ var Protocol = class {
 	*/
 	removeRequestHandler(method) {
 		this._requestHandlers.delete(method);
+		this._customSchemaRequestMethods.delete(method);
 	}
 	/**
 	* Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -16303,7 +16402,7 @@ function normalizeRawShapeSchema(schema) {
 	return schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/ajvProvider-CEoC__sr.mjs
 var require_code$1 = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.regexpCode = exports.getEsmExportName = exports.getProperty = exports.safeStringify = exports.stringify = exports.strConcat = exports.addCodeArg = exports.str = exports._ = exports.nil = exports._Code = exports.Name = exports.IDENTIFIER = exports._CodeOrName = void 0;
@@ -23438,7 +23537,7 @@ var AjvJsonSchemaValidator = class {
 };
 import_ajv.Ajv;
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/mcp-DYuW2ZSs.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/mcp-DIH4cS6P.mjs
 const COMPLETABLE_SYMBOL = Symbol.for("mcp.completable");
 /**
 * Checks if a schema is completable (has completion metadata).
@@ -23460,6 +23559,15 @@ function armSseKeepAlive(intervalMs, onTick) {
 	timer.unref?.();
 	return timer;
 }
+function comparableResource(value) {
+	const text = String(value);
+	const hash = text.indexOf("#");
+	return (hash === -1 ? text : text.slice(0, hash)).replace(/\/$/, "");
+}
+function sameResource(reported, expected) {
+	if (!reported) return false;
+	return comparableResource(reported) === comparableResource(expected);
+}
 function headerQuotedValue(value) {
 	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
 }
@@ -23479,6 +23587,38 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 	return header;
 }
 /**
+* Validate a raw `Authorization` header value as a Bearer token and return
+* the verified {@link AuthInfo}.
+*
+* The runtime-neutral core of Bearer authentication: it parses the header,
+* runs the verifier, compares the token's resource with `expectedResource`,
+* enforces `requiredScopes`, and rejects tokens without an
+* expiration or past it. On any failure it throws an {@link OAuthError} —
+* pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
+* answer, or use {@link requireBearerAuth} to get both steps as one call.
+*
+* Framework adapters build on this: `requireBearerAuth` from
+* `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
+*/
+async function verifyBearerToken(authorizationHeader, options) {
+	const { verifier, requiredScopes = [], expectedResource } = options;
+	if (!authorizationHeader) throw new OAuthError(OAuthErrorCode.InvalidToken, "Missing Authorization header");
+	const [type, token] = authorizationHeader.split(" ");
+	if (type?.toLowerCase() !== "bearer" || !token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
+	const authInfo = await verifier.verifyAccessToken(token);
+	if (expectedResource !== void 0 && !sameResource(authInfo.resource, expectedResource)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token was not issued for this resource");
+	if (requiredScopes.length > 0) {
+		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope");
+	}
+	if (typeof authInfo.expiresAt !== "number" || Number.isNaN(authInfo.expiresAt)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has no expiration time");
+	else if (authInfo.expiresAt < Date.now() / 1e3) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token has expired");
+	if (options.resourceMetadataUrl !== void 0 && authInfo.resourceMetadataUrl === void 0) return {
+		...authInfo,
+		resourceMetadataUrl: options.resourceMetadataUrl
+	};
+	return authInfo;
+}
+/**
 * Build the HTTP answer for a Bearer authentication failure.
 *
 * Maps an {@link OAuthError} to its status — `401` for `invalid_token` and
@@ -23791,6 +23931,11 @@ var Server = class extends Protocol {
 		if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
 		if (this._capabilities.logging) this._registerLoggingHandler();
 	}
+	/** Attaches to the given transport; rejects while this instance is connected to another one. */
+	async connect(transport) {
+		if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		await super.connect(transport);
+	}
 	/**
 	* Registers the built-in `logging/setLevel` request handler.
 	*
@@ -24336,6 +24481,30 @@ var Server = class extends Protocol {
 function discoverAdvertisedCapabilities(capabilities) {
 	return { ...capabilities };
 }
+function toolInputElementCount(value, max) {
+	let count = 0;
+	const stack = [value];
+	while (stack.length > 0) {
+		const node = stack.pop();
+		if (node === null || typeof node !== "object") continue;
+		if (Array.isArray(node)) for (const child of node) {
+			if (++count > max) return count;
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+		else for (const key in node) {
+			if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
+			if (++count > max) return count;
+			const child = node[key];
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+	}
+	return count;
+}
+function resolveMaxToolInputElements(value) {
+	if (value === void 0 || value === Infinity) return void 0;
+	if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+	return value;
+}
 /**
 * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
 * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -24354,16 +24523,12 @@ var McpServer = class {
 	* The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
 	*/
 	server;
+	_maxToolInputElements;
 	_registeredResources = {};
 	_registeredResourceTemplates = {};
 	_registeredTools = {};
 	_registeredPrompts = {};
-	/**
-	* Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-	* registration-time scan and the pre-dispatch validation step share one
-	* conversion instead of paying it twice per request under the
-	* per-request-factory `createMcpHandler` model.
-	*/
+	/** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
 	_toolInputSchemaJson = {};
 	/**
 	* The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -24388,6 +24553,7 @@ var McpServer = class {
 	}
 	constructor(serverInfo, options) {
 		this.server = new Server(serverInfo, options);
+		this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
 		if (options?.capabilities?.tools) this.setToolRequestHandlers();
 		if (options?.capabilities?.resources) this.setResourceRequestHandlers();
 		if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -24459,7 +24625,7 @@ var McpServer = class {
 				name,
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+				inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
 				annotations: tool.annotations,
 				icons: tool.icons,
 				execution: tool.execution,
@@ -24504,6 +24670,7 @@ var McpServer = class {
 	* Validates tool input arguments against the tool's input schema.
 	*/
 	async validateToolInput(tool, args, toolName) {
+		if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
 		if (!tool.inputSchema) return;
 		const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
 		if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -24777,19 +24944,19 @@ var McpServer = class {
 	}
 	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		validateAndWarnToolName(name);
-		if (inputSchema !== void 0) try {
-			const json = standardSchemaToJsonSchema(inputSchema, "input");
-			this._toolInputSchemaJson[name] = json;
-			const scan = scanXMcpHeaderDeclarations(json);
-			if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-		} catch {}
 		let currentHandler = handler;
+		let outputSchemaJson;
 		const registeredTool = {
 			title,
 			description,
 			inputSchema,
 			outputSchema,
-			outputSchemaJson: convertOutputSchemaJson(outputSchema),
+			get outputSchemaJson() {
+				return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+			},
+			set outputSchemaJson(value) {
+				outputSchemaJson = value;
+			},
 			annotations,
 			icons,
 			execution,
@@ -24950,6 +25117,13 @@ const EMPTY_OBJECT_JSON_SCHEMA = {
 	type: "object",
 	properties: {}
 };
+/** Converts a tool's `inputSchema` for `tools/list` and warns on an invalid SEP-2243 `x-mcp-header` declaration. */
+function convertListedInputSchema(name, inputSchema) {
+	const json = standardSchemaToJsonSchema(inputSchema, "input");
+	const scan = scanXMcpHeaderDeclarations(json);
+	if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+	return json;
+}
 /**
 * Convert a registered `outputSchema` to JSON Schema, memoised on {@link RegisteredTool.outputSchemaJson}
 * so `tools/call` passes the SAME advertised schema to the wire codec's `projectCallToolResult` that
@@ -24972,7 +25146,7 @@ function createPromptHandler(name, argsSchema, callback) {
 	if (argsSchema) {
 		const typedCallback = callback;
 		return async (args, ctx) => {
-			const parseResult = await validateStandardSchema(argsSchema, args);
+			const parseResult = await validateStandardSchema(argsSchema, args ?? {});
 			if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
 			return typedCallback(parseResult.data, ctx);
 		};
@@ -25009,7 +25183,7 @@ function unwrapOptionalSchema(schema) {
 	return schema.def?.innerType ?? schema;
 }
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/index.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/index.mjs
 /** Default upper bound, in bytes, on a request body read by the HTTP entry points (4 MiB). */
 const DEFAULT_MAX_REQUEST_BODY_SIZE = 4194304;
 /** Upper bound on the number of messages accepted in one JSON-RPC batch array. */
@@ -25098,6 +25272,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * @example Hono.js
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_hono"
 * app.all('/mcp', async c => {
+*     // Stateless example: create a server and a transport per request.
+*     const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*     const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*     await server.connect(transport);
 *     return transport.handleRequest(c.req.raw);
 * });
 * ```
@@ -25106,6 +25284,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_workers"
 * const worker = {
 *     async fetch(request: Request): Promise<Response> {
+*         // Stateless example: create a server and a transport per request.
+*         const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*         const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*         await server.connect(transport);
 *         return transport.handleRequest(request);
 *     }
 * };
@@ -25114,6 +25296,7 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 var WebStandardStreamableHTTPServerTransport = class {
 	sessionIdGenerator;
 	_started = false;
+	_hasHandledRequest = false;
 	_closed = false;
 	_streamMapping = /* @__PURE__ */ new Map();
 	_requestToStreamMapping = /* @__PURE__ */ new Map();
@@ -25235,6 +25418,8 @@ var WebStandardStreamableHTTPServerTransport = class {
 	*/
 	async handleRequest(req, options) {
 		if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+		if (!this.sessionIdGenerator && this._hasHandledRequest) throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
+		this._hasHandledRequest = true;
 		const validationError = this.validateRequestHeaders(req);
 		if (validationError) return validationError;
 		switch (req.method) {
@@ -83080,7 +83265,7 @@ function escapeStringRegexp(string) {
 	return string.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&").replace(/-/g, "\\x2d");
 }
 //#endregion
-//#region node_modules/.pnpm/mdast-util-find-and-replace@3.0.2/node_modules/mdast-util-find-and-replace/lib/index.js
+//#region node_modules/.pnpm/mdast-util-find-and-replace@3.0.3/node_modules/mdast-util-find-and-replace/lib/index.js
 /**
 * @import {Nodes, Parents, PhrasingContent, Root, Text} from 'mdast'
 * @import {BuildVisitor, Test, VisitorResult} from 'unist-util-visit-parents'
@@ -83157,7 +83342,11 @@ function findAndReplace(tree, list, options) {
 	const pairs = toPairs(list);
 	let pairIndex = -1;
 	while (++pairIndex < pairs.length) visitParents(tree, "text", visitor);
-	/** @type {BuildVisitor<Root, 'text'>} */
+	/**
+	* Visit a text node, and handle it if it is not in an ignored parent.
+	*
+	* @type {BuildVisitor<Root, 'text'>}
+	*/
 	function visitor(node, parents) {
 		let index = -1;
 		/** @type {Parents | undefined} */
@@ -83175,11 +83364,11 @@ function findAndReplace(tree, list, options) {
 	* Handle a text node which is not in an ignored parent.
 	*
 	* @param {Text} node
-	*   Text node.
+	*   Text node to search in.
 	* @param {Array<Parents>} parents
-	*   Parents.
+	*   Ancestors of `node`.
 	* @returns {VisitorResult}
-	*   Result.
+	*   Where to continue visiting.
 	*/
 	function handler(node, parents) {
 		const parent = parents[parents.length - 1];
@@ -83207,12 +83396,12 @@ function findAndReplace(tree, list, options) {
 			} : void 0;
 			if (value === false) find.lastIndex = position + 1;
 			else {
-				if (start !== position) nodes.push({
+				if (start !== position) add({
 					type: "text",
 					value: node.value.slice(start, position)
 				});
-				if (Array.isArray(value)) nodes.push(...value);
-				else if (value) nodes.push(value);
+				if (Array.isArray(value)) for (const child of value) add(child);
+				else if (value) add(value);
 				start = position + match[0].length;
 				change = true;
 			}
@@ -83220,13 +83409,26 @@ function findAndReplace(tree, list, options) {
 			match = find.exec(node.value);
 		}
 		if (change) {
-			if (start < node.value.length) nodes.push({
+			if (start < node.value.length) add({
 				type: "text",
 				value: node.value.slice(start)
 			});
 			parent.children.splice(index, 1, ...nodes);
 		} else nodes = [node];
 		return index + nodes.length;
+		/**
+		* Add a node.
+		*
+		* @param {PhrasingContent} child
+		*   Node to add.
+		* @returns {undefined}
+		*   Nothing.
+		*/
+		function add(child) {
+			const previous = nodes[nodes.length - 1];
+			if (previous && previous.type === "text" && child.type === "text") previous.value += child.value;
+			else nodes.push(child);
+		}
 	}
 }
 /**
@@ -83238,9 +83440,9 @@ function findAndReplace(tree, list, options) {
 *   Clean pairs.
 */
 function toPairs(tupleOrList) {
+	if (!Array.isArray(tupleOrList)) throw new TypeError("Expected find and replace tuple or list of tuples");
 	/** @type {Pairs} */
 	const result = [];
-	if (!Array.isArray(tupleOrList)) throw new TypeError("Expected find and replace tuple or list of tuples");
 	/** @type {FindAndReplaceList} */
 	const list = !tupleOrList[0] || Array.isArray(tupleOrList[0]) ? tupleOrList : [tupleOrList];
 	let index = -1;
@@ -83254,9 +83456,9 @@ function toPairs(tupleOrList) {
 * Turn a find into an expression.
 *
 * @param {Find} find
-*   Find.
+*   Pattern to find.
 * @returns {RegExp}
-*   Expression.
+*   Global expression.
 */
 function toExpression(find) {
 	return typeof find === "string" ? new RegExp(escapeStringRegexp(find), "g") : find;
@@ -83265,9 +83467,9 @@ function toExpression(find) {
 * Turn a replace into a function.
 *
 * @param {Replace} replace
-*   Replace.
+*   Thing to replace with.
 * @returns {ReplaceFunction}
-*   Function.
+*   Function that returns that thing.
 */
 function toFunction(replace) {
 	return typeof replace === "function" ? replace : function() {
@@ -105892,7 +106094,7 @@ const attachmentSchema = object({
 		error: (issue) => `Attachment too large: ${issue.input.length} base64 characters, limit ${MAX_BASE64_INPUT_CHARS}. Downscale the file, split the upload, or link to it instead of uploading.`
 	}).base64().describe(`File content encoded as base64. At most ${MAX_BASE64_INPUT_CHARS} characters (about ${MAX_BASE64_INPUT_MB} MB of file), and the attachments of one call must stay under that total; the HTTP transport additionally caps request bodies at 4 MB.`),
 	content_type: string$2().min(1).default("application/octet-stream").describe("MIME type, e.g. \"text/plain\", \"image/png\", \"application/pdf\".")
-});
+}).strict();
 /**
 * The optional `attachments` array parameter, capped as a whole.
 *
@@ -106222,7 +106424,7 @@ const createRequestTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Answers to the form's own questions, as { id, value } pairs. Take both the ids and the accepted values from get_request_form; an id this form does not carry, or a value a dropdown does not offer, is refused here because Zendesk would drop it without an error. Option values are the tag strings, never numbers."),
+				}).strict()).optional().describe("Answers to the form's own questions, as { id, value } pairs. Take both the ids and the accepted values from get_request_form; an id this form does not carry, or a value a dropdown does not offer, is refused here because Zendesk would drop it without an error. Option values are the tag strings, never numbers."),
 				attachments: attachmentsParam("Files to attach to the request, such as a screenshot or a log, with their content base64-encoded.")
 			}),
 			annotations: {
@@ -107012,7 +107214,7 @@ const createTicketTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts.")
+				}).strict()).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts.")
 			}),
 			annotations: {
 				readOnlyHint: false,
@@ -107069,7 +107271,7 @@ const createTicketTools = (ctx) => {
 				custom_fields: array(object({
 					id: number$2().int(),
 					value: unknown$3()
-				})).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts."),
+				}).strict()).optional().describe("Custom field values as { id, value } pairs (field ids come from your Zendesk admin settings). Call list_ticket_fields first to discover the numeric field ids and, for dropdown/multiselect fields, the exact option values Zendesk accepts."),
 				followers: object({
 					add: subscriberIdList("User ids to start following the ticket. Omit to only remove."),
 					remove: subscriberIdList("User ids to stop following the ticket. Omit to only add.")
@@ -107733,32 +107935,6 @@ const readPackageInfo = () => {
 	return cached;
 };
 //#endregion
-//#region src/utils/validation.ts
-/**
-* Build a strict params parser for a tool's input schema, computing the strict
-* schema and the valid-key list once at construction rather than per call.
-*
-* Zod objects default to `strip`, which silently drops unknown keys. That hid
-* #100: a caller passing `per_page` to list_tickets (whose parameter is
-* `page_size`) had the key dropped, so a large unpaginated page came back. The
-* parser rejects unknown keys and names both the offending ones and the valid
-* parameters, so a misremembered name fails loudly.
-*
-* Used on the proxy dispatch path (namespace/single modes); in `all` mode the
-* SDK validates against the strict schema we register.
-*/
-const createStrictParamsParser = (schema) => {
-	const strict = schema.strict();
-	const validKeys = Object.keys(schema.shape).sort().join(", ");
-	return (params) => {
-		const result = strict.safeParse(params);
-		if (result.success) return result.data;
-		const unknownKeys = result.error.issues.flatMap((issue) => issue.code === "unrecognized_keys" ? issue.keys : []);
-		if (unknownKeys.length > 0) throw new Error(`Unknown parameter(s): ${unknownKeys.join(", ")}. Valid parameters: ${validKeys || "(none)"}.`);
-		throw result.error;
-	};
-};
-//#endregion
 //#region src/server.ts
 /**
 * Invoke a tool handler, notifying `onUnauthorized` when Zendesk rejects the
@@ -107892,7 +108068,7 @@ const registerToolset = (server, { config, getToken, resolveBrandSubdomain, onUn
 				for (const tool of filteredTools) registered.push(server.registerTool(tool.name, {
 					title: tool.title,
 					description: tool.description,
-					inputSchema: tool.inputSchema.strict(),
+					inputSchema: toStrictStandardSchema(tool.inputSchema),
 					annotations: tool.annotations
 				}, async (params) => runHandler(tool, params, onUnauthorized)));
 				break;
@@ -107996,7 +108172,7 @@ const createMcpServer = (config, getToken, logger = silentLogger, onUnauthorized
 	return server;
 };
 //#endregion
-//#region node_modules/.pnpm/@modelcontextprotocol+server@2.2.0/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
+//#region node_modules/.pnpm/@modelcontextprotocol+server@2.3.1/node_modules/@modelcontextprotocol/server/dist/stdio.mjs
 /**
 * Marks a stdout `'error'` listener that a closed transport left attached purely to
 * swallow late write failures (see {@link StdioServerTransport.close}). A fresh
@@ -108424,7 +108600,7 @@ const installShutdown = (options) => {
 //#endregion
 //#region src/index.ts
 const buildStdioTokenStore = async (config, logger) => {
-	const { createTokenStore } = await import("./token-store-Aq7gP39o.js");
+	const { createTokenStore } = await import("./token-store-BLAkLLQO.js");
 	return createTokenStore({
 		subdomain: config.subdomain,
 		oauthClientId: config.oauthClientId,
@@ -108465,7 +108641,7 @@ const main = async () => {
 		return;
 	}
 	if (config.dev) logger.warn("dev_mode_ignored_http");
-	const { startHttpTransport } = await import("./http-GIKJdf05.js");
+	const { startHttpTransport } = await import("./http-BYYYoQaK.js");
 	const http = await startHttpTransport(config, logger);
 	installShutdown({
 		watchStdin: false,
@@ -108479,4 +108655,4 @@ main().catch((error) => {
 	process.exit(1);
 });
 //#endregion
-export { __toESM$1 as _, zendeskGet as a, DEFAULT_CALLBACK_PORT as c, createStartupError as d, errnoCode as f, __require as g, __exportAll$1 as h, WebStandardStreamableHTTPServerTransport as i, getOAuthUrls as l, __commonJSMin$1 as m, readPackageInfo as n, REQUEST_TIMEOUT_MS as o, readEnv as p, silentLogger as r, deadlineSignal as s, createMcpServer as t, STARTUP_DOCS as u };
+export { __commonJSMin$1 as _, verifyBearerToken as a, __toESM$1 as b, zendeskGet as c, DEFAULT_CALLBACK_PORT as d, getOAuthUrls as f, readEnv as g, errnoCode as h, WebStandardStreamableHTTPServerTransport as i, REQUEST_TIMEOUT_MS as l, createStartupError as m, readPackageInfo as n, OAuthError as o, STARTUP_DOCS as p, silentLogger as r, OAuthErrorCode as s, createMcpServer as t, deadlineSignal as u, __exportAll$1 as v, __require as y };

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:b998bb6f-ce4c-50fa-a843-1dbcc6584fe3",
+  "serialNumber": "urn:uuid:e7c0861b-27d8-53fc-9aa5-7312e5af7ead",
   "version": 1,
   "metadata": {
     "component": {
       "type": "application",
-      "bom-ref": "pkg:npm/%40fruggr/zendesk-mcp-server@3.3.0",
+      "bom-ref": "pkg:npm/%40fruggr/zendesk-mcp-server@3.3.1",
       "name": "@fruggr/zendesk-mcp-server",
-      "version": "3.3.0",
-      "purl": "pkg:npm/%40fruggr/zendesk-mcp-server@3.3.0"
+      "version": "3.3.1",
+      "purl": "pkg:npm/%40fruggr/zendesk-mcp-server@3.3.1"
     }
   },
   "components": [
@@ -27,37 +27,37 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/%40modelcontextprotocol/core@2.2.0",
+      "bom-ref": "pkg:npm/%40modelcontextprotocol/core@2.3.1",
       "name": "@modelcontextprotocol/core",
-      "version": "2.2.0",
-      "purl": "pkg:npm/%40modelcontextprotocol/core@2.2.0",
+      "version": "2.3.1",
+      "purl": "pkg:npm/%40modelcontextprotocol/core@2.3.1",
       "licenses": [
         {
-          "expression": "MIT"
+          "expression": "Apache-2.0"
         }
       ]
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/%40modelcontextprotocol/node@2.1.0",
+      "bom-ref": "pkg:npm/%40modelcontextprotocol/node@2.1.1",
       "name": "@modelcontextprotocol/node",
-      "version": "2.1.0",
-      "purl": "pkg:npm/%40modelcontextprotocol/node@2.1.0",
+      "version": "2.1.1",
+      "purl": "pkg:npm/%40modelcontextprotocol/node@2.1.1",
       "licenses": [
         {
-          "expression": "MIT"
+          "expression": "Apache-2.0"
         }
       ]
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/%40modelcontextprotocol/server@2.2.0",
+      "bom-ref": "pkg:npm/%40modelcontextprotocol/server@2.3.1",
       "name": "@modelcontextprotocol/server",
-      "version": "2.2.0",
-      "purl": "pkg:npm/%40modelcontextprotocol/server@2.2.0",
+      "version": "2.3.1",
+      "purl": "pkg:npm/%40modelcontextprotocol/server@2.3.1",
       "licenses": [
         {
-          "expression": "MIT"
+          "expression": "Apache-2.0"
         }
       ]
     },
@@ -999,10 +999,10 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:npm/mdast-util-find-and-replace@3.0.2",
+      "bom-ref": "pkg:npm/mdast-util-find-and-replace@3.0.3",
       "name": "mdast-util-find-and-replace",
-      "version": "3.0.2",
-      "purl": "pkg:npm/mdast-util-find-and-replace@3.0.2",
+      "version": "3.0.3",
+      "purl": "pkg:npm/mdast-util-find-and-replace@3.0.3",
       "licenses": [
         {
           "expression": "MIT"

package/dist/{token-persistence-BeetFqPF.js → token-persistence-BUHh23BM.js}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as readPackageInfo, p as readEnv, r as silentLogger } from "./index.js";
+import { g as readEnv, n as readPackageInfo, r as silentLogger } from "./index.js";
 import { createHash, randomBytes } from "node:crypto";
 import { dirname, join } from "node:path";
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";

package/dist/{token-store-Aq7gP39o.js → token-store-BLAkLLQO.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { l as getOAuthUrls, r as silentLogger } from "./index.js";
-import { a as saveToken, c as grantCovers, d as escapeHtml, i as resolveTokenPath, l as requestedScope, o as generateCodeChallenge, r as loadToken, s as generateCodeVerifier, t as clearToken } from "./token-persistence-BeetFqPF.js";
+import { f as getOAuthUrls, r as silentLogger } from "./index.js";
+import { a as saveToken, c as grantCovers, d as escapeHtml, i as resolveTokenPath, l as requestedScope, o as generateCodeChallenge, r as loadToken, s as generateCodeVerifier, t as clearToken } from "./token-persistence-BUHh23BM.js";
 import { promisify } from "node:util";
 import path from "node:path";
 import { fileURLToPath } from "node:url";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fruggr/zendesk-mcp-server",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "mcpName": "io.github.fruggr/zendesk-mcp-server",
   "description": "Deep Zendesk MCP server for your AI assistant: search, draft, update and translate Help Center articles and manage Support tickets end to end — comments, triage and image attachments.",
   "type": "module",
@@ -72,12 +72,12 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@12.9.1+sha512.06b055fff5cd20dc12781de173ced3310ce0951bf2ec620211a16045d5444d5c93a663210764ef29a653a610459ba0368f0e74f84d80c54723cf95aae7bc0d6d",
+  "packageManager": "pnpm@12.11.1+sha512.5b0e3288239a7ea4155d2094f547066e122a1376b3cd785a680c9112e116913e64aaaecf20dd83cc34030fa67013f5c5511f9cf430dd8384188b4c60b8a2ad1e",
   "devDependencies": {
     "@biomejs/biome": "2.5.14",
-    "@modelcontextprotocol/client": "2.2.0",
-    "@modelcontextprotocol/node": "2.1.0",
-    "@modelcontextprotocol/server": "2.2.0",
+    "@modelcontextprotocol/client": "2.3.1",
+    "@modelcontextprotocol/node": "2.1.1",
+    "@modelcontextprotocol/server": "2.3.1",
     "@semantic-release/changelog": "^7.0.0",
     "@semantic-release/exec": "^7.1.0",
     "@semantic-release/git": "^11.0.0",
@@ -98,7 +98,7 @@
     "hast-util-to-mdast": "10.1.2",
     "jose": "6.2.12",
     "lefthook": "^2.1.10",
-    "msw": "^2.12.13",
+    "msw": "^3.0.0",
     "oidc-provider": "~9.12.2",
     "open": "11.0.4",
     "rehype-parse": "9.0.1",