@hasna/skills 0.8.2 → 0.8.4

package/bin/mcp.js

@@ -20019,7 +20019,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@hasna/skills",
-    version: "0.8.2",
+    version: "0.8.4",
     description: "Skills library for AI coding agents",
     type: "module",
     bin: {
@@ -54704,18 +54704,128 @@ var init_execution_secrets = __esm(() => {
   init_selection_cache();
 });
 
-// src/lib/selected-run.ts
-var exports_selected_run = {};
-__export(exports_selected_run, {
-  resolveSelectedRun: () => resolveSelectedRun,
-  prepareSelectedSecretBindings: () => prepareSelectedSecretBindings,
-  executeSelectedLocal: () => executeSelectedLocal
+// src/lib/execution-grants.ts
+import { posix, win32 } from "path";
+function grantIdentifier(v) {
+  return typeof v === "string" && /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(v) && !v.includes("..");
+}
+function grantRecord(v) {
+  return !!v && typeof v === "object" && !Array.isArray(v);
+}
+function keys(v, required2, optional3 = []) {
+  return required2.every((k) => Object.hasOwn(v, k)) && Object.keys(v).every((k) => required2.includes(k) || optional3.includes(k));
+}
+function invalid6() {
+  throw new Error("Invalid execution grant policy: use exact selections, named actors and consumers, and vault reference names only.");
+}
+function authority(v) {
+  if (typeof v !== "string" || v.length > 2048 || /[\x00-\x20\x7f]/.test(v))
+    return false;
+  try {
+    const u = new URL(v);
+    return (u.protocol === "https:" || u.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(u.hostname)) && !u.username && !u.password && !u.search && !u.hash && u.pathname.endsWith("/v1") && u.href === v;
+  } catch {
+    return false;
+  }
+}
+function pathFlavor(value) {
+  return value.startsWith("/") ? posix : win32;
+}
+function grantWorkspace(v) {
+  if (typeof v !== "string" || !v || v.length > 4096 || /[\x00-\x1f\x7f]/.test(v))
+    return false;
+  const flavor = pathFlavor(v);
+  if (flavor === win32 && !/^(?:[A-Za-z]:\\|\\\\[^\\]+\\[^\\]+)/.test(v))
+    return false;
+  return flavor.isAbsolute(v) && flavor.normalize(v) === v;
+}
+function selection(v) {
+  return grantRecord(v) && keys(v, ["slug", "version", "bundleDigest"]) && grantIdentifier(v.slug) && isValidSkillVersion(v.version) && typeof v.bundleDigest === "string" && /^sha256:[a-f0-9]{64}$/.test(v.bundleDigest);
+}
+function validateExecutionGrantRequest(value) {
+  if (!grantRecord(value) || !keys(value, ["selection", "consumer"]) || !grantRecord(value.selection) || !keys(value.selection, [
+    "authority",
+    "workspaceId",
+    "profileId",
+    "profileRevision",
+    "slug",
+    "version",
+    "bundleDigest"
+  ]) || !grantRecord(value.consumer) || !keys(value.consumer, ["stationId", "workspaceDirectory"]))
+    invalid6();
+  const { selection: s, consumer: c } = value;
+  if (!selection({
+    slug: s.slug,
+    version: s.version,
+    bundleDigest: s.bundleDigest
+  }) || !authority(s.authority) || ![s.workspaceId, s.profileId, s.profileRevision, c.stationId].every(grantIdentifier) || !grantWorkspace(c.workspaceDirectory))
+    invalid6();
+  return structuredClone(value);
+}
+var MAX_EXECUTION_GRANT_BYTES;
+var init_execution_grants = __esm(() => {
+  init_execution_secrets();
+  init_skill_version();
+  MAX_EXECUTION_GRANT_BYTES = 2 * 1024 * 1024;
 });
-import { createHash as createHash9 } from "crypto";
-import { spawn } from "child_process";
-import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname8, join as join23, resolve as resolve5 } from "path";
-import { tmpdir } from "os";
+
+// src/lib/execution-grant-client.ts
+import { isDeepStrictEqual } from "util";
+function id(value) {
+  if (!grantIdentifier(value))
+    throw new Error("Invalid execution grant profile or revision identifier.");
+  return encodeURIComponent(value);
+}
+async function request(path, init = {}, authority2) {
+  try {
+    const connection = await resolveSkillsConnection();
+    if (!connection)
+      throw new Error;
+    const configured = skillsApiRequestUrl(connection.apiOrigin, "/api/v1/").replace(/\/+$/, "");
+    if (authority2 !== undefined && authority2 !== configured)
+      throw new Error;
+    const response = await fetch(skillsApiRequestUrl(connection.apiOrigin, `/api/v1${path}`), {
+      ...init,
+      redirect: "error",
+      credentials: "omit",
+      signal: AbortSignal.timeout(15000),
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": "hasna-skills",
+        Authorization: `Bearer ${connection.apiKey}`,
+        ...init.headers
+      }
+    });
+    if (!response.ok) {
+      response.body?.cancel().catch(() => {});
+      throw new SkillSelectionError("EXECUTION_GRANT_UNAVAILABLE", `Skills execution grant request failed (HTTP ${response.status}); no fallback was attempted.`);
+    }
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(await readBoundedResponse(response, MAX_EXECUTION_GRANT_BYTES)));
+  } catch (error61) {
+    if (error61 instanceof SkillSelectionError)
+      throw error61;
+    throw new SkillSelectionError("EXECUTION_GRANT_UNAVAILABLE", "The configured Skills execution grant service could not be reached or returned an invalid response; no fallback was attempted.");
+  }
+}
+async function resolveExecutionGrant(input2) {
+  const snapshot = validateExecutionGrantRequest(input2);
+  const value = await request(`/execution-grants/${id(snapshot.selection.profileId)}/resolve`, { method: "POST", body: JSON.stringify(snapshot) }, snapshot.selection.authority);
+  if (!grantRecord(value) || Object.keys(value).length !== 3 || !grantIdentifier(value.policyRevision) || !grantIdentifier(value.grantId) || !grantRecord(value.bindings)) {
+    throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
+  }
+  if (!isDeepStrictEqual(value.bindings.selection, snapshot.selection) || !isDeepStrictEqual(value.bindings.consumer, snapshot.consumer)) {
+    throw new SkillSelectionError("EXECUTION_GRANT_SCOPE_MISMATCH", "The Skills API returned a grant for a different selection or consumer.");
+  }
+  return value;
+}
+var init_execution_grant_client = __esm(() => {
+  init_fleet_credentials();
+  init_remote_files();
+  init_selection_cache();
+  init_execution_grants();
+});
+
+// src/lib/selected-manifest.ts
 function jsonEntry(entries, path) {
   const entry = entries.find((candidate) => candidate.path === path);
   if (!entry)
@@ -54736,11 +54846,28 @@ function describeEntries(entries) {
   const kind = frontmatter?.kind === "instruction" || manifest.kind === "instruction" || packageJson.skills?.kind === "instruction" ? "instruction" : "executable";
   return { kind, manifest, packageJson };
 }
+var init_selected_manifest = __esm(() => {
+  init_skill_validation();
+  init_selection_cache();
+});
+
+// src/lib/selected-run.ts
+var exports_selected_run = {};
+__export(exports_selected_run, {
+  resolveSelectedRun: () => resolveSelectedRun,
+  prepareSelectedSecretBindings: () => prepareSelectedSecretBindings,
+  executeSelectedLocal: () => executeSelectedLocal
+});
+import { createHash as createHash9 } from "crypto";
+import { spawn } from "child_process";
+import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync3, writeFileSync as writeFileSync10, realpathSync as realpathSync6 } from "fs";
+import { dirname as dirname8, join as join23, resolve as resolve5 } from "path";
+import { tmpdir, hostname as stationHostname2 } from "os";
 async function resolveSelectedRun(spec, profileId, options = {}) {
   const context2 = await resolveSelectionContext(profileId, options);
-  const selection = exactProfileSelection(spec, context2.receipt.profile);
-  const entries = await readSelectedEntries(selection, context2, options);
-  return { selection, profileId: context2.receipt.profile.profileId, entries, ...describeEntries(entries), cacheDir: selectionCacheRoot(options) };
+  const selection2 = exactProfileSelection(spec, context2.receipt.profile);
+  const entries = await readSelectedEntries(selection2, context2, options);
+  return { selection: selection2, profileId: context2.receipt.profile.profileId, entries, ...describeEntries(entries), cacheDir: selectionCacheRoot(options) };
 }
 async function prepareSelectedSecretBindings(selected, cwd = process.cwd()) {
   const entries = await readCachedSelection(selected.selection, { cacheDir: selected.cacheDir });
@@ -54755,8 +54882,8 @@ async function prepareSelectedSecretBindings(selected, cwd = process.cwd()) {
   return selectedSecretBindingsTemplate({ selection: selected.selection, profileId: selected.profileId, cwd }, names);
 }
 async function executeSelectedLocal(selected, options = {}) {
-  const selection = structuredClone(selected.selection), profileId = selected.profileId;
-  const entries = await readCachedSelection(selection, { cacheDir: selected.cacheDir });
+  const selection2 = structuredClone(selected.selection), profileId = selected.profileId;
+  const entries = await readCachedSelection(selection2, { cacheDir: selected.cacheDir });
   if (!entries)
     throw new SkillSelectionError("CACHED_BUNDLE_MISSING", "The selected local execution bundle is not cached.");
   const { kind, manifest, packageJson } = describeEntries(entries);
@@ -54800,9 +54927,12 @@ async function executeSelectedLocal(selected, options = {}) {
   const names = declaredSecretNames(runtime.env);
   if (options.secretBindings !== undefined && options.env !== undefined)
     throw new SkillSelectionError("INVALID_SECRET_BINDINGS", "Choose explicit vault bindings or SDK environment values, never both.");
-  const bindings = options.secretBindings === undefined ? undefined : validateSelectedSecretBindings(options.secretBindings, { selection, profileId, cwd: options.cwd ?? process.cwd() }, names);
+  let bindings = options.secretBindings === undefined ? undefined : validateSelectedSecretBindings(options.secretBindings, { selection: selection2, profileId, cwd: options.cwd ?? process.cwd() }, names);
   let secretEnv = {};
-  if (!bindings)
+  const shared = names.length > 0 && options.secretBindings === undefined && options.env === undefined;
+  if (shared && options.sharedExecutionGrants === false)
+    throw new SkillSelectionError("EXECUTION_GRANT_FRESH_SELECTION_REQUIRED", "Shared secret grants require a fresh API selection; cached execution is refused.");
+  if (!bindings && !shared)
     for (const name of names) {
       const value = options.env && Object.hasOwn(options.env, name) ? options.env[name] : undefined;
       if (value === undefined)
@@ -54832,17 +54962,31 @@ async function executeSelectedLocal(selected, options = {}) {
     if (version2.exitCode !== 0 || actual !== runtime.version)
       throw new SkillSelectionError("LOCAL_RUNTIME_VERSION_MISMATCH", "The installed runtime version differs from the version selected by the skill.");
   }
+  let executionGrant;
+  if (shared) {
+    const { authority: authority2, workspaceId, profileRevision, slug: slug2, version: version2, bundleDigest } = selection2;
+    const request2 = {
+      selection: { authority: authority2, workspaceId, profileId, profileRevision, slug: slug2, version: version2, bundleDigest },
+      consumer: { stationId: process.env.HASNA_STATION || stationHostname2(), workspaceDirectory: realpathSync6(options.cwd ?? process.cwd()) }
+    };
+    const grant = await (options.resolveExecutionGrant ?? resolveExecutionGrant)(request2);
+    if (!grant || !grantIdentifier(grant.policyRevision) || !grantIdentifier(grant.grantId))
+      throw new SkillSelectionError("INVALID_EXECUTION_GRANT", "The Skills API returned an invalid execution grant.");
+    bindings = validateSelectedSecretBindings(grant.bindings, { selection: selection2, profileId, cwd: options.cwd ?? process.cwd() }, names);
+    executionGrant = { policyRevision: grant.policyRevision, grantId: grant.grantId };
+  }
   if (bindings)
     secretEnv = await resolveSelectedSecrets(bindings, options.createSecretsClient);
   const result = await subprocess([executable, ...runtimeName === "bun" ? ["--no-env-file"] : [], join23(runDirectory, declaredEntry), ...args], runDirectory, { ...env, ...secretEnv }, input2, timeoutMs);
   result.stdout = redactExecutionSecrets(result.stdout, secretEnv);
   result.stderr = redactExecutionSecrets(result.stderr, secretEnv);
   const receipt = {
-    selection,
+    selection: selection2,
     target: "local",
     runtime: runtimeName,
     inputDigest: `sha256:${createHash9("sha256").update(input2).digest("hex")}`,
     runDirectory,
+    ...executionGrant ? { executionGrant } : {},
     ...bindings ? { secretBinding: { schema: bindings.schema, selection: bindings.selection, consumer: bindings.consumer, secretsAuthority: bindings.secretsAuthority, bindings: bindings.bindings } } : {},
     ...result
   };
@@ -54896,9 +55040,11 @@ async function subprocess(command, cwd, env, input2, timeoutMs) {
   });
 }
 var init_selected_run = __esm(() => {
+  init_execution_grant_client();
+  init_execution_grants();
   init_selection_resolver();
   init_selection_cache();
-  init_skill_validation();
+  init_selected_manifest();
   init_execution_secrets();
 });
 
@@ -54939,39 +55085,39 @@ class CloudExecutionClient {
     }
     return response;
   }
-  async submit(slug2, version2, input2, key, selection) {
+  async submit(slug2, version2, input2, key, selection2) {
     if (!/^[a-z0-9-]+$/.test(slug2) || !/^\d+\.\d+\.\d+$/.test(version2))
       throw Error("Cloud execution requires skill@exact-version");
     if (!/^[A-Za-z0-9._:-]{1,128}$/.test(key))
       throw Error("Invalid idempotency key");
-    if (selection?.authority && selection.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
+    if (selection2?.authority && selection2.authority !== skillsApiRequestUrl(this.apiOrigin, "/api/v1/").replace(/\/$/, ""))
       throw Error("Selected skill belongs to another Skills authority");
     const execution = parseExecution(await jsonBody(await this.request(slug2, "POST", {
       version: version2,
       input: input2,
       idempotencyKey: key,
-      ...selection ? {
-        bundleDigest: selection.bundleDigest,
-        workspaceId: selection.workspaceId
+      ...selection2 ? {
+        bundleDigest: selection2.bundleDigest,
+        workspaceId: selection2.workspaceId
       } : {}
     })));
-    if (execution.skill !== slug2 || execution.version !== version2 || selection && execution.bundleDigest.replace(/^sha256:/, "") !== selection.bundleDigest.replace(/^sha256:/, ""))
+    if (execution.skill !== slug2 || execution.version !== version2 || selection2 && execution.bundleDigest.replace(/^sha256:/, "") !== selection2.bundleDigest.replace(/^sha256:/, ""))
       throw Error("Cloud execution receipt does not match the selected exact skill");
     return execution;
   }
-  async get(id) {
-    return parseExecution(await jsonBody(await this.request(runId(id))));
+  async get(id2) {
+    return parseExecution(await jsonBody(await this.request(runId(id2))));
   }
-  async logs(id) {
-    return jsonBody(await this.request(runId(id) + "/logs"));
+  async logs(id2) {
+    return jsonBody(await this.request(runId(id2) + "/logs"));
   }
-  async artifacts(id) {
-    return (await this.get(id)).artifacts;
+  async artifacts(id2) {
+    return (await this.get(id2)).artifacts;
   }
-  async download(id, name) {
+  async download(id2, name) {
     if (!["document.pdf", "document.html"].includes(name))
       throw Error("Invalid cloud artifact name");
-    const response = await this.request(runId(id) + "/artifacts/" + encodeURIComponent(name));
+    const response = await this.request(runId(id2) + "/artifacts/" + encodeURIComponent(name));
     if (!response.body)
       throw Error("Cloud artifact body is missing");
     const reader = response.body.getReader();
@@ -54990,16 +55136,16 @@ class CloudExecutionClient {
     }
     return Buffer.concat(chunks);
   }
-  async cancel(id) {
-    return parseExecution(await jsonBody(await this.request(runId(id) + "/cancel", "POST", {})));
+  async cancel(id2) {
+    return parseExecution(await jsonBody(await this.request(runId(id2) + "/cancel", "POST", {})));
   }
-  async wait(id, options = {}) {
+  async wait(id2, options = {}) {
     const timeout = options.timeoutMs ?? 300000, interval = options.intervalMs ?? 1000;
     if (!Number.isFinite(timeout) || timeout < 1 || timeout > 1200000 || !Number.isFinite(interval) || interval < 100 || interval > 60000)
       throw Error("Invalid cloud polling bounds");
     const until = Date.now() + timeout;
     for (;; ) {
-      const run = await this.get(id);
+      const run = await this.get(id2);
       if (["succeeded", "failed", "cancelled"].includes(run.status))
         return run;
       if (Date.now() >= until)
@@ -55008,10 +55154,10 @@ class CloudExecutionClient {
     }
   }
 }
-function runId(id) {
-  if (!/^run_[a-z0-9_]+$/.test(id))
+function runId(id2) {
+  if (!/^run_[a-z0-9_]+$/.test(id2))
     throw Error("Invalid cloud execution id");
-  return id;
+  return id2;
 }
 function parseExecution(value) {
   const v = value;
@@ -55429,9 +55575,9 @@ function registerOperationTools(server) {
             return mcpError("SELECTED_INPUT_REQUIRED", "The selected cloud execution contract accepts declared JSON input, not legacy run arguments or quote receipts.");
           const { CloudExecutionClient: CloudExecutionClient2 } = await Promise.resolve().then(() => (init_cloud_executions(), exports_cloud_executions));
           const client = await CloudExecutionClient2.configured();
-          const selection = resolved.selection;
-          const run = await client.submit(selection.slug, selection.version, input2 ?? {}, idempotency_key ?? crypto.randomUUID(), selection);
-          return mcpJson({ selection, remote: true, run });
+          const selection2 = resolved.selection;
+          const run = await client.submit(selection2.slug, selection2.version, input2 ?? {}, idempotency_key ?? crypto.randomUUID(), selection2);
+          return mcpJson({ selection: selection2, remote: true, run });
         }
         const result2 = await executeSelectedLocal2(resolved, { args, input: input2, cwd: process.cwd() });
         return { ...mcpJson(result2), isError: result2.exitCode !== 0 };
@@ -55866,9 +56012,9 @@ function registerResourceMetaTools(server) {
       existing.last_seen_at = new Date().toISOString();
       return mcpJson({ ...existing, registered: false });
     }
-    const id = Math.random().toString(36).slice(2, 10);
-    const ag = { id, name: a.name, last_seen_at: new Date().toISOString() };
-    _agentReg.set(id, ag);
+    const id2 = Math.random().toString(36).slice(2, 10);
+    const ag = { id: id2, name: a.name, last_seen_at: new Date().toISOString() };
+    _agentReg.set(id2, ag);
     return mcpJson({ ...ag, registered: true });
   });
   server.tool("heartbeat", "Update last_seen_at to signal agent is active.", { agent_id: exports_external.string() }, async (a) => {
@@ -56059,11 +56205,11 @@ function addSchedule(skill, cron, options = {}) {
   if (!valid)
     return { schedule: null, error: error61 };
   const data = loadSchedules(options.targetDir);
-  const id = `${skill}-${Date.now()}`;
+  const id2 = `${skill}-${Date.now()}`;
   const now = new Date;
   const nextRun = getNextRun(cron, now);
   const schedule = {
-    id,
+    id: id2,
     name: options.name || `${skill} (${cron})`,
     skill,
     cron,
@@ -56569,11 +56715,11 @@ var init_private_publication_customer = __esm(() => {
 });
 
 // src/lib/private-publication-recovery.ts
-import { constants as constants8, closeSync as closeSync12, fsyncSync as fsyncSync2, fstatSync as fstatSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync15, openSync as openSync12, readSync as readSync6, realpathSync as realpathSync6, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "fs";
+import { constants as constants8, closeSync as closeSync12, fsyncSync as fsyncSync2, fstatSync as fstatSync12, lstatSync as lstatSync10, mkdirSync as mkdirSync15, openSync as openSync12, readSync as readSync6, realpathSync as realpathSync7, renameSync as renameSync6, unlinkSync as unlinkSync5, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname11, isAbsolute as isAbsolute7, join as join28, resolve as resolve6 } from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function safeDirectory(directory2) {
-  if (!isAbsolute7(directory2) || directory2 !== resolve6(directory2) || realpathSync6(directory2) !== directory2)
+  if (!isAbsolute7(directory2) || directory2 !== resolve6(directory2) || realpathSync7(directory2) !== directory2)
     return fail2();
   for (let path = directory2;; path = dirname11(path)) {
     const stat2 = lstatSync10(path);
@@ -56711,7 +56857,7 @@ async function preparePrivatePublication(client, sourceDirectory, recoveryDirect
     phase: "prepared",
     intent: null
   };
-  if (!isAbsolute7(recoveryDirectory) || resolve6(recoveryDirectory) !== recoveryDirectory || realpathSync6(dirname11(recoveryDirectory)) !== dirname11(recoveryDirectory))
+  if (!isAbsolute7(recoveryDirectory) || resolve6(recoveryDirectory) !== recoveryDirectory || realpathSync7(dirname11(recoveryDirectory)) !== dirname11(recoveryDirectory))
     return fail2();
   mkdirSync15(recoveryDirectory, { mode: 448 });
   safeDirectory(recoveryDirectory);
@@ -57417,14 +57563,14 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
   return /* @__PURE__ */ new TypeError("Body is unusable");
 }, rejectBodyUnusable = () => {
   return Promise.reject(newBodyUnusableError());
-}, textDecoder, consumeBodyDirectOnce = (request) => {
-  if (request[bodyConsumedDirectlyKey])
+}, textDecoder, consumeBodyDirectOnce = (request2) => {
+  if (request2[bodyConsumedDirectlyKey])
     return rejectBodyUnusable();
-  request[bodyConsumedDirectlyKey] = true;
+  request2[bodyConsumedDirectlyKey] = true;
 }, toArrayBuffer = (buf) => {
   return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
-}, contentType = (request) => {
-  return (request[headersKey] ||= newHeadersFromIncoming(request[incomingKey])).get("content-type") || "";
+}, contentType = (request2) => {
+  return (request2[headersKey] ||= newHeadersFromIncoming(request2[incomingKey])).get("content-type") || "";
 }, methodTokenRegExp, normalizeIncomingMethod = (method) => {
   if (typeof method !== "string" || method.length === 0)
     return "GET";
@@ -57457,57 +57603,57 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
   const normalized = method.toUpperCase();
   if (normalized === "CONNECT" || normalized === "TRACK" || normalized === "TRACE" && method !== "TRACE")
     return /* @__PURE__ */ new TypeError(`'${method}' HTTP method is unsupported.`);
-}, readBodyWithFastPath = (request, method, fromBuffer) => {
-  if (request[bodyConsumedDirectlyKey])
+}, readBodyWithFastPath = (request2, method, fromBuffer) => {
+  if (request2[bodyConsumedDirectlyKey])
     return rejectBodyUnusable();
-  const methodName = request.method;
+  const methodName = request2.method;
   if (methodName === "GET" || methodName === "HEAD")
-    return request[getRequestCache]()[method]();
+    return request2[getRequestCache]()[method]();
   const methodValidationError = validateDirectReadMethod(methodName);
   if (methodValidationError)
     return Promise.reject(methodValidationError);
-  if (request[requestCache]) {
+  if (request2[requestCache]) {
     if (methodName !== "TRACE")
-      return request[requestCache][method]();
+      return request2[requestCache][method]();
   }
-  const alreadyUsedError = consumeBodyDirectOnce(request);
+  const alreadyUsedError = consumeBodyDirectOnce(request2);
   if (alreadyUsedError)
     return alreadyUsedError;
-  const raw = readRawBodyIfAvailable(request);
+  const raw = readRawBodyIfAvailable(request2);
   if (raw) {
-    const result = Promise.resolve(fromBuffer(raw, request));
-    request[bodyBufferKey] = undefined;
+    const result = Promise.resolve(fromBuffer(raw, request2));
+    request2[bodyBufferKey] = undefined;
     return result;
   }
-  return readBodyDirect(request).then((buf) => {
-    const result = fromBuffer(buf, request);
-    request[bodyBufferKey] = undefined;
+  return readBodyDirect(request2).then((buf) => {
+    const result = fromBuffer(buf, request2);
+    request2[bodyBufferKey] = undefined;
     return result;
   });
-}, readRawBodyIfAvailable = (request) => {
-  const incoming = request[incomingKey];
+}, readRawBodyIfAvailable = (request2) => {
+  const incoming = request2[incomingKey];
   if ("rawBody" in incoming && incoming.rawBody instanceof Buffer)
     return incoming.rawBody;
-}, normalizeAbortError = (request, incoming) => {
+}, normalizeAbortError = (request2, incoming) => {
   if (incoming.errored)
     return incoming.errored;
-  const reason = request[abortReasonKey];
+  const reason = request2[abortReasonKey];
   if (reason !== undefined)
     return reason instanceof Error ? reason : new Error(String(reason));
   return /* @__PURE__ */ new Error("Client connection prematurely closed.");
-}, readBodyDirect = (request) => {
-  if (request[bodyBufferKey])
-    return Promise.resolve(request[bodyBufferKey]);
-  if (request[bodyReadPromiseKey])
-    return request[bodyReadPromiseKey];
-  const incoming = request[incomingKey];
+}, readBodyDirect = (request2) => {
+  if (request2[bodyBufferKey])
+    return Promise.resolve(request2[bodyBufferKey]);
+  if (request2[bodyReadPromiseKey])
+    return request2[bodyReadPromiseKey];
+  const incoming = request2[incomingKey];
   if (incoming.readableDidRead)
     return rejectBodyUnusable();
   const buffered = readBodyBufferedBeforeDisconnect(incoming);
   if (buffered !== undefined) {
     if (buffered instanceof Error)
       return Promise.reject(buffered);
-    request[bodyBufferKey] = buffered;
+    request2[bodyBufferKey] = buffered;
     return Promise.resolve(buffered);
   }
   const promise3 = new Promise((resolve7, reject) => {
@@ -57529,9 +57675,9 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
         if (recovered instanceof Error)
           reject(recovered);
         else if (recovered === undefined)
-          reject(error61 ?? normalizeAbortError(request, incoming));
+          reject(error61 ?? normalizeAbortError(request2, incoming));
         else {
-          request[bodyBufferKey] = recovered;
+          request2[bodyBufferKey] = recovered;
           resolve7(recovered);
         }
       });
@@ -57543,7 +57689,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
     const onEnd = () => {
       finish(() => {
         const buffer = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks);
-        request[bodyBufferKey] = buffer;
+        request2[bodyBufferKey] = buffer;
         resolve7(buffer);
       });
     };
@@ -57562,7 +57708,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
       if (recoverCompleteBodyAfterDisconnect())
         return;
       finish(() => {
-        reject(normalizeAbortError(request, incoming));
+        reject(normalizeAbortError(request2, incoming));
       });
     };
     const cleanup = () => {
@@ -57570,7 +57716,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
       incoming.off("end", onEnd);
       incoming.off("error", onError);
       incoming.off("close", onClose);
-      request[bodyReadPromiseKey] = undefined;
+      request2[bodyReadPromiseKey] = undefined;
     };
     incoming.on("data", onData);
     incoming.on("end", onEnd);
@@ -57587,7 +57733,7 @@ var RequestError, nonJoinedHeaders, validHeaderName, isHttpWhitespace = (code2)
         onClose();
     });
   });
-  request[bodyReadPromiseKey] = promise3;
+  request2[bodyReadPromiseKey] = promise3;
   return promise3;
 }, requestPrototype, newRequest = (incoming, defaultHostname) => {
   const req = Object.create(requestPrototype);
@@ -58162,10 +58308,10 @@ var init_dist2 = __esm(() => {
     get body() {
       if (!this[bodyConsumedDirectlyKey])
         return this[getRequestCache]().body;
-      const request = this[getRequestCache]();
-      if (!this[bodyLockReaderKey] && request.body)
-        this[bodyLockReaderKey] = request.body.getReader();
-      return request.body;
+      const request2 = this[getRequestCache]();
+      if (!this[bodyLockReaderKey] && request2.body)
+        this[bodyLockReaderKey] = request2.body.getReader();
+      return request2.body;
     },
     get bodyUsed() {
       if (this[bodyConsumedDirectlyKey])
@@ -58210,8 +58356,8 @@ var init_dist2 = __esm(() => {
     return readBodyWithFastPath(this, "arrayBuffer", (buf) => toArrayBuffer(buf));
   } });
   Object.defineProperty(requestPrototype, "blob", { value: function() {
-    return readBodyWithFastPath(this, "blob", (buf, request) => {
-      const type = contentType(request);
+    return readBodyWithFastPath(this, "blob", (buf, request2) => {
+      const type = contentType(request2);
       const init = type ? { headers: { "content-type": type } } : undefined;
       return new Response(buf, init).blob();
     });
@@ -59255,28 +59401,28 @@ data:
     }
     if (isJSONRPCResultResponse(message) || isJSONRPCErrorResponse(message)) {
       this._requestResponseMap.set(requestId, message);
-      const relatedIds = Array.from(this._requestToStreamMapping.entries()).filter(([_, sid]) => sid === streamId).map(([id]) => id);
-      const allResponsesReady = relatedIds.every((id) => this._requestResponseMap.has(id));
+      const relatedIds = Array.from(this._requestToStreamMapping.entries()).filter(([_, sid]) => sid === streamId).map(([id2]) => id2);
+      const allResponsesReady = relatedIds.every((id2) => this._requestResponseMap.has(id2));
       if (allResponsesReady) {
         if (!stream) {
           if (this._closed) {
-            for (const id of relatedIds) {
-              this._requestResponseMap.delete(id);
-              this._requestToStreamMapping.delete(id);
+            for (const id2 of relatedIds) {
+              this._requestResponseMap.delete(id2);
+              this._requestToStreamMapping.delete(id2);
             }
             return;
           }
           if (!this._enableJsonResponse && this._eventStore && this._resumableStreams.has(streamId)) {
-            for (const id of relatedIds) {
-              this._requestResponseMap.delete(id);
-              this._requestToStreamMapping.delete(id);
+            for (const id2 of relatedIds) {
+              this._requestResponseMap.delete(id2);
+              this._requestToStreamMapping.delete(id2);
             }
             this._resumableStreams.delete(streamId);
             return;
           }
-          for (const id of relatedIds) {
-            this._requestResponseMap.delete(id);
-            this._requestToStreamMapping.delete(id);
+          for (const id2 of relatedIds) {
+            this._requestResponseMap.delete(id2);
+            this._requestToStreamMapping.delete(id2);
           }
           throw new Error(`No connection established for request ID: ${String(requestId)}`);
         }
@@ -59287,7 +59433,7 @@ data:
           if (this.sessionId !== undefined) {
             headers["mcp-session-id"] = this.sessionId;
           }
-          const responses = relatedIds.map((id) => this._requestResponseMap.get(id));
+          const responses = relatedIds.map((id2) => this._requestResponseMap.get(id2));
           if (responses.length === 1) {
             stream.resolveJson(new Response(JSON.stringify(responses[0]), { status: 200, headers }));
           } else {
@@ -59296,9 +59442,9 @@ data:
         } else {
           stream.cleanup();
         }
-        for (const id of relatedIds) {
-          this._requestResponseMap.delete(id);
-          this._requestToStreamMapping.delete(id);
+        for (const id2 of relatedIds) {
+          this._requestResponseMap.delete(id2);
+          this._requestToStreamMapping.delete(id2);
         }
         this._resumableStreams.delete(streamId);
       }