@noodleseed/one 0.22.0 → 0.23.0

package/node_modules/undici/lib/web/fetch/index.js

@@ -1431,7 +1431,16 @@ async function httpNetworkOrCacheFetch (
     // Otherwise:
 
     // 1. Set httpRequest to a clone of request.
-    httpRequest = cloneRequest(request)
+    // Implementations are encouraged to avoid teeing request’s body’s stream
+    // when request’s body’s source is null as only a single body is needed in
+    // that case. E.g., when request’s body’s source is null, redirects and
+    // authentication will end up failing the fetch.
+    if (request.body?.source != null) {
+      httpRequest = cloneRequest(request)
+    } else {
+      httpRequest = cloneRequest({ ...request, body: null })
+      httpRequest.body = request.body
+    }
 
     // 2. Set httpFetchParams to a copy of fetchParams.
     httpFetchParams = { ...fetchParams }
@@ -1560,7 +1569,7 @@ async function httpNetworkOrCacheFetch (
   //    TODO: https://github.com/whatwg/fetch/issues/1285#issuecomment-896560129
   if (!httpRequest.headersList.contains('accept-encoding', true)) {
     if (urlHasHttpsScheme(requestCurrentURL(httpRequest))) {
-      httpRequest.headersList.append('accept-encoding', 'br, gzip, deflate', true)
+      httpRequest.headersList.append('accept-encoding', 'br, gzip, deflate, zstd', true)
     } else {
       httpRequest.headersList.append('accept-encoding', 'gzip, deflate', true)
     }

package/node_modules/undici/lib/web/fetch/request.js

@@ -930,6 +930,7 @@ function makeRequest (init) {
     referrerPolicy: init.referrerPolicy ?? '',
     mode: init.mode ?? 'no-cors',
     useCORSPreflightFlag: init.useCORSPreflightFlag ?? false,
+    // TODO: is this credentials mode? https://fetch.spec.whatwg.org/#concept-request-credentials-mode
     credentials: init.credentials ?? 'same-origin',
     useCredentials: init.useCredentials ?? false,
     cache: init.cache ?? 'default',

package/node_modules/undici/lib/web/fetch/util.js

@@ -1195,7 +1195,10 @@ function simpleRangeHeaderValue (value, allowWhitespace) {
   // 18. If rangeStartValue and rangeEndValue are numbers, and rangeStartValue is
   //     greater than rangeEndValue, then return failure.
   // Note: ... when can they not be numbers?
-  if (rangeStartValue > rangeEndValue) {
+  // Note: rangeStartValue or rangeEndValue may be null for open-ended ranges
+  //     such as `bytes=5-` or `bytes=-5`. A null value must not be coerced to 0
+  //     in the comparison, so this check only applies when both are numbers.
+  if (rangeStartValue !== null && rangeEndValue !== null && rangeStartValue > rangeEndValue) {
     return 'failure'
   }
 

package/node_modules/undici/lib/web/websocket/receiver.js

@@ -39,6 +39,9 @@ class ByteParser extends Writable {
   /** @type {import('./websocket').Handler} */
   #handler
 
+  /** @type {number} */
+  #maxFragments
+
   /** @type {number} */
   #maxPayloadSize
 
@@ -52,6 +55,7 @@ class ByteParser extends Writable {
 
     this.#handler = handler
     this.#extensions = extensions == null ? new Map() : extensions
+    this.#maxFragments = options.maxFragments ?? 0
     this.#maxPayloadSize = options.maxPayloadSize ?? 0
 
     if (this.#extensions.has('permessage-deflate')) {
@@ -75,7 +79,7 @@ class ByteParser extends Writable {
     if (
       this.#maxPayloadSize > 0 &&
       !isControlFrame(this.#info.opcode) &&
-      this.#info.payloadLength > this.#maxPayloadSize
+      this.#info.payloadLength + this.#fragmentsBytes > this.#maxPayloadSize
     ) {
       failWebsocketConnection(this.#handler, 1009, 'Payload size exceeds maximum allowed size')
       return false
@@ -242,7 +246,9 @@ class ByteParser extends Writable {
           this.#state = parserStates.INFO
         } else {
           if (!this.#info.compressed) {
-            this.writeFragments(body)
+            if (!this.writeFragments(body)) {
+              return
+            }
 
             // If the frame is not fragmented, a message has been received.
             // If the frame is fragmented, it will terminate with a fin bit set
@@ -264,7 +270,9 @@ class ByteParser extends Writable {
                   return
                 }
 
-                this.writeFragments(data)
+                if (!this.writeFragments(data)) {
+                  return
+                }
 
                 // Check cumulative fragment size
                 if (this.#maxPayloadSize > 0 && this.#fragmentsBytes > this.#maxPayloadSize) {
@@ -345,8 +353,17 @@ class ByteParser extends Writable {
   }
 
   writeFragments (fragment) {
+    if (
+      this.#maxFragments > 0 &&
+      this.#fragments.length === this.#maxFragments
+    ) {
+      failWebsocketConnection(this.#handler, 1008, 'Too many message fragments')
+      return false
+    }
+
     this.#fragmentsBytes += fragment.length
     this.#fragments.push(fragment)
+    return true
   }
 
   consumeFragments () {

package/node_modules/undici/lib/web/websocket/stream/websocketstream.js

@@ -258,7 +258,14 @@ class WebSocketStream {
   #onConnectionEstablished (response, parsedExtensions) {
     this.#handler.socket = response.socket
 
-    const parser = new ByteParser(this.#handler, parsedExtensions)
+    // Get options from dispatcher options
+    const maxFragments = this.#handler.controller.dispatcher?.webSocketOptions?.maxFragments
+    const maxPayloadSize = this.#handler.controller.dispatcher?.webSocketOptions?.maxPayloadSize
+
+    const parser = new ByteParser(this.#handler, parsedExtensions, {
+      maxFragments,
+      maxPayloadSize
+    })
     parser.on('drain', () => this.#handler.onParserDrain())
     parser.on('error', (err) => this.#handler.onParserError(err))
 

package/node_modules/undici/lib/web/websocket/websocket.js

@@ -468,10 +468,12 @@ class WebSocket extends EventTarget {
     // once this happens, the connection is open
     this.#handler.socket = response.socket
 
-    // Get maxPayloadSize from dispatcher options
+    // Get options from dispatcher options
+    const maxFragments = this.#handler.controller.dispatcher?.webSocketOptions?.maxFragments
     const maxPayloadSize = this.#handler.controller.dispatcher?.webSocketOptions?.maxPayloadSize
 
     const parser = new ByteParser(this.#handler, parsedExtensions, {
+      maxFragments,
       maxPayloadSize
     })
     parser.on('drain', () => this.#handler.onParserDrain())

package/node_modules/undici/package.json

@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.4.1",
+  "version": "8.7.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {

package/node_modules/undici/types/client.d.ts

@@ -57,7 +57,7 @@ export declare namespace Client {
     keepAliveTimeoutThreshold?: number;
     /** An IPC endpoint, either a Unix domain socket or Windows named pipe. Default: `null`. */
     socketPath?: string;
-    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Default: `1`. */
+    /** The amount of concurrent requests to be sent over the single TCP/TLS connection according to [RFC7230](https://tools.ietf.org/html/rfc7230#section-6.3.2). Only enable values greater than `1` when the remote server is trusted. Default: `1`. */
     pipelining?: number;
     /** @deprecated use the connect option instead */
     tls?: never;
@@ -116,6 +116,11 @@ export declare namespace Client {
     bytesRead?: number
   }
   export interface WebSocketOptions {
+    /**
+     * Maximum number of fragments in a message. Set to 0 to disable the limit.
+     * @default 131072
+     */
+    maxFragments?: number;
     /**
      * Maximum allowed payload size in bytes for WebSocket messages.
      * Applied to uncompressed messages, compressed frame payloads, and decompressed (permessage-deflate) messages.

package/node_modules/undici/types/cookies.d.ts

@@ -18,7 +18,7 @@ export interface Cookie {
 export function deleteCookie (
   headers: Headers,
   name: string,
-  attributes?: { name?: string, domain?: string }
+  attributes?: { path?: string, domain?: string }
 ): void
 
 export function getCookies (headers: Headers): Record<string, string>

package/node_modules/undici/types/errors.d.ts

@@ -154,6 +154,16 @@ declare namespace Errors {
     code: 'UND_ERR_PRX_TLS'
   }
 
+  export class ProxyConnectionError extends UndiciError {
+    constructor (
+      cause?: Error,
+      message?: string,
+      options?: Record<any, any>
+    )
+    name: 'ProxyConnectionError'
+    code: 'UND_ERR_PRX_CONN'
+  }
+
   export class MaxOriginsReachedError extends UndiciError {
     name: 'MaxOriginsReachedError'
     code: 'UND_ERR_MAX_ORIGINS_REACHED'

package/node_modules/undici/types/fetch.d.ts

@@ -57,6 +57,7 @@ export class BodyMixin {
   readonly formData: () => Promise<FormData>
   readonly json: () => Promise<unknown>
   readonly text: () => Promise<string>
+  readonly textStream: () => ReadableStream<string>
 }
 
 export interface SpecIterator<T, TReturn = any, TNext = undefined> {

package/node_modules/undici/types/handlers.d.ts

@@ -1,6 +1,8 @@
 import Dispatcher from './dispatcher'
 
 export declare class RedirectHandler implements Dispatcher.DispatchHandler {
+  static buildDispatch (dispatcher: Dispatcher, maxRedirections: number): Dispatcher.Dispatch
+
   constructor (
     dispatch: Dispatcher.Dispatch,
     maxRedirections: number,

package/node_modules/undici/types/proxy-agent.d.ts

@@ -24,6 +24,13 @@ declare namespace ProxyAgent {
     requestTls?: buildConnector.BuildOptions;
     proxyTls?: buildConnector.BuildOptions;
     clientFactory?(origin: URL, opts: object): Dispatcher;
+    /**
+     * Undici tunnels via CONNECT when the target endpoint uses HTTPS, and
+     * forwards (HTTP/1.1 absolute-form request-target, per RFC 9112 §3.2.2)
+     * otherwise, regardless of whether the proxy URL is HTTP or HTTPS. The
+     * non-tunneled forwarding path does not negotiate HTTP/2 with the proxy.
+     * Set to true to force tunneling for plain HTTP requests as well.
+     */
     proxyTunnel?: boolean;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers.",
   "license": "Apache-2.0",
@@ -138,7 +138,7 @@
     "cross-spawn": "7.0.6",
     "eventsource": "3.0.7",
     "eventsource-parser": "3.1.0",
-    "hono": "4.12.24",
+    "hono": "4.12.28",
     "ipaddr.js": "2.4.0",
     "jose": "6.2.3",
     "json-schema-typed": "8.0.2",
@@ -149,7 +149,7 @@
     "react": "19.2.7",
     "react-dom": "19.2.7",
     "typescript": "6.0.3",
-    "undici": "8.4.1",
+    "undici": "8.7.0",
     "yaml": "2.9.0",
     "zod": "4.4.3",
     "zod-to-json-schema": "3.25.2"
@@ -158,5 +158,5 @@
     "@types/node": "24.13.1"
   },
   "optionalDependencies": {},
-  "gitHead": "d6a7d530b6c6ef4205f34d617840fce83b9e815b"
+  "gitHead": "414b9f4abebb6230f70802aac51ebcd9faf837bc"
 }