@poe-platform/safe-bash 0.1.772 → 0.1.773

package/dist/safe-bash-mcp/index.d.ts

@@ -292,7 +292,10 @@ interface OAuthClientProvider$1 {
         requestUrl: URL;
         response: Response;
         challenge: OAuthUnauthorizedChallenge$1 | null;
-        discovery: OAuthDiscoveryResult$1;
+        /** Validated metadata supplied by direct callers, if already available. */
+        discovery?: OAuthDiscoveryResult$1;
+        /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
+        discover?: () => Promise<OAuthDiscoveryResult$1>;
         fetch: OAuthMetadataFetch$1;
         signal?: AbortSignal;
         /** Headers actually attached to this rejected request. */
@@ -983,7 +986,10 @@ interface OAuthClientProvider {
         requestUrl: URL;
         response: Response;
         challenge: OAuthUnauthorizedChallenge | null;
-        discovery: OAuthDiscoveryResult;
+        /** Validated metadata supplied by direct callers, if already available. */
+        discovery?: OAuthDiscoveryResult;
+        /** Lazy validated metadata; invoke only when OAuth recovery needs it. */
+        discover?: () => Promise<OAuthDiscoveryResult>;
         fetch: OAuthMetadataFetch;
         signal?: AbortSignal;
         /** Headers actually attached to this rejected request. */

package/dist/safe-bash-mcp/index.js

@@ -2120,7 +2120,10 @@ function createDefaultOAuthClientProvider(options) {
         };
         assertNoAccessTokenInUrl(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator(input.requestUrl);
-        const resource = canonicalizeResourceIndicator(input.discovery.resource);
+        const discovery = input.discovery ?? structuredClone(await waitForOAuthOperation(input.discover?.() ?? Promise.reject(new Error("OAuth recovery requires metadata discovery")), input.signal));
+        if (discovery === void 0)
+          throw new Error("OAuth recovery requires metadata discovery");
+        const resource = canonicalizeResourceIndicator(discovery.resource);
         assertRequestMatchesResource(requestUrl, resource);
         const cached = await waitForOAuthOperation(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
@@ -2140,7 +2143,7 @@ function createDefaultOAuthClientProvider(options) {
         }
         const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
-          ...input.discovery,
+          ...discovery,
           resource
         }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
         if (session?.tokens?.accessToken === void 0) {
@@ -8284,7 +8287,10 @@ function createDefaultOAuthClientProvider2(options) {
         };
         assertNoAccessTokenInUrl2(input.requestUrl, "Protected resource request URL");
         const requestUrl = canonicalizeResourceIndicator2(input.requestUrl);
-        const resource = canonicalizeResourceIndicator2(input.discovery.resource);
+        const discovery = input.discovery ?? structuredClone(await waitForOAuthOperation2(input.discover?.() ?? Promise.reject(new Error("OAuth recovery requires metadata discovery")), input.signal));
+        if (discovery === void 0)
+          throw new Error("OAuth recovery requires metadata discovery");
+        const resource = canonicalizeResourceIndicator2(discovery.resource);
         assertRequestMatchesResource2(requestUrl, resource);
         const cached = await waitForOAuthOperation2(loadSession(resource), input.signal);
         const currentTokens = cached?.tokens ?? (!initialGrantConsumed && initialGrant?.resource === resource ? initialGrant.tokens : void 0);
@@ -8304,7 +8310,7 @@ function createDefaultOAuthClientProvider2(options) {
         }
         const forceRefresh = rejectedCurrentGrant && (challengeError === "invalid_token" || input.presentedTokens !== void 0 && challengeError === void 0);
         const session = await ensureAuthorizedSession(resource, {
-          ...input.discovery,
+          ...discovery,
           resource
         }, input.fetch, true, forceRefresh, input.signal, presentedTokens);
         if (session?.tokens?.accessToken === void 0) {
@@ -10799,7 +10805,8 @@ var HttpTransport = class {
     try {
       const challenge = parseBearerWwwAuthenticateHeader(response.headers.get("WWW-Authenticate"));
       const resourceMetadataUrl = challenge?.params.resource_metadata;
-      const discovery = await discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
+      let discovery;
+      const discover = () => discovery ??= discoveryClient.discover(this.url, { resourceMetadataUrl, signal });
       const providerResponse = response.clone();
       let result;
       try {
@@ -10807,7 +10814,7 @@ var HttpTransport = class {
           requestUrl: new URL(this.url),
           response: providerResponse,
           challenge,
-          discovery,
+          discover,
           signal,
           requestHeaders: new Headers(requestHeaders),
           presentedTokens,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@poe-platform/safe-bash",
-  "version": "0.1.772",
+  "version": "0.1.773",
   "description": "Extensible virtual shell with pluggable filesystems and streaming commands",
   "type": "module",
   "license": "MIT",
@@ -841,7 +841,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@poe-platform/safe-fs": "0.1.772",
+    "@poe-platform/safe-fs": "0.1.773",
     "pdf-lib": "1.17.1",
     "@noble/hashes": "2.4.0",
     "pako": "3.0.1",
@@ -860,16 +860,16 @@
       "browser": "./dist/safe-bash/commands/archive/zip/aes-primitives-unavailable.js",
       "default": "./dist/safe-bash/commands/archive/zip/aes-primitives.js"
     },
+    "#git-wasm": {
+      "types": "./dist/safe-bash-command-git/runtime.d.ts",
+      "workerd": "./dist/safe-bash-command-git/runtime.workerd.js",
+      "default": "./dist/safe-bash-command-git/runtime.js"
+    },
     "#safe-bash-network-platform": {
       "types": "./dist/safe-bash/commands/network/platform.d.ts",
       "workerd": "./dist/safe-bash/commands/network/platform-portable.js",
       "browser": "./dist/safe-bash/commands/network/platform-portable.js",
       "default": "./dist/safe-bash/commands/network/platform.js"
-    },
-    "#git-wasm": {
-      "types": "./dist/safe-bash-command-git/runtime.d.ts",
-      "workerd": "./dist/safe-bash-command-git/runtime.workerd.js",
-      "default": "./dist/safe-bash-command-git/runtime.js"
     }
   },
   "peerDependencies": {

package/third-party/pdf-ast/THIRD_PARTY_NOTICES.md

@@ -406,7 +406,68 @@ and intermediate-surface state reset. Bitmap and SVG exports follow
 ports the unchanged `transparency_group.pdf` and `bug1873345.pdf` equality
 fixtures, with independently obtained reference pixels. Full non-isolated
 backdrop compositing for groups with outer effects retains PDF.js's documented
-limitation. Form contents remain vectors in SVG output.
+limitation.
+
+Masked non-isolated Forms with inner blending or soft-mask effects follow
+PDF.js `beginGroup`'s `needsBackdropCopy && inSMaskMode` path. The raster adapter
+copies the existing page within the transformed Form BBox before painting the
+group; ordinary outer-opacity groups keep their transparent intermediate.
+`src/render/masked-group-backdrop.test.ts` covers this distinction and the
+unchanged `issue13520.pdf` fixture. SVG uses a raster fallback for pages requiring
+this backdrop copy; other Form groups retain their vector output.
+
+CropBox handling follows PDF.js `Page.getBoundingBox` and `Page.view` in
+`src/core/document.js`, and the SVG corner transform follows
+`PageViewport.convertToViewportRectangle`. The adaptation stores bounds on the
+local display list and crops before page rotation, keeping editing coordinates
+unchanged. `src/render/crop-box.test.ts` covers these rules and the unmodified
+`issue13520.pdf` equality fixture, recorded in `src/fixtures/SOURCES.md`.
+
+MediaBox-origin rendering follows PDF.js `PageViewport` in
+`src/display/page_viewport.js`: viewport coordinates subtract the normalized
+lower-left page origin before applying rotation. Local rasterization applies
+that translation to paths, strokes, images, clips, and intermediate mask/group
+surfaces; SVG uses the vendored viewport transform. The unchanged PDF.js
+`bug852992_reduced.pdf` soft-mask fixture and memory-only offset-page tests cover
+this behavior in `src/render/media-box-origin.test.ts`.
+
+Sampled-function interpolation adapts PDF.js `PDFFunction.constructSampled`
+in `src/core/function.js`. The local evaluator reads the weighted neighboring
+samples directly, supports unsigned packed samples through 32 bits, and handles
+singleton axes without reading outside the table. Its degenerate-Domain test
+is ported from `test/unit/colorspace_spec.js` (AlternateCS), with assertions on
+the tint components before color conversion. The unchanged
+`bug852992_reduced.pdf` fixture also verifies the restored soft-mask fade.
+
+Exponential and stitched function evaluation follows PDF.js
+`PDFFunction.constructInterpolated` and `constructStitched` in the same source:
+apply the exponent to the input, and pass the stitched Encode result to the
+child without rescaling it to a unit interval. Local memory-only regressions
+cover non-unit domains, zero/negative exponents, output ranges, segment bounds,
+reversed encoding, and image tint consistency. Domain and Range clipping also
+follow the PDF function contract.
+
+Calculator functions use the unmodified PDF.js `buildPostScriptJsFunction`
+from `src/core/postscript/js_evaluator.js`, together with its AST and lexer.
+The JavaScript evaluator interprets instructions without `eval`, `Function`,
+or WebAssembly compilation. Compiled functions are cached weakly by COS stream;
+code, Domain, or Range edits invalidate the entry. `pdfjs-postscript.test.ts`
+ports 35 complete input/output vectors from `test/unit/postscript_spec.js`,
+alongside comment, image-function integration, and edit-invalidation coverage.
+
+The vendor bundle includes unmodified PDF.js `DeviceCmykCS` from
+`src/core/colorspace.js`. Path, shading, and image color conversion use this
+class directly, including CMYK palette entries and alternate tint colors.
+`src/render/cmyk-colors.test.ts` ports the byte and floating-point reference
+vectors from PDF.js `test/unit/colorspace_spec.js`, through local PDF APIs.
+
+The same bundle exports unmodified `CalGrayCS`, `CalRGBCS`, and `LabCS`.
+The shared calibrated-color adapter resolves COS parameters before calling
+these classes. Paths, gradients, images, palettes, and calibrated alternate
+tint spaces use the same converters. `calibrated-colors.test.ts` ports the
+corresponding PDF.js `colorspace_spec.js` input/output vectors through those
+APIs and the unchanged `calgray.pdf` equality fixture. Missing WhitePoint
+retains the local D65 fallback for malformed input.
 
 Malformed dictionary-key recovery follows PDF.js `Parser.getObj`, skipping
 stray non-Name tokens only in local repair mode. Damaged optional ToUnicode