@weavecode/weave 0.1.6 → 0.1.8

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/basic-auth/index.js

@@ -80,7 +80,7 @@ const basicAuth = (options, ...users) => {
 			}
 		}
 		const status = 401;
-		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/"/g, "\\\"") + "\"" };
+		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/[\\"]/g, "\\$&") + "\"" };
 		const responseMessage = typeof options.invalidUserMessage === "function" ? await options.invalidUserMessage(ctx) : options.invalidUserMessage;
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -44,7 +44,7 @@ const bearerAuth = (options) => {
 	if (!("token" in options || "verifyToken" in options)) throw new Error("bearer auth middleware requires options for \"token\" or \"verifyToken\"");
 	if (!options.realm) options.realm = "";
 	if (options.prefix === void 0) options.prefix = PREFIX;
-	const realm = options.realm?.replace(/"/g, "\\\"");
+	const realm = options.realm?.replace(/[\\"]/g, "\\$&");
 	const prefix = options.prefix;
 	const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`);
 	const wwwAuthenticatePrefix = prefix === "" ? "" : `${prefix} `;

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/csrf/index.js

@@ -8,7 +8,7 @@ const secFetchSiteValues = [
 ];
 const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
 const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
-const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+const isCsrfContentTypeRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/(?:plain|ping))\b/i;
 /**
 * CSRF Protection Middleware for Hono.
 *
@@ -94,7 +94,7 @@ const csrf = (options) => {
 		return await secFetchSiteHandler(secFetchSite, c);
 	};
 	return async function csrf(c, next) {
-		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
+		if (!isSafeMethodRe.test(c.req.method) && isCsrfContentTypeRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
 			const res = new Response("Forbidden", { status: 403 });
 			throw new HTTPException(403, { res });
 		}

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/jwk/jwk.js

@@ -109,8 +109,8 @@ const jwk = (options, init) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/jwt/jwt.js

@@ -103,8 +103,8 @@ const jwt = (options) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/language/language.js

@@ -1,5 +1,5 @@
-import { getCookie, setCookie } from "../../helper/cookie/index.js";
 import { parseAccept } from "../../utils/accept.js";
+import { getCookie, setCookie } from "../../helper/cookie/index.js";
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/mount/index.js

@@ -1,10 +1,9 @@
+import { createMountedRequest } from "../../utils/mount.js";
 import { routePath } from "../../helper/route/index.js";
 //#region src/middleware/mount/index.ts
 const defaultReplaceRequest = (c) => {
-	const pathPrefix = routePath(c).replace(/\/\*$/, "");
-	const url = new URL(c.req.raw.url);
-	url.pathname = c.req.path.slice(pathPrefix.length) || "/";
-	return new Request(url, c.req.raw);
+	const path = routePath(c);
+	return createMountedRequest(c, path.replace(/\/?\*$/, ""), path);
 };
 const defaultGetOptions = (c) => {
 	let executionContext = void 0;
@@ -21,6 +20,7 @@ const defaultGetOptions = (c) => {
 * @param {Function} applicationHandler - other Request Handler
 * @param {MountOptions} [options] - options of `mount()`
 * @returns {MiddlewareHandler} handler to register with `app.all()`
+* @throws {Error} If the route ends with a wildcard inside a segment (e.g. `/assets*`), or automatic request rewriting encounters duplicate path parameter names.
 *
 * @example
 * ```ts

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/node.js

@@ -1,8 +1,8 @@
 import { createNullObject } from "../utils.js";
 //#region src/router/reg-exp-router/node.ts
 const LABEL_REG_EXP_STR = "[^/]+";
-const ONLY_WILDCARD_REG_EXP_STR = ".*";
-const TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+const ONLY_WILDCARD_REG_EXP_STR = "[^]*";
+const TAIL_WILDCARD_REG_EXP_STR = "(?:|/[^]*)";
 const PATH_ERROR = Symbol();
 const regExpMetaChars = /* @__PURE__ */ new Set(".\\+*[^]$()");
 /**
@@ -15,8 +15,8 @@ const regExpMetaChars = /* @__PURE__ */ new Set(".\\+*[^]$()");
 function compareKey(a, b) {
 	if (a.length === 1) return b.length === 1 ? a < b ? -1 : 1 : -1;
 	if (b.length === 1) return 1;
-	if (a === ".*" || a === "(?:|/.*)") return b === "(?:|/.*)" ? -1 : 1;
-	else if (b === ".*" || b === "(?:|/.*)") return -1;
+	if (a === "[^]*" || a === "(?:|/[^]*)") return b === "[^]*" ? -1 : 1;
+	else if (b === "[^]*" || b === "(?:|/[^]*)") return -1;
 	if (a === "[^/]+") return 1;
 	else if (b === "[^/]+") return -1;
 	return a.length === b.length ? a < b ? -1 : 1 : b.length - a.length;
@@ -25,14 +25,14 @@ var Node = class Node {
 	#index;
 	#varIndex;
 	#children = createNullObject();
-	insert(tokens, index, paramMap, context, isStatic) {
+	insert(tokens, index, paramMap, context, keys) {
 		let node = this;
 		for (let i = 0, len = tokens.length; i < len; i++) {
 			const token = tokens[i];
 			const pattern = token.length === 1 ? token === "*" ? i === len - 1 ? [
 				"",
 				"",
-				".*"
+				ONLY_WILDCARD_REG_EXP_STR
 			] : [
 				"",
 				"",
@@ -47,15 +47,16 @@ var Node = class Node {
 				const name = pattern[1];
 				let regexpStr = pattern[2] || "[^/]+";
 				if (name && pattern[2]) {
-					if (regexpStr === ".*") throw PATH_ERROR;
+					if (new RegExp(regexpStr).test("")) throw PATH_ERROR;
 					regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
 					if (/\((?!\?:)/.test(regexpStr)) throw PATH_ERROR;
 					if (regexpStr.length === 1 && regExpMetaChars.has(regexpStr)) throw PATH_ERROR;
 				}
+				keys.push(regexpStr);
 				nextNode = node.#children[regexpStr];
 				if (!nextNode) {
-					if (regexpStr !== ".*" && regexpStr !== "(?:|/.*)") {
-						for (const k in node.#children) if ((regexpStr.length > 1 || k.length > 1) && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+					if (regexpStr !== "[^]*" && regexpStr !== "(?:|/[^]*)") {
+						for (const k in node.#children) if ((regexpStr.length > 1 || k.length > 1) && k !== "[^]*" && k !== "(?:|/[^]*)") throw PATH_ERROR;
 					}
 					nextNode = node.#children[regexpStr] = new Node();
 				}
@@ -64,16 +65,17 @@ var Node = class Node {
 					paramMap.push([name, nextNode.#varIndex]);
 				}
 			} else {
+				keys.push(token);
 				nextNode = node.#children[token];
 				if (!nextNode) {
-					for (const k in node.#children) if (k.length > 1 && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+					for (const k in node.#children) if (k.length > 1 && k !== "[^]*" && k !== "(?:|/[^]*)") throw PATH_ERROR;
 					nextNode = node.#children[token] = new Node();
 				}
 			}
 			node = nextNode;
 		}
 		if (node.#index !== void 0) throw PATH_ERROR;
-		node.#index = isStatic ? -1 : index;
+		node.#index = index;
 	}
 	buildRegExpStr() {
 		const strList = Object.keys(this.#children).sort(compareKey).map((k) => {

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/prepared-router.js

@@ -1,5 +1,5 @@
 import "../../router.js";
-import { emptyParam, match } from "./matcher.js";
+import { match } from "./matcher.js";
 import { RegExpRouter } from "./router.js";
 //#region src/router/reg-exp-router/prepared-router.ts
 var PreparedRegExpRouter = class {
@@ -27,7 +27,7 @@ var PreparedRegExpRouter = class {
 		if (!this.#matchers[method]) {
 			const all = this.#matchers["ALL"];
 			const staticMap = {};
-			for (const key in all[2]) staticMap[key] = [all[2][key][0].slice(), emptyParam];
+			for (const key in all[2]) staticMap[key] = [all[2][key][0].slice(), all[2][key][1]];
 			this.#matchers[method] = [
 				all[0],
 				all[1].map((list) => Array.isArray(list) ? list.slice() : 0),
@@ -71,7 +71,7 @@ const buildInitParams = ({ paths }) => {
 						...map
 					};
 					else relocateMap[path] = [[[], map]];
-					if (relocateMap[path][0][0].findIndex((j) => j === i) === -1) relocateMap[path][0][0].push(i);
+					if (!relocateMap[path][0][0].includes(i)) relocateMap[path][0][0].push(i);
 				}
 			});
 		});
@@ -79,7 +79,7 @@ const buildInitParams = ({ paths }) => {
 			if (p === path) {
 				relocateMap[path] ||= [[[]]];
 				const value = path2 === path ? "" : path2;
-				if (relocateMap[path][0][0].findIndex((v) => v === value) === -1) relocateMap[path][0][0].push(value);
+				if (!relocateMap[path][0][0].includes(value)) relocateMap[path][0][0].push(value);
 			}
 		});
 	}
@@ -88,7 +88,7 @@ const buildInitParams = ({ paths }) => {
 	return [matchers, relocateMap];
 };
 const serializeInitParams = ([matchers, relocateMap]) => {
-	return `[${JSON.stringify(matchers, (_, value) => value instanceof RegExp ? `##${value.toString()}##` : value).replace(/"##(.+?)##"/g, (_, str) => str.replace(/\\\\/g, "\\"))},${JSON.stringify(relocateMap)}]`;
+	return `[${JSON.stringify(matchers, (_, value) => value instanceof RegExp || value === void 0 ? `##${value}##` : value).replace(/"##(.+?)##"/g, (_, str) => str.replace(/\\\\/g, "\\"))},${JSON.stringify(relocateMap)}]`;
 };
 //#endregion
 export { PreparedRegExpRouter, buildInitParams, serializeInitParams };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/router.js

@@ -2,24 +2,24 @@ import { checkOptionalParameter } from "../../utils/url.js";
 import { MESSAGE_MATCHER_IS_ALREADY_BUILT, UnsupportedPathError } from "../../router.js";
 import { createNullObject } from "../utils.js";
 import { emptyParam, match } from "./matcher.js";
-import { LABEL_REG_EXP_STR, PATH_ERROR, TAIL_WILDCARD_REG_EXP_STR } from "./node.js";
+import { PATH_ERROR } from "./node.js";
 import { Trie } from "./trie.js";
 //#region src/router/reg-exp-router/router.ts
-let wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path) {
-	return wildcardRegExpCache[path] ??= new RegExp(`^${path.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match, metaChar) => metaChar ? `\\${metaChar}` : match === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
+function endsWithWildcard(keys) {
+	const tail = keys[keys.length - 1];
+	return tail === "[^]*" || tail === "(?:|/[^]*)";
 }
-function findMiddleware(middleware, path) {
-	for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path)) return [...middleware[k]];
+function covers(wildcard, target) {
+	const last = wildcard.length - 1;
+	for (let i = 0; i < last; i++) if (wildcard[i] !== target[i]) return false;
+	return wildcard[last] === "[^]*" || target.length === last || target[last] === "/";
 }
 var RegExpRouter = class {
 	name = "RegExpRouter";
-	#middleware;
-	#routes;
+	#handlers;
 	#tries;
 	constructor() {
-		this.#middleware = { ["ALL"]: createNullObject() };
-		this.#routes = { ["ALL"]: createNullObject() };
+		this.#handlers = { ["ALL"]: [] };
 		this.#tries = { ["ALL"]: new Trie() };
 	}
 	#insertPath(method, path) {
@@ -30,65 +30,53 @@ var RegExpRouter = class {
 		}
 	}
 	add(method, path, handler) {
-		const middleware = this.#middleware;
-		const routes = this.#routes;
-		if (!middleware) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
-		if (!middleware[method]) {
-			this.#tries[method] = new Trie();
-			for (const handlerMap of [middleware, routes]) {
-				handlerMap[method] = createNullObject();
-				for (const p in handlerMap["ALL"]) {
-					handlerMap[method][p] = [...handlerMap["ALL"][p]];
-					this.#insertPath(method, p);
-				}
-			}
+		const handlers = this.#handlers;
+		if (!handlers) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+		const tries = this.#tries;
+		if (!handlers[method]) {
+			tries[method] = new Trie();
+			handlers[method] = [...handlers["ALL"]];
+			for (const p in tries["ALL"].paths) this.#insertPath(method, p);
 		}
 		if (path === "/*") path = "*";
-		const methods = method === "ALL" ? Object.keys(middleware) : [method];
-		if (/\*$/.test(path)) {
-			const re = buildWildcardRegExp(path);
-			for (const m of methods) if (!middleware[m][path]) {
-				this.#insertPath(m, path);
-				middleware[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware["ALL"], path) || [];
-			}
-			for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path]);
-			return;
-		}
+		const methods = method === "ALL" ? Object.keys(handlers) : [method];
 		const paths = checkOptionalParameter(path) || [path];
 		for (const path of paths) for (const m of methods) {
-			if (!routes[m][path]) {
-				this.#insertPath(m, path);
-				routes[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware["ALL"], path) || [];
-			}
-			routes[m][path].push([handler, path]);
+			if (!tries[m].paths[path]) this.#insertPath(m, path);
+			handlers[m].push([handler, path]);
 		}
 	}
 	match = match;
 	buildAllMatchers() {
 		const matchers = createNullObject();
-		for (const method of Object.keys(this.#routes)) matchers[method] = this.#buildMatcher(method);
-		this.#middleware = this.#routes = this.#tries = void 0;
-		wildcardRegExpCache = createNullObject();
+		for (const method of Object.keys(this.#handlers)) matchers[method] = this.#buildMatcher(method);
+		this.#handlers = this.#tries = void 0;
 		return matchers;
 	}
 	#buildMatcher(method) {
-		const middleware = this.#middleware[method];
-		const routes = this.#routes[method];
+		const handlers = this.#handlers[method];
 		const trie = this.#tries[method];
 		const staticMap = createNullObject();
 		const handlerData = [];
 		const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-		for (const r of [middleware, routes]) for (const path in r) {
-			const handlers = r[path];
-			const pathData = trie.paths[path];
-			if (!pathData) {
-				staticMap[path] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
-				continue;
-			}
-			handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [h, trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
-				map[key] = paramReplacementMap[pathData[1][i][1]];
+		const own = createNullObject();
+		const entries = handlers.map(([h, p], i) => {
+			(own[p] ??= []).push(i);
+			return [h, trie.paths[p][1].reduceRight((map, [key, varIndex]) => {
+				map[key] = paramReplacementMap[varIndex];
 				return map;
-			}, createNullObject())]);
+			}, createNullObject())];
+		});
+		const wildcards = Object.keys(own).filter((p) => endsWithWildcard(trie.paths[p][2]));
+		for (const path in trie.paths) {
+			const [index, , keys] = trie.paths[path];
+			const indexes = [...own[path]];
+			for (const p of wildcards) if (p !== path && covers(trie.paths[p][2], keys)) indexes.push(...own[p]);
+			const data = indexes.sort((a, b) => a - b).map((i) => entries[i]);
+			if (index === -1) {
+				const last = Math.max(-1, ...data.flatMap(([, map]) => Object.values(map)));
+				staticMap[path] = [data, last === -1 ? emptyParam : path.match(regexp).slice(0, last + 1)];
+			} else handlerData[index] = data;
 		}
 		return [
 			regexp,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/trie.js

@@ -7,8 +7,14 @@ var Trie = class {
 	#index = 0;
 	paths = createNullObject();
 	insert(path, isStatic) {
+		const keys = [];
 		if (isStatic) {
-			this.#root.insert(path.split(""), 0, [], this.#context, true);
+			this.#root.insert(path.split(""), -1, [], this.#context, keys);
+			this.paths[path] = [
+				-1,
+				[],
+				keys
+			];
 			return;
 		}
 		const paramAssoc = [];
@@ -16,7 +22,7 @@ var Trie = class {
 		let markedPath = path;
 		for (let i = 0;;) {
 			let replaced = false;
-			markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
+			markedPath = markedPath.replace(/\{(?:\{[\d,]+\}|[^}])+\}/g, (m) => {
 				const mark = `@\\${i}`;
 				groups[i] = [mark, m];
 				i++;
@@ -30,7 +36,7 @@ var Trie = class {
 		*  - /* wildcard
 		*  - character
 		*/
-		const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+		const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./gs) || [];
 		for (let i = groups.length - 1; i >= 0; i--) {
 			const [mark] = groups[i];
 			for (let j = tokens.length - 1; j >= 0; j--) if (tokens[j].indexOf(mark) !== -1) {
@@ -38,8 +44,12 @@ var Trie = class {
 				break;
 			}
 		}
-		this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-		this.paths[path] = [this.#index++, paramAssoc];
+		this.#root.insert(tokens, this.#index, paramAssoc, this.#context, keys);
+		this.paths[path] = [
+			this.#index++,
+			paramAssoc,
+			keys
+		];
 	}
 	buildRegExp() {
 		let regexp = this.#root.buildRegExpStr();

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/middleware/mount/index.d.ts

@@ -16,6 +16,7 @@ type MountOptions = MountOptionHandler | {
  * @param {Function} applicationHandler - other Request Handler
  * @param {MountOptions} [options] - options of `mount()`
  * @returns {MiddlewareHandler} handler to register with `app.all()`
+ * @throws {Error} If the route ends with a wildcard inside a segment (e.g. `/assets*`), or automatic request rewriting encounters duplicate path parameter names.
  *
  * @example
  * ```ts

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/router/reg-exp-router/node.d.ts

@@ -1,7 +1,7 @@
 //#region src/router/reg-exp-router/node.d.ts
 export declare const LABEL_REG_EXP_STR = "[^/]+";
-export declare const ONLY_WILDCARD_REG_EXP_STR = ".*";
-export declare const TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+export declare const ONLY_WILDCARD_REG_EXP_STR = "[^]*";
+export declare const TAIL_WILDCARD_REG_EXP_STR = "(?:|/[^]*)";
 export declare const PATH_ERROR: unique symbol;
 export type ParamAssocArray = [string, number][];
 export interface Context {
@@ -9,7 +9,7 @@ export interface Context {
 }
 export declare class Node {
   
-  insert(tokens: readonly string[], index: number, paramMap: ParamAssocArray, context: Context, isStatic: boolean): void;
+  insert(tokens: readonly string[], index: number, paramMap: ParamAssocArray, context: Context, keys: string[]): void;
   buildRegExpStr(): string;
 }
 //#endregion

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/router/reg-exp-router/trie.d.ts

@@ -3,7 +3,7 @@ import { ParamAssocArray } from "./node.js";
 export type ReplacementMap = number[];
 export declare class Trie {
   
-  paths: Record<string, [number, ParamAssocArray]>;
+  paths: Record<string, [number, ParamAssocArray, string[]]>;
   insert(path: string, isStatic: boolean): void;
   buildRegExp(): [RegExp, ReplacementMap, ReplacementMap];
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/utils/mount.d.ts

@@ -0,0 +1,4 @@
+import { Context } from "../context.js";
+//#region src/utils/mount.d.ts
+export declare const createMountedRequest: (c: Context, pathPrefix: string, routePath: string) => Request;
+//#endregion

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/utils/url.d.ts

@@ -26,6 +26,7 @@ export declare const getPath: (request: Request) => string;
  */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
+export declare const stripPathPrefix: (rawPath: string, decodedPath: string, prefixLength: number) => string;
 /**
  * Merge paths.
  * @param {string[]} ...paths - The paths to merge.

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/jwt/jwt.js

@@ -15,7 +15,7 @@ const decodeJwtPart = (part) => JSON.parse(utf8Decoder.decode(decodeBase64Url(pa
 function isTokenHeader(obj) {
 	if (typeof obj === "object" && obj !== null) {
 		const objWithAlg = obj;
-		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
+		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT") && !("crit" in objWithAlg);
 	}
 	return false;
 }
@@ -66,6 +66,7 @@ const verify = async (token, publicKey, algOrOptions) => {
 		if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud))) throw new JwtTokenAudience(aud, payload.aud);
 	}
 	const headerPayload = token.substring(0, token.lastIndexOf("."));
+	if (!/^[A-Za-z0-9_-]*={0,2}$/.test(tokenParts[2])) throw new JwtTokenInvalid(token);
 	let signature;
 	try {
 		signature = decodeBase64Url(tokenParts[2]);

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/mount.js

@@ -0,0 +1,34 @@
+import { GET_MATCH_RESULT } from "../request/constants.js";
+import { getPattern, splitRoutingPath, stripPathPrefix } from "./url.js";
+//#region src/utils/mount.ts
+const getPathPrefixLength = (c, pathPrefix, routePath) => {
+	if (!/[:*]/.test(pathPrefix)) return pathPrefix.length;
+	const path = c.req.path;
+	const matchResult = c.req[GET_MATCH_RESULT];
+	const paramNames = /* @__PURE__ */ new Set();
+	let length = 0;
+	for (const part of splitRoutingPath(pathPrefix)) {
+		const pattern = getPattern(part);
+		if (pattern && pattern !== "*") {
+			const name = pattern[1];
+			if (paramNames.has(name)) throw new Error(`mount(): Duplicate path parameter "${name}" in "${routePath}".`);
+			paramNames.add(name);
+		}
+		if (pattern && pattern !== "*" && pattern[2] !== true) {
+			const value = matchResult.length === 2 ? matchResult[1][matchResult[0][c.req.routeIndex][1][pattern[1]]] : matchResult[0][c.req.routeIndex][1][pattern[1]];
+			length += value.length + 1;
+		} else if (pattern || part.endsWith("*")) {
+			const end = path.indexOf("/", length + 1);
+			length = end === -1 ? path.length : end;
+		} else length += part.length + 1;
+	}
+	return length;
+};
+const createMountedRequest = (c, pathPrefix, routePath) => {
+	if (/[^/]\*$/.test(routePath)) throw new Error(`mount(): Wildcard must follow "/" in "${routePath}".`);
+	const url = new URL(c.req.raw.url);
+	url.pathname = stripPathPrefix(url.pathname, c.req.path, getPathPrefixLength(c, pathPrefix, routePath));
+	return new Request(url, c.req.raw);
+};
+//#endregion
+export { createMountedRequest };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/url.js

@@ -110,6 +110,15 @@ const getPathNoStrict = (request) => {
 	const result = getPath(request);
 	return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
 };
+const stripPathPrefix = (rawPath, decodedPath, prefixLength) => {
+	if (rawPath.at(-1) === "/" && decodedPath.at(-1) !== "/") rawPath = rawPath.slice(0, -1);
+	let index = 0;
+	for (let i = decodedPath.indexOf("/"); i !== -1 && i < prefixLength; i = decodedPath.indexOf("/", i + 1)) {
+		index = rawPath.indexOf("/", index + 1);
+		if (index === -1) return "/";
+	}
+	return rawPath.slice(index) || "/";
+};
 /**
 * Merge paths.
 * @param {string[]} ...paths - The paths to merge.
@@ -203,4 +212,4 @@ const getQueryParams = (url, key) => {
 };
 const decodeURIComponent_ = decodeURIComponent;
 //#endregion
-export { checkOptionalParameter, decodeURIComponent_, getPath, getPathNoStrict, getPattern, getQueryParam, getQueryParams, getQueryStrings, mergePath, splitPath, splitRoutingPath, tryDecode, tryDecodeURI, tryDecodeURIComponent };
+export { checkOptionalParameter, decodeURIComponent_, getPath, getPathNoStrict, getPattern, getQueryParam, getQueryParams, getQueryStrings, mergePath, splitPath, splitRoutingPath, stripPathPrefix, tryDecode, tryDecodeURI, tryDecodeURIComponent };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/validator/validator.js

@@ -3,7 +3,7 @@ import { bufferToFormData } from "../utils/buffer.js";
 import { getCookie } from "../helper/cookie/index.js";
 //#region src/validator/validator.ts
 const jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
-const multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/i;
+const multipartRegex = /^multipart\/form-data(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 const urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 const validator = (target, validationFunc) => {
 	return async (c, next) => {

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.14",
+  "version": "4.13.16",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -5,7 +5,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.14");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.15");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -31,6 +31,8 @@ function isFreshFor(timestamp, duration) {
 function validateDuration(value, fallback, option) {
   if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
+  if (typeof value == "number" && value < 0)
+    throw new TypeError(`"${option}" option must not be negative`);
   return typeof value == "number" ? value : fallback;
 }
 function createRemoteJWKSet(url, options) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/deflate.js

@@ -23,7 +23,8 @@ async function transform(stream, input, maxLength = 1 / 0) {
     if (done)
       break;
     if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)
-      throw new JWEInvalid("Decompressed plaintext exceeded the configured limit");
+      throw await reader.cancel().catch(() => {
+      }), new JWEInvalid("Decompressed plaintext exceeded the configured limit");
   }
   return concat(...chunks);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -77,7 +77,8 @@ function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
       throw new TypeError("Invalid clockTolerance option type");
     tolerance = clockTolerance;
   }
-  validateInput("clockTolerance option", tolerance);
+  if (validateInput("clockTolerance option", tolerance), tolerance < 0)
+    throw new TypeError("Invalid clockTolerance option input");
   const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
     throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.14",
+  "version": "6.2.15",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/node_modules/@weavecode/cli/dist/cli.js

@@ -1,4 +1,4 @@
-import{CommandParser as p}from"./parser.js";import{initCommand as f}from"./commands/init.js";import{statusCommand as g}from"./commands/status.js";import{daemonCommand as h}from"./commands/daemon.js";import{dashboardCommand as C}from"./commands/dashboard.js";import{scanCommand as u}from"./commands/scan.js";import{chpassCommand as $}from"./commands/chpass.js";import{doctorCommand as b}from"./commands/doctor.js";import{uninstallCommand as E}from"./commands/uninstall.js";import{initCliLocale as x,t as e}from"./i18n/index.js";import{WEAVE_VERSION as S}from"@weavecode/server";const w=process.emitWarning.bind(process);process.emitWarning=(r,...n)=>{if(!(typeof r=="string"?r:String(r)).includes("SQLite is an experimental feature"))return w(r,...n)};const l=()=>S;function v(r){if(r.description){console.log(`  ${r.name.padEnd(12)}${e(r.description)}`);for(const n of r.subcommands??[]){const o=[n.name,...n.aliases??[]].join(", "),s=n.description?e(n.description):"";console.log(`    ${o.padEnd(12)}${s}`)}}}function i(r){const n=l();console.log(`${e("help.tagline",{version:n})}
+import{CommandParser as p}from"./parser.js";import{initCommand as f}from"./commands/init.js";import{statusCommand as g}from"./commands/status.js";import{daemonCommand as h}from"./commands/daemon.js";import{dashboardCommand as u}from"./commands/dashboard.js";import{scanCommand as C}from"./commands/scan.js";import{chpassCommand as b}from"./commands/chpass.js";import{doctorCommand as x}from"./commands/doctor.js";import{uninstallCommand as $}from"./commands/uninstall.js";import{initCliLocale as E,t as e}from"./i18n/index.js";import{WEAVE_VERSION as S}from"@weavecode/server";const w=process.emitWarning.bind(process);process.emitWarning=(n,...r)=>{if(!(typeof n=="string"?n:String(n)).includes("SQLite is an experimental feature"))return w(n,...r)};const l=()=>S;function v(n){if(n.description){console.log(`  ${n.name.padEnd(12)}${e(n.description)}`);for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?e(r.description):"";console.log(`    ${o.padEnd(12)}${s}`)}}}function a(n){const r=l();console.log(`${e("help.tagline",{version:r})}
 `),console.log(`${e("help.usage")}
-`),console.log(e("help.commands"));for(const o of r.getAllCommands())v(o);console.log(`
-${e("help.globalOptions")}`);for(const o of r.getGlobalOptions()){const s=o.short?`-${o.short}, --${o.name}`:`    --${o.name}`;console.log(`  ${s.padEnd(20)}${e(o.description)}`)}}function L(r){console.error(e("help.subcommands"));for(const n of r.subcommands??[]){const o=[n.name,...n.aliases??[]].join(", "),s=n.description?e(n.description):"";console.error(`  ${o.padEnd(12)}${s}`)}}export class CLI{parser;constructor(){this.parser=new p,this.registerCommands()}registerCommands(){this.parser.registerCommand(f),this.parser.registerCommand(E),this.parser.registerCommand(g),this.parser.registerCommand(h),this.parser.registerCommand(C),this.parser.registerCommand(u),this.parser.registerCommand($),this.parser.registerCommand(b)}async run(n=process.argv.slice(2)){delete process.env.CLAUDE_CODE_CHILD_SESSION,await x();const o=this.parser.parse(n);if(o.flags.version){console.log(l());return}if(o.flags.help||o.command.length===0){i(this.parser);return}let s;for(const a of o.command)s=(s?s.subcommands?.find(c=>c.name===a||c.aliases?.includes(a)):this.parser.getCommand(a))??s;if(!s?.action){if(s?.subcommands?.length){const a=o.positional[0];console.error(a?e("cli.unknownSubcommand",{command:s.name,subcommand:a}):e("cli.missingSubcommand",{command:s.name})),L(s),process.exit(1)}console.error(e("cli.unknownCommand",{command:o.command.join(" ")})),i(this.parser),process.exit(1)}const t=s.maxPositionals??0;if(o.positional.length>t){const a=o.command.join(" ");console.error(e("cli.unexpectedPositional",{command:a,arg:o.positional[t]})),i(this.parser),process.exit(1)}const m=this.parser.validateFlags(o.flags,s);if(m.length>0){for(const a of m)console.error(e("cli.error",{error:a}));process.exit(1)}const d={commandPath:o.command,flags:o.flags,positional:o.positional,raw:o.raw};await s.action(d)}}
+`),console.log(e("help.commands"));for(const o of n.getAllCommands())v(o);console.log(`
+${e("help.globalOptions")}`);for(const o of n.getGlobalOptions()){const s=o.short?`-${o.short}, --${o.name}`:`    --${o.name}`;console.log(`  ${s.padEnd(20)}${e(o.description)}`)}}function L(n){console.error(e("help.subcommands"));for(const r of n.subcommands??[]){const o=[r.name,...r.aliases??[]].join(", "),s=r.description?e(r.description):"";console.error(`  ${o.padEnd(12)}${s}`)}}export class CLI{parser;constructor(){this.parser=new p,this.registerCommands()}registerCommands(){this.parser.registerCommand(f),this.parser.registerCommand($),this.parser.registerCommand(g),this.parser.registerCommand(h),this.parser.registerCommand(u),this.parser.registerCommand(C),this.parser.registerCommand(b),this.parser.registerCommand(x)}async run(r=process.argv.slice(2)){delete process.env.CLAUDE_CODE_CHILD_SESSION,await E();const o=this.parser.parse(r);if(o.flags.version){console.log(l());return}if(o.flags.help||o.command.length===0){a(this.parser);return}let s;for(const t of o.command)s=(s?s.subcommands?.find(c=>c.name===t||c.aliases?.includes(t)):this.parser.getCommand(t))??s;if(!s?.action){if(s?.subcommands?.length){const t=o.positional[0];console.error(t?e("cli.unknownSubcommand",{command:s.name,subcommand:t}):e("cli.missingSubcommand",{command:s.name})),L(s),process.exit(1)}console.error(e("cli.unknownCommand",{command:o.command.join(" ")})),a(this.parser),process.exit(1)}const i=s.maxPositionals??0;if(o.positional.length>i){const t=o.command.join(" ");console.error(e("cli.unexpectedPositional",{command:t,arg:o.positional[i]})),a(this.parser),process.exit(1)}const m=this.parser.validateFlags(o.flags,s);if(m.length>0){for(const t of m)console.error(e("cli.error",{error:t}));process.exit(1)}const d={commandPath:o.command,flags:o.flags,positional:o.positional,raw:o.raw};await s.action(d)}}

package/node_modules/@weavecode/cli/dist/commands/chpass.js

@@ -1 +1 @@
-import{DAEMON_HOST as c}from"@weavecode/server";import{logger as s}from"@weavecode/core";import{t as r}from"../i18n/index.js";import{ensureDaemonRunning as i}from"./daemon.js";import{localTokenHeader as p}from"./daemon-auth.js";const m=6;async function h(e){const t=e.positional[0];if(typeof t!="string"||t.length<m){s.warn(r("out.chpass.usage")),process.exitCode=1;return}const n=await i();try{const o=await fetch(`http://${c}:${n.port}/auth/password`,{method:"PUT",headers:{"content-type":"application/json",...p()},body:JSON.stringify({next:t})}),a=await o.json().catch(()=>({}));if(!o.ok)throw new Error(typeof a.error=="string"?a.error:`HTTP ${o.status}`);s.success(r("out.chpass.ok"))}catch(o){s.warn(r("out.chpass.fail",{error:o instanceof Error?o.message:String(o)})),process.exitCode=1}}export const chpassCommand={name:"chpass",description:"cmd.chpass.desc",action:h,maxPositionals:1};
+import{DAEMON_HOST as c}from"@weavecode/server";import{logger as s}from"@weavecode/core";import{t as r}from"../i18n/index.js";import{ensureDaemonRunning as i}from"./daemon.js";import{localTokenHeader as p}from"./daemon-auth.js";const m=6;async function h(n){const t=n.positional[0];if(typeof t!="string"||t.length<m){s.warn(r("out.chpass.usage")),process.exitCode=1;return}const a=await i();try{const o=await fetch(`http://${c}:${a.port}/auth/password`,{method:"PUT",headers:{"content-type":"application/json",...p()},body:JSON.stringify({next:t})}),e=await o.json().catch(()=>({}));if(!o.ok)throw new Error(typeof e.error=="string"?e.error:`HTTP ${o.status}`);s.success(r("out.chpass.ok"))}catch(o){s.warn(r("out.chpass.fail",{error:o instanceof Error?o.message:String(o)})),process.exitCode=1}}export const chpassCommand={name:"chpass",description:"cmd.chpass.desc",action:h,maxPositionals:1};