@weavecode/weave 0.1.7 → 0.1.8

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/basic-auth/index.js

@@ -80,7 +80,7 @@ const basicAuth = (options, ...users) => {
 			}
 		}
 		const status = 401;
-		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/"/g, "\\\"") + "\"" };
+		const headers = { "WWW-Authenticate": "Basic realm=\"" + options.realm?.replace(/[\\"]/g, "\\$&") + "\"" };
 		const responseMessage = typeof options.invalidUserMessage === "function" ? await options.invalidUserMessage(ctx) : options.invalidUserMessage;
 		const res = typeof responseMessage === "string" ? new Response(responseMessage, {
 			status,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/bearer-auth/index.js

@@ -44,7 +44,7 @@ const bearerAuth = (options) => {
 	if (!("token" in options || "verifyToken" in options)) throw new Error("bearer auth middleware requires options for \"token\" or \"verifyToken\"");
 	if (!options.realm) options.realm = "";
 	if (options.prefix === void 0) options.prefix = PREFIX;
-	const realm = options.realm?.replace(/"/g, "\\\"");
+	const realm = options.realm?.replace(/[\\"]/g, "\\$&");
 	const prefix = options.prefix;
 	const tokenRegexp = new RegExp(`^${TOKEN_STRINGS}$`);
 	const wwwAuthenticatePrefix = prefix === "" ? "" : `${prefix} `;

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/csrf/index.js

@@ -8,7 +8,7 @@ const secFetchSiteValues = [
 ];
 const isSecFetchSite = (value) => secFetchSiteValues.includes(value);
 const isSafeMethodRe = /^(GET|HEAD|OPTIONS)$/;
-const isRequestedByFormElementRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/plain)\b/i;
+const isCsrfContentTypeRe = /^\b(application\/x-www-form-urlencoded|multipart\/form-data|text\/(?:plain|ping))\b/i;
 /**
 * CSRF Protection Middleware for Hono.
 *
@@ -94,7 +94,7 @@ const csrf = (options) => {
 		return await secFetchSiteHandler(secFetchSite, c);
 	};
 	return async function csrf(c, next) {
-		if (!isSafeMethodRe.test(c.req.method) && isRequestedByFormElementRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
+		if (!isSafeMethodRe.test(c.req.method) && isCsrfContentTypeRe.test(c.req.header("content-type") || "text/plain") && !await isAllowedSecFetchSite(c.req.header("sec-fetch-site"), c) && !await isAllowedOrigin(c.req.header("origin"), c)) {
 			const res = new Response("Forbidden", { status: 403 });
 			throw new HTTPException(403, { res });
 		}

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/jwk/jwk.js

@@ -109,8 +109,8 @@ const jwk = (options, init) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/jwt/jwt.js

@@ -103,8 +103,8 @@ const jwt = (options) => {
 	};
 };
 function unauthorizedResponse(opts) {
-	const realm = (opts.realm ?? opts.ctx.req.url).replace(/"/g, "\\\"");
-	const errDescription = opts.errDescription.replace(/"/g, "\\\"");
+	const realm = (opts.realm ?? opts.ctx.req.url).replace(/[\\"]/g, "\\$&");
+	const errDescription = opts.errDescription.replace(/[\\"]/g, "\\$&");
 	return new Response("Unauthorized", {
 		status: 401,
 		statusText: opts.statusText,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/language/language.js

@@ -1,5 +1,5 @@
-import { getCookie, setCookie } from "../../helper/cookie/index.js";
 import { parseAccept } from "../../utils/accept.js";
+import { getCookie, setCookie } from "../../helper/cookie/index.js";
 //#region src/middleware/language/language.ts
 const DEFAULT_OPTIONS = {
 	order: [

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/middleware/mount/index.js

@@ -1,10 +1,9 @@
+import { createMountedRequest } from "../../utils/mount.js";
 import { routePath } from "../../helper/route/index.js";
 //#region src/middleware/mount/index.ts
 const defaultReplaceRequest = (c) => {
-	const pathPrefix = routePath(c).replace(/\/\*$/, "");
-	const url = new URL(c.req.raw.url);
-	url.pathname = c.req.path.slice(pathPrefix.length) || "/";
-	return new Request(url, c.req.raw);
+	const path = routePath(c);
+	return createMountedRequest(c, path.replace(/\/?\*$/, ""), path);
 };
 const defaultGetOptions = (c) => {
 	let executionContext = void 0;
@@ -21,6 +20,7 @@ const defaultGetOptions = (c) => {
 * @param {Function} applicationHandler - other Request Handler
 * @param {MountOptions} [options] - options of `mount()`
 * @returns {MiddlewareHandler} handler to register with `app.all()`
+* @throws {Error} If the route ends with a wildcard inside a segment (e.g. `/assets*`), or automatic request rewriting encounters duplicate path parameter names.
 *
 * @example
 * ```ts

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/node.js

@@ -1,8 +1,8 @@
 import { createNullObject } from "../utils.js";
 //#region src/router/reg-exp-router/node.ts
 const LABEL_REG_EXP_STR = "[^/]+";
-const ONLY_WILDCARD_REG_EXP_STR = ".*";
-const TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+const ONLY_WILDCARD_REG_EXP_STR = "[^]*";
+const TAIL_WILDCARD_REG_EXP_STR = "(?:|/[^]*)";
 const PATH_ERROR = Symbol();
 const regExpMetaChars = /* @__PURE__ */ new Set(".\\+*[^]$()");
 /**
@@ -15,8 +15,8 @@ const regExpMetaChars = /* @__PURE__ */ new Set(".\\+*[^]$()");
 function compareKey(a, b) {
 	if (a.length === 1) return b.length === 1 ? a < b ? -1 : 1 : -1;
 	if (b.length === 1) return 1;
-	if (a === ".*" || a === "(?:|/.*)") return b === "(?:|/.*)" ? -1 : 1;
-	else if (b === ".*" || b === "(?:|/.*)") return -1;
+	if (a === "[^]*" || a === "(?:|/[^]*)") return b === "[^]*" ? -1 : 1;
+	else if (b === "[^]*" || b === "(?:|/[^]*)") return -1;
 	if (a === "[^/]+") return 1;
 	else if (b === "[^/]+") return -1;
 	return a.length === b.length ? a < b ? -1 : 1 : b.length - a.length;
@@ -25,14 +25,14 @@ var Node = class Node {
 	#index;
 	#varIndex;
 	#children = createNullObject();
-	insert(tokens, index, paramMap, context, isStatic) {
+	insert(tokens, index, paramMap, context, keys) {
 		let node = this;
 		for (let i = 0, len = tokens.length; i < len; i++) {
 			const token = tokens[i];
 			const pattern = token.length === 1 ? token === "*" ? i === len - 1 ? [
 				"",
 				"",
-				".*"
+				ONLY_WILDCARD_REG_EXP_STR
 			] : [
 				"",
 				"",
@@ -47,15 +47,16 @@ var Node = class Node {
 				const name = pattern[1];
 				let regexpStr = pattern[2] || "[^/]+";
 				if (name && pattern[2]) {
-					if (regexpStr === ".*") throw PATH_ERROR;
+					if (new RegExp(regexpStr).test("")) throw PATH_ERROR;
 					regexpStr = regexpStr.replace(/^\((?!\?:)(?=[^)]+\)$)/, "(?:");
 					if (/\((?!\?:)/.test(regexpStr)) throw PATH_ERROR;
 					if (regexpStr.length === 1 && regExpMetaChars.has(regexpStr)) throw PATH_ERROR;
 				}
+				keys.push(regexpStr);
 				nextNode = node.#children[regexpStr];
 				if (!nextNode) {
-					if (regexpStr !== ".*" && regexpStr !== "(?:|/.*)") {
-						for (const k in node.#children) if ((regexpStr.length > 1 || k.length > 1) && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+					if (regexpStr !== "[^]*" && regexpStr !== "(?:|/[^]*)") {
+						for (const k in node.#children) if ((regexpStr.length > 1 || k.length > 1) && k !== "[^]*" && k !== "(?:|/[^]*)") throw PATH_ERROR;
 					}
 					nextNode = node.#children[regexpStr] = new Node();
 				}
@@ -64,16 +65,17 @@ var Node = class Node {
 					paramMap.push([name, nextNode.#varIndex]);
 				}
 			} else {
+				keys.push(token);
 				nextNode = node.#children[token];
 				if (!nextNode) {
-					for (const k in node.#children) if (k.length > 1 && k !== ".*" && k !== "(?:|/.*)") throw PATH_ERROR;
+					for (const k in node.#children) if (k.length > 1 && k !== "[^]*" && k !== "(?:|/[^]*)") throw PATH_ERROR;
 					nextNode = node.#children[token] = new Node();
 				}
 			}
 			node = nextNode;
 		}
 		if (node.#index !== void 0) throw PATH_ERROR;
-		node.#index = isStatic ? -1 : index;
+		node.#index = index;
 	}
 	buildRegExpStr() {
 		const strList = Object.keys(this.#children).sort(compareKey).map((k) => {

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/prepared-router.js

@@ -1,5 +1,5 @@
 import "../../router.js";
-import { emptyParam, match } from "./matcher.js";
+import { match } from "./matcher.js";
 import { RegExpRouter } from "./router.js";
 //#region src/router/reg-exp-router/prepared-router.ts
 var PreparedRegExpRouter = class {
@@ -27,7 +27,7 @@ var PreparedRegExpRouter = class {
 		if (!this.#matchers[method]) {
 			const all = this.#matchers["ALL"];
 			const staticMap = {};
-			for (const key in all[2]) staticMap[key] = [all[2][key][0].slice(), emptyParam];
+			for (const key in all[2]) staticMap[key] = [all[2][key][0].slice(), all[2][key][1]];
 			this.#matchers[method] = [
 				all[0],
 				all[1].map((list) => Array.isArray(list) ? list.slice() : 0),
@@ -71,7 +71,7 @@ const buildInitParams = ({ paths }) => {
 						...map
 					};
 					else relocateMap[path] = [[[], map]];
-					if (relocateMap[path][0][0].findIndex((j) => j === i) === -1) relocateMap[path][0][0].push(i);
+					if (!relocateMap[path][0][0].includes(i)) relocateMap[path][0][0].push(i);
 				}
 			});
 		});
@@ -79,7 +79,7 @@ const buildInitParams = ({ paths }) => {
 			if (p === path) {
 				relocateMap[path] ||= [[[]]];
 				const value = path2 === path ? "" : path2;
-				if (relocateMap[path][0][0].findIndex((v) => v === value) === -1) relocateMap[path][0][0].push(value);
+				if (!relocateMap[path][0][0].includes(value)) relocateMap[path][0][0].push(value);
 			}
 		});
 	}
@@ -88,7 +88,7 @@ const buildInitParams = ({ paths }) => {
 	return [matchers, relocateMap];
 };
 const serializeInitParams = ([matchers, relocateMap]) => {
-	return `[${JSON.stringify(matchers, (_, value) => value instanceof RegExp ? `##${value.toString()}##` : value).replace(/"##(.+?)##"/g, (_, str) => str.replace(/\\\\/g, "\\"))},${JSON.stringify(relocateMap)}]`;
+	return `[${JSON.stringify(matchers, (_, value) => value instanceof RegExp || value === void 0 ? `##${value}##` : value).replace(/"##(.+?)##"/g, (_, str) => str.replace(/\\\\/g, "\\"))},${JSON.stringify(relocateMap)}]`;
 };
 //#endregion
 export { PreparedRegExpRouter, buildInitParams, serializeInitParams };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/router.js

@@ -2,24 +2,24 @@ import { checkOptionalParameter } from "../../utils/url.js";
 import { MESSAGE_MATCHER_IS_ALREADY_BUILT, UnsupportedPathError } from "../../router.js";
 import { createNullObject } from "../utils.js";
 import { emptyParam, match } from "./matcher.js";
-import { LABEL_REG_EXP_STR, PATH_ERROR, TAIL_WILDCARD_REG_EXP_STR } from "./node.js";
+import { PATH_ERROR } from "./node.js";
 import { Trie } from "./trie.js";
 //#region src/router/reg-exp-router/router.ts
-let wildcardRegExpCache = createNullObject();
-function buildWildcardRegExp(path) {
-	return wildcardRegExpCache[path] ??= new RegExp(`^${path.replace(/\/:[^/{}]+(?:\{\[\^\/]\+})?(?=[/{]|$)|\/?\*$|([.\\+*[^\]$()?{}|])/g, (match, metaChar) => metaChar ? `\\${metaChar}` : match === "/*" ? TAIL_WILDCARD_REG_EXP_STR : match === "*" ? ".*" : `/:${LABEL_REG_EXP_STR}`)}$`);
+function endsWithWildcard(keys) {
+	const tail = keys[keys.length - 1];
+	return tail === "[^]*" || tail === "(?:|/[^]*)";
 }
-function findMiddleware(middleware, path) {
-	for (const k of Object.keys(middleware).sort((a, b) => b.length - a.length)) if (buildWildcardRegExp(k).test(path)) return [...middleware[k]];
+function covers(wildcard, target) {
+	const last = wildcard.length - 1;
+	for (let i = 0; i < last; i++) if (wildcard[i] !== target[i]) return false;
+	return wildcard[last] === "[^]*" || target.length === last || target[last] === "/";
 }
 var RegExpRouter = class {
 	name = "RegExpRouter";
-	#middleware;
-	#routes;
+	#handlers;
 	#tries;
 	constructor() {
-		this.#middleware = { ["ALL"]: createNullObject() };
-		this.#routes = { ["ALL"]: createNullObject() };
+		this.#handlers = { ["ALL"]: [] };
 		this.#tries = { ["ALL"]: new Trie() };
 	}
 	#insertPath(method, path) {
@@ -30,65 +30,53 @@ var RegExpRouter = class {
 		}
 	}
 	add(method, path, handler) {
-		const middleware = this.#middleware;
-		const routes = this.#routes;
-		if (!middleware) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
-		if (!middleware[method]) {
-			this.#tries[method] = new Trie();
-			for (const handlerMap of [middleware, routes]) {
-				handlerMap[method] = createNullObject();
-				for (const p in handlerMap["ALL"]) {
-					handlerMap[method][p] = [...handlerMap["ALL"][p]];
-					this.#insertPath(method, p);
-				}
-			}
+		const handlers = this.#handlers;
+		if (!handlers) throw new Error(MESSAGE_MATCHER_IS_ALREADY_BUILT);
+		const tries = this.#tries;
+		if (!handlers[method]) {
+			tries[method] = new Trie();
+			handlers[method] = [...handlers["ALL"]];
+			for (const p in tries["ALL"].paths) this.#insertPath(method, p);
 		}
 		if (path === "/*") path = "*";
-		const methods = method === "ALL" ? Object.keys(middleware) : [method];
-		if (/\*$/.test(path)) {
-			const re = buildWildcardRegExp(path);
-			for (const m of methods) if (!middleware[m][path]) {
-				this.#insertPath(m, path);
-				middleware[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware["ALL"], path) || [];
-			}
-			for (const handlerMap of [middleware, routes]) for (const m of methods) for (const p in handlerMap[m]) re.test(p) && handlerMap[m][p].push([handler, path]);
-			return;
-		}
+		const methods = method === "ALL" ? Object.keys(handlers) : [method];
 		const paths = checkOptionalParameter(path) || [path];
 		for (const path of paths) for (const m of methods) {
-			if (!routes[m][path]) {
-				this.#insertPath(m, path);
-				routes[m][path] = findMiddleware(middleware[m], path) || findMiddleware(middleware["ALL"], path) || [];
-			}
-			routes[m][path].push([handler, path]);
+			if (!tries[m].paths[path]) this.#insertPath(m, path);
+			handlers[m].push([handler, path]);
 		}
 	}
 	match = match;
 	buildAllMatchers() {
 		const matchers = createNullObject();
-		for (const method of Object.keys(this.#routes)) matchers[method] = this.#buildMatcher(method);
-		this.#middleware = this.#routes = this.#tries = void 0;
-		wildcardRegExpCache = createNullObject();
+		for (const method of Object.keys(this.#handlers)) matchers[method] = this.#buildMatcher(method);
+		this.#handlers = this.#tries = void 0;
 		return matchers;
 	}
 	#buildMatcher(method) {
-		const middleware = this.#middleware[method];
-		const routes = this.#routes[method];
+		const handlers = this.#handlers[method];
 		const trie = this.#tries[method];
 		const staticMap = createNullObject();
 		const handlerData = [];
 		const [regexp, indexReplacementMap, paramReplacementMap] = trie.buildRegExp();
-		for (const r of [middleware, routes]) for (const path in r) {
-			const handlers = r[path];
-			const pathData = trie.paths[path];
-			if (!pathData) {
-				staticMap[path] = [handlers.map(([h]) => [h, createNullObject()]), emptyParam];
-				continue;
-			}
-			handlerData[pathData[0]] = handlers.map(([h, handlerPath]) => [h, trie.paths[handlerPath][1].reduceRight((map, [key], i) => {
-				map[key] = paramReplacementMap[pathData[1][i][1]];
+		const own = createNullObject();
+		const entries = handlers.map(([h, p], i) => {
+			(own[p] ??= []).push(i);
+			return [h, trie.paths[p][1].reduceRight((map, [key, varIndex]) => {
+				map[key] = paramReplacementMap[varIndex];
 				return map;
-			}, createNullObject())]);
+			}, createNullObject())];
+		});
+		const wildcards = Object.keys(own).filter((p) => endsWithWildcard(trie.paths[p][2]));
+		for (const path in trie.paths) {
+			const [index, , keys] = trie.paths[path];
+			const indexes = [...own[path]];
+			for (const p of wildcards) if (p !== path && covers(trie.paths[p][2], keys)) indexes.push(...own[p]);
+			const data = indexes.sort((a, b) => a - b).map((i) => entries[i]);
+			if (index === -1) {
+				const last = Math.max(-1, ...data.flatMap(([, map]) => Object.values(map)));
+				staticMap[path] = [data, last === -1 ? emptyParam : path.match(regexp).slice(0, last + 1)];
+			} else handlerData[index] = data;
 		}
 		return [
 			regexp,

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/router/reg-exp-router/trie.js

@@ -7,8 +7,14 @@ var Trie = class {
 	#index = 0;
 	paths = createNullObject();
 	insert(path, isStatic) {
+		const keys = [];
 		if (isStatic) {
-			this.#root.insert(path.split(""), 0, [], this.#context, true);
+			this.#root.insert(path.split(""), -1, [], this.#context, keys);
+			this.paths[path] = [
+				-1,
+				[],
+				keys
+			];
 			return;
 		}
 		const paramAssoc = [];
@@ -16,7 +22,7 @@ var Trie = class {
 		let markedPath = path;
 		for (let i = 0;;) {
 			let replaced = false;
-			markedPath = markedPath.replace(/\{[^}]+\}/g, (m) => {
+			markedPath = markedPath.replace(/\{(?:\{[\d,]+\}|[^}])+\}/g, (m) => {
 				const mark = `@\\${i}`;
 				groups[i] = [mark, m];
 				i++;
@@ -30,7 +36,7 @@ var Trie = class {
 		*  - /* wildcard
 		*  - character
 		*/
-		const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./g) || [];
+		const tokens = markedPath.match(/(?::[^\/]+)|(?:\/\*$)|./gs) || [];
 		for (let i = groups.length - 1; i >= 0; i--) {
 			const [mark] = groups[i];
 			for (let j = tokens.length - 1; j >= 0; j--) if (tokens[j].indexOf(mark) !== -1) {
@@ -38,8 +44,12 @@ var Trie = class {
 				break;
 			}
 		}
-		this.#root.insert(tokens, this.#index, paramAssoc, this.#context, false);
-		this.paths[path] = [this.#index++, paramAssoc];
+		this.#root.insert(tokens, this.#index, paramAssoc, this.#context, keys);
+		this.paths[path] = [
+			this.#index++,
+			paramAssoc,
+			keys
+		];
 	}
 	buildRegExp() {
 		let regexp = this.#root.buildRegExpStr();

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/middleware/mount/index.d.ts

@@ -16,6 +16,7 @@ type MountOptions = MountOptionHandler | {
  * @param {Function} applicationHandler - other Request Handler
  * @param {MountOptions} [options] - options of `mount()`
  * @returns {MiddlewareHandler} handler to register with `app.all()`
+ * @throws {Error} If the route ends with a wildcard inside a segment (e.g. `/assets*`), or automatic request rewriting encounters duplicate path parameter names.
  *
  * @example
  * ```ts

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/router/reg-exp-router/node.d.ts

@@ -1,7 +1,7 @@
 //#region src/router/reg-exp-router/node.d.ts
 export declare const LABEL_REG_EXP_STR = "[^/]+";
-export declare const ONLY_WILDCARD_REG_EXP_STR = ".*";
-export declare const TAIL_WILDCARD_REG_EXP_STR = "(?:|/.*)";
+export declare const ONLY_WILDCARD_REG_EXP_STR = "[^]*";
+export declare const TAIL_WILDCARD_REG_EXP_STR = "(?:|/[^]*)";
 export declare const PATH_ERROR: unique symbol;
 export type ParamAssocArray = [string, number][];
 export interface Context {
@@ -9,7 +9,7 @@ export interface Context {
 }
 export declare class Node {
   
-  insert(tokens: readonly string[], index: number, paramMap: ParamAssocArray, context: Context, isStatic: boolean): void;
+  insert(tokens: readonly string[], index: number, paramMap: ParamAssocArray, context: Context, keys: string[]): void;
   buildRegExpStr(): string;
 }
 //#endregion

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/router/reg-exp-router/trie.d.ts

@@ -3,7 +3,7 @@ import { ParamAssocArray } from "./node.js";
 export type ReplacementMap = number[];
 export declare class Trie {
   
-  paths: Record<string, [number, ParamAssocArray]>;
+  paths: Record<string, [number, ParamAssocArray, string[]]>;
   insert(path: string, isStatic: boolean): void;
   buildRegExp(): [RegExp, ReplacementMap, ReplacementMap];
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/utils/mount.d.ts

@@ -0,0 +1,4 @@
+import { Context } from "../context.js";
+//#region src/utils/mount.d.ts
+export declare const createMountedRequest: (c: Context, pathPrefix: string, routePath: string) => Request;
+//#endregion

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/types/utils/url.d.ts

@@ -26,6 +26,7 @@ export declare const getPath: (request: Request) => string;
  */
 export declare const getQueryStrings: (url: string) => string;
 export declare const getPathNoStrict: (request: Request) => string;
+export declare const stripPathPrefix: (rawPath: string, decodedPath: string, prefixLength: number) => string;
 /**
  * Merge paths.
  * @param {string[]} ...paths - The paths to merge.

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/jwt/jwt.js

@@ -15,7 +15,7 @@ const decodeJwtPart = (part) => JSON.parse(utf8Decoder.decode(decodeBase64Url(pa
 function isTokenHeader(obj) {
 	if (typeof obj === "object" && obj !== null) {
 		const objWithAlg = obj;
-		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT");
+		return "alg" in objWithAlg && Object.values(AlgorithmTypes).includes(objWithAlg.alg) && (!("typ" in objWithAlg) || objWithAlg.typ === "JWT") && !("crit" in objWithAlg);
 	}
 	return false;
 }
@@ -66,6 +66,7 @@ const verify = async (token, publicKey, algOrOptions) => {
 		if (!(Array.isArray(payload.aud) ? payload.aud : [payload.aud]).some((payloadAud) => aud instanceof RegExp ? aud.test(payloadAud) : typeof aud === "string" ? payloadAud === aud : Array.isArray(aud) && aud.includes(payloadAud))) throw new JwtTokenAudience(aud, payload.aud);
 	}
 	const headerPayload = token.substring(0, token.lastIndexOf("."));
+	if (!/^[A-Za-z0-9_-]*={0,2}$/.test(tokenParts[2])) throw new JwtTokenInvalid(token);
 	let signature;
 	try {
 		signature = decodeBase64Url(tokenParts[2]);

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/mount.js

@@ -0,0 +1,34 @@
+import { GET_MATCH_RESULT } from "../request/constants.js";
+import { getPattern, splitRoutingPath, stripPathPrefix } from "./url.js";
+//#region src/utils/mount.ts
+const getPathPrefixLength = (c, pathPrefix, routePath) => {
+	if (!/[:*]/.test(pathPrefix)) return pathPrefix.length;
+	const path = c.req.path;
+	const matchResult = c.req[GET_MATCH_RESULT];
+	const paramNames = /* @__PURE__ */ new Set();
+	let length = 0;
+	for (const part of splitRoutingPath(pathPrefix)) {
+		const pattern = getPattern(part);
+		if (pattern && pattern !== "*") {
+			const name = pattern[1];
+			if (paramNames.has(name)) throw new Error(`mount(): Duplicate path parameter "${name}" in "${routePath}".`);
+			paramNames.add(name);
+		}
+		if (pattern && pattern !== "*" && pattern[2] !== true) {
+			const value = matchResult.length === 2 ? matchResult[1][matchResult[0][c.req.routeIndex][1][pattern[1]]] : matchResult[0][c.req.routeIndex][1][pattern[1]];
+			length += value.length + 1;
+		} else if (pattern || part.endsWith("*")) {
+			const end = path.indexOf("/", length + 1);
+			length = end === -1 ? path.length : end;
+		} else length += part.length + 1;
+	}
+	return length;
+};
+const createMountedRequest = (c, pathPrefix, routePath) => {
+	if (/[^/]\*$/.test(routePath)) throw new Error(`mount(): Wildcard must follow "/" in "${routePath}".`);
+	const url = new URL(c.req.raw.url);
+	url.pathname = stripPathPrefix(url.pathname, c.req.path, getPathPrefixLength(c, pathPrefix, routePath));
+	return new Request(url, c.req.raw);
+};
+//#endregion
+export { createMountedRequest };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/utils/url.js

@@ -110,6 +110,15 @@ const getPathNoStrict = (request) => {
 	const result = getPath(request);
 	return result.length > 1 && result.at(-1) === "/" ? result.slice(0, -1) : result;
 };
+const stripPathPrefix = (rawPath, decodedPath, prefixLength) => {
+	if (rawPath.at(-1) === "/" && decodedPath.at(-1) !== "/") rawPath = rawPath.slice(0, -1);
+	let index = 0;
+	for (let i = decodedPath.indexOf("/"); i !== -1 && i < prefixLength; i = decodedPath.indexOf("/", i + 1)) {
+		index = rawPath.indexOf("/", index + 1);
+		if (index === -1) return "/";
+	}
+	return rawPath.slice(index) || "/";
+};
 /**
 * Merge paths.
 * @param {string[]} ...paths - The paths to merge.
@@ -203,4 +212,4 @@ const getQueryParams = (url, key) => {
 };
 const decodeURIComponent_ = decodeURIComponent;
 //#endregion
-export { checkOptionalParameter, decodeURIComponent_, getPath, getPathNoStrict, getPattern, getQueryParam, getQueryParams, getQueryStrings, mergePath, splitPath, splitRoutingPath, tryDecode, tryDecodeURI, tryDecodeURIComponent };
+export { checkOptionalParameter, decodeURIComponent_, getPath, getPathNoStrict, getPattern, getQueryParam, getQueryParams, getQueryStrings, mergePath, splitPath, splitRoutingPath, stripPathPrefix, tryDecode, tryDecodeURI, tryDecodeURIComponent };

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/dist/validator/validator.js

@@ -3,7 +3,7 @@ import { bufferToFormData } from "../utils/buffer.js";
 import { getCookie } from "../helper/cookie/index.js";
 //#region src/validator/validator.ts
 const jsonRegex = /^application\/([a-z-\.]+\+)?json(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
-const multipartRegex = /^multipart\/form-data(;\s?boundary=[a-zA-Z0-9'"()+_,\-./:=?]+)?$/i;
+const multipartRegex = /^multipart\/form-data(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 const urlencodedRegex = /^application\/x-www-form-urlencoded(;\s*[a-zA-Z0-9\-]+\=([^;]+))*$/i;
 const validator = (target, validationFunc) => {
 	return async (c, next) => {

package/node_modules/@modelcontextprotocol/sdk/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.14",
+  "version": "4.13.16",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -5,7 +5,7 @@ function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.14");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.15");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -31,6 +31,8 @@ function isFreshFor(timestamp, duration) {
 function validateDuration(value, fallback, option) {
   if (Number.isNaN(value))
     throw new TypeError(`"${option}" option must not be NaN`);
+  if (typeof value == "number" && value < 0)
+    throw new TypeError(`"${option}" option must not be negative`);
   return typeof value == "number" ? value : fallback;
 }
 function createRemoteJWKSet(url, options) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/deflate.js

@@ -23,7 +23,8 @@ async function transform(stream, input, maxLength = 1 / 0) {
     if (done)
       break;
     if (chunks.push(value), length += value.byteLength, maxLength !== 1 / 0 && length > maxLength)
-      throw new JWEInvalid("Decompressed plaintext exceeded the configured limit");
+      throw await reader.cancel().catch(() => {
+      }), new JWEInvalid("Decompressed plaintext exceeded the configured limit");
   }
   return concat(...chunks);
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -77,7 +77,8 @@ function validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {
       throw new TypeError("Invalid clockTolerance option type");
     tolerance = clockTolerance;
   }
-  validateInput("clockTolerance option", tolerance);
+  if (validateInput("clockTolerance option", tolerance), tolerance < 0)
+    throw new TypeError("Invalid clockTolerance option input");
   const { currentDate } = options, now = validateInput("currentDate option", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, "iat", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, "nbf");
   if (nbf !== void 0 && nbf > now + tolerance)
     throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', claimsSet, "nbf", checkFailed);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.14",
+  "version": "6.2.15",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/node_modules/@weavecode/cli/dist/commands/msg.js

@@ -1,2 +1,2 @@
-import{DAEMON_HOST as h}from"@weavecode/server";import{logger as a}from"@weavecode/core";import{createRuntimeRegistry as y}from"@weavecode/harness";import{ensureDaemonRunning as u}from"./daemon.js";import{t as i}from"../i18n/index.js";async function g(s,o,e){const t=await fetch(`http://${h}:${s}${o}`,e),n=await t.json().catch(()=>({}));if(!t.ok)throw new Error(String(n.error??`HTTP ${t.status}`));return n}export function resolveSessionRef(s,o){const e=o.toLowerCase(),t=s.filter(c=>c.sessionId.toLowerCase()===e);if(t.length===1)return{row:t[0]};const n=s.filter(c=>c.sessionId.toLowerCase().startsWith(e));if(n.length===1)return{row:n[0]};const r=s.filter(c=>c.title!=null&&c.title.toLowerCase().includes(e));if(r.length===1)return{row:r[0]};const m=n.length>0?n:r;return m.length>1?{error:"ambiguous",rows:m}:{error:"not-found"}}export function currentSessionId(s,o){for(const e of o){if(!e)continue;const t=s[e];if(typeof t=="string"&&t!=="")return t}return null}export function pickReplyTarget(s,o){for(let e=s.length-1;e>=0;e--){const t=s[e];if(t.toSessionId===o&&t.fromSessionId!=null)return t.fromSessionId}return null}function I(s){const o=s[0].map((e,t)=>Math.max(...s.map(n=>n[t].length)));return s.map(e=>e.map((t,n)=>t.padEnd(o[n])).join("  ").trimEnd()).join(`
-`)}const l=s=>s.slice(0,8);function f(s,o){return g(s,"/sessions").then(({sessions:e})=>{const t=resolveSessionRef(e,o);if("row"in t)return t.row;throw t.error==="ambiguous"?new Error(i("out.msg.ambiguous",{ref:o,candidates:t.rows.map(n=>`${l(n.sessionId)}${n.title?` (${n.title})`:""}`).join(", ")})):new Error(i("out.msg.notFound",{ref:o}))})}function p(){const s=y().byCapability("messaging").flatMap(o=>o.messaging?.sessionEnv?[o.messaging.sessionEnv]:[]);return currentSessionId(process.env,s)}async function w(s,o,e,t,n){const r=await f(s,o),m=await g(s,`/sessions/${encodeURIComponent(r.sessionId)}/messages`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({text:e,mode:t,fromKind:"cli",fromSessionId:n})});a.success(i("out.msg.sendOk",{target:r.title??l(r.sessionId),id:m.messageId,status:m.status}))}async function S(s,o){const{sessions:e}=await g(s,"/sessions");if(!o){const{capabilities:r}=await g(s,"/messaging/capabilities"),m=new Set(r.filter(d=>d.discovery).map(d=>d.harness)),c=e.map(d=>[l(d.sessionId),d.title??"",d.harness??"-",d.turnOpen===void 0?"-":d.turnOpen?i("out.msg.busy"):i("out.msg.idle"),d.harness!=null&&m.has(d.harness)?"\u2713":"\u2014"]);if(c.length===0){a.info(i("out.msg.noSessions"));return}a.info(i("out.msg.sessionHeader",{n:c.length})),console.log(I([[i("out.msg.col.session"),i("out.msg.col.title"),i("out.msg.col.harness"),i("out.msg.col.state"),i("out.msg.col.msg")],...c]));return}const t=await f(s,o),{messages:n}=await g(s,`/sessions/${encodeURIComponent(t.sessionId)}/messages`);a.info(i("out.msg.threadHeader",{session:t.title??t.sessionId,n:n.length}));for(const r of n){const m=r.fromSessionId===t.sessionId?"\u25B6":"\u25C0",c=r.fromKind==="dashboard"?"dashboard":r.fromKind==="cli"?"cli":r.fromSessionId??"?";console.log(`${r.createdAt.slice(11,19)} ${m} ${c} [${r.status}] ${r.text.slice(0,80)}`)}}async function C(s,o,e){const t=await f(s,o),n=p(),r=await g(s,`/sessions/${encodeURIComponent(t.sessionId)}/watch`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({watcherSessionId:n,notify:e??null})});a.success(i("out.msg.watchOk",{target:t.title??l(t.sessionId),id:r.watchId,via:n??i("out.msg.watchViaDashboard")}))}async function x(s,o){const e=p();if(!e){a.warn(i("out.msg.replyNoSession")),process.exitCode=1;return}const{messages:t}=await g(s,`/sessions/${encodeURIComponent(e)}/messages`),n=pickReplyTarget(t,e);if(!n){a.warn(i("out.msg.replyNothing")),process.exitCode=1;return}await w(s,n,o,"inject",e)}export const msgCommand={name:"msg",description:"cmd.msg.desc",subcommands:[{name:"ls",description:"cmd.msg.ls.desc",async action(s){const o=await u();try{await S(o.port,s.positional[0])}catch(e){a.warn(i("out.msg.failed",{error:e instanceof Error?e.message:String(e)})),process.exitCode=1}}},{name:"send",description:"cmd.msg.send.desc",options:[{name:"mode",short:"m",description:"flag.msg.mode",type:"string",choices:["auto","inject","headless"],default:"inject"}],async action(s){const o=s.positional[0],e=s.positional.slice(1).join(" ");if(!o||!e){a.warn(i("out.msg.sendUsage")),process.exitCode=1;return}const t=await u();try{await w(t.port,o,e,String(s.flags.mode??"inject"),p())}catch(n){a.warn(i("out.msg.sendFail",{error:n instanceof Error?n.message:String(n)})),process.exitCode=1}}},{name:"watch",description:"cmd.msg.watch.desc",options:[{name:"notify",description:"flag.msg.notify",type:"string"}],async action(s){const o=s.positional[0];if(!o){a.warn(i("out.msg.watchUsage")),process.exitCode=1;return}const e=await u();try{await C(e.port,o,s.flags.notify==null?void 0:String(s.flags.notify))}catch(t){a.warn(i("out.msg.watchFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}},{name:"reply",description:"cmd.msg.reply.desc",async action(s){const o=s.positional.join(" ");if(!o){a.warn(i("out.msg.replyUsage")),process.exitCode=1;return}const e=await u();try{await x(e.port,o)}catch(t){a.warn(i("out.msg.sendFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}}]};
+import{DAEMON_HOST as h}from"@weavecode/server";import{logger as a}from"@weavecode/core";import{createRuntimeRegistry as y}from"@weavecode/harness";import{ensureDaemonRunning as d}from"./daemon.js";import{t as i}from"../i18n/index.js";async function u(s,o,e){const t=await fetch(`http://${h}:${s}${o}`,e),n=await t.json().catch(()=>({}));if(!t.ok)throw new Error(String(n.error??`HTTP ${t.status}`));return n}export function resolveSessionRef(s,o){const e=o.toLowerCase(),t=s.filter(c=>c.sessionId.toLowerCase()===e);if(t.length===1)return{row:t[0]};const n=s.filter(c=>c.sessionId.toLowerCase().startsWith(e));if(n.length===1)return{row:n[0]};const r=s.filter(c=>c.title!=null&&c.title.toLowerCase().includes(e));if(r.length===1)return{row:r[0]};const g=n.length>0?n:r;return g.length>1?{error:"ambiguous",rows:g}:{error:"not-found"}}export function currentSessionId(s,o){for(const e of o){if(!e)continue;const t=s[e];if(typeof t=="string"&&t!=="")return t}return null}export function pickReplyTarget(s,o){for(let e=s.length-1;e>=0;e--){const t=s[e];if(t.toSessionId===o&&t.fromSessionId!=null)return t.fromSessionId}return null}function I(s){const o=s[0].map((e,t)=>Math.max(...s.map(n=>n[t].length)));return s.map(e=>e.map((t,n)=>t.padEnd(o[n])).join("  ").trimEnd()).join(`
+`)}const l=s=>s.slice(0,8);function f(s,o){return u(s,"/sessions").then(({sessions:e})=>{const t=resolveSessionRef(e,o);if("row"in t)return t.row;throw t.error==="ambiguous"?new Error(i("out.msg.ambiguous",{ref:o,candidates:t.rows.map(n=>`${l(n.sessionId)}${n.title?` (${n.title})`:""}`).join(", ")})):new Error(i("out.msg.notFound",{ref:o}))})}function p(){const s=y().byCapability("messaging").flatMap(o=>o.messaging?.sessionEnv?[o.messaging.sessionEnv]:[]);return currentSessionId(process.env,s)}async function w(s,o,e,t,n){const r=await f(s,o),g=await u(s,`/sessions/${encodeURIComponent(r.sessionId)}/messages`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({text:e,mode:t,fromKind:"cli",fromSessionId:n})});a.success(i("out.msg.sendOk",{target:r.title??l(r.sessionId),id:g.messageId,status:g.status}))}async function S(s,o){const{sessions:e}=await u(s,"/sessions");if(!o){const{capabilities:r}=await u(s,"/messaging/capabilities"),g=new Set(r.filter(m=>m.discovery).map(m=>m.harness)),c=e.map(m=>[l(m.sessionId),m.title??"",m.harness??"-",m.turnOpen===void 0?"-":m.turnOpen?i("out.msg.busy"):i("out.msg.idle"),m.harness!=null&&g.has(m.harness)?"\u2713":"\u2014"]);if(c.length===0){a.info(i("out.msg.noSessions"));return}a.info(i("out.msg.sessionHeader",{n:c.length})),console.log(I([[i("out.msg.col.session"),i("out.msg.col.title"),i("out.msg.col.harness"),i("out.msg.col.state"),i("out.msg.col.msg")],...c]));return}const t=await f(s,o),{messages:n}=await u(s,`/sessions/${encodeURIComponent(t.sessionId)}/messages`);a.info(i("out.msg.threadHeader",{session:t.title??t.sessionId,n:n.length}));for(const r of n){const g=r.fromSessionId===t.sessionId?"\u25B6":"\u25C0",c=r.fromKind==="dashboard"?"dashboard":r.fromKind==="cli"?"cli":r.fromSessionId??"?";console.log(`${r.createdAt.slice(11,19)} ${g} ${c} [${r.status}] ${r.text.slice(0,80)}`)}}async function C(s,o,e){const t=await f(s,o),n=p(),r=await u(s,`/sessions/${encodeURIComponent(t.sessionId)}/watch`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({watcherSessionId:n,notify:e??null})});a.success(i("out.msg.watchOk",{target:t.title??l(t.sessionId),id:r.watchId,via:n??i("out.msg.watchViaDashboard")}))}async function x(s,o){const e=p();if(!e){a.warn(i("out.msg.replyNoSession")),process.exitCode=1;return}const{messages:t}=await u(s,`/sessions/${encodeURIComponent(e)}/messages`),n=pickReplyTarget(t,e);if(!n){a.warn(i("out.msg.replyNothing")),process.exitCode=1;return}await w(s,n,o,"inject",e)}export const msgCommand={name:"msg",description:"cmd.msg.desc",subcommands:[{name:"ls",description:"cmd.msg.ls.desc",async action(s){const o=await d();try{await S(o.port,s.positional[0])}catch(e){a.warn(i("out.msg.failed",{error:e instanceof Error?e.message:String(e)})),process.exitCode=1}}},{name:"send",description:"cmd.msg.send.desc",options:[{name:"mode",short:"m",description:"flag.msg.mode",type:"string",choices:["auto","inject","headless"],default:"inject"}],async action(s){const o=s.positional[0],e=s.positional.slice(1).join(" ");if(!o||!e){a.warn(i("out.msg.sendUsage")),process.exitCode=1;return}const t=await d();try{await w(t.port,o,e,String(s.flags.mode??"inject"),p())}catch(n){a.warn(i("out.msg.sendFail",{error:n instanceof Error?n.message:String(n)})),process.exitCode=1}}},{name:"watch",description:"cmd.msg.watch.desc",options:[{name:"notify",description:"flag.msg.notify",type:"string"}],async action(s){const o=s.positional[0];if(!o){a.warn(i("out.msg.watchUsage")),process.exitCode=1;return}const e=await d();try{await C(e.port,o,s.flags.notify==null?void 0:String(s.flags.notify))}catch(t){a.warn(i("out.msg.watchFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}},{name:"reply",description:"cmd.msg.reply.desc",async action(s){const o=s.positional.join(" ");if(!o){a.warn(i("out.msg.replyUsage")),process.exitCode=1;return}const e=await d();try{await x(e.port,o)}catch(t){a.warn(i("out.msg.sendFail",{error:t instanceof Error?t.message:String(t)})),process.exitCode=1}}}]};