@zuplo/cli 7.8.6 → 7.8.8

package/node_modules/@modelcontextprotocol/client/dist/{src-D_zzAWoS.mjs → src-DDAAhLnO.mjs}

@@ -176,6 +176,16 @@ let OAuthErrorCode = /* @__PURE__ */ function(OAuthErrorCode$1) {
 	* The requested resource is invalid, missing, unknown, or malformed. (Custom error for resource indicators - RFC 8707)
 	*/
 	OAuthErrorCode$1["InvalidTarget"] = "invalid_target";
+	/**
+	* The DPoP proof accompanying the request is invalid, or does not match the key the grant
+	* (e.g. a refresh token) is bound to. (RFC 9449 §5 / §7.1)
+	*/
+	OAuthErrorCode$1["InvalidDpopProof"] = "invalid_dpop_proof";
+	/**
+	* The server requires a server-supplied nonce in the DPoP proof; retry with the `DPoP-Nonce`
+	* it returned. (RFC 9449 §8 / §9)
+	*/
+	OAuthErrorCode$1["UseDpopNonce"] = "use_dpop_nonce";
 	return OAuthErrorCode$1;
 }({});
 /**
@@ -359,8 +369,18 @@ var SdkError = class extends Error {
 		if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
 		return brandedHasInstance(this, value);
 	}
-	constructor(code, message, data) {
-		super(message);
+	/**
+	* @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+	* @param message - Human-readable description.
+	* @param data - Optional structured payload (for example the HTTP status carried by
+	* {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+	* promoted to `Error.cause`.
+	* @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+	* failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+	* loggers and error trackers walk.
+	*/
+	constructor(code, message, data, options) {
+		super(message, options);
 		this.code = code;
 		this.data = data;
 		this.name = "SdkError";
@@ -387,8 +407,11 @@ var SdkHttpError = class extends SdkError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
 	}
-	constructor(code, message, data) {
-		super(code, message, data);
+	/**
+	* @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+	*/
+	constructor(code, message, data, options) {
+		super(code, message, data, options);
 		this.name = "SdkHttpError";
 	}
 	get status() {
@@ -2214,7 +2237,7 @@ const rev2025NotificationMethods = Object.keys(notificationMethodKeys$1);
 
 //#endregion
 //#region ../core-internal/src/wire/rev2025-11-25/codec.ts
-function isPlainObject$4(value) {
+function isPlainObject$5(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /** Tri-state wrap of an optional Zod schema lookup (the function-only contract). */
@@ -2239,7 +2262,7 @@ const NOT_IN_ERA$1 = {
 };
 /** Whether a `tools/list` entry advertises a non-object `outputSchema` root that needs the SEP-2106 legacy wrap. */
 function toolNeedsLegacyWrap(t) {
-	return isPlainObject$4(t) && isPlainObject$4(t["outputSchema"]) && isNonObjectJsonSchemaRoot(t["outputSchema"]);
+	return isPlainObject$5(t) && isPlainObject$5(t["outputSchema"]) && isNonObjectJsonSchemaRoot(t["outputSchema"]);
 }
 /** The wire→neutral trust boundary: a decoded 2025-era wire result is adopted as the neutral `Result` here (the module's single deliberate assertion). */
 function toNeutralResult(value) {
@@ -2274,7 +2297,7 @@ const rev2025Codec = {
 		};
 	},
 	decodeResult(_method, raw) {
-		if (isPlainObject$4(raw) && "resultType" in raw) {
+		if (isPlainObject$5(raw) && "resultType" in raw) {
 			const stripped = { ...raw };
 			delete stripped["resultType"];
 			return {
@@ -3649,7 +3672,7 @@ function fillCacheFields(method, result) {
 	delete filled[RESULT_CACHE_HINT_FALLBACK];
 	return filled;
 }
-function isPlainObject$3(value) {
+function isPlainObject$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /**
@@ -3677,7 +3700,7 @@ function stampServerInfoMeta(result, serverInfo) {
 		...result,
 		_meta: { [SERVER_INFO_META_KEY]: serverInfo }
 	};
-	if (!isPlainObject$3(meta)) return result;
+	if (!isPlainObject$4(meta)) return result;
 	if (meta[SERVER_INFO_META_KEY] !== void 0) return result;
 	return {
 		...result,
@@ -3822,7 +3845,7 @@ const rev2026NotificationMethods = Object.keys(notificationMethodKeys);
 
 //#endregion
 //#region ../core-internal/src/wire/rev2026-07-28/codec.ts
-function isPlainObject$2(value) {
+function isPlainObject$3(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /** Tri-state wrap of an optional Zod schema lookup (the function-only contract). */
@@ -3864,14 +3887,14 @@ function enforceDeletedFields(method, result) {
 		return next;
 	};
 	const tools = result.tools;
-	if (method === "tools/list" && Array.isArray(tools) && tools.some((tool) => isPlainObject$2(tool) && "execution" in tool)) copy().tools = tools.map((tool) => {
-		if (!isPlainObject$2(tool) || !("execution" in tool)) return tool;
+	if (method === "tools/list" && Array.isArray(tools) && tools.some((tool) => isPlainObject$3(tool) && "execution" in tool)) copy().tools = tools.map((tool) => {
+		if (!isPlainObject$3(tool) || !("execution" in tool)) return tool;
 		const rest = { ...tool };
 		delete rest["execution"];
 		return rest;
 	});
 	const capabilities = result.capabilities;
-	if (isPlainObject$2(capabilities) && "tasks" in capabilities) {
+	if (isPlainObject$3(capabilities) && "tasks" in capabilities) {
 		const rest = { ...capabilities };
 		delete rest["tasks"];
 		copy().capabilities = rest;
@@ -3918,7 +3941,7 @@ const rev2026Codec = {
 	projectCallToolResult: (result) => appendTextFallbackForNonObject(result),
 	inputRequestSchema: getInputRequestSchema2026,
 	decodeResult(method, raw) {
-		if (!isPlainObject$2(raw)) return {
+		if (!isPlainObject$3(raw)) return {
 			kind: "invalid",
 			error: new SdkError(SdkErrorCode.InvalidResult, `Invalid result for ${method}: not an object`, { method })
 		};
@@ -3939,7 +3962,7 @@ const rev2026Codec = {
 		};
 		if (rawResultType === "input_required") {
 			const rawInputRequests = raw["inputRequests"];
-			const inputRequests = isPlainObject$2(rawInputRequests) ? rawInputRequests : {};
+			const inputRequests = isPlainObject$3(rawInputRequests) ? rawInputRequests : {};
 			const requestState = raw["requestState"];
 			if (Object.keys(inputRequests).length === 0 && typeof requestState !== "string") return {
 				kind: "invalid",
@@ -4607,7 +4630,7 @@ const INBOUND_VALIDATION_LADDER = [
 		evaluatedAt: "pre-dispatch",
 		codes: [HEADER_MISMATCH_ERROR_CODE],
 		conformance: ["http-header-validation"],
-		rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
+		rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half — including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
 	},
 	{
 		rung: "client-capabilities",
@@ -4650,6 +4673,55 @@ const LADDER_ERROR_HTTP_STATUS = {
 	[ProtocolErrorCode.MissingRequiredClientCapability]: 400,
 	[HEADER_MISMATCH_ERROR_CODE]: 400
 };
+/**
+* The methods whose body carries a `params.name` / `params.uri` /
+* `params.taskId` value the `Mcp-Name` header must mirror, and which body
+* field supplies it. The core rows come from SEP-2243 § Standard Request
+* Headers (`Required For` column); the `tasks/*` rows come from SEP-2663's
+* Streamable HTTP binding ("the client MUST set the `Mcp-Name` header to the
+* value of `params.taskId`" for `tasks/get` / `tasks/update` /
+* `tasks/cancel`, so intermediaries can route every request for a task to the
+* instance holding its state). Shared by the client transport (header
+* emission) and the server ladder (validation) so both sides derive from one
+* table.
+*/
+const MCP_NAME_HEADER_SOURCE = {
+	"tools/call": "name",
+	"prompts/get": "name",
+	"resources/read": "uri",
+	"tasks/get": "taskId",
+	"tasks/update": "taskId",
+	"tasks/cancel": "taskId"
+};
+/**
+* Resolve the `Mcp-Name` source for one request against
+* {@linkcode MCP_NAME_HEADER_SOURCE}: which body field the header mirrors for
+* `method`, and the string value that field carries in `params`.
+*
+* Returns `undefined` when `method` is off-table (no `Mcp-Name` is emitted or
+* required). Otherwise `value` is the field's string value, or `undefined`
+* when `params` is not a plain object or the field is absent / not a string —
+* the client emits no header then, and the server leaves that body to the
+* rungs further down the ladder.
+*
+* `method` is peer-supplied on the server and caller-supplied on the client,
+* so the table lookup is `Object.hasOwn`-guarded against `Object.prototype`
+* collisions (`constructor`, `toString`, …). Shared by the client transport
+* (emission) and {@linkcode validateStandardRequestHeaders} (validation) so
+* the extraction — not just the table — cannot drift between the two sides.
+*/
+function mcpNameSource(method, params) {
+	const field = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
+	if (field === void 0) return;
+	const raw = isPlainObject$2(params) ? params[field] : void 0;
+	return {
+		field,
+		value: typeof raw === "string" ? raw : void 0
+	};
+}
+function isPlainObject$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 
 //#endregion
 //#region ../core-internal/src/util/schema.ts
@@ -5697,7 +5769,7 @@ var Protocol = class {
 		return this._requestHandlers.get(method);
 	}
 	async _oncancel(notification) {
-		if (!notification.params.requestId) return;
+		if (notification.params.requestId === void 0) return;
 		this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
 	}
 	_setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -6096,19 +6168,20 @@ var Protocol = class {
 			const cancel = (reason) => {
 				if (responseReceived) return;
 				this._progressHandlers.delete(messageId);
-				if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-					jsonrpc: "2.0",
-					method: "notifications/cancelled",
-					params: {
-						requestId: messageId,
-						reason: String(reason)
-					}
-				}), {
-					relatedRequestId,
-					resumptionToken,
-					onresumptiontoken
-				}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
-				else requestAbort.abort();
+				if (requestAbort === void 0) {
+					if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+						jsonrpc: "2.0",
+						method: "notifications/cancelled",
+						params: {
+							requestId: messageId,
+							reason: String(reason)
+						}
+					}), {
+						relatedRequestId,
+						resumptionToken,
+						onresumptiontoken
+					}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
+				} else requestAbort.abort();
 				reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
 			};
 			this._responseHandlers.set(messageId, (response) => {
@@ -6188,7 +6261,7 @@ var Protocol = class {
 			jsonrpc: "2.0",
 			...notification
 		});
-		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
 			if (this._pendingDebouncedNotifications.has(notification.method)) return;
 			this._pendingDebouncedNotifications.add(notification.method);
 			Promise.resolve().then(() => {
@@ -7059,5 +7132,5 @@ function fromJsonSchema(schema, validator) {
 }
 
 //#endregion
-export { legacyProtocolVersions as $, isInitializeRequest as A, SdkErrorCode as At, DiscoverResultSchema as B, HEADER_MISMATCH_ERROR_CODE as C, OAuthClientInformationFullSchema as Ct, assertCompleteRequestPrompt as D, OAuthTokensSchema as Dt, scanXMcpHeaderDeclarations as E, OAuthProtectedResourceMetadataSchema as Et, isJSONRPCRequest as F, stampErrorBrands as Ft, MissingRequiredClientCapabilityError as G, ListChangedOptionsBaseSchema as H, isJSONRPCResponse as I, UnsupportedProtocolVersionError as J, ProtocolError as K, isJSONRPCResultResponse as L, isInputRequiredResult as M, OAuthError as Mt, isJSONRPCErrorResponse as N, OAuthErrorCode as Nt, assertCompleteRequestResourceTemplate as O, OpenIdProviderDiscoveryMetadataSchema as Ot, isJSONRPCNotification as P, brandedHasInstance as Pt, isModernProtocolVersion as Q, isTaskAugmentedRequestParams as R, parseSchema as S, IdJagTokenExchangeResponseSchema as St, encodeMcpParamValue as T, OAuthMetadataSchema as Tt, MODERN_WIRE_REVISION as U, JSONRPCMessageSchema as V, codecForVersion as W, ProtocolErrorCode as X, UrlElicitationRequiredError as Y, SUPPORTED_MODERN_PROTOCOL_VERSIONS as Z, mergeCapabilities as _, SUPPORTED_PROTOCOL_VERSIONS as _t, createFetchWithInit as a, INTERNAL_ERROR as at, resolveInputRequiredDriverConfig as b, checkResourceAllowed as bt, STDIO_DEFAULT_MAX_BUFFER_SIZE as c, JSONRPC_VERSION as ct, getDisplayName as d, METHOD_NOT_FOUND as dt, modernProtocolVersions as et, isJsonContentType as f, PARSE_ERROR as ft, Protocol as g, SUBSCRIPTION_ID_META_KEY as gt, DEFAULT_REQUEST_TIMEOUT_MSEC as h, SERVER_INFO_META_KEY as ht, UriTemplate as i, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as it, isInitializedNotification as j, SdkHttpError as jt, isCallToolResult as k, SdkError as kt, deserializeMessage as l, LATEST_PROTOCOL_VERSION as lt, runInputRequiredFlow as m, RELATED_TASK_META_KEY as mt, preloadSchemas as n, CLIENT_CAPABILITIES_META_KEY as nt, normalizeHeaders as o, INVALID_PARAMS as ot, mediaTypeEssence as p, PROTOCOL_VERSION_META_KEY as pt, ResourceNotFoundError as q, InMemoryTransport as r, CLIENT_INFO_META_KEY as rt, ReadBuffer as s, INVALID_REQUEST as st, fromJsonSchema as t, BAGGAGE_META_KEY as tt, serializeMessage as u, LOG_LEVEL_META_KEY as ut, isSpecType as v, TRACEPARENT_META_KEY as vt, buildMcpParamHeaders as w, OAuthErrorResponseSchema as wt, withInputRequired as x, resourceUrlFromServerUrl as xt, specTypeSchemas as y, TRACESTATE_META_KEY as yt, parseJSONRPCMessage as z };
-//# sourceMappingURL=src-D_zzAWoS.mjs.map
+export { legacyProtocolVersions as $, isInitializeRequest as A, SdkErrorCode as At, DiscoverResultSchema as B, mcpNameSource as C, OAuthClientInformationFullSchema as Ct, assertCompleteRequestPrompt as D, OAuthTokensSchema as Dt, scanXMcpHeaderDeclarations as E, OAuthProtectedResourceMetadataSchema as Et, isJSONRPCRequest as F, stampErrorBrands as Ft, MissingRequiredClientCapabilityError as G, ListChangedOptionsBaseSchema as H, isJSONRPCResponse as I, UnsupportedProtocolVersionError as J, ProtocolError as K, isJSONRPCResultResponse as L, isInputRequiredResult as M, OAuthError as Mt, isJSONRPCErrorResponse as N, OAuthErrorCode as Nt, assertCompleteRequestResourceTemplate as O, OpenIdProviderDiscoveryMetadataSchema as Ot, isJSONRPCNotification as P, brandedHasInstance as Pt, isModernProtocolVersion as Q, isTaskAugmentedRequestParams as R, HEADER_MISMATCH_ERROR_CODE as S, IdJagTokenExchangeResponseSchema as St, encodeMcpParamValue as T, OAuthMetadataSchema as Tt, MODERN_WIRE_REVISION as U, JSONRPCMessageSchema as V, codecForVersion as W, ProtocolErrorCode as X, UrlElicitationRequiredError as Y, SUPPORTED_MODERN_PROTOCOL_VERSIONS as Z, isSpecType as _, SUPPORTED_PROTOCOL_VERSIONS as _t, createFetchWithInit as a, INTERNAL_ERROR as at, withInputRequired as b, checkResourceAllowed as bt, deserializeMessage as c, JSONRPC_VERSION as ct, isJsonContentType as d, METHOD_NOT_FOUND as dt, modernProtocolVersions as et, mediaTypeEssence as f, PARSE_ERROR as ft, mergeCapabilities as g, SUBSCRIPTION_ID_META_KEY as gt, Protocol as h, SERVER_INFO_META_KEY as ht, UriTemplate as i, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as it, isInitializedNotification as j, SdkHttpError as jt, isCallToolResult as k, SdkError as kt, serializeMessage as l, LATEST_PROTOCOL_VERSION as lt, DEFAULT_REQUEST_TIMEOUT_MSEC as m, RELATED_TASK_META_KEY as mt, preloadSchemas as n, CLIENT_CAPABILITIES_META_KEY as nt, ReadBuffer as o, INVALID_PARAMS as ot, runInputRequiredFlow as p, PROTOCOL_VERSION_META_KEY as pt, ResourceNotFoundError as q, InMemoryTransport as r, CLIENT_INFO_META_KEY as rt, STDIO_DEFAULT_MAX_BUFFER_SIZE as s, INVALID_REQUEST as st, fromJsonSchema as t, BAGGAGE_META_KEY as tt, getDisplayName as u, LOG_LEVEL_META_KEY as ut, specTypeSchemas as v, TRACEPARENT_META_KEY as vt, buildMcpParamHeaders as w, OAuthErrorResponseSchema as wt, parseSchema as x, resourceUrlFromServerUrl as xt, resolveInputRequiredDriverConfig as y, TRACESTATE_META_KEY as yt, parseJSONRPCMessage as z };
+//# sourceMappingURL=src-DDAAhLnO.mjs.map