@zuplo/cli 7.8.6 → 7.8.8

package/node_modules/@modelcontextprotocol/server/dist/{src-CX2iR2pK.mjs → src-D-y6h4N7.mjs}

@@ -176,6 +176,16 @@ let OAuthErrorCode = /* @__PURE__ */ function(OAuthErrorCode$1) {
 	* The requested resource is invalid, missing, unknown, or malformed. (Custom error for resource indicators - RFC 8707)
 	*/
 	OAuthErrorCode$1["InvalidTarget"] = "invalid_target";
+	/**
+	* The DPoP proof accompanying the request is invalid, or does not match the key the grant
+	* (e.g. a refresh token) is bound to. (RFC 9449 §5 / §7.1)
+	*/
+	OAuthErrorCode$1["InvalidDpopProof"] = "invalid_dpop_proof";
+	/**
+	* The server requires a server-supplied nonce in the DPoP proof; retry with the `DPoP-Nonce`
+	* it returned. (RFC 9449 §8 / §9)
+	*/
+	OAuthErrorCode$1["UseDpopNonce"] = "use_dpop_nonce";
 	return OAuthErrorCode$1;
 }({});
 /**
@@ -359,8 +369,18 @@ var SdkError = class extends Error {
 		if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
 		return brandedHasInstance(this, value);
 	}
-	constructor(code, message, data) {
-		super(message);
+	/**
+	* @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+	* @param message - Human-readable description.
+	* @param data - Optional structured payload (for example the HTTP status carried by
+	* {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+	* promoted to `Error.cause`.
+	* @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+	* failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+	* loggers and error trackers walk.
+	*/
+	constructor(code, message, data, options) {
+		super(message, options);
 		this.code = code;
 		this.data = data;
 		this.name = "SdkError";
@@ -387,8 +407,11 @@ var SdkHttpError = class extends SdkError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
 	}
-	constructor(code, message, data) {
-		super(code, message, data);
+	/**
+	* @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+	*/
+	constructor(code, message, data, options) {
+		super(code, message, data, options);
 		this.name = "SdkHttpError";
 	}
 	get status() {
@@ -4770,9 +4793,15 @@ function paramHeaderMismatchRejection(cell, header, body) {
 *   named revision belongs to (a malformed envelope behind a present claim is
 *   a validation error, never a silent fall back to legacy handling).
 * - A request without a claim is legacy-era traffic.
-* - The `MCP-Protocol-Version` header is a cross-check only: it never
-*   upgrades or downgrades a body-derived classification, and a disagreement
-*   between header and body is an explicit ladder outcome.
+* - The `MCP-Protocol-Version` header is a cross-check only *for
+*   classification*: it never upgrades or downgrades a body-derived
+*   classification, and a disagreement between header and body is an explicit
+*   ladder outcome. Its absence likewise never changes the era — but the spec
+*   requires the header on every modern *request* POST, so a
+*   modern-classified request that omits it is refused one rung later, by
+*   {@linkcode validateStandardRequestHeaders}, not here. Notification POSTs
+*   are exempt (see the next bullet), and that rung enforces presence on
+*   requests only.
 * - Notifications carry no envelope claim of their own under the current
 *   spec, so for notification POSTs without a body claim the modern header is
 *   determinative; the `Mcp-Method` header is validated against the body when
@@ -4900,7 +4929,7 @@ const INBOUND_VALIDATION_LADDER = [
 		evaluatedAt: "pre-dispatch",
 		codes: [HEADER_MISMATCH_ERROR_CODE],
 		conformance: ["http-header-validation"],
-		rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
+		rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half — including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
 	},
 	{
 		rung: "client-capabilities",
@@ -4983,15 +5012,51 @@ function crossCheckMismatch(cell, header, body, rung = "era-classification") {
 	} }), true);
 }
 /**
-* The methods whose body carries a `params.name` / `params.uri` value the
-* `Mcp-Name` header must mirror, and which body field supplies it (SEP-2243
-* § Standard Request Headers, `Required For` column).
+* The methods whose body carries a `params.name` / `params.uri` /
+* `params.taskId` value the `Mcp-Name` header must mirror, and which body
+* field supplies it. The core rows come from SEP-2243 § Standard Request
+* Headers (`Required For` column); the `tasks/*` rows come from SEP-2663's
+* Streamable HTTP binding ("the client MUST set the `Mcp-Name` header to the
+* value of `params.taskId`" for `tasks/get` / `tasks/update` /
+* `tasks/cancel`, so intermediaries can route every request for a task to the
+* instance holding its state). Shared by the client transport (header
+* emission) and the server ladder (validation) so both sides derive from one
+* table.
 */
 const MCP_NAME_HEADER_SOURCE = {
 	"tools/call": "name",
 	"prompts/get": "name",
-	"resources/read": "uri"
+	"resources/read": "uri",
+	"tasks/get": "taskId",
+	"tasks/update": "taskId",
+	"tasks/cancel": "taskId"
 };
+/**
+* Resolve the `Mcp-Name` source for one request against
+* {@linkcode MCP_NAME_HEADER_SOURCE}: which body field the header mirrors for
+* `method`, and the string value that field carries in `params`.
+*
+* Returns `undefined` when `method` is off-table (no `Mcp-Name` is emitted or
+* required). Otherwise `value` is the field's string value, or `undefined`
+* when `params` is not a plain object or the field is absent / not a string —
+* the client emits no header then, and the server leaves that body to the
+* rungs further down the ladder.
+*
+* `method` is peer-supplied on the server and caller-supplied on the client,
+* so the table lookup is `Object.hasOwn`-guarded against `Object.prototype`
+* collisions (`constructor`, `toString`, …). Shared by the client transport
+* (emission) and {@linkcode validateStandardRequestHeaders} (validation) so
+* the extraction — not just the table — cannot drift between the two sides.
+*/
+function mcpNameSource(method, params) {
+	const field = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
+	if (field === void 0) return;
+	const raw = isPlainObject$2(params) ? params[field] : void 0;
+	return {
+		field,
+		value: typeof raw === "string" ? raw : void 0
+	};
+}
 /** Strip RFC 9110 optional whitespace (SP / HTAB) around a field value in linear time. */
 function stripHttpOws(value) {
 	let start = 0;
@@ -5019,13 +5084,19 @@ function stripHttpOws(value) {
 * `era-classification` rung for the `MCP-Protocol-Version` and
 * `Mcp-Method` *mismatch* cells) when:
 *
+* - the required `MCP-Protocol-Version` header is absent (SEP-2243 requires it
+*   on every modern *request* POST, and lists it first among the required
+*   standard headers — so a request missing it *and* `Mcp-Method` is answered
+*   by this cell);
 * - the required `Mcp-Method` header is absent;
 * - the required `Mcp-Name` header is absent on a `tools/call`,
-*   `prompts/get`, or `resources/read` request whose body carries the
-*   `params.name` / `params.uri` value the header mirrors;
+*   `prompts/get`, `resources/read`, or (per SEP-2663's Streamable HTTP
+*   binding) `tasks/get` / `tasks/update` / `tasks/cancel` request whose
+*   body carries the `params.name` / `params.uri` / `params.taskId` value
+*   the header mirrors;
 * - the `Mcp-Name` header carries an invalid `=?base64?…?=` sentinel; or
 * - the (decoded) `Mcp-Name` value disagrees with the body's
-*   `params.name` / `params.uri`.
+*   `params.name` / `params.uri` / `params.taskId`.
 *
 * Returns `undefined` (pass) for notifications (the spec table reads
 * "All requests"), for methods that have no `Mcp-Name` source, and when the
@@ -5036,16 +5107,22 @@ function stripHttpOws(value) {
 * call to the classifier (no headers passed) keeps routing a modern request
 * unchanged: the classifier remains a pure body-primary router, and this
 * function is the presence/`Mcp-Name` half of the standard-header rung the
-* entry layers on top.
+* entry layers on top. That separation is what lets the missing
+* `MCP-Protocol-Version` cell live here without disturbing the body-primary
+* rule — classification still resolves from the body (a proxy stripping the
+* header must not change the era), and only this rung refuses to serve it.
 */
 function validateStandardRequestHeaders(request, route) {
 	if (route.messageKind !== "request") return;
 	const method = route.message.method;
+	if (request.protocolVersionHeader === void 0) {
+		const claimed = route.classification.revision;
+		return crossCheckMismatch("version-header-missing", "(missing)", claimed === void 0 ? "the body carries a modern per-request envelope but the required MCP-Protocol-Version header is absent" : `the body envelope names protocol version ${claimed} but the required MCP-Protocol-Version header is absent`, "standard-header-validation");
+	}
 	if (request.mcpMethodHeader === void 0) return crossCheckMismatch("method-header-missing", "(missing)", `the body names method ${method} but the required Mcp-Method header is absent`, "standard-header-validation");
-	const sourceField = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
-	if (sourceField === void 0) return;
-	const sourceValue = route.message.params?.[sourceField];
-	const bodyValue = typeof sourceValue === "string" ? sourceValue : void 0;
+	const source = mcpNameSource(method, route.message.params);
+	if (source === void 0) return;
+	const { field: sourceField, value: bodyValue } = source;
 	if (request.mcpNameHeader === void 0) {
 		if (bodyValue === void 0) return;
 		return crossCheckMismatch("name-header-missing", "(missing)", `the body carries params.${sourceField}="${bodyValue}" but the required Mcp-Name header is absent`, "standard-header-validation");
@@ -6247,7 +6324,7 @@ var Protocol = class {
 		return this._requestHandlers.get(method);
 	}
 	async _oncancel(notification) {
-		if (!notification.params.requestId) return;
+		if (notification.params.requestId === void 0) return;
 		this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
 	}
 	_setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -6646,19 +6723,20 @@ var Protocol = class {
 			const cancel = (reason) => {
 				if (responseReceived) return;
 				this._progressHandlers.delete(messageId);
-				if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-					jsonrpc: "2.0",
-					method: "notifications/cancelled",
-					params: {
-						requestId: messageId,
-						reason: String(reason)
-					}
-				}), {
-					relatedRequestId,
-					resumptionToken,
-					onresumptiontoken
-				}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
-				else requestAbort.abort();
+				if (requestAbort === void 0) {
+					if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+						jsonrpc: "2.0",
+						method: "notifications/cancelled",
+						params: {
+							requestId: messageId,
+							reason: String(reason)
+						}
+					}), {
+						relatedRequestId,
+						resumptionToken,
+						onresumptiontoken
+					}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
+				} else requestAbort.abort();
 				reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
 			};
 			this._responseHandlers.set(messageId, (response) => {
@@ -6738,7 +6816,7 @@ var Protocol = class {
 			jsonrpc: "2.0",
 			...notification
 		});
-		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
 			if (this._pendingDebouncedNotifications.has(notification.method)) return;
 			this._pendingDebouncedNotifications.add(notification.method);
 			Promise.resolve().then(() => {
@@ -7603,4 +7681,4 @@ function fromJsonSchema(schema, validator) {
 
 //#endregion
 export { isTaskAugmentedRequestParams as $, promptArgumentsFromStandardSchema as A, LATEST_PROTOCOL_VERSION as At, scanXMcpHeaderDeclarations as B, TRACESTATE_META_KEY as Bt, REQUEST_STATE_ONLY_LEG_PACING_MS as C, CLIENT_CAPABILITIES_META_KEY as Ct, acceptedContent as D, INVALID_PARAMS as Dt, sleep as E, INTERNAL_ERROR as Et, carriesValidModernEnvelopeClaim as F, RELATED_TASK_META_KEY as Ft, isInitializeRequest as G, resourceUrlFromServerUrl as Gt, assertCompleteRequestPrompt as H, requiredClientCapabilitiesForInputRequest as Ht, classifyInboundRequest as I, SERVER_INFO_META_KEY as It, isJSONRPCErrorResponse as J, SdkHttpError as Jt, isInitializedNotification as K, SdkError as Kt, httpStatusForErrorCode as L, SUBSCRIPTION_ID_META_KEY as Lt, validateStandardSchema as M, METHOD_NOT_FOUND as Mt, parseSchema as N, PARSE_ERROR as Nt, inputRequired as O, INVALID_REQUEST as Ot, LADDER_ERROR_HTTP_STATUS as P, PROTOCOL_VERSION_META_KEY as Pt, isJSONRPCResultResponse as Q, modernOnlyStrictRejection as R, SUPPORTED_PROTOCOL_VERSIONS as Rt, specTypeSchemas as S, BAGGAGE_META_KEY as St, linkedRoundAbort as T, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as Tt, assertCompleteRequestResourceTemplate as U, requiredClientCapabilitiesForRequest as Ut, validateMcpParamHeaders as V, missingClientCapabilities as Vt, isCallToolResult as W, checkResourceAllowed as Wt, isJSONRPCRequest as X, OAuthErrorCode as Xt, isJSONRPCNotification as Y, OAuthError as Yt, isJSONRPCResponse as Z, mergeCapabilities as _, normalizeContentlessToolResult as _t, UriTemplate as a, requestMetaOf as at, withRequestStateValue as b, legacyProtocolVersions as bt, ReadBuffer as c, codecForVersion as ct, serializeMessage as d, ResourceNotFoundError as dt, parseJSONRPCMessage as et, getDisplayName as f, UnsupportedProtocolVersionError as ft, Protocol as g, attachCacheHintFallback as gt, DEFAULT_REQUEST_TIMEOUT_MSEC as h, assertValidCacheHint as ht, InMemoryTransport as i, hasEnvelopeClaim as it, standardSchemaToJsonSchema as j, LOG_LEVEL_META_KEY as jt, inputResponse as k, JSONRPC_VERSION as kt, STDIO_DEFAULT_MAX_BUFFER_SIZE as l, MissingRequiredClientCapabilityError as lt, mediaTypeEssence as m, ProtocolErrorCode as mt, preloadSchemas as n, LoggingLevelSchema as nt, createFetchWithInit as o, validateEnvelopeMeta as ot, isJsonContentType as p, UrlElicitationRequiredError as pt, isInputRequiredResult as q, SdkErrorCode as qt, normalizeRawShapeSchema as r, envelopeClaimVersion as rt, validateAndWarnToolName as s, MODERN_WIRE_REVISION as st, fromJsonSchema as t, JSONRPCMessageSchema as tt, deserializeMessage as u, ProtocolError as ut, requestStateAccessor as v, SUPPORTED_MODERN_PROTOCOL_VERSIONS as vt, inputRequiredRoundsExceededMessage as w, CLIENT_INFO_META_KEY as wt, isSpecType as x, modernProtocolVersions as xt, setNegotiatedProtocolVersion as y, isModernProtocolVersion as yt, validateStandardRequestHeaders as z, TRACEPARENT_META_KEY as zt };
-//# sourceMappingURL=src-CX2iR2pK.mjs.map
+//# sourceMappingURL=src-D-y6h4N7.mjs.map