@zuplo/cli 7.9.5 → 7.9.6

package/node_modules/@modelcontextprotocol/client/dist/index.mjs

@@ -1,4 +1,4 @@
-import { $ as legacyProtocolVersions, A as isInitializeRequest, At as SdkError, B as DiscoverResultSchema, C as mcpNameSource, Ct as IdJagTokenExchangeResponseSchema, D as assertCompleteRequestPrompt, Dt as OAuthProtectedResourceMetadataSchema, E as scanXMcpHeaderDeclarations, Et as OAuthMetadataSchema, F as isJSONRPCRequest, Ft as brandedHasInstance, G as MissingRequiredClientCapabilityError, H as ListChangedOptionsBaseSchema, I as isJSONRPCResponse, It as stampErrorBrands, J as UnsupportedProtocolVersionError, K as ProtocolError, L as isJSONRPCResultResponse, M as isInputRequiredResult, Mt as SdkHttpError, N as isJSONRPCErrorResponse, Nt as OAuthError, O as assertCompleteRequestResourceTemplate, Ot as OAuthTokensSchema, P as isJSONRPCNotification, Pt as OAuthErrorCode, Q as isModernProtocolVersion, R as isTaskAugmentedRequestParams, S as HEADER_MISMATCH_ERROR_CODE, St as withoutIssuer, T as encodeMcpParamValue, Tt as OAuthErrorResponseSchema, U as MODERN_WIRE_REVISION, V as JSONRPCMessageSchema, W as codecForVersion, X as ProtocolErrorCode, Y as UrlElicitationRequiredError, Z as SUPPORTED_MODERN_PROTOCOL_VERSIONS, _ as isSpecType, _t as SUPPORTED_PROTOCOL_VERSIONS, a as createFetchWithInit, at as INTERNAL_ERROR, b as withInputRequired, bt as checkResourceAllowed, c as deserializeMessage, ct as JSONRPC_VERSION, d as isJsonContentType, dt as METHOD_NOT_FOUND, et as modernProtocolVersions, f as mediaTypeEssence, ft as PARSE_ERROR, g as mergeCapabilities, gt as SUBSCRIPTION_ID_META_KEY, h as Protocol, ht as SERVER_INFO_META_KEY, i as UriTemplate, it as DEFAULT_NEGOTIATED_PROTOCOL_VERSION, j as isInitializedNotification, jt as SdkErrorCode, k as isCallToolResult, kt as OpenIdProviderDiscoveryMetadataSchema, l as serializeMessage, lt as LATEST_PROTOCOL_VERSION, m as DEFAULT_REQUEST_TIMEOUT_MSEC, mt as RELATED_TASK_META_KEY, n as preloadSchemas, nt as CLIENT_CAPABILITIES_META_KEY, o as ReadBuffer, ot as INVALID_PARAMS, p as runInputRequiredFlow, pt as PROTOCOL_VERSION_META_KEY, q as ResourceNotFoundError, r as InMemoryTransport, rt as CLIENT_INFO_META_KEY, s as STDIO_DEFAULT_MAX_BUFFER_SIZE, st as INVALID_REQUEST, t as fromJsonSchema$1, tt as BAGGAGE_META_KEY, u as getDisplayName, ut as LOG_LEVEL_META_KEY, v as specTypeSchemas, vt as TRACEPARENT_META_KEY, w as buildMcpParamHeaders, wt as OAuthClientInformationFullSchema, x as parseSchema, xt as resourceUrlFromServerUrl, y as resolveInputRequiredDriverConfig, yt as TRACESTATE_META_KEY, z as parseJSONRPCMessage } from "./src-xKF0PJN-.mjs";
+import { $ as ProtocolErrorCode, A as assertCompleteRequestPrompt, At as OAuthProtectedResourceMetadataSchema, B as isJSONRPCResultResponse, C as withInputRequired, Ct as checkResourceAllowed, D as buildMcpParamHeaders, Dt as OAuthClientInformationFullSchema, E as mcpNameSource, Et as IdJagTokenExchangeResponseSchema, F as isInputRequiredResult, Ft as SdkHttpError, G as ListChangedOptionsBaseSchema, H as parseJSONRPCMessage, I as isJSONRPCErrorResponse, It as OAuthError, J as MissingRequiredClientCapabilityError, K as MODERN_WIRE_REVISION, L as isJSONRPCNotification, Lt as OAuthErrorCode, M as isCallToolResult, Mt as OpenIdProviderDiscoveryMetadataSchema, N as isInitializeRequest, Nt as SdkError, O as encodeMcpParamValue, Ot as OAuthErrorResponseSchema, P as isInitializedNotification, Pt as SdkErrorCode, Q as UrlElicitationRequiredError, R as isJSONRPCRequest, Rt as brandedHasInstance, S as resolveInputRequiredDriverConfig, St as TRACESTATE_META_KEY, T as HEADER_MISMATCH_ERROR_CODE, Tt as withoutIssuer, U as DiscoverResultSchema, V as isTaskAugmentedRequestParams, W as JSONRPCMessageSchema, X as ResourceNotFoundError, Y as ProtocolError, Z as UnsupportedProtocolVersionError, _ as DEFAULT_REQUEST_TIMEOUT_MSEC, _t as RELATED_TASK_META_KEY, a as createFetchWithInit, at as CLIENT_CAPABILITIES_META_KEY, b as isSpecType, bt as SUPPORTED_PROTOCOL_VERSIONS, c as unfollowedRedirect, ct as INTERNAL_ERROR, d as deserializeMessage, dt as JSONRPC_VERSION, et as SUPPORTED_MODERN_PROTOCOL_VERSIONS, f as serializeMessage, ft as LATEST_PROTOCOL_VERSION, g as runInputRequiredFlow, gt as PROTOCOL_VERSION_META_KEY, h as mediaTypeEssence, ht as PARSE_ERROR, i as UriTemplate, it as BAGGAGE_META_KEY, j as assertCompleteRequestResourceTemplate, jt as OAuthTokensSchema, k as scanXMcpHeaderDeclarations, kt as OAuthMetadataSchema, l as ReadBuffer, lt as INVALID_PARAMS, m as isJsonContentType, mt as METHOD_NOT_FOUND, n as preloadSchemas, nt as legacyProtocolVersions, o as fetchLeavingRedirects, ot as CLIENT_INFO_META_KEY, p as getDisplayName, pt as LOG_LEVEL_META_KEY, q as codecForVersion, r as InMemoryTransport, rt as modernProtocolVersions, s as fetchWithinOrigin, st as DEFAULT_NEGOTIATED_PROTOCOL_VERSION, t as fromJsonSchema$1, tt as isModernProtocolVersion, u as STDIO_DEFAULT_MAX_BUFFER_SIZE, ut as INVALID_REQUEST, v as Protocol, vt as SERVER_INFO_META_KEY, w as parseSchema, wt as resourceUrlFromServerUrl, x as specTypeSchemas, xt as TRACEPARENT_META_KEY, y as mergeCapabilities, yt as SUBSCRIPTION_ID_META_KEY, z as isJSONRPCResponse, zt as stampErrorBrands } from "./src-WCy6ifGf.mjs";
 import { CORS_IS_POSSIBLE, DefaultJsonSchemaValidator } from "@modelcontextprotocol/client/_shims";
 import pkceChallenge from "pkce-challenge";
 import { EventSource } from "eventsource";
@@ -989,12 +989,13 @@ async function discoverOAuthProtectedResourceMetadata(serverUrl, opts, fetchFn =
 * error object alone, so the swallow-and-fallthrough heuristic is preserved there.
 */
 async function fetchWithCorsRetry(url, headers, fetchFn = fetch) {
+	const withinOrigin = fetchWithinOrigin(fetchFn);
 	try {
-		return await fetchFn(url, { headers });
+		return await withinOrigin(url, { headers });
 	} catch (error) {
 		if (!(error instanceof TypeError) || !CORS_IS_POSSIBLE) throw error;
 		if (headers) try {
-			return await fetchFn(url, {});
+			return await withinOrigin(url, {});
 		} catch (retryError) {
 			if (!(retryError instanceof TypeError)) throw retryError;
 			return;
@@ -1021,7 +1022,7 @@ async function tryMetadataDiscovery(url, protocolVersion, fetchFn = fetch) {
 function shouldAttemptFallback(response, pathname) {
 	if (!response) return true;
 	if (pathname === "/") return false;
-	return response.status >= 400 && response.status < 500 || response.status === 502;
+	return !response.ok && response.status < 500 || response.status === 502;
 }
 /**
 * Generic function for discovering OAuth metadata with fallback support
@@ -1144,7 +1145,7 @@ async function discoverAuthorizationServerMetadata(authorizationServerUrl, { fet
 		continue;
 		if (!response.ok) {
 			await response.text?.().catch(() => {});
-			if (response.status >= 400 && response.status < 500 || response.status === 502) continue;
+			if (response.status < 500 || response.status === 502) continue;
 			throw new Error(`HTTP ${response.status} trying to load ${type === "oauth" ? "OAuth" : "OpenID provider"} metadata from ${endpointUrl}`);
 		}
 		const parsed = type === "oauth" ? OAuthMetadataSchema.parse(await response.json()) : OpenIdProviderDiscoveryMetadataSchema.parse(await response.json());
@@ -1263,7 +1264,7 @@ async function executeTokenRequest(authorizationServerUrl, { metadata, tokenRequ
 			htm: "POST",
 			htu: tokenUrl
 		}));
-		return (fetchFn ?? fetch)(tokenUrl, {
+		return fetchWithinOrigin(fetchFn ?? fetch)(tokenUrl, {
 			method: "POST",
 			headers: requestHeaders,
 			body: tokenRequestParams
@@ -1434,7 +1435,7 @@ async function registerClient(authorizationServerUrl, { metadata, clientMetadata
 		...clientMetadata,
 		...scope === void 0 ? {} : { scope }
 	};
-	const response = await (fetchFn ?? fetch)(registrationUrl, {
+	const response = await fetchWithinOrigin(fetchFn ?? fetch)(registrationUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
 		body: JSON.stringify(submittedMetadata)
@@ -2415,6 +2416,10 @@ function classifyProbeOutcome(outcome, context) {
 		case "rpc-error": return classifyRpcError(outcome, context);
 		case "http-error": return classifyHttpError(outcome, context);
 		case "network-error": return classifyNetworkError(outcome.error, context);
+		case "unusable-reply": return {
+			kind: "error",
+			error: new SdkError(SdkErrorCode.EraNegotiationFailed, `Version negotiation probe failed: the server answered with an unusable reply (${describeError(outcome.error)})`, { cause: outcome.error }, { cause: outcome.error })
+		};
 		case "auth-required": return {
 			kind: "error",
 			error: outcome.error
@@ -2752,6 +2757,11 @@ function buildProbeRequest(id, protocolVersion, clientInfo, capabilities) {
 		}) }
 	};
 }
+/** True for what the transport throws when the probe was answered 2xx without a usable reply. */
+function isUnusableReplyError(error) {
+	if (error instanceof SdkError && error.code === SdkErrorCode.ClientHttpUnexpectedContent) return true;
+	return error instanceof Error && error.name === "SyntaxError";
+}
 function normalizeReply(reply, timeoutMs) {
 	switch (reply.kind) {
 		case "response": return reply.error === void 0 ? {
@@ -2776,6 +2786,10 @@ function normalizeReply(reply, timeoutMs) {
 					statusText: error.data.statusText
 				};
 			}
+			if (isUnusableReplyError(error)) return {
+				kind: "unusable-reply",
+				error
+			};
 			return {
 				kind: "network-error",
 				error
@@ -4426,7 +4440,7 @@ async function requestJwtAuthorizationGrant(options) {
 	});
 	if (clientSecret) params.set("client_secret", clientSecret);
 	if (scope) params.set("scope", scope);
-	const response = await fetchFn(tokenUrl, {
+	const response = await fetchWithinOrigin(fetchFn)(tokenUrl, {
 		method: "POST",
 		headers: { "Content-Type": "application/x-www-form-urlencoded" },
 		body: params.toString()
@@ -4519,7 +4533,7 @@ async function exchangeJwtAuthGrant(options) {
 		client_id: clientId,
 		client_secret: clientSecret
 	}, headers, params);
-	const response = await fetchFn(tokenUrl, {
+	const response = await fetchWithinOrigin(fetchFn)(tokenUrl, {
 		method: "POST",
 		headers,
 		body: params.toString()
@@ -5039,6 +5053,7 @@ var SSEClientTransport = class {
 	_skipIssuerMetadataValidation;
 	_fetch;
 	_fetchWithInit;
+	_redirectPolicy;
 	_dpop;
 	_protocolVersion;
 	onclose;
@@ -5060,9 +5075,21 @@ var SSEClientTransport = class {
 				this._fetch = this._dpop(opts.fetch ?? fetch);
 			}
 		} else this._authProvider = opts?.authProvider;
+		this._redirectPolicy = opts?.redirectPolicy;
 		this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+		if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
 	}
 	_last401Response;
+	_connectAuthRetried = false;
+	/** `baseFetch` with redirects handled as `redirectPolicy` says. */
+	_redirects(baseFetch) {
+		return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+	}
+	/** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+	_unfollowedRedirect(url, response) {
+		const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url, response);
+		return text && `${text} (redirectPolicy: 'same-origin')`;
+	}
 	async _commonHeaders() {
 		const headers = new Headers(this._requestInit?.headers || void 0);
 		let token;
@@ -5077,7 +5104,8 @@ var SSEClientTransport = class {
 	}
 	_startOrAuth() {
 		const eventSourceFetch = this._eventSourceInit?.fetch;
-		const fetchImpl = eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch;
+		const fetchImpl = this._redirects(eventSourceFetch ? this._dpop?.(eventSourceFetch) ?? eventSourceFetch : this._fetch ?? fetch);
+		let redirect;
 		return new Promise((resolve, reject) => {
 			this._eventSource = new EventSource(this._url.href, {
 				...this._eventSourceInit,
@@ -5088,6 +5116,7 @@ var SSEClientTransport = class {
 						...init,
 						headers
 					});
+					redirect = this._unfollowedRedirect(url, response);
 					if (response.status === 401) {
 						this._last401Response = response;
 						if (response.headers.has("www-authenticate")) {
@@ -5102,31 +5131,42 @@ var SSEClientTransport = class {
 			this._abortController = new AbortController();
 			this._eventSource.onerror = (event) => {
 				if (event.code === 401 && this._authProvider) {
-					if (this._authProvider.onUnauthorized && this._last401Response) {
+					if (this._authProvider.onUnauthorized && this._last401Response && !this._connectAuthRetried) {
 						const response = this._last401Response;
 						this._last401Response = void 0;
+						this._connectAuthRetried = true;
 						this._eventSource?.close();
 						this._authProvider.onUnauthorized({
 							response,
 							serverUrl: this._url,
 							fetchFn: this._fetchWithInit
 						}).then(() => this._startOrAuth().then(resolve, reject), (error$2) => {
+							this._connectAuthRetried = false;
 							markAuthSeamEscape(error$2);
 							this.onerror?.(error$2);
 							reject(error$2);
 						});
 						return;
 					}
-					const error$1 = markAuthSeamEscape(new UnauthorizedError());
+					const retried = this._connectAuthRetried;
+					this._connectAuthRetried = false;
+					const error$1 = markAuthSeamEscape(retried ? new SdkHttpError(SdkErrorCode.ClientHttpAuthentication, "Server returned 401 after re-authentication", {
+						status: 401,
+						statusText: this._last401Response?.statusText ?? ""
+					}) : new UnauthorizedError());
+					this._last401Response = void 0;
 					reject(error$1);
 					this.onerror?.(error$1);
 					return;
 				}
-				const error = new SseError(event.code, event.message, event);
+				this._connectAuthRetried = false;
+				const error = new SseError(event.code, redirect ?? event.message, event);
 				reject(error);
 				this.onerror?.(error);
 			};
-			this._eventSource.onopen = () => {};
+			this._eventSource.onopen = () => {
+				this._connectAuthRetried = false;
+			};
 			this._eventSource.addEventListener("endpoint", (event) => {
 				const messageEvent = event;
 				try {
@@ -5193,7 +5233,7 @@ var SSEClientTransport = class {
 				body: JSON.stringify(message),
 				signal: this._abortController?.signal
 			};
-			const response = await (this._fetch ?? fetch)(this._endpoint, init);
+			const response = await this._redirects(this._fetch ?? fetch)(this._endpoint, init);
 			if (!response.ok) {
 				if (response.status === 401 && this._authProvider) {
 					if (response.headers.has("www-authenticate")) {
@@ -5222,7 +5262,7 @@ var SSEClientTransport = class {
 					throw markAuthSeamEscape(new UnauthorizedError());
 				}
 				const text = await response.text?.().catch(() => null);
-				throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${text}`);
+				throw new Error(`Error POSTing to endpoint (HTTP ${response.status}): ${this._unfollowedRedirect(this._endpoint, response) ?? text}`);
 			}
 			await response.text?.().catch(() => {});
 		} catch (error) {
@@ -5307,6 +5347,7 @@ var StreamableHTTPClientTransport = class {
 	_skipIssuerMetadataValidation;
 	_fetch;
 	_fetchWithInit;
+	_redirectPolicy;
 	_sessionId;
 	_reconnectionOptions;
 	_protocolVersion;
@@ -5337,7 +5378,9 @@ var StreamableHTTPClientTransport = class {
 			this._authProvider = adaptOAuthProvider(opts.authProvider, { skipIssuerMetadataValidation: opts.skipIssuerMetadataValidation });
 			if (opts.authProvider.dpop) this._fetch = withDpopFromProvider(opts.authProvider)(opts.fetch ?? fetch);
 		} else this._authProvider = opts?.authProvider;
+		this._redirectPolicy = opts?.redirectPolicy;
 		this._fetchWithInit = createFetchWithInit(opts?.fetch, opts?.requestInit);
+		if (this._redirectPolicy === "follow") this._fetchWithInit = fetchLeavingRedirects(this._fetchWithInit);
 		this._sessionId = opts?.sessionId;
 		this._protocolVersion = opts?.protocolVersion;
 		this._reconnectionOptions = opts?.reconnectionOptions ?? DEFAULT_STREAMABLE_HTTP_RECONNECTION_OPTIONS;
@@ -5389,6 +5432,15 @@ var StreamableHTTPClientTransport = class {
 			skipIssuerMetadataValidation: this._skipIssuerMetadataValidation
 		});
 	}
+	/** `baseFetch` with redirects handled as `redirectPolicy` says. */
+	_redirects(baseFetch) {
+		return this._redirectPolicy === "follow" ? baseFetch : fetchWithinOrigin(baseFetch);
+	}
+	/** Error text for a redirect `response` that was not followed, or `undefined` for any other response. */
+	_unfollowedRedirect(url, response) {
+		const text = this._redirectPolicy === "follow" ? void 0 : unfollowedRedirect(url, response);
+		return text && `${text} (redirectPolicy: 'same-origin')`;
+	}
 	async _commonHeaders() {
 		const headers = new Headers(this._requestInit?.headers || void 0);
 		let token;
@@ -5440,7 +5492,7 @@ var StreamableHTTPClientTransport = class {
 			if (resumptionToken) headers.set("last-event-id", resumptionToken);
 			const transportSignal = this._abortController?.signal;
 			const signal = requestSignal !== void 0 && transportSignal !== void 0 ? anySignal(transportSignal, requestSignal) : requestSignal ?? transportSignal;
-			const response = await (this._fetch ?? fetch)(this._url, {
+			const response = await this._redirects(this._fetch ?? fetch)(this._url, {
 				...this._requestInit,
 				method: "GET",
 				headers,
@@ -5492,7 +5544,8 @@ var StreamableHTTPClientTransport = class {
 					options.onRequestStreamEnd?.();
 					return;
 				}
-				throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${response.statusText}`, {
+				const reason = this._unfollowedRedirect(this._url, response) ?? response.statusText;
+				throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToOpenStream, `Failed to open SSE stream: ${reason}`, {
 					status: response.status,
 					statusText: response.statusText
 				});
@@ -5681,7 +5734,7 @@ var StreamableHTTPClientTransport = class {
 				body: JSON.stringify(message),
 				signal
 			};
-			const response = await (this._fetch ?? fetch)(this._url, init);
+			const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
 			if (isHandshake && response.ok) this._sessionId = response.headers.get("mcp-session-id") || void 0;
 			if (!response.ok) {
 				if (response.status === 401 && this._authProvider) {
@@ -5732,7 +5785,8 @@ var StreamableHTTPClientTransport = class {
 						return;
 					}
 				} catch {}
-				throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${text}`, {
+				const reason = this._unfollowedRedirect(this._url, response) ?? text;
+				throw new SdkHttpError(SdkErrorCode.ClientHttpNotImplemented, `Error POSTing to endpoint: ${reason}`, {
 					status: response.status,
 					statusText: response.statusText,
 					text
@@ -5789,9 +5843,9 @@ var StreamableHTTPClientTransport = class {
 				headers,
 				signal: this._abortController?.signal
 			};
-			const response = await (this._fetch ?? fetch)(this._url, init);
+			const response = await this._redirects(this._fetch ?? fetch)(this._url, init);
 			await response.text?.().catch(() => {});
-			if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${response.statusText}`, {
+			if (!response.ok && response.status !== 405) throw new SdkHttpError(SdkErrorCode.ClientHttpFailedToTerminateSession, `Failed to terminate session: ${this._unfollowedRedirect(this._url, response) ?? response.statusText}`, {
 				status: response.status,
 				statusText: response.statusText
 			});