@zuplo/cli 7.9.8 → 7.9.11

package/node_modules/@inquirer/type/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inquirer/type",
-  "version": "4.1.1",
+  "version": "4.2.0",
   "description": "Inquirer core TS types",
   "keywords": [
     "answer",
@@ -84,5 +84,5 @@
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "gitHead": "5748bd9966b5e175ddf5995ee4cdce6f60c4272e"
+  "gitHead": "a9436bd94d55a439df308f50e77a7cd0b2078e98"
 }

package/node_modules/@modelcontextprotocol/client/README.md

@@ -2,13 +2,7 @@
 
 The MCP (Model Context Protocol) TypeScript client SDK. Build MCP clients that connect to MCP servers.
 
-<!-- prettier-ignore -->
-> [!WARNING]
-> **v2 is the stable release line**, implementing the [2026-07-28 MCP spec](https://modelcontextprotocol.io/specification/2026-07-28). Migrating from v1? Start with the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/).
-
-<!-- prettier-ignore -->
-> [!NOTE]
-> This is **v2** of the MCP TypeScript SDK. It replaces the monolithic `@modelcontextprotocol/sdk` package from v1. See the **[migration guide](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/migration/upgrade-to-v2.md)** if you're coming from v1.
+> **This is v2 of the MCP TypeScript SDK, the stable release line**, implementing the [2026-07-28 MCP spec](https://modelcontextprotocol.io/specification/2026-07-28). It replaces the single `@modelcontextprotocol/sdk` package from v1. Start with the [documentation](https://ts.sdk.modelcontextprotocol.io/v2/); coming from v1, see the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2). Found a problem? [Open an issue](https://github.com/modelcontextprotocol/typescript-sdk/issues/new?template=v2-feedback.yml).
 
 ## Install
 

package/node_modules/@modelcontextprotocol/client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/client",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Model Context Protocol implementation for TypeScript - Client package",
   "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -128,7 +128,7 @@
     "jose": "^6.1.3",
     "pkce-challenge": "^5.0.0",
     "zod": "^4.2.0",
-    "@modelcontextprotocol/core": "2.3.0"
+    "@modelcontextprotocol/core": "2.3.1"
   },
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
@@ -147,7 +147,7 @@
     "typescript-eslint": "^8.48.1",
     "vitest": "^4.0.15",
     "tsdown": "^0.18.0",
-    "@modelcontextprotocol/core-internal": "^2.0.3",
+    "@modelcontextprotocol/core-internal": "^2.0.4",
     "@modelcontextprotocol/tsconfig": "^2.0.0",
     "@modelcontextprotocol/vitest-config": "^2.0.0",
     "@modelcontextprotocol/eslint-config": "^2.0.0",

package/node_modules/@modelcontextprotocol/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/core",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Model Context Protocol for TypeScript — public Zod schemas (spec + OAuth/OpenID)",
   "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",

package/node_modules/@modelcontextprotocol/sdk/README.md

@@ -1,4 +1,10 @@
-# MCP TypeScript SDK [![NPM Version](https://img.shields.io/npm/v/%40modelcontextprotocol%2Fsdk)](https://www.npmjs.com/package/@modelcontextprotocol/sdk) [![MIT licensed](https://img.shields.io/npm/l/%40modelcontextprotocol%2Fsdk)](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/LICENSE)
+# MCP TypeScript SDK [![NPM Version](https://img.shields.io/npm/v/%40modelcontextprotocol%2Fsdk)](https://www.npmjs.com/package/@modelcontextprotocol/sdk) [![MIT licensed](https://img.shields.io/npm/l/%40modelcontextprotocol%2Fsdk)](https://github.com/modelcontextprotocol/typescript-sdk/blob/v1.x/LICENSE)
+
+> **This is v1.x of the MCP TypeScript SDK, the maintenance line.** It implements the MCP spec up to 2025-11-25. Support for the [2026-07-28 spec](https://modelcontextprotocol.io/specification/2026-07-28) is not planned for v1.x: it is in v2, the current stable release, which
+> ships as separate packages, [`@modelcontextprotocol/server`](https://www.npmjs.com/package/@modelcontextprotocol/server) and [`@modelcontextprotocol/client`](https://www.npmjs.com/package/@modelcontextprotocol/client). See the
+> [v2 documentation](https://ts.sdk.modelcontextprotocol.io/v2/) and the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2).
+>
+> **Staying on v1.x?** It continues to receive bug fixes and security updates for at least six months after the v2 release (2026-07-27). The v1 documentation is at <https://ts.sdk.modelcontextprotocol.io/>.
 
 <details>
 <summary>Table of Contents</summary>
@@ -17,7 +23,7 @@
 ## Overview
 
 The Model Context Protocol allows applications to provide context for LLMs in a standardized way, separating the concerns of providing context from the actual LLM interaction. This TypeScript SDK implements
-[the full MCP specification](https://modelcontextprotocol.io/specification/draft), making it easy to:
+[the 2025-11-25 MCP specification](https://modelcontextprotocol.io/specification/2025-11-25), making it easy to:
 
 - Create MCP servers that expose resources, prompts and tools
 - Build MCP clients that can connect to any MCP server

package/node_modules/@modelcontextprotocol/sdk/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@modelcontextprotocol/sdk",
-    "version": "1.32.0",
+    "version": "1.32.1",
     "description": "Model Context Protocol implementation for TypeScript",
     "license": "MIT",
     "author": "Anthropic, PBC (https://anthropic.com)",

package/node_modules/@modelcontextprotocol/server/README.md

@@ -2,13 +2,7 @@
 
 The MCP (Model Context Protocol) TypeScript server SDK. Build MCP servers that expose tools, resources, and prompts.
 
-<!-- prettier-ignore -->
-> [!WARNING]
-> **v2 is the stable release line**, implementing the [2026-07-28 MCP spec](https://modelcontextprotocol.io/specification/2026-07-28). Migrating from v1? Start with the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/).
-
-<!-- prettier-ignore -->
-> [!NOTE]
-> This is **v2** of the MCP TypeScript SDK. It replaces the monolithic `@modelcontextprotocol/sdk` package from v1. See the **[migration guide](https://github.com/modelcontextprotocol/typescript-sdk/blob/main/docs/migration/upgrade-to-v2.md)** if you're coming from v1.
+> **This is v2 of the MCP TypeScript SDK, the stable release line**, implementing the [2026-07-28 MCP spec](https://modelcontextprotocol.io/specification/2026-07-28). It replaces the single `@modelcontextprotocol/sdk` package from v1. Start with the [documentation](https://ts.sdk.modelcontextprotocol.io/v2/); coming from v1, see the [migration guide](https://ts.sdk.modelcontextprotocol.io/v2/migration/upgrade-to-v2). Found a problem? [Open an issue](https://github.com/modelcontextprotocol/typescript-sdk/issues/new?template=v2-feedback.yml).
 
 ## Install
 

package/node_modules/@modelcontextprotocol/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/server",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "Model Context Protocol implementation for TypeScript - Server package",
   "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",
@@ -123,7 +123,7 @@
   ],
   "dependencies": {
     "zod": "^4.2.0",
-    "@modelcontextprotocol/core": "2.3.0"
+    "@modelcontextprotocol/core": "2.3.1"
   },
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
@@ -141,7 +141,7 @@
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.1",
     "vitest": "^4.0.15",
-    "@modelcontextprotocol/core-internal": "^2.0.3",
+    "@modelcontextprotocol/core-internal": "^2.0.4",
     "@modelcontextprotocol/eslint-config": "^2.0.0",
     "@modelcontextprotocol/test-helpers": "^2.0.0",
     "@modelcontextprotocol/tsconfig": "^2.0.0",

package/node_modules/@posthog/core/dist/utils/bot-detection.d.ts

@@ -1,6 +1,12 @@
 export declare const DEFAULT_BLOCKED_UA_STRS: string[];
+/** Exposed for tests only. Not part of the public API. */
+export declare function __resetBotDetectionCacheForTests(): void;
 /**
- * Block various web spiders from executing our JS and sending false capturing data
+ * Block various web spiders from executing our JS and sending false capturing data.
+ *
+ * @param ua - User agent string to check
+ * @param customBlockedUserAgents - Additional UA substrings to block
+ * @returns true if the UA matches a known-bot substring
  */
 export declare const isBlockedUA: (ua: string | undefined, customBlockedUserAgents?: string[]) => boolean;
 //# sourceMappingURL=bot-detection.d.ts.map

package/node_modules/@posthog/core/dist/utils/bot-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bot-detection.d.ts","sourceRoot":"","sources":["../../src/utils/bot-detection.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,UAmGnC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,OAAiB,MAAM,GAAG,SAAS,4BAA2B,MAAM,EAAE,KAAQ,OAWrG,CAAA"}
+{"version":3,"file":"bot-detection.d.ts","sourceRoot":"","sources":["../../src/utils/bot-detection.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,uBAAuB,UAmGnC,CAAA;AAeD,0DAA0D;AAC1D,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD;AAaD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,OAAiB,MAAM,GAAG,SAAS,4BAA2B,MAAM,EAAE,KAAQ,OAsBrG,CAAA"}

package/node_modules/@posthog/core/dist/utils/bot-detection.js

@@ -106,22 +106,42 @@ const DEFAULT_BLOCKED_UA_STRS = [
     'google-inspectiontool',
     'bytespider'
 ];
+const UA_CACHE = new Map();
+const MAX_CACHE_ENTRIES = 256;
+function __resetBotDetectionCacheForTests() {
+    UA_CACHE.clear();
+}
+function buildCacheKey(ua, custom) {
+    let customEncoded = '';
+    for(let i = 0; i < custom.length; i++){
+        const c = custom[i];
+        customEncoded += c.length + ':' + c;
+    }
+    return ua.length + ':' + ua + '|' + custom.length + ':' + customEncoded;
+}
 const isBlockedUA = function(ua, customBlockedUserAgents = []) {
     if (!ua) return false;
+    const key = buildCacheKey(ua, customBlockedUserAgents);
+    const cached = UA_CACHE.get(key);
+    if (void 0 !== cached) return cached;
     const uaLower = ua.toLowerCase();
-    return DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA)=>{
-        const blockedUaLower = blockedUA.toLowerCase();
-        return -1 !== uaLower.indexOf(blockedUaLower);
-    });
+    const result = DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA)=>-1 !== uaLower.indexOf(blockedUA.toLowerCase()));
+    if (UA_CACHE.size >= MAX_CACHE_ENTRIES) UA_CACHE.clear();
+    UA_CACHE.set(key, result);
+    return result;
 };
-__webpack_require__.d(__webpack_exports__, {}, {
+__webpack_require__.d(__webpack_exports__, {
+    __resetBotDetectionCacheForTests: ()=>__resetBotDetectionCacheForTests
+}, {
     DEFAULT_BLOCKED_UA_STRS: DEFAULT_BLOCKED_UA_STRS,
     isBlockedUA: isBlockedUA
 });
 exports.DEFAULT_BLOCKED_UA_STRS = __webpack_exports__.DEFAULT_BLOCKED_UA_STRS;
+exports.__resetBotDetectionCacheForTests = __webpack_exports__.__resetBotDetectionCacheForTests;
 exports.isBlockedUA = __webpack_exports__.isBlockedUA;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "DEFAULT_BLOCKED_UA_STRS",
+    "__resetBotDetectionCacheForTests",
     "isBlockedUA"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/node_modules/@posthog/core/dist/utils/bot-detection.mjs

@@ -77,12 +77,28 @@ const DEFAULT_BLOCKED_UA_STRS = [
     'google-inspectiontool',
     'bytespider'
 ];
+const UA_CACHE = new Map();
+const MAX_CACHE_ENTRIES = 256;
+function __resetBotDetectionCacheForTests() {
+    UA_CACHE.clear();
+}
+function buildCacheKey(ua, custom) {
+    let customEncoded = '';
+    for(let i = 0; i < custom.length; i++){
+        const c = custom[i];
+        customEncoded += c.length + ':' + c;
+    }
+    return ua.length + ':' + ua + '|' + custom.length + ':' + customEncoded;
+}
 const isBlockedUA = function(ua, customBlockedUserAgents = []) {
     if (!ua) return false;
+    const key = buildCacheKey(ua, customBlockedUserAgents);
+    const cached = UA_CACHE.get(key);
+    if (void 0 !== cached) return cached;
     const uaLower = ua.toLowerCase();
-    return DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA)=>{
-        const blockedUaLower = blockedUA.toLowerCase();
-        return -1 !== uaLower.indexOf(blockedUaLower);
-    });
+    const result = DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA)=>-1 !== uaLower.indexOf(blockedUA.toLowerCase()));
+    if (UA_CACHE.size >= MAX_CACHE_ENTRIES) UA_CACHE.clear();
+    UA_CACHE.set(key, result);
+    return result;
 };
-export { DEFAULT_BLOCKED_UA_STRS, isBlockedUA };
+export { DEFAULT_BLOCKED_UA_STRS, __resetBotDetectionCacheForTests, isBlockedUA };

package/node_modules/@posthog/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/core",
-  "version": "1.55.3",
+  "version": "1.56.0",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },

package/node_modules/@posthog/core/src/utils/bot-detection.spec.ts

@@ -0,0 +1,100 @@
+import { DEFAULT_BLOCKED_UA_STRS, isBlockedUA, __resetBotDetectionCacheForTests } from './bot-detection'
+
+beforeEach(() => {
+  __resetBotDetectionCacheForTests()
+})
+
+const REAL_CHROME_UAS = [
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.7499.193 Safari/537.36',
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.199 Safari/537.36',
+  'Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/123.0.6312.122 Mobile/15E148 Safari/604.1',
+  'Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36',
+  // Chrome 154 and 155 stable — released 2026-09.
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.8037.58 Safari/537.36',
+  'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.8059.12 Safari/537.36',
+]
+
+describe('DEFAULT_BLOCKED_UA_STRS', () => {
+  it('contains at least 50 entries', () => {
+    expect(DEFAULT_BLOCKED_UA_STRS.length).toBeGreaterThan(50)
+  })
+
+  it('contains critical entries', () => {
+    expect(DEFAULT_BLOCKED_UA_STRS).toContain('googlebot')
+    expect(DEFAULT_BLOCKED_UA_STRS).toContain('headlesschrome')
+    expect(DEFAULT_BLOCKED_UA_STRS).toContain('bot/')
+  })
+})
+
+describe('isBlockedUA', () => {
+  it('returns false for undefined ua', () => {
+    expect(isBlockedUA(undefined)).toBe(false)
+  })
+
+  it('returns false for real Chrome UAs (including Chrome 154 and 155)', () => {
+    for (const ua of REAL_CHROME_UAS) {
+      expect(isBlockedUA(ua)).toBe(false)
+    }
+  })
+
+  it('returns true for known bot substrings', () => {
+    expect(isBlockedUA('Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)')).toBe(true)
+    expect(isBlockedUA('Mozilla/5.0 bingbot/2.0')).toBe(true)
+    expect(isBlockedUA('headlessChrome/119.0')).toBe(true)
+  })
+
+  it('is case-insensitive on the UA input', () => {
+    const bot = 'Mozilla/5.0 (compatible; Googlebot/2.1)'
+    expect(isBlockedUA(bot)).toBe(true)
+    expect(isBlockedUA(bot.toLowerCase())).toBe(true)
+    expect(isBlockedUA(bot.toUpperCase())).toBe(true)
+  })
+
+  it('accepts customBlockedUserAgents', () => {
+    expect(isBlockedUA('custombot', ['custombot'])).toBe(true)
+    expect(isBlockedUA('custombot', [])).toBe(false)
+  })
+})
+
+describe('isBlockedUA session memoization', () => {
+  it('returns the same result on repeated calls with identical inputs', () => {
+    const ua = REAL_CHROME_UAS[0]
+    const first = isBlockedUA(ua)
+    const second = isBlockedUA(ua)
+    expect(second).toBe(first)
+  })
+
+  it('cache is bucketed per customBlockedUserAgents list', () => {
+    const ua = 'Mozilla/5.0 custombot'
+    expect(isBlockedUA(ua, [])).toBe(false)
+    expect(isBlockedUA(ua, ['custombot'])).toBe(true)
+    expect(isBlockedUA(ua, [])).toBe(false)
+  })
+
+  it('__resetBotDetectionCacheForTests wipes the cache', () => {
+    isBlockedUA(REAL_CHROME_UAS[0])
+    __resetBotDetectionCacheForTests()
+    // Still correct after reset; this just proves the reset doesn't corrupt state.
+    expect(isBlockedUA(REAL_CHROME_UAS[0])).toBe(false)
+  })
+
+  it('handles a burst of many distinct UAs without breaking correctness', () => {
+    for (let i = 0; i < 500; i++) {
+      const ua = `Mozilla/5.0 (burst-${i}) AppleWebKit/537.36`
+      expect(isBlockedUA(ua)).toBe(false)
+    }
+  })
+})
+
+describe('isBlockedUA cache-key delimiter injection', () => {
+  it('does not collide when custom list contains delimiter bytes', () => {
+    const ua = 'MyAgent/1.0'
+    // Length-prefixed keys mean embedded ':' or '|' in list entries cannot
+    // forge a key that aliases another (ua, custom[]) pair.
+    const a = isBlockedUA(ua, ['foo:1', 'bar'])
+    const b = isBlockedUA(ua, ['foo', '1:bar'])
+    // Both lookups are independent cache slots and both correctly return false.
+    expect(a).toBe(false)
+    expect(b).toBe(false)
+  })
+})

package/node_modules/@posthog/core/src/utils/bot-detection.ts

@@ -102,17 +102,61 @@ export const DEFAULT_BLOCKED_UA_STRS = [
 ]
 
 /**
- * Block various web spiders from executing our JS and sending false capturing data
+ * Session-level memoization for isBlockedUA.
+ *
+ * navigator.userAgent is constant across all events captured in a browser
+ * session, and PostHog's autocapture path calls isBlockedUA on every event.
+ * Memoizing the boolean result turns an O(N) substring-scan over all N events
+ * into O(1) after the first lookup. The map is keyed on (ua, customBlockedUserAgents)
+ * — a config change yields a fresh slot. If the cache grows past MAX_CACHE_ENTRIES
+ * we drop it entirely (healthy sessions see O(1) distinct keys).
+ */
+const UA_CACHE = new Map<string, boolean>()
+const MAX_CACHE_ENTRIES = 256
+
+/** Exposed for tests only. Not part of the public API. */
+export function __resetBotDetectionCacheForTests(): void {
+  UA_CACHE.clear()
+}
+
+function buildCacheKey(ua: string, custom: string[]): string {
+  // Length-prefixed encoding is collision-free regardless of what bytes
+  // appear inside ua or custom entries.
+  let customEncoded = ''
+  for (let i = 0; i < custom.length; i++) {
+    const c = custom[i]
+    customEncoded += c.length + ':' + c
+  }
+  return ua.length + ':' + ua + '|' + custom.length + ':' + customEncoded
+}
+
+/**
+ * Block various web spiders from executing our JS and sending false capturing data.
+ *
+ * @param ua - User agent string to check
+ * @param customBlockedUserAgents - Additional UA substrings to block
+ * @returns true if the UA matches a known-bot substring
  */
 export const isBlockedUA = function (ua: string | undefined, customBlockedUserAgents: string[] = []): boolean {
   if (!ua) {
     return false
   }
 
+  const key = buildCacheKey(ua, customBlockedUserAgents)
+  const cached = UA_CACHE.get(key)
+  if (cached !== undefined) {
+    return cached
+  }
+
   const uaLower = ua.toLowerCase()
-  return DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA) => {
-    const blockedUaLower = blockedUA.toLowerCase()
+  const result = DEFAULT_BLOCKED_UA_STRS.concat(customBlockedUserAgents).some((blockedUA) => {
     // can't use includes because IE 11 :/
-    return uaLower.indexOf(blockedUaLower) !== -1
+    return uaLower.indexOf(blockedUA.toLowerCase()) !== -1
   })
+
+  if (UA_CACHE.size >= MAX_CACHE_ENTRIES) {
+    UA_CACHE.clear()
+  }
+  UA_CACHE.set(key, result)
+  return result
 }