deadbyte-mcp 0.15.16 → 0.15.18

package/node_modules/@modelcontextprotocol/server/dist/shimsWorkerd.cjs

@@ -1,4 +1,4 @@
-const require_src = require('./src-STyD_Vvf.cjs');
+const require_src = require('./src-CgFsfg3E.cjs');
 const require_cfWorkerProvider = require('./cfWorkerProvider-BwbPzsdI.cjs');
 
 //#region src/shimsWorkerd.ts

package/node_modules/@modelcontextprotocol/server/dist/shimsWorkerd.mjs

@@ -1,4 +1,4 @@
-import { n as preloadSchemas } from "./src-CX2iR2pK.mjs";
+import { n as preloadSchemas } from "./src-D-y6h4N7.mjs";
 import { t as CfWorkerJsonSchemaValidator } from "./cfWorkerProvider-p3WaZPqB.mjs";
 
 //#region src/shimsWorkerd.ts

package/node_modules/@modelcontextprotocol/server/dist/{src-STyD_Vvf.cjs → src-CgFsfg3E.cjs}

@@ -177,6 +177,16 @@ let OAuthErrorCode = /* @__PURE__ */ function(OAuthErrorCode$1) {
 	* The requested resource is invalid, missing, unknown, or malformed. (Custom error for resource indicators - RFC 8707)
 	*/
 	OAuthErrorCode$1["InvalidTarget"] = "invalid_target";
+	/**
+	* The DPoP proof accompanying the request is invalid, or does not match the key the grant
+	* (e.g. a refresh token) is bound to. (RFC 9449 §5 / §7.1)
+	*/
+	OAuthErrorCode$1["InvalidDpopProof"] = "invalid_dpop_proof";
+	/**
+	* The server requires a server-supplied nonce in the DPoP proof; retry with the `DPoP-Nonce`
+	* it returned. (RFC 9449 §8 / §9)
+	*/
+	OAuthErrorCode$1["UseDpopNonce"] = "use_dpop_nonce";
 	return OAuthErrorCode$1;
 }({});
 /**
@@ -360,8 +370,18 @@ var SdkError = class extends Error {
 		if (typeof this !== "function") throw new TypeError("isInstance must be called on the class (e.g. `SdkError.isInstance(value)`); for callbacks use `v => SdkError.isInstance(v)`");
 		return brandedHasInstance(this, value);
 	}
-	constructor(code, message, data) {
-		super(message);
+	/**
+	* @param code - Stable string code identifying the failure ({@linkcode SdkErrorCode}).
+	* @param message - Human-readable description.
+	* @param data - Optional structured payload (for example the HTTP status carried by
+	* {@linkcode SdkHttpError}). Opaque to the SDK: a `cause` key inside `data` is not
+	* promoted to `Error.cause`.
+	* @param options - Standard `ErrorOptions`, forwarded to `Error`. Pass the underlying
+	* failure as `{ cause }` so it is reachable through the `Error.cause` chain that
+	* loggers and error trackers walk.
+	*/
+	constructor(code, message, data, options) {
+		super(message, options);
 		this.code = code;
 		this.data = data;
 		this.name = "SdkError";
@@ -388,8 +408,11 @@ var SdkHttpError = class extends SdkError {
 	static {
 		Object.defineProperty(this, "mcpBrand", { value: "mcp.SdkHttpError" });
 	}
-	constructor(code, message, data) {
-		super(code, message, data);
+	/**
+	* @param options - Standard `ErrorOptions`, forwarded to `Error` (see {@linkcode SdkError}).
+	*/
+	constructor(code, message, data, options) {
+		super(code, message, data, options);
 		this.name = "SdkHttpError";
 	}
 	get status() {
@@ -4771,9 +4794,15 @@ function paramHeaderMismatchRejection(cell, header, body) {
 *   named revision belongs to (a malformed envelope behind a present claim is
 *   a validation error, never a silent fall back to legacy handling).
 * - A request without a claim is legacy-era traffic.
-* - The `MCP-Protocol-Version` header is a cross-check only: it never
-*   upgrades or downgrades a body-derived classification, and a disagreement
-*   between header and body is an explicit ladder outcome.
+* - The `MCP-Protocol-Version` header is a cross-check only *for
+*   classification*: it never upgrades or downgrades a body-derived
+*   classification, and a disagreement between header and body is an explicit
+*   ladder outcome. Its absence likewise never changes the era — but the spec
+*   requires the header on every modern *request* POST, so a
+*   modern-classified request that omits it is refused one rung later, by
+*   {@linkcode validateStandardRequestHeaders}, not here. Notification POSTs
+*   are exempt (see the next bullet), and that rung enforces presence on
+*   requests only.
 * - Notifications carry no envelope claim of their own under the current
 *   spec, so for notification POSTs without a body claim the modern header is
 *   determinative; the `Mcp-Method` header is validated against the body when
@@ -4901,7 +4930,7 @@ const INBOUND_VALIDATION_LADDER = [
 		evaluatedAt: "pre-dispatch",
 		codes: [HEADER_MISMATCH_ERROR_CODE],
 		conformance: ["http-header-validation"],
-		rationale: "SEP-2243 standard `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
+		rationale: "SEP-2243 standard `MCP-Protocol-Version` / `Mcp-Method` / `Mcp-Name` headers — presence, sentinel decoding, and `Mcp-Name` ↔ body cross-check — are validated by the HTTP entry on a modern-classified request after the supported-revision gate and before dispatch. The spec requires `MCP-Protocol-Version` and `Mcp-Method` on every modern *request* POST (`Mcp-Name` only for the methods that mirror `params.name` / `params.uri` / `params.taskId`, see `MCP_NAME_HEADER_SOURCE`) and names them in that order, so a request missing several is answered by the earliest. Notification POSTs are exempt: the presence half runs on requests only, so a modern-enveloped notification is dispatched even with no standard headers at all. The classifier’s own header-mismatch cells (protocol-version, `Mcp-Method` mismatch) stay on the edge `era-classification` rung; this rung carries the entry-layer presence/`Mcp-Name` half — including the missing `MCP-Protocol-Version` cell, which cannot live on the edge rung without breaking body-primary classification. Evaluated before the capability gate, the factory call, and the `Mcp-Param-*` rung so a request that fails several rungs is answered by the standard-header rung first. The documented order (after method-registry 5 and request-params 6) is NOT the observed precedence: serveModern evaluates this rung immediately after the supported-revision gate, so a request that also fails a dispatch rung is answered here before the dispatch rungs (5–6) are consulted."
 	},
 	{
 		rung: "client-capabilities",
@@ -4984,15 +5013,51 @@ function crossCheckMismatch(cell, header, body, rung = "era-classification") {
 	} }), true);
 }
 /**
-* The methods whose body carries a `params.name` / `params.uri` value the
-* `Mcp-Name` header must mirror, and which body field supplies it (SEP-2243
-* § Standard Request Headers, `Required For` column).
+* The methods whose body carries a `params.name` / `params.uri` /
+* `params.taskId` value the `Mcp-Name` header must mirror, and which body
+* field supplies it. The core rows come from SEP-2243 § Standard Request
+* Headers (`Required For` column); the `tasks/*` rows come from SEP-2663's
+* Streamable HTTP binding ("the client MUST set the `Mcp-Name` header to the
+* value of `params.taskId`" for `tasks/get` / `tasks/update` /
+* `tasks/cancel`, so intermediaries can route every request for a task to the
+* instance holding its state). Shared by the client transport (header
+* emission) and the server ladder (validation) so both sides derive from one
+* table.
 */
 const MCP_NAME_HEADER_SOURCE = {
 	"tools/call": "name",
 	"prompts/get": "name",
-	"resources/read": "uri"
+	"resources/read": "uri",
+	"tasks/get": "taskId",
+	"tasks/update": "taskId",
+	"tasks/cancel": "taskId"
 };
+/**
+* Resolve the `Mcp-Name` source for one request against
+* {@linkcode MCP_NAME_HEADER_SOURCE}: which body field the header mirrors for
+* `method`, and the string value that field carries in `params`.
+*
+* Returns `undefined` when `method` is off-table (no `Mcp-Name` is emitted or
+* required). Otherwise `value` is the field's string value, or `undefined`
+* when `params` is not a plain object or the field is absent / not a string —
+* the client emits no header then, and the server leaves that body to the
+* rungs further down the ladder.
+*
+* `method` is peer-supplied on the server and caller-supplied on the client,
+* so the table lookup is `Object.hasOwn`-guarded against `Object.prototype`
+* collisions (`constructor`, `toString`, …). Shared by the client transport
+* (emission) and {@linkcode validateStandardRequestHeaders} (validation) so
+* the extraction — not just the table — cannot drift between the two sides.
+*/
+function mcpNameSource(method, params) {
+	const field = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
+	if (field === void 0) return;
+	const raw = isPlainObject$2(params) ? params[field] : void 0;
+	return {
+		field,
+		value: typeof raw === "string" ? raw : void 0
+	};
+}
 /** Strip RFC 9110 optional whitespace (SP / HTAB) around a field value in linear time. */
 function stripHttpOws(value) {
 	let start = 0;
@@ -5020,13 +5085,19 @@ function stripHttpOws(value) {
 * `era-classification` rung for the `MCP-Protocol-Version` and
 * `Mcp-Method` *mismatch* cells) when:
 *
+* - the required `MCP-Protocol-Version` header is absent (SEP-2243 requires it
+*   on every modern *request* POST, and lists it first among the required
+*   standard headers — so a request missing it *and* `Mcp-Method` is answered
+*   by this cell);
 * - the required `Mcp-Method` header is absent;
 * - the required `Mcp-Name` header is absent on a `tools/call`,
-*   `prompts/get`, or `resources/read` request whose body carries the
-*   `params.name` / `params.uri` value the header mirrors;
+*   `prompts/get`, `resources/read`, or (per SEP-2663's Streamable HTTP
+*   binding) `tasks/get` / `tasks/update` / `tasks/cancel` request whose
+*   body carries the `params.name` / `params.uri` / `params.taskId` value
+*   the header mirrors;
 * - the `Mcp-Name` header carries an invalid `=?base64?…?=` sentinel; or
 * - the (decoded) `Mcp-Name` value disagrees with the body's
-*   `params.name` / `params.uri`.
+*   `params.name` / `params.uri` / `params.taskId`.
 *
 * Returns `undefined` (pass) for notifications (the spec table reads
 * "All requests"), for methods that have no `Mcp-Name` source, and when the
@@ -5037,16 +5108,22 @@ function stripHttpOws(value) {
 * call to the classifier (no headers passed) keeps routing a modern request
 * unchanged: the classifier remains a pure body-primary router, and this
 * function is the presence/`Mcp-Name` half of the standard-header rung the
-* entry layers on top.
+* entry layers on top. That separation is what lets the missing
+* `MCP-Protocol-Version` cell live here without disturbing the body-primary
+* rule — classification still resolves from the body (a proxy stripping the
+* header must not change the era), and only this rung refuses to serve it.
 */
 function validateStandardRequestHeaders(request, route) {
 	if (route.messageKind !== "request") return;
 	const method = route.message.method;
+	if (request.protocolVersionHeader === void 0) {
+		const claimed = route.classification.revision;
+		return crossCheckMismatch("version-header-missing", "(missing)", claimed === void 0 ? "the body carries a modern per-request envelope but the required MCP-Protocol-Version header is absent" : `the body envelope names protocol version ${claimed} but the required MCP-Protocol-Version header is absent`, "standard-header-validation");
+	}
 	if (request.mcpMethodHeader === void 0) return crossCheckMismatch("method-header-missing", "(missing)", `the body names method ${method} but the required Mcp-Method header is absent`, "standard-header-validation");
-	const sourceField = Object.hasOwn(MCP_NAME_HEADER_SOURCE, method) ? MCP_NAME_HEADER_SOURCE[method] : void 0;
-	if (sourceField === void 0) return;
-	const sourceValue = route.message.params?.[sourceField];
-	const bodyValue = typeof sourceValue === "string" ? sourceValue : void 0;
+	const source = mcpNameSource(method, route.message.params);
+	if (source === void 0) return;
+	const { field: sourceField, value: bodyValue } = source;
 	if (request.mcpNameHeader === void 0) {
 		if (bodyValue === void 0) return;
 		return crossCheckMismatch("name-header-missing", "(missing)", `the body carries params.${sourceField}="${bodyValue}" but the required Mcp-Name header is absent`, "standard-header-validation");
@@ -6248,7 +6325,7 @@ var Protocol = class {
 		return this._requestHandlers.get(method);
 	}
 	async _oncancel(notification) {
-		if (!notification.params.requestId) return;
+		if (notification.params.requestId === void 0) return;
 		this._requestHandlerAbortControllers.get(notification.params.requestId)?.abort(notification.params.reason);
 	}
 	_setupTimeout(messageId, timeout, maxTotalTimeout, onTimeout, resetTimeoutOnProgress = false) {
@@ -6647,19 +6724,20 @@ var Protocol = class {
 			const cancel = (reason) => {
 				if (responseReceived) return;
 				this._progressHandlers.delete(messageId);
-				if (requestAbort === void 0) this._transport?.send(this._envelopeOutbound({
-					jsonrpc: "2.0",
-					method: "notifications/cancelled",
-					params: {
-						requestId: messageId,
-						reason: String(reason)
-					}
-				}), {
-					relatedRequestId,
-					resumptionToken,
-					onresumptiontoken
-				}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
-				else requestAbort.abort();
+				if (requestAbort === void 0) {
+					if (request.method !== "initialize") this._transport?.send(this._envelopeOutbound({
+						jsonrpc: "2.0",
+						method: "notifications/cancelled",
+						params: {
+							requestId: messageId,
+							reason: String(reason)
+						}
+					}), {
+						relatedRequestId,
+						resumptionToken,
+						onresumptiontoken
+					}).catch((error) => this._onerror(/* @__PURE__ */ new Error(`Failed to send cancellation: ${error}`)));
+				} else requestAbort.abort();
 				reject(reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason)));
 			};
 			this._responseHandlers.set(messageId, (response) => {
@@ -6739,7 +6817,7 @@ var Protocol = class {
 			jsonrpc: "2.0",
 			...notification
 		});
-		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && !options?.relatedRequestId) {
+		if ((this._options?.debouncedNotificationMethods ?? []).includes(notification.method) && !notification.params && options?.relatedRequestId === void 0) {
 			if (this._pendingDebouncedNotifications.has(notification.method)) return;
 			this._pendingDebouncedNotifications.add(notification.method);
 			Promise.resolve().then(() => {
@@ -8101,4 +8179,4 @@ Object.defineProperty(exports, 'withRequestStateValue', {
     return withRequestStateValue;
   }
 });
-//# sourceMappingURL=src-STyD_Vvf.cjs.map
+//# sourceMappingURL=src-CgFsfg3E.cjs.map