maka-agent 0.2.2-dev.92.20261019 → 0.2.2-dev.98.20261024

package/node_modules/@modelcontextprotocol/client/dist/shimsWorkerd.cjs

@@ -1,4 +1,4 @@
-const require_src = require('./src-oZBjf3U1.cjs');
+const require_src = require('./src-DpAS0jfg.cjs');
 const require_cfWorkerProvider = require('./cfWorkerProvider-B3dvjU3F.cjs');
 
 //#region src/shimsWorkerd.ts

package/node_modules/@modelcontextprotocol/client/dist/shimsWorkerd.mjs

@@ -1,4 +1,4 @@
-import { n as preloadSchemas } from "./src-xKF0PJN-.mjs";
+import { n as preloadSchemas } from "./src-WCy6ifGf.mjs";
 import { t as CfWorkerJsonSchemaValidator } from "./cfWorkerProvider-BylNJ1R5.mjs";
 
 //#region src/shimsWorkerd.ts

package/node_modules/@modelcontextprotocol/client/dist/{src-oZBjf3U1.cjs → src-DpAS0jfg.cjs}

@@ -3072,7 +3072,7 @@ function build() {
 	const subscriptionsListenParamsShape = { notifications: SubscriptionFilterSchema$1 };
 	const SubscriptionsListenRequestSchema$1 = wireRequest("subscriptions/listen", subscriptionsListenParamsShape);
 	/**
-	* Anchor SubscriptionsListenResultMeta — required subscriptionId stamp on
+	* Anchor SubscriptionsListenResultMetaObject — required subscriptionId stamp on
 	* the graceful-close result. Extends `ResultMetaObject` since spec PR
 	* #3002 (composed, so the serverInfo key and its leniency stay single-sourced).
 	*/
@@ -3345,7 +3345,8 @@ function build() {
 		ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
 		ReadResourceResultResponseSchema: wireResultResponse(zod_v4.union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
 		CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+		SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
 	};
 }
 let memo;
@@ -4093,6 +4094,10 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
 	return ALL_CODECS.some((codec) => codec.hasNotificationMethod(method));
 }
+/** The names SEP-2663 re-defines for the Tasks extension on the era that removed them from core. */
+function isExtensionReusedRequestMethod(method) {
+	return method === "tasks/get" || method === "tasks/cancel";
+}
 const ALL_CODECS = [rev2025Codec, rev2026Codec];
 
 //#endregion
@@ -5029,13 +5034,14 @@ function buildInputRequired(spec) {
 * @example Write-once tool requesting confirmation
 * ```ts
 * server.registerTool('deploy', { inputSchema: z.object({ env: z.string() }) }, async ({ env }, ctx) => {
-*     const confirmed = acceptedContent<{ confirm: boolean }>(ctx.mcpReq.inputResponses, 'confirm');
-*     if (!confirmed) {
+*     const confirmationSchema = z.object({ confirm: z.boolean() });
+*     const confirmed = acceptedContent(ctx.mcpReq.inputResponses, 'confirm', confirmationSchema);
+*     if (confirmed?.confirm !== true) {
 *         return inputRequired({
 *             inputRequests: {
 *                 confirm: inputRequired.elicit({
 *                     message: `Deploy to ${env}?`,
-*                     requestedSchema: { type: 'object', properties: { confirm: { type: 'boolean' } }, required: ['confirm'] }
+*                     requestedSchema: confirmationSchema
 *                 })
 *             }
 *         });
@@ -5662,6 +5668,8 @@ var Protocol = class {
 	_transport;
 	_requestMessageId = 0;
 	_requestHandlers = /* @__PURE__ */ new Map();
+	/** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+	_customSchemaRequestMethods = /* @__PURE__ */ new Set();
 	_requestHandlerAbortControllers = /* @__PURE__ */ new Map();
 	_notificationHandlers = /* @__PURE__ */ new Map();
 	_responseHandlers = /* @__PURE__ */ new Map();
@@ -5943,7 +5951,7 @@ var Protocol = class {
 				return;
 			}
 		}
-		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method)) {
+		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
 			sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
 			return;
 		}
@@ -6076,8 +6084,11 @@ var Protocol = class {
 	}
 	request(request, schemaOrOptions, maybeOptions) {
 		const codec = this._resolveOutboundCodec(request.method);
+		if (isStandardSchema(schemaOrOptions)) {
+			if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec, request.method);
+			return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
+		}
 		this._assertOutboundRequestInEra(codec, request.method);
-		if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
 		const validate = codecResultValidator(codec, request.method);
 		if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
 		return this._requestWithSchemaViaCodec(codec, request, validate, schemaOrOptions);
@@ -6322,6 +6333,8 @@ var Protocol = class {
 			return maybeHandler(parsed.data, ctx);
 		};
 		else throw new TypeError("setRequestHandler: handler is required");
+		if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+		else this._customSchemaRequestMethods.add(method);
 		this._requestHandlers.set(method, this._wrapHandler(method, stored));
 	}
 	/**
@@ -6350,6 +6363,7 @@ var Protocol = class {
 	*/
 	removeRequestHandler(method) {
 		this._requestHandlers.delete(method);
+		this._customSchemaRequestMethods.delete(method);
 	}
 	/**
 	* Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -6813,6 +6827,71 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
 		});
 	};
 }
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const MAX_REDIRECTS = 5;
+/** Whether `to` has the scheme, host and port of `from`, or is its https form with both on the default port. */
+function isWithinOrigin(from, to) {
+	if (from.protocol === to.protocol && from.host === to.host) return true;
+	return from.protocol === "http:" && to.protocol === "https:" && from.hostname === to.hostname && !from.port && !to.port;
+}
+/** The URL that a redirect `response` to a request for `url` points at, if it names one. */
+function redirectTarget(url, response) {
+	const location = REDIRECT_STATUSES.has(response.status) ? response.headers?.get("location") : void 0;
+	if (!location) return void 0;
+	try {
+		return new URL(location, url);
+	} catch {
+		return;
+	}
+}
+const leftToFetch = /* @__PURE__ */ new WeakSet();
+/** A copy of `baseFetch` that `fetchWithinOrigin` returns as it is, which leaves redirects to `baseFetch`. */
+function fetchLeavingRedirects(baseFetch) {
+	const copy = (url, init) => baseFetch(url, init);
+	leftToFetch.add(copy);
+	return copy;
+}
+/** Wraps `baseFetch` to follow a redirect only when it keeps the method and stays within the origin of the request. */
+function fetchWithinOrigin(baseFetch) {
+	if (leftToFetch.has(baseFetch)) return baseFetch;
+	return async (url, init) => {
+		if (init?.redirect === "error" || init?.redirect === "manual") return baseFetch(url, init);
+		const method = (init?.method ?? "GET").toUpperCase();
+		let current = url;
+		for (let followed = 0;; followed++) {
+			const response = await baseFetch(current, {
+				...init,
+				redirect: "manual"
+			});
+			const target = redirectTarget(current, response);
+			if (!target || followed === MAX_REDIRECTS) return response;
+			const from = new URL(current);
+			const keepsMethod = method === "GET" || response.status === 307 || response.status === 308;
+			const keepsUserinfo = !(target.username || target.password) || target.username === from.username && target.password === from.password;
+			if (!keepsMethod || !keepsUserinfo || !isWithinOrigin(from, target)) return response;
+			await response.text?.().catch(() => {});
+			current = target;
+		}
+	};
+}
+/** Error text for a redirect `response` to a request for `url` that was not followed, or `undefined` for any other response. */
+function unfollowedRedirect(url, response) {
+	if (response.type === "opaqueredirect") return "Redirect not followed: this runtime does not expose where it points";
+	const target = redirectTarget(response.url || url, response);
+	if (!target) return void 0;
+	target.username = target.password = target.search = target.hash = "";
+	if (target.protocol === "http:" && new URL(response.url || url).protocol === "https:") {
+		target.protocol = "https:";
+		return `Redirect from https to plain http not followed; try ${target.href} as the endpoint`;
+	}
+	return `Redirect to ${target.href} not followed; use that URL as the endpoint if it is the intended server`;
+}
 
 //#endregion
 //#region ../core-internal/src/shared/uriTemplate.ts
@@ -7343,6 +7422,18 @@ Object.defineProperty(exports, 'encodeMcpParamValue', {
     return encodeMcpParamValue;
   }
 });
+Object.defineProperty(exports, 'fetchLeavingRedirects', {
+  enumerable: true,
+  get: function () {
+    return fetchLeavingRedirects;
+  }
+});
+Object.defineProperty(exports, 'fetchWithinOrigin', {
+  enumerable: true,
+  get: function () {
+    return fetchWithinOrigin;
+  }
+});
 Object.defineProperty(exports, 'fromJsonSchema', {
   enumerable: true,
   get: function () {
@@ -7523,6 +7614,12 @@ Object.defineProperty(exports, 'stampErrorBrands', {
     return stampErrorBrands;
   }
 });
+Object.defineProperty(exports, 'unfollowedRedirect', {
+  enumerable: true,
+  get: function () {
+    return unfollowedRedirect;
+  }
+});
 Object.defineProperty(exports, 'withInputRequired', {
   enumerable: true,
   get: function () {
@@ -7535,4 +7632,4 @@ Object.defineProperty(exports, 'withoutIssuer', {
     return withoutIssuer;
   }
 });
-//# sourceMappingURL=src-oZBjf3U1.cjs.map
+//# sourceMappingURL=src-DpAS0jfg.cjs.map

package/node_modules/@modelcontextprotocol/client/dist/{src-xKF0PJN-.mjs → src-WCy6ifGf.mjs}

@@ -3071,7 +3071,7 @@ function build() {
 	const subscriptionsListenParamsShape = { notifications: SubscriptionFilterSchema$1 };
 	const SubscriptionsListenRequestSchema$1 = wireRequest("subscriptions/listen", subscriptionsListenParamsShape);
 	/**
-	* Anchor SubscriptionsListenResultMeta — required subscriptionId stamp on
+	* Anchor SubscriptionsListenResultMetaObject — required subscriptionId stamp on
 	* the graceful-close result. Extends `ResultMetaObject` since spec PR
 	* #3002 (composed, so the serverInfo key and its leniency stay single-sourced).
 	*/
@@ -3344,7 +3344,8 @@ function build() {
 		ListResourceTemplatesResultResponseSchema: wireResultResponse(ListResourceTemplatesResultSchema$1),
 		ReadResourceResultResponseSchema: wireResultResponse(z.union([ReadResourceResultSchema$1, InputRequiredResultSchema])),
 		CompleteResultResponseSchema: wireResultResponse(CompleteResultSchema$1),
-		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1)
+		DiscoverResultResponseSchema: wireResultResponse(DiscoverResultSchema$1),
+		SubscriptionsListenResultResponseSchema: wireResultResponse(SubscriptionsListenResultSchema$1)
 	};
 }
 let memo;
@@ -4092,6 +4093,10 @@ function isSpecRequestMethod(method) {
 function isSpecNotificationMethod(method) {
 	return ALL_CODECS.some((codec) => codec.hasNotificationMethod(method));
 }
+/** The names SEP-2663 re-defines for the Tasks extension on the era that removed them from core. */
+function isExtensionReusedRequestMethod(method) {
+	return method === "tasks/get" || method === "tasks/cancel";
+}
 const ALL_CODECS = [rev2025Codec, rev2026Codec];
 
 //#endregion
@@ -5028,13 +5033,14 @@ function buildInputRequired(spec) {
 * @example Write-once tool requesting confirmation
 * ```ts
 * server.registerTool('deploy', { inputSchema: z.object({ env: z.string() }) }, async ({ env }, ctx) => {
-*     const confirmed = acceptedContent<{ confirm: boolean }>(ctx.mcpReq.inputResponses, 'confirm');
-*     if (!confirmed) {
+*     const confirmationSchema = z.object({ confirm: z.boolean() });
+*     const confirmed = acceptedContent(ctx.mcpReq.inputResponses, 'confirm', confirmationSchema);
+*     if (confirmed?.confirm !== true) {
 *         return inputRequired({
 *             inputRequests: {
 *                 confirm: inputRequired.elicit({
 *                     message: `Deploy to ${env}?`,
-*                     requestedSchema: { type: 'object', properties: { confirm: { type: 'boolean' } }, required: ['confirm'] }
+*                     requestedSchema: confirmationSchema
 *                 })
 *             }
 *         });
@@ -5661,6 +5667,8 @@ var Protocol = class {
 	_transport;
 	_requestMessageId = 0;
 	_requestHandlers = /* @__PURE__ */ new Map();
+	/** Methods registered with an explicit schema; the era gate in `_onrequest` reads it for the Tasks extension names. */
+	_customSchemaRequestMethods = /* @__PURE__ */ new Set();
 	_requestHandlerAbortControllers = /* @__PURE__ */ new Map();
 	_notificationHandlers = /* @__PURE__ */ new Map();
 	_responseHandlers = /* @__PURE__ */ new Map();
@@ -5942,7 +5950,7 @@ var Protocol = class {
 				return;
 			}
 		}
-		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method)) {
+		if (isSpecRequestMethod(request.method) && !codec.hasRequestMethod(request.method) && !(isExtensionReusedRequestMethod(request.method) && this._customSchemaRequestMethods.has(request.method))) {
 			sendErrorResponse(ProtocolErrorCode.MethodNotFound, "Method not found");
 			return;
 		}
@@ -6075,8 +6083,11 @@ var Protocol = class {
 	}
 	request(request, schemaOrOptions, maybeOptions) {
 		const codec = this._resolveOutboundCodec(request.method);
+		if (isStandardSchema(schemaOrOptions)) {
+			if (!isExtensionReusedRequestMethod(request.method)) this._assertOutboundRequestInEra(codec, request.method);
+			return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
+		}
 		this._assertOutboundRequestInEra(codec, request.method);
-		if (isStandardSchema(schemaOrOptions)) return this._requestWithSchemaViaCodec(codec, request, schemaOrOptions, maybeOptions);
 		const validate = codecResultValidator(codec, request.method);
 		if (validate === void 0) throw new TypeError(`'${request.method}' is not a spec method; pass a result schema as the second argument to request().`);
 		return this._requestWithSchemaViaCodec(codec, request, validate, schemaOrOptions);
@@ -6321,6 +6332,8 @@ var Protocol = class {
 			return maybeHandler(parsed.data, ctx);
 		};
 		else throw new TypeError("setRequestHandler: handler is required");
+		if (typeof schemasOrHandler === "function") this._customSchemaRequestMethods.delete(method);
+		else this._customSchemaRequestMethods.add(method);
 		this._requestHandlers.set(method, this._wrapHandler(method, stored));
 	}
 	/**
@@ -6349,6 +6362,7 @@ var Protocol = class {
 	*/
 	removeRequestHandler(method) {
 		this._requestHandlers.delete(method);
+		this._customSchemaRequestMethods.delete(method);
 	}
 	/**
 	* Asserts that a request handler has not already been set for the given method, in preparation for a new one being automatically installed.
@@ -6812,6 +6826,71 @@ function createFetchWithInit(baseFetch = fetch, baseInit) {
 		});
 	};
 }
+const REDIRECT_STATUSES = new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const MAX_REDIRECTS = 5;
+/** Whether `to` has the scheme, host and port of `from`, or is its https form with both on the default port. */
+function isWithinOrigin(from, to) {
+	if (from.protocol === to.protocol && from.host === to.host) return true;
+	return from.protocol === "http:" && to.protocol === "https:" && from.hostname === to.hostname && !from.port && !to.port;
+}
+/** The URL that a redirect `response` to a request for `url` points at, if it names one. */
+function redirectTarget(url, response) {
+	const location = REDIRECT_STATUSES.has(response.status) ? response.headers?.get("location") : void 0;
+	if (!location) return void 0;
+	try {
+		return new URL(location, url);
+	} catch {
+		return;
+	}
+}
+const leftToFetch = /* @__PURE__ */ new WeakSet();
+/** A copy of `baseFetch` that `fetchWithinOrigin` returns as it is, which leaves redirects to `baseFetch`. */
+function fetchLeavingRedirects(baseFetch) {
+	const copy = (url, init) => baseFetch(url, init);
+	leftToFetch.add(copy);
+	return copy;
+}
+/** Wraps `baseFetch` to follow a redirect only when it keeps the method and stays within the origin of the request. */
+function fetchWithinOrigin(baseFetch) {
+	if (leftToFetch.has(baseFetch)) return baseFetch;
+	return async (url, init) => {
+		if (init?.redirect === "error" || init?.redirect === "manual") return baseFetch(url, init);
+		const method = (init?.method ?? "GET").toUpperCase();
+		let current = url;
+		for (let followed = 0;; followed++) {
+			const response = await baseFetch(current, {
+				...init,
+				redirect: "manual"
+			});
+			const target = redirectTarget(current, response);
+			if (!target || followed === MAX_REDIRECTS) return response;
+			const from = new URL(current);
+			const keepsMethod = method === "GET" || response.status === 307 || response.status === 308;
+			const keepsUserinfo = !(target.username || target.password) || target.username === from.username && target.password === from.password;
+			if (!keepsMethod || !keepsUserinfo || !isWithinOrigin(from, target)) return response;
+			await response.text?.().catch(() => {});
+			current = target;
+		}
+	};
+}
+/** Error text for a redirect `response` to a request for `url` that was not followed, or `undefined` for any other response. */
+function unfollowedRedirect(url, response) {
+	if (response.type === "opaqueredirect") return "Redirect not followed: this runtime does not expose where it points";
+	const target = redirectTarget(response.url || url, response);
+	if (!target) return void 0;
+	target.username = target.password = target.search = target.hash = "";
+	if (target.protocol === "http:" && new URL(response.url || url).protocol === "https:") {
+		target.protocol = "https:";
+		return `Redirect from https to plain http not followed; try ${target.href} as the endpoint`;
+	}
+	return `Redirect to ${target.href} not followed; use that URL as the endpoint if it is the intended server`;
+}
 
 //#endregion
 //#region ../core-internal/src/shared/uriTemplate.ts
@@ -7160,5 +7239,5 @@ function fromJsonSchema(schema, validator) {
 }
 
 //#endregion
-export { legacyProtocolVersions as $, isInitializeRequest as A, SdkError as At, DiscoverResultSchema as B, mcpNameSource as C, IdJagTokenExchangeResponseSchema as Ct, assertCompleteRequestPrompt as D, OAuthProtectedResourceMetadataSchema as Dt, scanXMcpHeaderDeclarations as E, OAuthMetadataSchema as Et, isJSONRPCRequest as F, brandedHasInstance as Ft, MissingRequiredClientCapabilityError as G, ListChangedOptionsBaseSchema as H, isJSONRPCResponse as I, stampErrorBrands as It, UnsupportedProtocolVersionError as J, ProtocolError as K, isJSONRPCResultResponse as L, isInputRequiredResult as M, SdkHttpError as Mt, isJSONRPCErrorResponse as N, OAuthError as Nt, assertCompleteRequestResourceTemplate as O, OAuthTokensSchema as Ot, isJSONRPCNotification as P, OAuthErrorCode as Pt, isModernProtocolVersion as Q, isTaskAugmentedRequestParams as R, HEADER_MISMATCH_ERROR_CODE as S, withoutIssuer as St, encodeMcpParamValue as T, OAuthErrorResponseSchema as Tt, MODERN_WIRE_REVISION as U, JSONRPCMessageSchema as V, codecForVersion as W, ProtocolErrorCode as X, UrlElicitationRequiredError as Y, SUPPORTED_MODERN_PROTOCOL_VERSIONS as Z, isSpecType as _, SUPPORTED_PROTOCOL_VERSIONS as _t, createFetchWithInit as a, INTERNAL_ERROR as at, withInputRequired as b, checkResourceAllowed as bt, deserializeMessage as c, JSONRPC_VERSION as ct, isJsonContentType as d, METHOD_NOT_FOUND as dt, modernProtocolVersions as et, mediaTypeEssence as f, PARSE_ERROR as ft, mergeCapabilities as g, SUBSCRIPTION_ID_META_KEY as gt, Protocol as h, SERVER_INFO_META_KEY as ht, UriTemplate as i, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as it, isInitializedNotification as j, SdkErrorCode as jt, isCallToolResult as k, OpenIdProviderDiscoveryMetadataSchema as kt, serializeMessage as l, LATEST_PROTOCOL_VERSION as lt, DEFAULT_REQUEST_TIMEOUT_MSEC as m, RELATED_TASK_META_KEY as mt, preloadSchemas as n, CLIENT_CAPABILITIES_META_KEY as nt, ReadBuffer as o, INVALID_PARAMS as ot, runInputRequiredFlow as p, PROTOCOL_VERSION_META_KEY as pt, ResourceNotFoundError as q, InMemoryTransport as r, CLIENT_INFO_META_KEY as rt, STDIO_DEFAULT_MAX_BUFFER_SIZE as s, INVALID_REQUEST as st, fromJsonSchema as t, BAGGAGE_META_KEY as tt, getDisplayName as u, LOG_LEVEL_META_KEY as ut, specTypeSchemas as v, TRACEPARENT_META_KEY as vt, buildMcpParamHeaders as w, OAuthClientInformationFullSchema as wt, parseSchema as x, resourceUrlFromServerUrl as xt, resolveInputRequiredDriverConfig as y, TRACESTATE_META_KEY as yt, parseJSONRPCMessage as z };
-//# sourceMappingURL=src-xKF0PJN-.mjs.map
+export { ProtocolErrorCode as $, assertCompleteRequestPrompt as A, OAuthProtectedResourceMetadataSchema as At, isJSONRPCResultResponse as B, withInputRequired as C, checkResourceAllowed as Ct, buildMcpParamHeaders as D, OAuthClientInformationFullSchema as Dt, mcpNameSource as E, IdJagTokenExchangeResponseSchema as Et, isInputRequiredResult as F, SdkHttpError as Ft, ListChangedOptionsBaseSchema as G, parseJSONRPCMessage as H, isJSONRPCErrorResponse as I, OAuthError as It, MissingRequiredClientCapabilityError as J, MODERN_WIRE_REVISION as K, isJSONRPCNotification as L, OAuthErrorCode as Lt, isCallToolResult as M, OpenIdProviderDiscoveryMetadataSchema as Mt, isInitializeRequest as N, SdkError as Nt, encodeMcpParamValue as O, OAuthErrorResponseSchema as Ot, isInitializedNotification as P, SdkErrorCode as Pt, UrlElicitationRequiredError as Q, isJSONRPCRequest as R, brandedHasInstance as Rt, resolveInputRequiredDriverConfig as S, TRACESTATE_META_KEY as St, HEADER_MISMATCH_ERROR_CODE as T, withoutIssuer as Tt, DiscoverResultSchema as U, isTaskAugmentedRequestParams as V, JSONRPCMessageSchema as W, ResourceNotFoundError as X, ProtocolError as Y, UnsupportedProtocolVersionError as Z, DEFAULT_REQUEST_TIMEOUT_MSEC as _, RELATED_TASK_META_KEY as _t, createFetchWithInit as a, CLIENT_CAPABILITIES_META_KEY as at, isSpecType as b, SUPPORTED_PROTOCOL_VERSIONS as bt, unfollowedRedirect as c, INTERNAL_ERROR as ct, deserializeMessage as d, JSONRPC_VERSION as dt, SUPPORTED_MODERN_PROTOCOL_VERSIONS as et, serializeMessage as f, LATEST_PROTOCOL_VERSION as ft, runInputRequiredFlow as g, PROTOCOL_VERSION_META_KEY as gt, mediaTypeEssence as h, PARSE_ERROR as ht, UriTemplate as i, BAGGAGE_META_KEY as it, assertCompleteRequestResourceTemplate as j, OAuthTokensSchema as jt, scanXMcpHeaderDeclarations as k, OAuthMetadataSchema as kt, ReadBuffer as l, INVALID_PARAMS as lt, isJsonContentType as m, METHOD_NOT_FOUND as mt, preloadSchemas as n, legacyProtocolVersions as nt, fetchLeavingRedirects as o, CLIENT_INFO_META_KEY as ot, getDisplayName as p, LOG_LEVEL_META_KEY as pt, codecForVersion as q, InMemoryTransport as r, modernProtocolVersions as rt, fetchWithinOrigin as s, DEFAULT_NEGOTIATED_PROTOCOL_VERSION as st, fromJsonSchema as t, isModernProtocolVersion as tt, STDIO_DEFAULT_MAX_BUFFER_SIZE as u, INVALID_REQUEST as ut, Protocol as v, SERVER_INFO_META_KEY as vt, parseSchema as w, resourceUrlFromServerUrl as wt, specTypeSchemas as x, TRACEPARENT_META_KEY as xt, mergeCapabilities as y, SUBSCRIPTION_ID_META_KEY as yt, isJSONRPCResponse as z, stampErrorBrands as zt };
+//# sourceMappingURL=src-WCy6ifGf.mjs.map

package/node_modules/@modelcontextprotocol/client/dist/stdio.cjs

@@ -1,5 +1,5 @@
 const require_chunk = require('./chunk-Bnu9O96Y.cjs');
-const require_src = require('./src-oZBjf3U1.cjs');
+const require_src = require('./src-DpAS0jfg.cjs');
 let node_process = require("node:process");
 node_process = require_chunk.__toESM(node_process);
 let node_stream = require("node:stream");

package/node_modules/@modelcontextprotocol/client/dist/stdio.mjs

@@ -1,4 +1,4 @@
-import { At as SdkError, jt as SdkErrorCode, l as serializeMessage, o as ReadBuffer } from "./src-xKF0PJN-.mjs";
+import { Nt as SdkError, Pt as SdkErrorCode, f as serializeMessage, l as ReadBuffer } from "./src-WCy6ifGf.mjs";
 import process from "node:process";
 import { PassThrough } from "node:stream";
 import spawn from "cross-spawn";

package/node_modules/@modelcontextprotocol/client/node_modules/@modelcontextprotocol/core/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@modelcontextprotocol/core",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Model Context Protocol for TypeScript — public Zod schemas (spec + OAuth/OpenID)",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",
   "homepage": "https://modelcontextprotocol.io",
   "bugs": "https://github.com/modelcontextprotocol/typescript-sdk/issues",

package/node_modules/@modelcontextprotocol/client/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@modelcontextprotocol/client",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "Model Context Protocol implementation for TypeScript - Client package",
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "Anthropic, PBC (https://anthropic.com)",
   "homepage": "https://modelcontextprotocol.io",
   "bugs": "https://github.com/modelcontextprotocol/typescript-sdk/issues",
@@ -124,11 +124,11 @@
   "dependencies": {
     "cross-spawn": "^7.0.5",
     "eventsource": "^3.0.2",
-    "eventsource-parser": "^3.0.0",
+    "eventsource-parser": "^3.0.8",
     "jose": "^6.1.3",
     "pkce-challenge": "^5.0.0",
     "zod": "^4.2.0",
-    "@modelcontextprotocol/core": "2.2.0"
+    "@modelcontextprotocol/core": "2.3.0"
   },
   "devDependencies": {
     "@cfworker/json-schema": "^4.1.1",
@@ -147,7 +147,7 @@
     "typescript-eslint": "^8.48.1",
     "vitest": "^4.0.15",
     "tsdown": "^0.18.0",
-    "@modelcontextprotocol/core-internal": "^2.0.2",
+    "@modelcontextprotocol/core-internal": "^2.0.3",
     "@modelcontextprotocol/tsconfig": "^2.0.0",
     "@modelcontextprotocol/vitest-config": "^2.0.0",
     "@modelcontextprotocol/eslint-config": "^2.0.0",

package/node_modules/fast-uri/.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release the package
+
+on:
+  workflow_dispatch:
+    inputs:
+      semver:
+        description: 'Release bump type'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+          - prepatch
+          - preminor
+          - premajor
+          - prerelease
+      preid:
+        description: 'Prerelease identifier (e.g. rc), used by the pre* bump types'
+        required: false
+        type: string
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      id-token: write # required for npm provenance via OIDC
+      contents: write # required to push the release commit and the tag
+    uses: fastify/workflows/.github/workflows/reusable-release.yml@b0a2ab2d8259b6bd574b804cd6874bbd75c3577c
+    with:
+      semver: ${{ inputs.semver }}
+      preid: ${{ inputs.preid }}
+      dist-tag: ${{ startsWith(inputs.semver, 'pre') && 'three-next' || 'three' }}
+      make-latest: false

package/node_modules/fast-uri/README.md

@@ -14,12 +14,18 @@ All of the above functions can accept an additional options argument that is an
 
 Malformed authorities and out-of-range ports are reported through the parsed component's `error` field. `normalize()` leaves malformed string inputs unchanged, and `equal()` returns `false` when either string input is malformed.
 
+Schemes are never percent-decoded. RFC 3986 does not allow percent-encoding in a scheme, so an input such as `%6Aavascript:alert(1)` is reported as malformed (`error: 'URI scheme is malformed.'`) instead of being parsed as `javascript:`. `normalize()` leaves it unchanged, `equal()` returns `false`, and `resolve()` and `serialize()` throw.
+
+For schemes with domain hosts (`http`, `https`, `ws`, `wss`, or any scheme with the `domainHost` option), a host containing an ASCII character that RFC 3986 does not allow in a reg-name (for example `@`, TAB, LF, CR, space, `"`, `<`, `>`, `^`, `` ` ``, `{`, `|`, `}`) is reported as malformed (`error: 'URI host is malformed.'`). It is never passed through a WHATWG URL parser that could treat `@` as a delimiter or strip whitespace. `normalize()` leaves such input unchanged, `equal()` returns `false`, and `resolve()` throws.
+
 *	`scheme` (string)
 	Indicates the scheme that the URI should be treated as, overriding the URI's normal scheme parsing behavior.
 
 *	`reference` (string)
 	If set to `"suffix"`, it indicates that the URI is in the suffix format and the parser will use the option's `scheme` property to determine the URI's scheme.
 
+	A suffix reference is written without its scheme and without the `//` authority marker (RFC 3986 section 4.5). Such a reference is inherently ambiguous: an authority component cannot always be distinguished from a path. When the input carries an authority of the form `host:port` (for example `//javascript:80/x`) or a userinfo containing a colon, the serialized suffix output can begin with text that reparses as a URI scheme (for example `javascript:80/x`). Do not treat suffix output as a trusted absolute URL, and do not render it or use it in a scheme allowlist without first validating it with `parse()`. If you need an unambiguous result, use the default (non-suffix) serialization.
+
 *	`tolerant` (boolean, false)
 	If set to `true`, the parser will relax URI resolving rules.
 
@@ -79,6 +85,8 @@ uri.normalize('http://example.com/a%2Fb')
 
 Reserved path escapes such as `%2F` and `%2E` are preserved as path data during normalization and comparison.
 
+Dot segments in relative references are removed without changing what the reference resolves to: leading `..` segments that cannot be collapsed are kept, a relative path is never turned into a root-relative one, and a first-segment colon exposed by the removal is kept behind a leading `./` so the reference is not reparsed as a scheme (`a/../b` → `b`, `../x` → `../x`, `x/..` → `./`, `a/../a:b` → `./a:b`).
+
 ### Equal
 
 ```js