@1mcp/agent 0.36.0 → 0.38.0

package/build/logger/mcpLoggingEnhancer.js

@@ -1,193 +1,2 @@
-import { v4 as uuidv4 } from 'uuid';
-import logger from './logger.js';
-const activeRequests = new Map();
-/**
- * Logs MCP request details
- */
-function logRequest(requestId, method, params) {
-    logger.info('MCP Request', {
-        requestId,
-        method,
-        params: JSON.stringify(params),
-        timestamp: new Date().toISOString(),
-    });
-}
-/**
- * Logs MCP response details
- */
-function logResponse(requestId, result, duration) {
-    logger.info('MCP Response', {
-        requestId,
-        duration,
-        timestamp: new Date().toISOString(),
-    });
-}
-/**
- * Logs MCP error details
- */
-function logError(requestId, error, duration) {
-    logger.error('MCP Error', {
-        requestId,
-        error: error instanceof Error ? error.message : JSON.stringify(error),
-        stack: error instanceof Error ? error.stack : undefined,
-        duration,
-        timestamp: new Date().toISOString(),
-    });
-}
-/**
- * Logs MCP notification details
- */
-function logNotification(method, params) {
-    logger.info('MCP Notification', {
-        method,
-        params: JSON.stringify(params),
-        timestamp: new Date().toISOString(),
-    });
-}
-/**
- * Wraps the original request handler with logging
- */
-function wrapRequestHandler(originalHandler, method) {
-    return async (request, extra) => {
-        const requestId = uuidv4();
-        const startTime = Date.now();
-        // Store request context
-        activeRequests.set(requestId, {
-            requestId,
-            method,
-            startTime,
-        });
-        // Log request with type-safe params extraction
-        const requestParams = hasParamsProperty(request) ? request.params : undefined;
-        logRequest(requestId, method, requestParams);
-        try {
-            // Execute original handler with enhanced extra object
-            const result = await originalHandler(request, {
-                ...extra,
-                sendNotification: async (notification) => {
-                    logger.info('Sending notification', { requestId, notification });
-                    return extra.sendNotification(notification);
-                },
-                // Reason: MCP SDK sendRequest expects any schema type; Zod schemas have complex generic types
-                // eslint-disable-next-line @typescript-eslint/no-explicit-any
-                sendRequest: async (request, resultSchema, options) => {
-                    logger.info('Sending request', { requestId, request });
-                    // Reason: MCP SDK internal types don't match our wrapper signatures; any required for compatibility
-                    // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-argument, @typescript-eslint/no-explicit-any
-                    return extra.sendRequest(request, resultSchema, options);
-                },
-            });
-            // Log response
-            const duration = Date.now() - startTime;
-            logResponse(requestId, result, duration);
-            return result;
-        }
-        catch (error) {
-            // Log error
-            const duration = Date.now() - startTime;
-            logError(requestId, error, duration);
-            throw error;
-        }
-        finally {
-            // Clean up request context
-            activeRequests.delete(requestId);
-        }
-    };
-}
-// Type guard to check if request has params property
-function hasParamsProperty(request) {
-    return typeof request === 'object' && request !== null && 'params' in request;
-}
-// Type-safe utility to extract method name from Zod schema
-function extractMethodName(schema) {
-    try {
-        // Reason: Accessing internal Zod schema properties not exposed in public types
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-explicit-any
-        const schemaAny = schema;
-        // Reason: Navigating Zod's internal structure to extract method name from schema
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-unsafe-call
-        if (schemaAny._def?.shape?.()?.method?._def?.value) {
-            // Reason: Extracting method name from deep within Zod's internal schema structure
-            // eslint-disable-next-line @typescript-eslint/no-unsafe-return, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access
-            return schemaAny._def.shape().method._def.value;
-        }
-    }
-    catch {
-        // Silently fall back to default if extraction fails
-    }
-    return 'unknown';
-}
-/**
- * Wraps the original notification handler with logging
- */
-function wrapNotificationHandler(originalHandler, method) {
-    return async (notification) => {
-        // Log notification with type-safe params extraction
-        const notificationParams = hasParamsProperty(notification) ? notification.params : undefined;
-        logNotification(method, notificationParams);
-        // Execute original handler
-        await originalHandler(notification);
-    };
-}
-/**
- * Enhances an MCP server with request/response logging
- */
-export function enhanceServerWithLogging(server) {
-    // Store original methods
-    const originalSetRequestHandler = server.setRequestHandler.bind(server);
-    const originalSetNotificationHandler = server.setNotificationHandler.bind(server);
-    const originalNotification = server.notification.bind(server);
-    // Override request handler registration with proper type safety
-    const serverWithHandlers = server;
-    serverWithHandlers.setRequestHandler = (requestSchema, handler) => {
-        // Extract method name safely using our type-safe utility
-        const methodName = extractMethodName(requestSchema);
-        const wrappedHandler = wrapRequestHandler(handler, methodName);
-        // Reason: Original MCP SDK method signatures incompatible with our wrapped handlers; any required for override
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        return originalSetRequestHandler.call(server, requestSchema, wrappedHandler);
-    };
-    // Override notification handler registration with proper type safety
-    const serverWithNotificationHandlers = server;
-    serverWithNotificationHandlers.setNotificationHandler = (notificationSchema, handler) => {
-        // Extract method name safely using our type-safe utility
-        const methodName = extractMethodName(notificationSchema);
-        const wrappedHandler = wrapNotificationHandler(handler, methodName);
-        // Reason: Original MCP SDK method signatures incompatible with our wrapped handlers; any required for override
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        return originalSetNotificationHandler.call(server, notificationSchema, wrappedHandler);
-    };
-    // Override notification sending
-    server.notification = (notification) => {
-        logNotification(notification.method, notification.params);
-        if (!server.transport) {
-            logger.warn('Attempted to send notification on disconnected transport');
-            return Promise.resolve();
-        }
-        // Try to send notification, catch connection errors gracefully
-        try {
-            const result = originalNotification(notification);
-            // Handle both sync and async cases
-            if (result && typeof result.catch === 'function') {
-                // It's a promise - handle async errors
-                return result.catch((error) => {
-                    if (error instanceof Error && error.message.includes('Not connected')) {
-                        logger.warn('Attempted to send notification on disconnected transport');
-                        return Promise.resolve();
-                    }
-                    throw error;
-                });
-            }
-            // Sync result
-            return result;
-        }
-        catch (error) {
-            if (error instanceof Error && error.message.includes('Not connected')) {
-                logger.warn('Attempted to send notification on disconnected transport');
-                return Promise.resolve();
-            }
-            throw error;
-        }
-    };
-}
+export { enhanceServerWithLogging } from '../sdk/legacy/server/runtime/mcpLoggingEnhancer.js';
 //# sourceMappingURL=mcpLoggingEnhancer.js.map

package/build/logger/mcpLoggingEnhancer.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcpLoggingEnhancer.js","sourceRoot":"","sources":["../../src/logger/mcpLoggingEnhancer.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AAGpC,OAAO,MAAM,MAAM,aAAa,CAAC;AAejC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsB,CAAC;AAErD;;GAEG;AACH,SAAS,UAAU,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAe;IACpE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE;QACzB,SAAS;QACT,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,SAAiB,EAAE,MAAe,EAAE,QAAgB;IACvE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE;QAC1B,SAAS;QACT,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,SAAiB,EAAE,KAAc,EAAE,QAAgB;IACnE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE;QACxB,SAAS;QACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QACrE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACvD,QAAQ;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,MAAe;IACtD,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE;QAC9B,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,eAAqC,EACrC,MAAc;IAEd,OAAO,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wBAAwB;QACxB,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE;YAC5B,SAAS;YACT,MAAM;YACN,SAAS;SACV,CAAC,CAAC;QAEH,+CAA+C;QAC/C,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;QAE7C,IAAI,CAAC;YACH,sDAAsD;YACtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE;gBAC5C,GAAG,KAAK;gBACR,gBAAgB,EAAE,KAAK,EAAE,YAAgC,EAAE,EAAE;oBAC3D,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;oBACjE,OAAO,KAAK,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC;gBACD,8FAA8F;gBAC9F,8DAA8D;gBAC9D,WAAW,EAAE,KAAK,EAAE,OAAsB,EAAE,YAAiB,EAAE,OAAiB,EAAE,EAAE;oBAClF,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;oBACvD,oGAAoG;oBACpG,0IAA0I;oBAC1I,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,YAAmB,EAAE,OAAc,CAAC,CAAC;gBACzE,CAAC;aACF,CAAC,CAAC;YAEH,eAAe;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAEzC,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY;YACZ,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YACxC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YACrC,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,2BAA2B;YAC3B,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,QAAQ,IAAI,OAAO,CAAC;AAChF,CAAC;AAED,2DAA2D;AAC3D,SAAS,iBAAiB,CAAC,MAAiB;IAC1C,IAAI,CAAC;QACH,+EAA+E;QAC/E,uGAAuG;QACvG,MAAM,SAAS,GAAG,MAAa,CAAC;QAChC,iFAAiF;QACjF,yGAAyG;QACzG,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YACnD,kFAAkF;YAClF,8IAA8I;YAC9I,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAClD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAC9B,eAA0C,EAC1C,MAAc;IAEd,OAAO,KAAK,EAAE,YAAY,EAAE,EAAE;QAC5B,oDAAoD;QACpD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,eAAe,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAE5C,2BAA2B;QAC3B,MAAM,eAAe,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,yBAAyB;IACzB,MAAM,yBAAyB,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxE,MAAM,8BAA8B,GAAG,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE9D,gEAAgE;IAChE,MAAM,kBAAkB,GAAG,MAQ1B,CAAC;IAEF,kBAAkB,CAAC,iBAAiB,GAAG,CACrC,aAAgB,EAChB,OAG+B,EACzB,EAAE;QACR,yDAAyD;QACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,kBAAkB,CAAC,OAA+B,EAAE,UAAU,CAAC,CAAC;QACvF,+GAA+G;QAC/G,8DAA8D;QAC9D,OAAO,yBAAyB,CAAC,IAAI,CAAC,MAAM,EAAE,aAAoB,EAAE,cAAqB,CAAC,CAAC;IAC7F,CAAC,CAAC;IAEF,qEAAqE;IACrE,MAAM,8BAA8B,GAAG,MAKtC,CAAC;IAEF,8BAA8B,CAAC,sBAAsB,GAAG,CACtD,kBAAqB,EACrB,OAA2D,EACrD,EAAE;QACR,yDAAyD;QACzD,MAAM,UAAU,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;QAEzD,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAoC,EAAE,UAAU,CAAC,CAAC;QACjG,+GAA+G;QAC/G,8DAA8D;QAC9D,OAAO,8BAA8B,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAyB,EAAE,cAAqB,CAAC,CAAC;IACvG,CAAC,CAAC;IAEF,gCAAgC;IAChC,MAAM,CAAC,YAAY,GAAG,CAAC,YAGtB,EAAE,EAAE;QACH,eAAe,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;QAE1D,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;YACxE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;YAElD,mCAAmC;YACnC,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjD,uCAAuC;gBACvC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACrC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;wBACtE,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;wBACxE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;oBAC3B,CAAC;oBACD,MAAM,KAAK,CAAC;gBACd,CAAC,CAAC,CAAC;YACL,CAAC;YAED,cAAc;YACd,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtE,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3B,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcpLoggingEnhancer.js","sourceRoot":"","sources":["../../src/logger/mcpLoggingEnhancer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,sDAAsD,CAAC"}

package/build/logger/secureLogger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secureLogger.d.ts","sourceRoot":"","sources":["../../src/logger/secureLogger.ts"],"names":[],"mappings":"AAmFA;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAQzD;AAsBD;;GAEG;AACH,eAAO,MAAM,YAAY;qBAnBN,MAAM,SAAS,OAAO;oBAAtB,MAAM,SAAS,OAAO;oBAAtB,MAAM,SAAS,OAAO;qBAAtB,MAAM,SAAS,OAAO;CAwBxC,CAAC;AAEF;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAMnE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D"}
+{"version":3,"file":"secureLogger.d.ts","sourceRoot":"","sources":["../../src/logger/secureLogger.ts"],"names":[],"mappings":"AAyOA;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAQzD;AAsBD;;GAEG;AACH,eAAO,MAAM,YAAY;qBAnBN,MAAM,SAAS,OAAO;oBAAtB,MAAM,SAAS,OAAO;oBAAtB,MAAM,SAAS,OAAO;qBAAtB,MAAM,SAAS,OAAO;CAwBxC,CAAC;AAEF;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAOnE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAO5D"}

package/build/logger/secureLogger.js

@@ -1,23 +1,98 @@
 import logger from './logger.js';
 /**
- * Consolidated patterns for sensitive data detection
+ * Patterns matching value-bearing credentials (used for both values and object keys)
  */
-const SENSITIVE_PATTERNS = [
-    // OAuth tokens and credentials (consolidates 6 patterns)
-    /(?:access_token|refresh_token|authorization_code|client_secret|client_id|bearer\s+[\w\-.~+/]+=*)/gi,
+const KEY_SENSITIVE_PATTERNS = [
+    // PEM Private Key blocks (CWE-532, matches full block or unterminated block through string boundary)
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/gi,
+    // Bearer tokens in Authorization headers / raw Bearer prefixes (supports space and colon separators)
+    /bearer(?:\s+|:\s*)[a-zA-Z0-9_\-.~+/]+=*/gi,
+    // Basic authentication credentials (Authorization: Basic <base64>)
+    /basic\s+[a-zA-Z0-9+/=]{8,}/gi,
+    // JWT tokens (Header.Payload.Signature)
+    /\beyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]{10,}\b/gi,
+    // Key-value credential assignments (supports unquoted, quoted, JSON-stringified, camelCase, snake_case, and kebab-case)
+    /(?:[?&]|["']|\b)(?:[tT]oken|[cC]ode|[sS]ecret|client_secret|clientSecret|[pP]assword|[pP]asswd|api[_-]?key|apiKey|auth[_-]?token|authToken|access[_-]?token|accessToken|refresh[_-]?token|refreshToken|private[_-]?key|privateKey|authorization[_-]?code|authorizationCode)\s*["']?\s*[:=]\s*(?:"(?:\\[\s\S]|[^"\\])*(?:"|$)|'(?:\\[\s\S]|[^'\\])*(?:'|$)|[^\s,;&{}"]+)/gi,
     // URLs with sensitive parameters (consolidates 4 patterns)
-    /https?:\/\/[^\s]*[?&](?:[tT]oken|[cC]ode)=[^\s&]*/gi,
+    /https?:\/\/[^\s]*[?&](?:[tT]oken|[cC]ode|[sS]ecret|[kK]ey|client_secret|clientSecret|refreshToken|accessToken|authorization_code|authorizationCode)=[^\s&]*/gi,
     // Query parameters with sensitive data (consolidates 2 patterns)
-    /[?&](?:[tT]oken|[cC]ode)=[^\s&]*/gi,
+    /[?&](?:[tT]oken|[cC]ode|[sS]ecret|[kK]ey|client_secret|clientSecret|refreshToken|accessToken|authorization_code|authorizationCode)=[^\s&]*/gi,
+];
+/**
+ * Consolidated patterns for sensitive data detection in string values
+ */
+const SENSITIVE_PATTERNS = [
+    ...KEY_SENSITIVE_PATTERNS,
+    // OAuth tokens and credentials (consolidates 6 patterns)
+    /(?:access_token|refresh_token|authorization_code|client_secret)/gi,
     // OAuth configuration patterns (consolidates 4 patterns)
     /(?:scopes?|redirect_uris?|with\s+scope):\s*(?:\[[^\]]*\]|[^\s,}]+(?:\s+[^\s]+)*)/gi,
-    // Generic secret patterns (consolidates 5 patterns)
-    /(?:api[_-]?key|secret|password|passwd|auth[_-]?token)/gi,
+    // Generic secret patterns (consolidates 5 patterns) - fallback keywords
+    /(?:api[_-]?key|secret|password|passwd|auth[_-]?token|private[_-]?key)/gi,
 ];
 /**
  * Base patterns for sensitive key detection (case-insensitive)
  */
-const SENSITIVE_KEY_PATTERNS = ['secret', 'token', 'password', 'passwd', 'key'];
+const SENSITIVE_KEY_PATTERNS = [
+    'secret',
+    'token',
+    'password',
+    'passwd',
+    'key',
+    'authorization_code',
+    'auth_code',
+    'auth_token',
+    'authtoken',
+];
+/**
+ * C0 + C1 control characters + DEL + Unicode Line/Paragraph Separators + Bidi overrides (CWE-117, CWE-150, Trojan Source CVE-2021-42574).
+ * Covers \x00-\x1F (C0), \x7F (DEL), \x80-\x9F (C1 including 8-bit CSI \x9B),
+ * \u2028/\u2029 (Unicode line/paragraph separators), \u202A-\u202E/\u2066-\u2069 (Bidi overrides),
+ * and \u200B-\u200D/\uFEFF (Zero-width formatting characters).
+ * Single character class — linear time, no nested quantifiers, no ReDoS risk.
+ */
+// eslint-disable-next-line no-control-regex -- intentional: this IS the sanitization pattern
+const CONTROL_CHARS_PATTERN = /[\x00-\x1F\x7F-\x9F\u200B-\u200D\u2028\u2029\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+/**
+ * Escape control characters as visible literals (log4j2 %encode{}{CRLF} /
+ * Veracode CWE-117 guidance style) so attacker-controlled input cannot forge
+ * log lines or inject ANSI escape sequences, while preserving audit intent.
+ */
+function escapeControlChars(value) {
+    return value.replace(CONTROL_CHARS_PATTERN, (char) => {
+        if (char === '\n')
+            return '\\n';
+        if (char === '\r')
+            return '\\r';
+        if (char === '\t')
+            return '\\t';
+        const code = char.charCodeAt(0);
+        if (code <= 0xff) {
+            return `\\x${code.toString(16).padStart(2, '0').toUpperCase()}`;
+        }
+        return `\\u${code.toString(16).padStart(4, '0').toUpperCase()}`;
+    });
+}
+/**
+ * Sanitize a string by applying pattern redaction followed by control character escaping.
+ */
+function sanitizeString(value) {
+    let sanitized = value;
+    for (const pattern of SENSITIVE_PATTERNS) {
+        sanitized = sanitized.replace(pattern, '[REDACTED]');
+    }
+    return escapeControlChars(sanitized);
+}
+/**
+ * Sanitize an object key: redacts credential patterns and escapes control characters.
+ */
+function sanitizeKey(key) {
+    let redactedKey = key;
+    for (const pattern of KEY_SENSITIVE_PATTERNS) {
+        redactedKey = redactedKey.replace(pattern, '[REDACTED]');
+    }
+    return escapeControlChars(redactedKey);
+}
 /**
  * Check if a key contains sensitive patterns
  */
@@ -38,27 +113,88 @@ function sanitize(value, depth = 0) {
         return value;
     }
     if (typeof value === 'string') {
-        // Apply pattern-based redaction to strings
-        let sanitized = value;
-        for (const pattern of SENSITIVE_PATTERNS) {
-            sanitized = sanitized.replace(pattern, '[REDACTED]');
-        }
-        return sanitized;
+        return sanitizeString(value);
     }
     if (typeof value === 'number' || typeof value === 'boolean') {
         return value;
     }
+    if (typeof value === 'bigint') {
+        return `${value.toString()}n`;
+    }
+    if (typeof value === 'symbol') {
+        return sanitizeString(value.toString());
+    }
+    if (typeof value === 'function') {
+        return '[Function]';
+    }
+    if (value instanceof Date) {
+        return isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();
+    }
+    if (value instanceof RegExp) {
+        return sanitizeString(value.toString());
+    }
+    if (value instanceof Error) {
+        const sanitizedError = {
+            name: typeof value.name === 'string'
+                ? sanitize(value.name, depth + 1)
+                : sanitizeString(String(value.name)),
+            message: sanitize(value.message, depth + 1),
+        };
+        if (value.stack) {
+            sanitizedError.stack = sanitize(value.stack, depth + 1);
+        }
+        if ('cause' in value && value.cause !== undefined) {
+            sanitizedError.cause = sanitize(value.cause, depth + 1);
+        }
+        for (const [key, val] of Object.entries(value)) {
+            if (key === 'name' || key === 'message' || key === 'stack' || key === 'cause' || key === '__proto__') {
+                continue;
+            }
+            const sanitizedKey = sanitizeKey(key);
+            if (isSensitiveKey(key)) {
+                sanitizedError[sanitizedKey] = '[REDACTED]';
+            }
+            else {
+                sanitizedError[sanitizedKey] = sanitize(val, depth + 1);
+            }
+        }
+        return sanitizedError;
+    }
+    if (value instanceof Set) {
+        return Array.from(value).map((item) => sanitize(item, depth + 1));
+    }
+    if (value instanceof Map) {
+        const mapObj = {};
+        for (const [k, v] of value.entries()) {
+            const stringKey = typeof k === 'string' ? k : String(k);
+            if (stringKey === '__proto__') {
+                continue;
+            }
+            const sanitizedKey = sanitizeKey(stringKey);
+            if (isSensitiveKey(stringKey)) {
+                mapObj[sanitizedKey] = '[REDACTED]';
+            }
+            else {
+                mapObj[sanitizedKey] = sanitize(v, depth + 1);
+            }
+        }
+        return mapObj;
+    }
     if (Array.isArray(value)) {
         return value.map((item) => sanitize(item, depth + 1));
     }
     if (typeof value === 'object' && value !== null) {
         const sanitized = {};
         for (const [key, val] of Object.entries(value)) {
+            if (key === '__proto__') {
+                continue;
+            }
+            const sanitizedKey = sanitizeKey(key);
             if (isSensitiveKey(key)) {
-                sanitized[key] = '[REDACTED]';
+                sanitized[sanitizedKey] = '[REDACTED]';
             }
             else {
-                sanitized[key] = sanitize(val, depth + 1);
+                sanitized[sanitizedKey] = sanitize(val, depth + 1);
             }
         }
         return sanitized;
@@ -72,9 +208,9 @@ export function sanitizeForLogging(data) {
     try {
         return sanitize(data);
     }
-    catch (error) {
-        // Log the actual error safely without exposing sensitive data
-        console.error('Sanitization error occurred:', error instanceof Error ? error.message : 'Unknown error');
+    catch {
+        // Log safe static marker to stderr without exposing dynamic error.message (preventing throwing getter bypasses)
+        console.error('Sanitization error occurred');
         return '[SANITIZATION_ERROR]';
     }
 }
@@ -83,7 +219,7 @@ export function sanitizeForLogging(data) {
  */
 function createLoggerMethod(level) {
     return (message, data) => {
-        const sanitizedMessage = typeof message === 'string' ? sanitize(message) : message;
+        const sanitizedMessage = sanitizeForLogging(message);
         const sanitizedMessageStr = typeof sanitizedMessage === 'string' ? sanitizedMessage : String(sanitizedMessage);
         if (data !== undefined) {
             // Type-safe assertion that the logger method exists and is callable
@@ -113,14 +249,15 @@ export function sanitizeOAuthServerList(servers) {
     return servers.map((server) => {
         // Only show server name without any sensitive configuration
         const serverName = server.split('|')[0] || server; // Extract just the name part
-        return serverName.replace(/[?&](client_id|client_secret|token|code)=[^&]*/gi, '[OAUTH_REDACTED]');
+        const redacted = serverName.replace(/[?&](client_id|client_secret|token|code)=[^&]*/gi, '[OAUTH_REDACTED]');
+        return escapeControlChars(redacted);
     });
 }
 /**
  * Utility function to create safe error messages that don't expose sensitive data
  */
 export function createSafeErrorMessage(error) {
-    const sanitizedError = sanitize(error);
+    const sanitizedError = sanitizeForLogging(error);
     const errorString = typeof sanitizedError === 'string' ? sanitizedError : String(sanitizedError);
     return errorString
         .replace(/HTTP \d+.*$/gi, 'HTTP [STATUS_CODE]') // Remove potentially sensitive HTTP response details

package/build/logger/secureLogger.js.map

@@ -1 +1 @@
-{"version":3,"file":"secureLogger.js","sourceRoot":"","sources":["../../src/logger/secureLogger.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,yDAAyD;IACzD,oGAAoG;IAEpG,2DAA2D;IAC3D,qDAAqD;IAErD,iEAAiE;IACjE,oCAAoC;IAEpC,yDAAyD;IACzD,oFAAoF;IAEpF,oDAAoD;IACpD,yDAAyD;CAC1D,CAAC;AAEF;;GAEG;AACH,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAEhF;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACzC,6BAA6B;IAC7B,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,2CAA2C;QAC3C,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,8DAA8D;QAC9D,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACxG,OAAO,sBAAsB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAA0C;IACpE,OAAO,CAAC,OAAe,EAAE,IAAc,EAAE,EAAE;QACzC,MAAM,gBAAgB,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACnF,MAAM,mBAAmB,GAAG,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/G,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAkD,CAAC;YACpF,YAAY,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAkD,CAAC;YACpF,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC;IAClC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC;CACnC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,4DAA4D;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,6BAA6B;QAChF,OAAO,UAAU,CAAC,OAAO,CAAC,kDAAkD,EAAE,kBAAkB,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEjG,OAAO,WAAW;SACf,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,qDAAqD;SACpG,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC,CAAC,uBAAuB;AAC1F,CAAC"}
+{"version":3,"file":"secureLogger.js","sourceRoot":"","sources":["../../src/logger/secureLogger.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,qGAAqG;IACrG,oFAAoF;IAEpF,qGAAqG;IACrG,2CAA2C;IAE3C,mEAAmE;IACnE,8BAA8B;IAE9B,wCAAwC;IACxC,qEAAqE;IAErE,wHAAwH;IACxH,2WAA2W;IAE3W,2DAA2D;IAC3D,+JAA+J;IAE/J,iEAAiE;IACjE,8IAA8I;CAC/I,CAAC;AAEF;;GAEG;AACH,MAAM,kBAAkB,GAAG;IACzB,GAAG,sBAAsB;IAEzB,yDAAyD;IACzD,mEAAmE;IAEnE,yDAAyD;IACzD,oFAAoF;IAEpF,wEAAwE;IACxE,yEAAyE;CAC1E,CAAC;AAEF;;GAEG;AACH,MAAM,sBAAsB,GAAG;IAC7B,QAAQ;IACR,OAAO;IACP,UAAU;IACV,QAAQ;IACR,KAAK;IACL,oBAAoB;IACpB,WAAW;IACX,YAAY;IACZ,WAAW;CACZ,CAAC;AAEF;;;;;;GAMG;AACH,6FAA6F;AAC7F,MAAM,qBAAqB,GAAG,gFAAgF,CAAC;AAE/G;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,EAAE;QACnD,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,WAAW,GAAG,GAAG,CAAC;IACtB,KAAK,MAAM,OAAO,IAAI,sBAAsB,EAAE,CAAC;QAC7C,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,kBAAkB,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACzC,6BAA6B;IAC7B,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,GAAG,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC;IAChC,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,YAAY,MAAM,EAAE,CAAC;QAC5B,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,cAAc,GAA4B;YAC9C,IAAI,EACF,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAC5B,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAY;gBAC7C,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,GAAG,CAAC,CAAC;SAC5C,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,cAAc,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAClD,cAAc,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACrG,SAAS;YACX,CAAC;YACD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,cAAc,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,IAAI,KAAK,YAAY,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACxD,IAAI,SAAS,KAAK,WAAW,EAAE,CAAC;gBAC9B,SAAS;YACX,CAAC;YACD,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,SAAS,GAA4B,EAAE,CAAC;QAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;gBACxB,SAAS;YACX,CAAC;YACD,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,SAAS,CAAC,YAAY,CAAC,GAAG,YAAY,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,gHAAgH;QAChH,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7C,OAAO,sBAAsB,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,KAA0C;IACpE,OAAO,CAAC,OAAe,EAAE,IAAc,EAAE,EAAE;QACzC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,mBAAmB,GAAG,OAAO,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE/G,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAkD,CAAC;YACpF,YAAY,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,oEAAoE;YACpE,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAkD,CAAC;YACpF,YAAY,CAAC,mBAAmB,CAAC,CAAC;QACpC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC;IAClC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC;CACnC,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAiB;IACvD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC5B,4DAA4D;QAC5D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,6BAA6B;QAChF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,kDAAkD,EAAE,kBAAkB,CAAC,CAAC;QAC5G,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAEjG,OAAO,WAAW;SACf,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,qDAAqD;SACpG,OAAO,CAAC,sBAAsB,EAAE,2BAA2B,CAAC,CAAC,CAAC,uBAAuB;AAC1F,CAAC"}

package/build/sdk/contracts/index.d.ts

@@ -0,0 +1,5 @@
+export * from './jsonValue.js';
+export * from './legacySdkAdapter.js';
+export * from './oneMcpProtocolError.js';
+export * from './protocol.js';
+//# sourceMappingURL=index.d.ts.map

package/build/sdk/contracts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sdk/contracts/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC"}

package/build/sdk/contracts/index.js

@@ -0,0 +1,5 @@
+export * from './jsonValue.js';
+export * from './legacySdkAdapter.js';
+export * from './oneMcpProtocolError.js';
+export * from './protocol.js';
+//# sourceMappingURL=index.js.map

package/build/sdk/contracts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sdk/contracts/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,uBAAuB,CAAC;AACtC,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC"}

package/build/sdk/contracts/jsonValue.d.ts

@@ -0,0 +1,21 @@
+export type JsonPrimitive = null | boolean | number | string;
+export type JsonArray = JsonValue[];
+export interface JsonObject {
+    [key: string]: JsonValue;
+}
+export type JsonValue = JsonPrimitive | JsonArray | JsonObject;
+/** Finite resource budgets applied while validating and cloning foreign values. */
+export declare const JSON_VALUE_LIMITS: Readonly<{
+    maxDepth: 64;
+    maxNodes: 10000;
+    maxTotalStringLength: 1000000;
+}>;
+export declare class InvalidJsonValueError extends TypeError {
+    readonly path: string;
+    readonly reason: string;
+    constructor(path: string, reason: string);
+}
+/** Validates an unknown boundary value and returns a detached plain JSON clone. */
+export declare function toJsonValue(value: unknown): JsonValue;
+export declare function isJsonValue(value: unknown): value is JsonValue;
+//# sourceMappingURL=jsonValue.d.ts.map

package/build/sdk/contracts/jsonValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jsonValue.d.ts","sourceRoot":"","sources":["../../../src/sdk/contracts/jsonValue.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAC7D,MAAM,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;AACpC,MAAM,WAAW,UAAU;IACzB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AACD,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,UAAU,CAAC;AAE/D,mFAAmF;AACnF,eAAO,MAAM,iBAAiB;;;;EAI5B,CAAC;AAEH,qBAAa,qBAAsB,SAAQ,SAAS;IAEhD,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBADd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAyGD,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAErD;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,SAAS,CAQ9D"}

package/build/sdk/contracts/jsonValue.js

@@ -0,0 +1,127 @@
+/** Finite resource budgets applied while validating and cloning foreign values. */
+export const JSON_VALUE_LIMITS = Object.freeze({
+    maxDepth: 64,
+    maxNodes: 10_000,
+    maxTotalStringLength: 1_000_000,
+});
+export class InvalidJsonValueError extends TypeError {
+    path;
+    reason;
+    constructor(path, reason) {
+        super(`Invalid JSON value at ${path}: ${reason}`);
+        this.path = path;
+        this.reason = reason;
+        this.name = 'InvalidJsonValueError';
+    }
+}
+function fail(path, reason) {
+    throw new InvalidJsonValueError(path, reason);
+}
+function consumeNode(state, path) {
+    state.nodes += 1;
+    if (state.nodes > JSON_VALUE_LIMITS.maxNodes) {
+        fail(path, `node limit of ${JSON_VALUE_LIMITS.maxNodes} exceeded`);
+    }
+}
+function consumeString(state, path, value) {
+    state.stringLength += value.length;
+    if (state.stringLength > JSON_VALUE_LIMITS.maxTotalStringLength) {
+        fail(path, `total string length limit of ${JSON_VALUE_LIMITS.maxTotalStringLength} exceeded`);
+    }
+}
+function childPath(path, key) {
+    return `${path}[${JSON.stringify(key)}]`;
+}
+function cloneArray(value, path, depth, state) {
+    const keys = Reflect.ownKeys(value);
+    for (const key of keys) {
+        if (key === 'length')
+            continue;
+        if (typeof key !== 'string' || !/^(0|[1-9]\d*)$/.test(key) || Number(key) >= value.length) {
+            fail(path, 'arrays must not have symbol or extra properties');
+        }
+    }
+    const result = [];
+    for (let index = 0; index < value.length; index += 1) {
+        const itemPath = `${path}[${index}]`;
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (!descriptor)
+            fail(itemPath, 'sparse arrays are not supported');
+        if (!descriptor.enumerable || !('value' in descriptor)) {
+            fail(itemPath, 'array elements must be own enumerable data properties');
+        }
+        result.push(cloneValue(descriptor.value, itemPath, depth + 1, state));
+    }
+    return result;
+}
+function cloneObject(value, path, depth, state) {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        fail(path, 'only Object.prototype and null-prototype objects are supported');
+    }
+    const result = {};
+    for (const key of Reflect.ownKeys(value)) {
+        if (typeof key === 'symbol')
+            fail(path, 'symbol properties are not supported');
+        const propertyPath = childPath(path, key);
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor?.enumerable)
+            fail(propertyPath, 'non-enumerable properties are not supported');
+        if (!('value' in descriptor))
+            fail(propertyPath, 'accessor properties are not supported');
+        consumeString(state, propertyPath, key);
+        Object.defineProperty(result, key, {
+            configurable: true,
+            enumerable: true,
+            value: cloneValue(descriptor.value, propertyPath, depth + 1, state),
+            writable: true,
+        });
+    }
+    return result;
+}
+function cloneValue(value, path, depth, state) {
+    if (depth > JSON_VALUE_LIMITS.maxDepth) {
+        fail(path, `depth limit of ${JSON_VALUE_LIMITS.maxDepth} exceeded`);
+    }
+    consumeNode(state, path);
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'string') {
+        consumeString(state, path, value);
+        return value;
+    }
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            fail(path, 'numbers must be finite');
+        if (Object.is(value, -0))
+            fail(path, 'negative zero is not supported');
+        return value;
+    }
+    if (typeof value !== 'object')
+        fail(path, `${typeof value} values are not supported`);
+    if (state.ancestors.has(value))
+        fail(path, 'cyclic values are not supported');
+    state.ancestors.add(value);
+    try {
+        return Array.isArray(value) ? cloneArray(value, path, depth, state) : cloneObject(value, path, depth, state);
+    }
+    finally {
+        state.ancestors.delete(value);
+    }
+}
+/** Validates an unknown boundary value and returns a detached plain JSON clone. */
+export function toJsonValue(value) {
+    return cloneValue(value, '$', 0, { ancestors: new WeakSet(), nodes: 0, stringLength: 0 });
+}
+export function isJsonValue(value) {
+    try {
+        toJsonValue(value);
+        return true;
+    }
+    catch (error) {
+        if (error instanceof InvalidJsonValueError)
+            return false;
+        throw error;
+    }
+}
+//# sourceMappingURL=jsonValue.js.map