npm - @coffeerunhobby/mcp-ha-connect - Versions diffs - 1.7.0 → 1.7.2 - Mend

@coffeerunhobby/mcp-ha-connect 1.7.0 → 1.7.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/README.md +2 -2
package/dist/server/http.js +14 -1
package/dist/server/http.js.map +1 -1
package/dist/tools/infra/actions.d.ts +7 -0
package/dist/tools/infra/actions.js +2 -0
package/dist/tools/infra/actions.js.map +1 -1
package/dist/tools/infra/index.d.ts +2 -0
package/dist/tools/infra/index.js +32 -0
package/dist/tools/infra/index.js.map +1 -1
package/dist/version.d.ts +1 -1
package/dist/version.js +1 -1
package/docs/CHANGELOG.md +21 -0
package/openapi.json +1 -1
package/package.json +1 -1
package/src/server/http.ts +15 -1
package/src/tools/infra/actions.ts +9 -0
package/src/tools/infra/index.ts +37 -0
package/src/version.ts +1 -1
package/tests/security/resourceConsumption.test.ts +9 -0
package/tests/tools/infra/invokeAction.test.ts +84 -1

package/README.md CHANGED Viewed

@@ -2,7 +2,7 @@
 A production-ready Model Context Protocol (MCP) server for Home Assistant integration with AI assistants like Claude and LM Studio.
-[![npm version](https://badge.fury.io/js/%40coffeerunhobby%2Fmcp-ha-connect.svg)](https://www.npmjs.com/package/@coffeerunhobby/mcp-ha-connect)
+[![npm version](https://img.shields.io/npm/v/%40coffeerunhobby%2Fmcp-ha-connect)](https://www.npmjs.com/package/@coffeerunhobby/mcp-ha-connect)
 [![Docker](https://img.shields.io/badge/docker-ghcr.io-blue)](https://github.com/coffeerunhobby/mcp-ha-connect/pkgs/container/mcp-ha-connect)
 [![Discord](https://img.shields.io/badge/Discord-join%20chat-5865F2?logo=discord&logoColor=white)](https://discord.gg/zeQ6aWVFgS)
@@ -283,7 +283,7 @@ chat-eligible in code can be activated per category with read/write granularity:
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `MCP_CHAT_TOOLS` | unset (= legacy 8 HA tools) | Category slice, e.g. `ha-core:rw,ha-history:r,omada-read:r`. Categories: `ha-core`, `ha-history`, `ha-automations`, `omada-read`, `omada-write`. Config can only narrow what the code marks chat-eligible; ADMIN tools (`invokeAction`) can never appear on this face. |
-| `MCP_REST_ACTIONS` | unset (= tool not registered) | JSON map of pre-registered REST actions for the `invokeAction` MCP tool (ADMIN; MCP face only), e.g. `{"deploy":{"url":"http://host:8425/v1/update","bearerToken":"..."}}` |
+| `MCP_REST_ACTIONS` | unset (= tool not registered) | JSON map of pre-registered REST actions for the `invokeAction` MCP tool (ADMIN; MCP face only), e.g. `{"deploy":{"url":"http://host:8425/v1/update","bearerToken":"...","cooldownMs":300000}}`. Each action is rate-limited: min interval between firings = `cooldownMs` (default 60000; `0` disables) — caps deploy-storm blast radius if a model loops a legitimate action |
 Activated chat tools appear in the generated `/openapi.json` as `POST /api/tools/<name>`
 and dispatch through the same handlers, validation, and RBAC as the MCP face.

package/dist/server/http.js CHANGED Viewed

@@ -83,7 +83,11 @@ export function parseBody(req, maxBytes = MAX_BODY_BYTES) {
                 resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
             }
             catch (error) {
-                reject(new Error(`Invalid JSON: ${error.message}`));
+                // A malformed body is a client mistake, not a server fault: tag it 400 so
+                // the request handler surfaces "400 Bad Request" instead of a generic 500.
+                const err = new Error(`Invalid JSON: ${error.message}`);
+                err.statusCode = 400;
+                reject(err);
             }
         });
         req.on('error', reject);
@@ -393,6 +397,15 @@ export async function startHttpServer(options) {
                 }
                 return;
             }
+            // A malformed request body is the client's fault, not ours: return 400 with the
+            // parse detail (which is safe — it describes the client's own JSON, not our
+            // internals) rather than masking it as a 500 Internal Server Error.
+            if (errorStatusCode(error) === 400) {
+                if (!res.headersSent) {
+                    sendJson(res, 400, { error: 'Bad Request', message: error.message });
+                }
+                return;
+            }
             logger.error('HTTP request error', {
                 error,
                 method: req.method,

package/dist/server/http.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA6C,MAAM,WAAW,CAAC;AAGxG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAA0D,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,uDAAuD;IACvD,GAAG,CAAC,GAAG,GAAG,UACR,KAAe,EACf,kBAAkD,EAClD,QAAqB;QAErB,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAmB,CAAC;IAEpB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAO1C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,WAAmB,cAAc;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;YACnB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAkB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAI,KAA+B,EAAE,UAAU,CAAC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAmB;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACpE,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,2CAA2C,CAAC,CAAC;IAC3F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IACnF,OAAO,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,aAAa,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB;IACrE,OAAO,qBAAqB,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAgB;IAEhB,+BAA+B;IAC/B,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACvC,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC1B,SAAS;QACT,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA0C;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,EAAE,IAAI,EAAE;SACP,WAAW,EAAE,CAAC;IACjB,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAyB;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAEvD,0DAA0D;IAC1D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEpE,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,YAAY,GAAkB,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE;QACxE,QAAQ,EAAE,MAAM;QAChB,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;QAChC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7C,eAAe,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS;KAChD,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC;IAElE,qCAAqC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB;QACzC,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,WAAW,EAAE,MAAM,CAAC,oBAAoB;YACxC,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;YACxC,6DAA6D;YAC7D,cAAc,EAAE,MAAM,CAAC,uBAAuB;SAC/C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,6BAA6B;IAC7B,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,eAAe,GAAG,IAAI,eAAe,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;gBAChF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAoB,EAAE,WAA2B,EAAE,EAAE;QAC1F,4CAA4C;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAEpD,mDAAmD;QACnD,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,mFAAmF;QACnF,8EAA8E;QAC9E,6EAA6E;QAC7E,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;YACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,6DAA6D;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,wCAAwC;YAClD,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,2CAA2C;QACrD,CAAC;QAED,qCAAqC;QACrC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,wBAAwB;YACxB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvD,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,gBAAgB,IAAI,eAAe,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACzB,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBACpD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,kFAAkF;gBAClF,mFAAmF;gBACnF,iFAAiF;gBACjF,yFAAyF;gBACzF,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvE,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvC,QAAQ,EAAE,YAAY;oBACtB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBACvC,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAClG,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;gBAEtF,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,YAAY;YACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACjC,KAAK;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,sEAAsE;gBACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,kCAAkC;IACpE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,sCAAsC;IACxE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAE,qCAAqC;IACvE,MAAM,CAAC,oBAAoB,GAAG,CAAC,CAAC,CAAE,4CAA4C;IAE9E,4BAA4B;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QAChD,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QAEtB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,yBAAyB;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,CAAC;gBACD,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxE,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEjB,yBAAyB;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QAED,oBAAoB;QACpB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,kBAAkB;IAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,IAAI;gBACJ,QAAQ;gBACR,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE;gBAC3C,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC/F,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;aACpH,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
1	+ {"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/server/http.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,IAAI,gBAAgB,EAA6C,MAAM,WAAW,CAAC;AAGxG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAA0D,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AAEvB,oCAAoC;AACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;AAEzD;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAmB;IACjD,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtC,uDAAuD;IACvD,GAAG,CAAC,GAAG,GAAG,UACR,KAAe,EACf,kBAAkD,EAClD,QAAqB;QAErB,wDAAwD;QACxD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,UAAU,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,kDAAkD;QAClD,IAAI,OAAO,kBAAkB,KAAK,UAAU,EAAE,CAAC;YAC7C,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAmB,CAAC;IAEpB,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAO1C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,GAAoB,EAAE,WAAmB,cAAc;IAC/E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACnE,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;YACnB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAC3D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,CAAC,SAAS,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,0EAA0E;gBAC1E,2EAA2E;gBAC3E,MAAM,GAAG,GAAc,IAAI,KAAK,CAAC,iBAAkB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC9E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,eAAe,CAAC,KAAc;IACrC,MAAM,IAAI,GAAI,KAA+B,EAAE,UAAU,CAAC;IAC1D,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,QAAQ,CAAC,GAAmB,EAAE,UAAkB,EAAE,IAAa;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAClD,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAmB;IACnD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAoB,EAAE,GAAmB;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;IACpE,gFAAgF;IAChF,+EAA+E;IAC/E,oFAAoF;IACpF,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,2CAA2C,CAAC,CAAC;IAC3F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,OAAe,EAAE,aAAqB;IACnF,OAAO,GAAG,KAAK,eAAe,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,aAAa,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,QAAgB;IACrE,OAAO,qBAAqB,CAAC,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAoB,EACpB,GAAmB,EACnB,GAAW,EACX,MAAgB;IAEhB,+BAA+B;IAC/B,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzB,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACvC,QAAQ,EAAE,eAAe;QACzB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC1B,SAAS;QACT,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAA0C;IAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;SAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,EAAE,IAAI,EAAE;SACP,WAAW,EAAE,CAAC;IACjB,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACpD,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAyB;IACtF,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,MAAM,cAAc,GAAG,MAAM,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAEvD,0DAA0D;IAC1D,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,IAAI,GAAG,CAAC,CAAC;QAC5D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,4BAA4B,CAAC,CAAC;QAC5E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6CAA6C,CAAC,CAAC;QAC7F,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAA0B;IAC9D,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAEpE,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,YAAY,GAAkB,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE;QACxE,QAAQ,EAAE,MAAM;QAChB,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE;QAChC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7C,eAAe,EAAE,MAAM,CAAC,SAAS,KAAK,SAAS;KAChD,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,IAAI,WAAW,CAAC;IACpD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,mBAAmB,IAAI,SAAS,CAAC;IAC3D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,IAAI,mBAAmB,CAAC;IAElE,qCAAqC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB;QACzC,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,iBAAiB;YAClC,WAAW,EAAE,MAAM,CAAC,oBAAoB;YACxC,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;YACxC,6DAA6D;YAC7D,cAAc,EAAE,MAAM,CAAC,uBAAuB;SAC/C,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC;IAET,6BAA6B;IAC7B,MAAM,cAAc,GAAG,oBAAoB,CAAC;QAC1C,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,cAAc;QACjC,MAAM,EAAE,MAAM,CAAC,UAAU;QACzB,QAAQ,EAAE,MAAM,CAAC,YAAY;KAC9B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,IAAI,eAAe,GAA2B,IAAI,CAAC;IACnD,IAAI,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,eAAe,GAAG,IAAI,eAAe,CAAC;YACpC,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,OAAO,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oEAAoE,EAAE;gBAChF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,eAAe,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,IAAI;QACJ,QAAQ;QACR,SAAS,EAAE,QAAQ;QACnB,OAAO;QACP,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;QAC/D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,CAAC,CAAC,QAAQ;QACrB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,aAAa,EAAE,MAAM,CAAC,gBAAgB,IAAI,CAAC,CAAC,eAAe;KAC5D,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAoB,EAAE,WAA2B,EAAE,EAAE;QAC1F,4CAA4C;QAC5C,MAAM,EAAE,GAAG,EAAE,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QAEpD,mDAAmD;QACnD,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAE1B,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAElC,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;gBACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,mFAAmF;QACnF,8EAA8E;QAC9E,6EAA6E;QAC7E,IAAI,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC;YACnD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3B,CAAC;QAED,6DAA6D;QAC7D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,CAAC,wCAAwC;YAClD,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,2CAA2C;QACrD,CAAC;QAED,qCAAqC;QACrC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAE7B,IAAI,CAAC;YACH,wBAAwB;YACxB,IAAI,MAAM,CAAC,qBAAqB,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvD,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,kCAAkC;YAClC,IAAI,MAAM,CAAC,gBAAgB,IAAI,eAAe,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACzB,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBACzB,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YAED,qDAAqD;YACrD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;gBACpD,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACzB,kFAAkF;gBAClF,mFAAmF;gBACnF,iFAAiF;gBACjF,yFAAyF;gBACzF,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;gBACvE,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;gBAC3E,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;gBAC5D,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,wEAAwE;YACxE,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvC,QAAQ,EAAE,YAAY;oBACtB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE;oBACvC,SAAS;oBACT,QAAQ;iBACT,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,2CAA2C;YAC3C,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAuB,CAAC;gBACtE,MAAM,aAAa,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAEtE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrE,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAClG,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;gBAEtF,IAAI,KAAK,IAAI,MAAM,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;gBACjC,CAAC;gBACD,OAAO;YACT,CAAC;YAED,YAAY;YACZ,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qDAAqD;YACrD,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;gBACrG,CAAC;gBACD,OAAO;YACT,CAAC;YAED,gFAAgF;YAChF,4EAA4E;YAC5E,oEAAoE;YACpE,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;gBACjC,KAAK;gBACL,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG;aACJ,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,sEAAsE;gBACtE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;oBACjB,KAAK,EAAE,uBAAuB;oBAC9B,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;iBAC9B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,kCAAkC;IACpE,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC,CAAG,sCAAsC;IACxE,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC,CAAE,qCAAqC;IACvE,MAAM,CAAC,oBAAoB,GAAG,CAAC,CAAC,CAAE,4CAA4C;IAE9E,4BAA4B;IAC5B,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;QAChD,IAAI,cAAc;YAAE,OAAO;QAC3B,cAAc,GAAG,IAAI,CAAC;QAEtB,MAAM,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAExE,yBAAyB;QACzB,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAC7B,CAAC;gBACD,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACxE,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBAChC,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,CAAC;QAEjB,yBAAyB;QACzB,IAAI,eAAe,EAAE,CAAC;YACpB,eAAe,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QAED,oBAAoB;QACpB,IAAI,WAAW,EAAE,CAAC;YAChB,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,oBAAoB;QACpB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAClC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,kBAAkB;IAClB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;gBACnC,IAAI;gBACJ,QAAQ;gBACR,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,GAAG,OAAO,EAAE;gBAC3C,SAAS,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;gBAC/F,YAAY,EAAE,MAAM,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,QAAQ,IAAI,IAAI,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS;aACpH,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/infra/actions.d.ts CHANGED Viewed

@@ -15,6 +15,13 @@ export interface RestAction {
     bearerToken?: string;
     /** Per-action timeout; some actions (watchtower update = image pulls) run long. */
     timeoutMs?: number;
+    /**
+     * Minimum interval between firings of THIS action (rate limit). Defaults to
+     * 60s when unset; 0 disables. Caps the blast radius of a prompt-injected
+     * model looping a legitimate action (deploy storms / endpoint DoS) — the
+     * name-only lookup already stops forged actions; this stops repeated real ones.
+     */
+    cooldownMs?: number;
 }
 /**
  * Parse MCP_REST_ACTIONS (JSON):

package/dist/tools/infra/actions.js CHANGED Viewed

@@ -12,6 +12,8 @@ const actionSchema = z.object({
     url: z.string().url({ message: 'each action needs a valid http(s) url' }),
     bearerToken: z.string().min(1).optional(),
     timeoutMs: z.number().int().min(1000).max(300_000).optional(),
+    // 0 = explicitly disabled; capped at 24h so a config typo can't brick an action.
+    cooldownMs: z.number().int().min(0).max(86_400_000).optional(),
 });
 /**
  * Parse MCP_REST_ACTIONS (JSON):

package/dist/tools/infra/actions.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"actions.js","sourceRoot":"","sources":["../../../src/tools/infra/actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;~~AAqBxB~~;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;~~CAChE~~,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CACX,8GAA8G,CACjH,CAAC;IACN,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,OAAO,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAC;IAE9F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACX,yCAAyC,IAAI,iBAAiB,mBAAmB,CAAC,MAAM,EAAE,CAC7F,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,kCAAkC,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC"}
1	+ {"version":3,"file":"actions.js","sourceRoot":"","sources":["../../../src/tools/infra/actions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA4BxB;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;IACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAC7D,iFAAiF;IACjF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAuB;IACpD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CACX,8GAA8G,CACjH,CAAC;IACN,CAAC;IAED,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,OAAO,GAA+B,MAAM,CAAC,MAAM,CAAC,IAAI,CAA+B,CAAC;IAE9F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACX,yCAAyC,IAAI,iBAAiB,mBAAmB,CAAC,MAAM,EAAE,CAC7F,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,kCAAkC,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/tools/infra/index.d.ts CHANGED Viewed

@@ -15,4 +15,6 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { RestAction } from './actions.js';
 export type { RestAction } from './actions.js';
 export { parseRestActions } from './actions.js';
+/** Test hook: clear the process-wide cooldown state between test cases. */
+export declare function resetActionCooldowns(): void;
 export declare function registerInfraTools(server: McpServer, actions: Record<string, RestAction>): number;

package/dist/tools/infra/index.js CHANGED Viewed

@@ -19,6 +19,24 @@ export { parseRestActions } from './actions.js';
 const DEFAULT_TIMEOUT_MS = 120_000;
 /** Cap on response bytes surfaced to the caller (anti context-flooding). */
 const MAX_RESPONSE_CHARS = 500;
+/** Default per-action cooldown (override per action via `cooldownMs`; 0 disables). */
+const DEFAULT_COOLDOWN_MS = 60_000;
+/**
+ * Last-fired timestamps per action name — the rate limiter's whole state.
+ *
+ * MODULE-level on purpose: the HTTP server registers tools per SESSION, so a
+ * closure-scoped map would give every new session a fresh cooldown (trivially
+ * bypassed by reconnecting). One process = one store. In-memory is correct for
+ * this single-process server; the check-and-claim below runs synchronously
+ * before any await, so two racing calls cannot both pass (no TOCTOU on the
+ * event loop). Resets on restart — acceptable: a restart itself takes longer
+ * than the default cooldown.
+ */
+const lastFired = new Map();
+/** Test hook: clear the process-wide cooldown state between test cases. */
+export function resetActionCooldowns() {
+    lastFired.clear();
+}
 export function registerInfraTools(server, actions) {
     const names = Object.keys(actions);
     if (names.length === 0) {
@@ -51,6 +69,20 @@ export function registerInfraTools(server, actions) {
             throw new Error(`Unknown action '${action}'. Available actions: ${names.join(', ')}`);
         }
         const spec = actions[action];
+        // Rate limit: check-and-CLAIM synchronously before the fetch, so the
+        // slot is consumed even when the call fails (no hammering a dying
+        // endpoint), and two racing calls can't both pass.
+        const cooldownMs = spec.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+        if (cooldownMs > 0) {
+            const now = Date.now();
+            const elapsed = now - (lastFired.get(action) ?? Number.NEGATIVE_INFINITY);
+            if (elapsed < cooldownMs) {
+                const retryInS = Math.ceil((cooldownMs - elapsed) / 1000);
+                throw new Error(`Action '${action}' is cooling down — try again in ~${String(retryInS)}s. ` +
+                    'Repeated firing of infrastructure actions is rate-limited by design.');
+            }
+            lastFired.set(action, now);
+        }
         logger.info('Invoking registered REST action', { action, method: spec.method, url: spec.url });
         const response = await fetch(spec.url, {
             method: spec.method,

package/dist/tools/infra/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/infra/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,GAAG,CAAC;~~AAE~~/B,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,OAAmC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACP,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3C,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,EAAE,mCAAmC,CAAC;aAC5C,QAAQ,CAAC,yDAAyD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KAC7F,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CACf,cAAc,EACd;QACI,WAAW,EACP,iGAAiG;YACjG,yFAAyF;YACzF,sBAAsB,SAAS,IAAI;YACnC,wGAAwG;QAC5G,WAAW,EAAE,WAAW,CAAC,KAAK;KACjC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACjD,uEAAuE;QACvE,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7B,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YACvF,mEAAmE;YACnE,kDAAkD;YAClD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACpE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO,YAAY,CAAC;YAChB,MAAM;YACN,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,IAAI,SAAS;SAC9B,CAAC,CAAC;IACP,CAAC,EACG,UAAU,CAAC,KAAK,CACnB,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACb,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/infra/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB;IAChC,SAAS,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAiB,EAAE,OAAmC;IACrF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,KAAK;SAClB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACP,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3C,OAAO,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEhB,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;QACzB,MAAM,EAAE,CAAC;aACJ,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,EAAE,EAAE,mCAAmC,CAAC;aAC5C,QAAQ,CAAC,yDAAyD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KAC7F,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CACf,cAAc,EACd;QACI,WAAW,EACP,iGAAiG;YACjG,yFAAyF;YACzF,sBAAsB,SAAS,IAAI;YACnC,wGAAwG;QAC5G,WAAW,EAAE,WAAW,CAAC,KAAK;KACjC,EACD,eAAe,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QACjD,uEAAuE;QACvE,kEAAkE;QAClE,8CAA8C;QAC9C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,yBAAyB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAE7B,qEAAqE;QACrE,kEAAkE;QAClE,mDAAmD;QACnD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC1D,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1E,IAAI,OAAO,GAAG,UAAU,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACX,WAAW,MAAM,qCAAqC,MAAM,CAAC,QAAQ,CAAC,KAAK;oBAC3E,sEAAsE,CACzE,CAAC;YACN,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAE/F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;YACvF,mEAAmE;YACnE,kDAAkD;YAClD,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SACpE,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAElF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,mBAAmB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7G,CAAC;QAED,OAAO,YAAY,CAAC;YAChB,MAAM;YACN,MAAM,EAAE,WAAW;YACnB,UAAU,EAAE,QAAQ,CAAC,MAAM;YAC3B,QAAQ,EAAE,IAAI,IAAI,SAAS;SAC9B,CAAC,CAAC;IACP,CAAC,EACG,UAAU,CAAC,KAAK,CACnB,CACJ,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACb,CAAC"}

package/dist/version.d.ts CHANGED Viewed

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export declare const VERSION = "1.7.0";
+export declare const VERSION = "1.7.2";

package/dist/version.js CHANGED Viewed

@@ -2,5 +2,5 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.7.0';
+export const VERSION = '1.7.2';
 //# sourceMappingURL=version.js.map

package/docs/CHANGELOG.md CHANGED Viewed

@@ -1,3 +1,24 @@
+### 1.7.2
+**Fix — a malformed request body now returns 400 Bad Request, not 500.** A client that
+sends invalid JSON (e.g. bash-style `\"` escaping from a Windows shell that the shell
+doesn't strip) was met with `500 Internal Server Error`, masking a client mistake as a
+server fault. `parseBody` now tags a JSON parse failure `400` and the request handler
+surfaces `400 Bad Request` with the parse detail (safe — it describes the client's own
+body, not our internals). Oversize bodies still return `413`; genuine faults still `500`.
+**Security — cleared every high/moderate advisory in the production dependency tree.**
+Five transitive/direct packages bumped to already-in-range patched releases — no
+`overrides`, no hard-dep downgrades, `package.json` unchanged (npm audit `--omit=dev`
+now reports 0 vulnerabilities):
+- `ip-address` 10.2.0 → 10.5.0 (SSRF / trust-boundary bypass; via express-rate-limit, unused by us)
+- `fast-uri` 3.1.3 → 3.1.6 (via ajv)
+- `@hono/node-server` 1.19.14 → 1.19.17 (Windows path traversal in serve-static)
+- `hono` 4.12.29 → 4.13.3 (algorithmic-complexity DoS in language middleware)
+- `undici` 6.27.0 → 6.28.0 (our direct dep)
+Remaining `npm audit` findings are dev-only tooling (esbuild/vitest/tsx) that never ship
+in the runtime image.
 ### 1.5.4
 **Improvement — actionable error hints so agents self-correct instead of stalling.**
 Not-found / invalid-input errors now carry a next-step pointer toward the tool that

package/openapi.json CHANGED Viewed

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Home Assistant MCP Wrapper",
-    "version": "1.7.0",
+    "version": "1.7.2",
     "description": "REST endpoints that wrap MCP tools for Home Assistant integration. Raw JSON-RPC passthrough available at POST / for n8n compatibility."
   },
   "servers": [

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@coffeerunhobby/mcp-ha-connect",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Smart home MCP server for Home Assistant plus Local AI integration",
   "type": "module",
   "main": "dist/index.js",

package/src/server/http.ts CHANGED Viewed

@@ -112,7 +112,11 @@ export function parseBody(req: IncomingMessage, maxBytes: number = MAX_BODY_BYTE
       try {
         resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
       } catch (error) {
-        reject(new Error(`Invalid JSON: ${(error as Error).message}`));
+        // A malformed body is a client mistake, not a server fault: tag it 400 so
+        // the request handler surfaces "400 Bad Request" instead of a generic 500.
+        const err: HttpError = new Error(`Invalid JSON: ${(error as Error).message}`);
+        err.statusCode = 400;
+        reject(err);
       }
     });
@@ -473,6 +477,16 @@ export async function startHttpServer(options: HttpServerOptions): Promise<void>
         return;
       }
+      // A malformed request body is the client's fault, not ours: return 400 with the
+      // parse detail (which is safe — it describes the client's own JSON, not our
+      // internals) rather than masking it as a 500 Internal Server Error.
+      if (errorStatusCode(error) === 400) {
+        if (!res.headersSent) {
+          sendJson(res, 400, { error: 'Bad Request', message: (error as Error).message });
+        }
+        return;
+      }
       logger.error('HTTP request error', {
         error,
         method: req.method,

package/src/tools/infra/actions.ts CHANGED Viewed

@@ -17,6 +17,13 @@ export interface RestAction {
     bearerToken?: string;
     /** Per-action timeout; some actions (watchtower update = image pulls) run long. */
     timeoutMs?: number;
+    /**
+     * Minimum interval between firings of THIS action (rate limit). Defaults to
+     * 60s when unset; 0 disables. Caps the blast radius of a prompt-injected
+     * model looping a legitimate action (deploy storms / endpoint DoS) — the
+     * name-only lookup already stops forged actions; this stops repeated real ones.
+     */
+    cooldownMs?: number;
 }
 /**
@@ -33,6 +40,8 @@ const actionSchema = z.object({
     url: z.string().url({ message: 'each action needs a valid http(s) url' }),
     bearerToken: z.string().min(1).optional(),
     timeoutMs: z.number().int().min(1000).max(300_000).optional(),
+    // 0 = explicitly disabled; capped at 24h so a config typo can't brick an action.
+    cooldownMs: z.number().int().min(0).max(86_400_000).optional(),
 });
 /**

package/src/tools/infra/index.ts CHANGED Viewed

@@ -27,6 +27,26 @@ export { parseRestActions } from './actions.js';
 const DEFAULT_TIMEOUT_MS = 120_000;
 /** Cap on response bytes surfaced to the caller (anti context-flooding). */
 const MAX_RESPONSE_CHARS = 500;
+/** Default per-action cooldown (override per action via `cooldownMs`; 0 disables). */
+const DEFAULT_COOLDOWN_MS = 60_000;
+/**
+ * Last-fired timestamps per action name — the rate limiter's whole state.
+ *
+ * MODULE-level on purpose: the HTTP server registers tools per SESSION, so a
+ * closure-scoped map would give every new session a fresh cooldown (trivially
+ * bypassed by reconnecting). One process = one store. In-memory is correct for
+ * this single-process server; the check-and-claim below runs synchronously
+ * before any await, so two racing calls cannot both pass (no TOCTOU on the
+ * event loop). Resets on restart — acceptable: a restart itself takes longer
+ * than the default cooldown.
+ */
+const lastFired = new Map<string, number>();
+/** Test hook: clear the process-wide cooldown state between test cases. */
+export function resetActionCooldowns(): void {
+    lastFired.clear();
+}
 export function registerInfraTools(server: McpServer, actions: Record<string, RestAction>): number {
     const names = Object.keys(actions);
@@ -68,6 +88,23 @@ export function registerInfraTools(server: McpServer, actions: Record<string, Re
             }
             const spec = actions[action];
+            // Rate limit: check-and-CLAIM synchronously before the fetch, so the
+            // slot is consumed even when the call fails (no hammering a dying
+            // endpoint), and two racing calls can't both pass.
+            const cooldownMs = spec.cooldownMs ?? DEFAULT_COOLDOWN_MS;
+            if (cooldownMs > 0) {
+                const now = Date.now();
+                const elapsed = now - (lastFired.get(action) ?? Number.NEGATIVE_INFINITY);
+                if (elapsed < cooldownMs) {
+                    const retryInS = Math.ceil((cooldownMs - elapsed) / 1000);
+                    throw new Error(
+                        `Action '${action}' is cooling down — try again in ~${String(retryInS)}s. ` +
+                        'Repeated firing of infrastructure actions is rate-limited by design.'
+                    );
+                }
+                lastFired.set(action, now);
+            }
             logger.info('Invoking registered REST action', { action, method: spec.method, url: spec.url });
             const response = await fetch(spec.url, {

package/src/version.ts CHANGED Viewed

@@ -2,4 +2,4 @@
  * Package version - hardcoded at build time for reliability
  * Keep in sync with package.json version
  */
-export const VERSION = '1.7.0';
+export const VERSION = '1.7.2';

package/tests/security/resourceConsumption.test.ts CHANGED Viewed

@@ -129,5 +129,14 @@ describe('SEC-DOS — Unrestricted Resource Consumption', () => {
       await expect(parseBody(req, 1024)).rejects.toMatchObject({ statusCode: 413 });
       expect(req.destroy).toHaveBeenCalled();
     });
+    it('rejects a malformed JSON body with a client-side 400, not a 500', async () => {
+      // A body the client mis-escaped (e.g. bash-style `\"` from a Windows shell)
+      // arrives as invalid JSON. It is the client's fault, so parseBody tags it 400
+      // and the request handler surfaces "400 Bad Request" instead of a generic 500.
+      const req = streamingReq([Buffer.from('{\\"jsonrpc\\":\\"2.0\\"}')]);
+      await expect(parseBody(req)).rejects.toMatchObject({ statusCode: 400 });
+    });
   });
 });

package/tests/tools/infra/invokeAction.test.ts CHANGED Viewed

@@ -11,7 +11,7 @@
 import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { registerInfraTools, parseRestActions } from '../../../src/tools/infra/index.js';
+import { registerInfraTools, parseRestActions, resetActionCooldowns } from '../../../src/tools/infra/index.js';
 import { Permission } from '../../../src/tools/common.js';
 describe('parseRestActions', () => {
@@ -88,6 +88,9 @@ describe('invokeAction tool', () => {
     beforeEach(() => {
         fetchSpy = vi.spyOn(globalThis, 'fetch');
+        // The cooldown store is process-wide (module-level by design — sessions
+        // must share it); clear it so cases can't poison each other.
+        resetActionCooldowns();
     });
     afterEach(() => {
@@ -181,6 +184,86 @@ describe('invokeAction tool', () => {
         expect(result.content[0].text.length).toBeLessThan(700); // 500-char cap + wrapper
     });
+    it('rate-limits: a second firing within the cooldown is rejected without touching the network', async () => {
+        fetchSpy.mockResolvedValue(new Response('OK', { status: 200 }));
+        const server = createMockServer();
+        registerInfraTools(server, ACTIONS);
+        const { handler } = server.handlers.get('invokeAction')!;
+        const first = (await handler({ action: 'update-node-u2' }, adminExtra)) as { isError?: boolean };
+        expect(first.isError).toBeFalsy();
+        const second = (await handler({ action: 'update-node-u2' }, adminExtra)) as { isError?: boolean; content: Array<{ text: string }> };
+        expect(second.isError).toBe(true);
+        expect(second.content[0].text).toMatch(/cooling down/);
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+    });
+    it('rate-limits per action: cooling one action does not block another', async () => {
+        fetchSpy.mockResolvedValue(new Response('OK', { status: 200 }));
+        const server = createMockServer();
+        registerInfraTools(server, ACTIONS);
+        const { handler } = server.handlers.get('invokeAction')!;
+        await handler({ action: 'update-node-u2' }, adminExtra);
+        const other = (await handler({ action: 'ping-webhook' }, adminExtra)) as { isError?: boolean };
+        expect(other.isError).toBeFalsy();
+        expect(fetchSpy).toHaveBeenCalledTimes(2);
+    });
+    it('allows firing again once the cooldown has elapsed', async () => {
+        vi.useFakeTimers();
+        try {
+            fetchSpy.mockResolvedValue(new Response('OK', { status: 200 }));
+            const server = createMockServer();
+            registerInfraTools(server, ACTIONS);
+            const { handler } = server.handlers.get('invokeAction')!;
+            await handler({ action: 'update-node-u2' }, adminExtra);
+            vi.advanceTimersByTime(60_001); // default cooldown is 60s
+            const again = (await handler({ action: 'update-node-u2' }, adminExtra)) as { isError?: boolean };
+            expect(again.isError).toBeFalsy();
+            expect(fetchSpy).toHaveBeenCalledTimes(2);
+        } finally {
+            vi.useRealTimers();
+        }
+    });
+    it('a FAILED firing still consumes the cooldown slot (no hammering a dying endpoint)', async () => {
+        fetchSpy.mockResolvedValue(new Response('boom', { status: 503 }));
+        const server = createMockServer();
+        registerInfraTools(server, ACTIONS);
+        const { handler } = server.handlers.get('invokeAction')!;
+        const first = (await handler({ action: 'update-node-u2' }, adminExtra)) as { isError?: boolean };
+        expect(first.isError).toBe(true); // HTTP 503 surfaced
+        const retry = (await handler({ action: 'update-node-u2' }, adminExtra)) as { isError?: boolean; content: Array<{ text: string }> };
+        expect(retry.isError).toBe(true);
+        expect(retry.content[0].text).toMatch(/cooling down/);
+        expect(fetchSpy).toHaveBeenCalledTimes(1);
+    });
+    it('cooldownMs: 0 disables the rate limit for that action', async () => {
+        fetchSpy.mockResolvedValue(new Response('OK', { status: 200 }));
+        const noCooldown = parseRestActions(
+            '{"rapid":{"url":"http://192.168.0.9:1/x","cooldownMs":0}}'
+        );
+        const server = createMockServer();
+        registerInfraTools(server, noCooldown);
+        const { handler } = server.handlers.get('invokeAction')!;
+        await handler({ action: 'rapid' }, adminExtra);
+        const second = (await handler({ action: 'rapid' }, adminExtra)) as { isError?: boolean };
+        expect(second.isError).toBeFalsy();
+        expect(fetchSpy).toHaveBeenCalledTimes(2);
+    });
+    it('rejects invalid cooldownMs at config parse', () => {
+        expect(() => parseRestActions('{"a":{"url":"http://h:1/x","cooldownMs":-1}}')).toThrow(/Invalid MCP_REST_ACTIONS entry/);
+        expect(() => parseRestActions('{"a":{"url":"http://h:1/x","cooldownMs":999999999}}')).toThrow(/Invalid MCP_REST_ACTIONS entry/);
+        expect(parseRestActions('{"a":{"url":"http://h:1/x","cooldownMs":30000}}')['a'].cooldownMs).toBe(30000);
+    });
     it('denies callers without the ADMIN permission bit', async () => {
         const server = createMockServer();
         registerInfraTools(server, ACTIONS);