@defai.digital/mcp-runtime 13.0.3

package/dist/validation/request-validator.js

@@ -0,0 +1,151 @@
+import { DEFAULT_REQUEST_LIMITS, TOOL_ARRAY_FIELDS, getArrayLimit, } from '@defai.digital/contracts';
+/**
+ * Validate request against limits.
+ *
+ * Invariants enforced:
+ * - INV-MCP-LIMIT-001: Array size enforcement
+ * - INV-MCP-LIMIT-002: Early rejection
+ * - INV-MCP-LIMIT-003: Tool-specific limits
+ * - INV-MCP-LIMIT-004: Descriptive errors
+ */
+export function validateRequest(toolName, args, limits = DEFAULT_REQUEST_LIMITS) {
+    const errors = [];
+    // Validate request size
+    const requestSize = estimateRequestSize(args);
+    if (requestSize > limits.maxRequestBytes) {
+        errors.push({
+            path: '$',
+            code: 'REQUEST_TOO_LARGE',
+            message: `Request size (${requestSize} bytes) exceeds limit (${limits.maxRequestBytes} bytes)`,
+            limit: limits.maxRequestBytes,
+            actual: requestSize,
+        });
+    }
+    // Validate arrays and strings recursively
+    validateValue(args, '$', toolName, limits, errors, 0);
+    if (errors.length > 0) {
+        return { valid: false, errors };
+    }
+    return { valid: true };
+}
+/**
+ * Recursively validate a value against limits.
+ */
+function validateValue(value, path, toolName, limits, errors, depth) {
+    // Check depth
+    if (depth > limits.maxObjectDepth) {
+        errors.push({
+            path,
+            code: 'OBJECT_TOO_DEEP',
+            message: `Object depth (${depth}) exceeds limit (${limits.maxObjectDepth})`,
+            limit: limits.maxObjectDepth,
+            actual: depth,
+        });
+        return;
+    }
+    if (Array.isArray(value)) {
+        validateArray(value, path, toolName, limits, errors, depth);
+    }
+    else if (typeof value === 'string') {
+        validateString(value, path, limits, errors);
+    }
+    else if (value !== null && typeof value === 'object') {
+        validateObject(value, path, toolName, limits, errors, depth);
+    }
+}
+/**
+ * Validate an array against limits.
+ *
+ * INV-MCP-LIMIT-001: Array size enforcement.
+ * INV-MCP-LIMIT-003: Tool-specific limits.
+ */
+function validateArray(arr, path, toolName, limits, errors, depth) {
+    // Get field name from path (last segment)
+    const fieldName = path.split('.').pop() ?? '';
+    // Check if this field has tool-specific limits
+    const toolArrayFields = TOOL_ARRAY_FIELDS[toolName] ?? [];
+    const isKnownArrayField = toolArrayFields.includes(fieldName);
+    // Get the appropriate limit
+    const arrayLimit = isKnownArrayField
+        ? getArrayLimit(toolName, fieldName, limits)
+        : limits.maxArraySize;
+    if (arr.length > arrayLimit) {
+        errors.push({
+            path,
+            code: 'ARRAY_TOO_LARGE',
+            message: `Array at '${path}' has ${arr.length} items, exceeds limit of ${arrayLimit}`,
+            limit: arrayLimit,
+            actual: arr.length,
+        });
+    }
+    // Validate array items (with depth + 1)
+    for (let i = 0; i < Math.min(arr.length, 100); i++) {
+        validateValue(arr[i], `${path}[${i}]`, toolName, limits, errors, depth + 1);
+    }
+}
+/**
+ * Validate a string against limits.
+ */
+function validateString(str, path, limits, errors) {
+    if (str.length > limits.maxStringLength) {
+        errors.push({
+            path,
+            code: 'STRING_TOO_LONG',
+            message: `String at '${path}' has ${str.length} characters, exceeds limit of ${limits.maxStringLength}`,
+            limit: limits.maxStringLength,
+            actual: str.length,
+        });
+    }
+}
+/**
+ * Validate an object against limits.
+ */
+function validateObject(obj, path, toolName, limits, errors, depth) {
+    for (const [key, value] of Object.entries(obj)) {
+        const childPath = path === '$' ? key : `${path}.${key}`;
+        validateValue(value, childPath, toolName, limits, errors, depth + 1);
+    }
+}
+/**
+ * Estimate request size in bytes.
+ */
+function estimateRequestSize(value) {
+    try {
+        const json = JSON.stringify(value);
+        return json.length * 2; // Approximate UTF-8 size
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Create a validation middleware for tool handlers.
+ *
+ * INV-MCP-LIMIT-002: Early rejection.
+ */
+export function createValidationMiddleware(limits = DEFAULT_REQUEST_LIMITS) {
+    return function validateToolRequest(toolName, args) {
+        return validateRequest(toolName, args, limits);
+    };
+}
+/**
+ * Check if a validation result indicates success.
+ */
+export function isValidRequest(result) {
+    return result.valid;
+}
+/**
+ * Format validation errors for display.
+ */
+export function formatValidationErrors(errors) {
+    return errors
+        .map((e) => {
+        let msg = `${e.path}: ${e.message}`;
+        if (e.limit !== undefined && e.actual !== undefined) {
+            msg += ` (limit: ${e.limit}, actual: ${e.actual})`;
+        }
+        return msg;
+    })
+        .join('\n');
+}
+//# sourceMappingURL=request-validator.js.map

package/dist/validation/request-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-validator.js","sourceRoot":"","sources":["../../src/validation/request-validator.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAgB,EAChB,IAAa,EACb,SAA2B,sBAAsB;IAEjD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,wBAAwB;IACxB,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,WAAW,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,GAAG;YACT,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,iBAAiB,WAAW,0BAA0B,MAAM,CAAC,eAAe,SAAS;YAC9F,KAAK,EAAE,MAAM,CAAC,eAAe;YAC7B,MAAM,EAAE,WAAW;SACpB,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEtD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CACpB,KAAc,EACd,IAAY,EACZ,QAAgB,EAChB,MAAwB,EACxB,MAAyB,EACzB,KAAa;IAEb,cAAc;IACd,IAAI,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,iBAAiB,KAAK,oBAAoB,MAAM,CAAC,cAAc,GAAG;YAC3E,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;SAAM,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvD,cAAc,CAAC,KAAgC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,GAAc,EACd,IAAY,EACZ,QAAgB,EAChB,MAAwB,EACxB,MAAyB,EACzB,KAAa;IAEb,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAE9C,+CAA+C;IAC/C,MAAM,eAAe,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,iBAAiB,GAAG,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE9D,4BAA4B;IAC5B,MAAM,UAAU,GAAG,iBAAiB;QAClC,CAAC,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;IAExB,IAAI,GAAG,CAAC,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,aAAa,IAAI,SAAS,GAAG,CAAC,MAAM,4BAA4B,UAAU,EAAE;YACrF,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACnD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,GAAW,EACX,IAAY,EACZ,MAAwB,EACxB,MAAyB;IAEzB,IAAI,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI;YACJ,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,cAAc,IAAI,SAAS,GAAG,CAAC,MAAM,iCAAiC,MAAM,CAAC,eAAe,EAAE;YACvG,KAAK,EAAE,MAAM,CAAC,eAAe;YAC7B,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,GAA4B,EAC5B,IAAY,EACZ,QAAgB,EAChB,MAAwB,EACxB,MAAyB,EACzB,KAAa;IAEb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;QACxD,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,yBAAyB;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAA2B,sBAAsB;IAEjD,OAAO,SAAS,mBAAmB,CACjC,QAAgB,EAChB,IAAa;QAEb,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,MAAwB;IACrD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpD,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;QACrD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@defai.digital/mcp-runtime",
+  "version": "13.0.3",
+  "type": "module",
+  "description": "MCP runtime domain - cache, timeout, response helpers, and request validation",
+  "license": "Apache-2.0",
+  "author": "DEFAI Private Limited",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/defai-digital/automatosx.git",
+    "directory": "packages/core/mcp-runtime"
+  },
+  "homepage": "https://github.com/defai-digital/automatosx#readme",
+  "bugs": {
+    "url": "https://github.com/defai-digital/automatosx/issues"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@defai.digital/contracts": "13.0.3"
+  },
+  "scripts": {
+    "build": "tsc --build",
+    "clean": "rm -rf dist *.tsbuildinfo"
+  }
+}