@forestadmin/mcp-server 1.21.1 → 1.22.1

package/dist/tools/request-action-file-upload.js

@@ -0,0 +1,162 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = declareRequestActionFileUploadTool;
+const crypto = __importStar(require("crypto"));
+const zod_1 = require("zod");
+const file_reference_1 = require("../file-uploads/file-reference");
+const handles_1 = require("../file-uploads/handles");
+const tool_with_logging_1 = __importDefault(require("../utils/tool-with-logging"));
+const MIME_TYPE_PATTERN = /^[\w.+-]+\/[\w.+-]+$/;
+const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/i;
+const SHA256_BASE64_PATTERN = /^[A-Za-z0-9+/]{43}=$/;
+const MAX_FILENAME_LENGTH = 128;
+const REQUIRED_SCOPE = 'mcp:action';
+// Names the requirement rather than a menu path: the setting that satisfies it is not in the same
+// place in every client, and on a managed workspace the end user may have no access to it at all.
+const UPLOAD_PREREQUISITE = 'Uploading requires an outbound HTTP request from your environment. A hosted code execution ' +
+    'sandbox runs on its own network and reaches only allowed hosts, so the host of uploadUrl must ' +
+    'be publicly reachable — a localhost or private address never is from there — and allowed for ' +
+    'outbound traffic in that environment. Where that is configured depends on the client, and on a ' +
+    'managed workspace it may be an administrator setting rather than a user one. A blocked or ' +
+    'unreachable request is a client configuration issue, not an expired handle: report it as such ' +
+    'instead of requesting another destination.';
+// The storage key delimits segments with '/', so keep a conservative charset. Truncation keeps
+// the tail so the extension survives. A name made only of dots would let a backend that joins
+// paths climb out of the per-upload directory.
+function sanitizeFilename(filename) {
+    const safe = filename
+        .trim()
+        .slice(-MAX_FILENAME_LENGTH)
+        // Unicode-aware: ASCII \w turns `facture-été.pdf` into `facture-_t_.pdf`, so the accented
+        // letters vanish while the spaces and parentheses survive. Same key safety, no `/`.
+        .replace(/[^\p{L}\p{N}._\- ()]/gu, '_');
+    return !safe || /^\.+$/.test(safe) ? 'file' : safe;
+}
+function normalizeSha256(sha256) {
+    if (!sha256)
+        return undefined;
+    if (SHA256_BASE64_PATTERN.test(sha256))
+        return sha256;
+    if (SHA256_HEX_PATTERN.test(sha256))
+        return Buffer.from(sha256, 'hex').toString('base64');
+    throw new Error('sha256 must be the file digest as hex or base64.');
+}
+function declareRequestActionFileUploadTool(mcpServer, ctx) {
+    const { logger, fileUploads } = ctx;
+    return (0, tool_with_logging_1.default)(mcpServer, 'requestActionFileUpload', {
+        title: 'Request an upload destination for an action file field',
+        description: `Get a destination to upload a file to, then reference it in an action form field.
+
+Call this whenever getActionForm shows a field of type "File" or "FileList". Never inline base64 file content as a field value: it would be far larger than any payload limit.
+
+Workflow:
+1. Compute the file's sha256 and call this tool with the filename, mimeType and sha256. The digest pins the destination to that exact content — without it, on some backends anyone who reads the upload url in a log can replace the bytes before the action runs. Skip it only when you cannot compute a digest.
+2. Upload the raw bytes to the returned uploadUrl, with the returned method and every returned header. Some backends sign a pinned sha256 into a checksum header and reject the upload without it, so apply the headers as returned rather than assuming which ones matter. A pinned digest is re-verified when the action runs either way. The bytes must not pass through this tool or through your own output.
+3. Pass the returned fileHandle string as the value of the file field in executeAction.
+
+${UPLOAD_PREREQUISITE}
+
+The url accepts one upload: to send different bytes, call this tool again for a fresh destination. The handle expires too, so run the upload and the action without a long pause in between.`,
+        inputSchema: {
+            filename: zod_1.z
+                .string()
+                .trim()
+                .min(1)
+                .describe('Original file name, e.g. "invoice-2026-01.pdf".'),
+            mimeType: zod_1.z.string().describe('Media type of the file, e.g. "application/pdf".'),
+            sha256: zod_1.z
+                .string()
+                .optional()
+                .describe('Sha256 digest of the file, hex or base64. Pins the destination to that exact ' +
+                'content; compute it and pass it whenever you can.'),
+        },
+    }, async (options, extra) => {
+        if (!fileUploads) {
+            throw new Error('File uploads are not configured on this server. ' +
+                'Ask the administrator to set the fileUploads option to enable action file fields.');
+        }
+        const userId = extra.authInfo?.extra?.userId;
+        if (userId === undefined || userId === null) {
+            throw new Error('Cannot request a file upload without an authenticated user');
+        }
+        // /mcp only requires mcp:read, but this mints a pre-authorized write into the host's
+        // storage. The route this tool replaced enforced mcp:action, so it is enforced here.
+        if (!extra.authInfo?.scopes?.includes(REQUIRED_SCOPE)) {
+            throw new Error(`Requesting a file upload requires the "${REQUIRED_SCOPE}" scope.`);
+        }
+        if (!MIME_TYPE_PATTERN.test(options.mimeType)) {
+            throw new Error(`"${options.mimeType}" is not a media type. Expected a type/subtype pair, e.g. application/pdf.`);
+        }
+        const sha256Base64 = normalizeSha256(options.sha256);
+        const safeName = sanitizeFilename(options.filename);
+        const key = `${fileUploads.keyPrefix}${crypto.randomUUID()}/${safeName}`;
+        const destination = await fileUploads.storage.createUploadUrl({
+            key,
+            mimeType: options.mimeType,
+            ...(sha256Base64 && { sha256: sha256Base64 }),
+            expiresInSeconds: fileUploads.uploadUrlTtlSeconds,
+        });
+        const handle = (0, handles_1.signUploadHandle)({
+            key,
+            name: safeName,
+            mimeType: options.mimeType,
+            userId,
+            ...(sha256Base64 && { sha256Base64 }),
+        }, fileUploads.authSecret, fileUploads.handleTtlSeconds);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: JSON.stringify({
+                        uploadUrl: destination.url,
+                        method: destination.method ?? 'PUT',
+                        headers: destination.headers ?? { 'Content-Type': options.mimeType },
+                        expiresInSeconds: fileUploads.uploadUrlTtlSeconds,
+                        maxBytes: fileUploads.maxBytes,
+                        fileHandle: `${file_reference_1.UPLOADED_FILE_PREFIX}${handle}`,
+                        // Repeated in the response so the model has the diagnosis in context at the moment
+                        // its upload fails, not only when it first read the tool description.
+                        prerequisite: UPLOAD_PREREQUISITE,
+                    }),
+                },
+            ],
+        };
+    }, logger);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVxdWVzdC1hY3Rpb24tZmlsZS11cGxvYWQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdG9vbHMvcmVxdWVzdC1hY3Rpb24tZmlsZS11cGxvYWQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUF1REEscURBNkdDO0FBaktELCtDQUFpQztBQUNqQyw2QkFBd0I7QUFFeEIsbUVBQXNFO0FBQ3RFLHFEQUEyRDtBQUMzRCxtRkFBaUU7QUFFakUsTUFBTSxpQkFBaUIsR0FBRyxzQkFBc0IsQ0FBQztBQUNqRCxNQUFNLGtCQUFrQixHQUFHLGlCQUFpQixDQUFDO0FBQzdDLE1BQU0scUJBQXFCLEdBQUcsc0JBQXNCLENBQUM7QUFDckQsTUFBTSxtQkFBbUIsR0FBRyxHQUFHLENBQUM7QUFDaEMsTUFBTSxjQUFjLEdBQUcsWUFBWSxDQUFDO0FBRXBDLGtHQUFrRztBQUNsRyxrR0FBa0c7QUFDbEcsTUFBTSxtQkFBbUIsR0FDdkIsNkZBQTZGO0lBQzdGLGdHQUFnRztJQUNoRywrRkFBK0Y7SUFDL0YsaUdBQWlHO0lBQ2pHLDRGQUE0RjtJQUM1RixnR0FBZ0c7SUFDaEcsNENBQTRDLENBQUM7QUFRL0MsK0ZBQStGO0FBQy9GLDhGQUE4RjtBQUM5RiwrQ0FBK0M7QUFDL0MsU0FBUyxnQkFBZ0IsQ0FBQyxRQUFnQjtJQUN4QyxNQUFNLElBQUksR0FBRyxRQUFRO1NBQ2xCLElBQUksRUFBRTtTQUNOLEtBQUssQ0FBQyxDQUFDLG1CQUFtQixDQUFDO1FBQzVCLDBGQUEwRjtRQUMxRixvRkFBb0Y7U0FDbkYsT0FBTyxDQUFDLHdCQUF3QixFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBRTFDLE9BQU8sQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDckQsQ0FBQztBQUVELFNBQVMsZUFBZSxDQUFDLE1BQTBCO0lBQ2pELElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDOUIsSUFBSSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDdEQsSUFBSSxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQUUsT0FBTyxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7SUFFMUYsTUFBTSxJQUFJLEtBQUssQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0FBQ3RFLENBQUM7QUFFRCxTQUF3QixrQ0FBa0MsQ0FDeEQsU0FBb0IsRUFDcEIsR0FBZ0I7SUFFaEIsTUFBTSxFQUFFLE1BQU0sRUFBRSxXQUFXLEVBQUUsR0FBRyxHQUFHLENBQUM7SUFFcEMsT0FBTyxJQUFBLDJCQUF1QixFQUM1QixTQUFTLEVBQ1QseUJBQXlCLEVBQ3pCO1FBQ0UsS0FBSyxFQUFFLHdEQUF3RDtRQUMvRCxXQUFXLEVBQUU7Ozs7Ozs7OztFQVNqQixtQkFBbUI7OzZMQUV3SztRQUN2TCxXQUFXLEVBQUU7WUFDWCxRQUFRLEVBQUUsT0FBQztpQkFDUixNQUFNLEVBQUU7aUJBQ1IsSUFBSSxFQUFFO2lCQUNOLEdBQUcsQ0FBQyxDQUFDLENBQUM7aUJBQ04sUUFBUSxDQUFDLGlEQUFpRCxDQUFDO1lBQzlELFFBQVEsRUFBRSxPQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsUUFBUSxDQUFDLGlEQUFpRCxDQUFDO1lBQ2hGLE1BQU0sRUFBRSxPQUFDO2lCQUNOLE1BQU0sRUFBRTtpQkFDUixRQUFRLEVBQUU7aUJBQ1YsUUFBUSxDQUNQLCtFQUErRTtnQkFDN0UsbURBQW1ELENBQ3REO1NBQ0o7S0FDRixFQUNELEtBQUssRUFBRSxPQUF3QyxFQUFFLEtBQUssRUFBRSxFQUFFO1FBQ3hELElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksS0FBSyxDQUNiLGtEQUFrRDtnQkFDaEQsbUZBQW1GLENBQ3RGLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsTUFBcUMsQ0FBQztRQUU1RSxJQUFJLE1BQU0sS0FBSyxTQUFTLElBQUksTUFBTSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQzVDLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBRUQscUZBQXFGO1FBQ3JGLHFGQUFxRjtRQUNyRixJQUFJLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUM7WUFDdEQsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsY0FBYyxVQUFVLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBRUQsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM5QyxNQUFNLElBQUksS0FBSyxDQUNiLElBQUksT0FBTyxDQUFDLFFBQVEsNEVBQTRFLENBQ2pHLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxZQUFZLEdBQUcsZUFBZSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNyRCxNQUFNLFFBQVEsR0FBRyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDcEQsTUFBTSxHQUFHLEdBQUcsR0FBRyxXQUFXLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxVQUFVLEVBQUUsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUV6RSxNQUFNLFdBQVcsR0FBRyxNQUFNLFdBQVcsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1lBQzVELEdBQUc7WUFDSCxRQUFRLEVBQUUsT0FBTyxDQUFDLFFBQVE7WUFDMUIsR0FBRyxDQUFDLFlBQVksSUFBSSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQztZQUM3QyxnQkFBZ0IsRUFBRSxXQUFXLENBQUMsbUJBQW1CO1NBQ2xELENBQUMsQ0FBQztRQUVILE1BQU0sTUFBTSxHQUFHLElBQUEsMEJBQWdCLEVBQzdCO1lBQ0UsR0FBRztZQUNILElBQUksRUFBRSxRQUFRO1lBQ2QsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLE1BQU07WUFDTixHQUFHLENBQUMsWUFBWSxJQUFJLEVBQUUsWUFBWSxFQUFFLENBQUM7U0FDdEMsRUFDRCxXQUFXLENBQUMsVUFBVSxFQUN0QixXQUFXLENBQUMsZ0JBQWdCLENBQzdCLENBQUM7UUFFRixPQUFPO1lBQ0wsT0FBTyxFQUFFO2dCQUNQO29CQUNFLElBQUksRUFBRSxNQUFlO29CQUNyQixJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQzt3QkFDbkIsU0FBUyxFQUFFLFdBQVcsQ0FBQyxHQUFHO3dCQUMxQixNQUFNLEVBQUUsV0FBVyxDQUFDLE1BQU0sSUFBSSxLQUFLO3dCQUNuQyxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sSUFBSSxFQUFFLGNBQWMsRUFBRSxPQUFPLENBQUMsUUFBUSxFQUFFO3dCQUNwRSxnQkFBZ0IsRUFBRSxXQUFXLENBQUMsbUJBQW1CO3dCQUNqRCxRQUFRLEVBQUUsV0FBVyxDQUFDLFFBQVE7d0JBQzlCLFVBQVUsRUFBRSxHQUFHLHFDQUFvQixHQUFHLE1BQU0sRUFBRTt3QkFDOUMsbUZBQW1GO3dCQUNuRixzRUFBc0U7d0JBQ3RFLFlBQVksRUFBRSxtQkFBbUI7cUJBQ2xDLENBQUM7aUJBQ0g7YUFDRjtTQUNGLENBQUM7SUFDSixDQUFDLEVBQ0QsTUFBTSxDQUNQLENBQUM7QUFDSixDQUFDIn0=

package/dist/utils/load-file-uploads.d.ts

@@ -0,0 +1,14 @@
+import type { FileUploadsOptions } from '../file-uploads/types';
+/**
+ * Loads the `fileUploads` options of the standalone server from a module on disk.
+ *
+ * A storage backend is an object with methods, so it cannot travel through an environment
+ * variable like every other standalone option. Without this, file uploads would be reachable
+ * only by embedding the server in an agent or by writing a custom entry point.
+ *
+ * The module default-exports the options, or a function returning them:
+ *
+ *   module.exports = { storage: myS3Storage, maxBytes: 50 * 1024 * 1024 };
+ */
+export default function loadFileUploads(modulePath?: string): Promise<FileUploadsOptions | undefined>;
+//# sourceMappingURL=load-file-uploads.d.ts.map

package/dist/utils/load-file-uploads.js

@@ -0,0 +1,105 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = loadFileUploads;
+const path = __importStar(require("path"));
+// A module is free to throw a non-Error, and reading .message off it yields undefined.
+const describe = (error) => (error instanceof Error ? error.message : String(error));
+// Attached rather than passed to the constructor: the error cause option needs a newer lib than
+// this package targets, while Node itself carries the property fine.
+const withCause = (message, cause) => Object.assign(new Error(message), { cause });
+/**
+ * Loads the `fileUploads` options of the standalone server from a module on disk.
+ *
+ * A storage backend is an object with methods, so it cannot travel through an environment
+ * variable like every other standalone option. Without this, file uploads would be reachable
+ * only by embedding the server in an agent or by writing a custom entry point.
+ *
+ * The module default-exports the options, or a function returning them:
+ *
+ *   module.exports = { storage: myS3Storage, maxBytes: 50 * 1024 * 1024 };
+ */
+async function loadFileUploads(modulePath) {
+    if (!modulePath)
+        return undefined;
+    const resolved = path.resolve(process.cwd(), modulePath);
+    let loaded;
+    try {
+        // require rather than import(): this package is CommonJS, and Node handles an ESM module here
+        // too, whereas a file:// specifier breaks under the test runner.
+        // eslint-disable-next-line global-require, import/no-dynamic-require, @typescript-eslint/no-var-requires
+        loaded = require(resolved);
+    }
+    catch (error) {
+        // "cannot find it" and "it ran and failed" send the operator to different places, and only the
+        // first is about the path they configured.
+        const absent = error?.code === 'MODULE_NOT_FOUND' &&
+            String(error?.message).includes(resolved);
+        throw withCause(absent
+            ? `FOREST_MCP_UPLOAD_STORAGE_MODULE "${modulePath}" was not found (resolved to ${resolved}).`
+            : `FOREST_MCP_UPLOAD_STORAGE_MODULE "${modulePath}" failed while loading: ${describe(error)}`, error);
+    }
+    const exported = loaded?.default ?? loaded;
+    let options;
+    try {
+        options = (typeof exported === 'function' ? await exported() : exported);
+    }
+    catch (error) {
+        // The sync path above is wrapped; a rejecting factory would otherwise surface with no mention
+        // of the module it came from.
+        throw withCause(`FOREST_MCP_UPLOAD_STORAGE_MODULE "${modulePath}" failed while building the options: ${describe(error)}`, error);
+    }
+    // An object without a storage key is legitimate — it selects the in-memory store. Nothing at all
+    // is a mistake, most likely a module that forgot to export.
+    if (!options || typeof options !== 'object') {
+        throw new Error(`FOREST_MCP_UPLOAD_STORAGE_MODULE "${modulePath}" must export the fileUploads options, or a ` +
+            'function returning them. See the fileUploads section of the mcp-server README.');
+    }
+    // Whoever sets this variable did it *for* the storage: a bad import or a factory that returned
+    // early leaves `{ storage: undefined }`, which the server would silently replace with the
+    // in-memory store — putting a deliberately replicated deployment on the one backend that cannot
+    // serve it. A missing method fails later, on the first user's upload, so it is checked here too.
+    if ('storage' in options) {
+        const storage = options.storage;
+        const missing = ['createUploadUrl', 'download', 'getSize'].filter(method => typeof storage?.[method] !== 'function');
+        if (missing.length) {
+            throw new Error(`FOREST_MCP_UPLOAD_STORAGE_MODULE "${modulePath}" exports a storage missing ` +
+                `${missing.join(', ')}. An UploadStorage implements createUploadUrl, download and ` +
+                'getSize. Omit the storage entirely to use the in-memory store on purpose.');
+        }
+    }
+    return options;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibG9hZC1maWxlLXVwbG9hZHMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdXRpbHMvbG9hZC1maWxlLXVwbG9hZHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFzQkEsa0NBMkVDO0FBL0ZELDJDQUE2QjtBQUU3Qix1RkFBdUY7QUFDdkYsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFjLEVBQUUsRUFBRSxDQUFDLENBQUMsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFOUYsZ0dBQWdHO0FBQ2hHLHFFQUFxRTtBQUNyRSxNQUFNLFNBQVMsR0FBRyxDQUFDLE9BQWUsRUFBRSxLQUFjLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO0FBRXBHOzs7Ozs7Ozs7O0dBVUc7QUFDWSxLQUFLLFVBQVUsZUFBZSxDQUMzQyxVQUFtQjtJQUVuQixJQUFJLENBQUMsVUFBVTtRQUFFLE9BQU8sU0FBUyxDQUFDO0lBRWxDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELElBQUksTUFBdUQsQ0FBQztJQUU1RCxJQUFJLENBQUM7UUFDSCw4RkFBOEY7UUFDOUYsaUVBQWlFO1FBQ2pFLHlHQUF5RztRQUN6RyxNQUFNLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQzdCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsK0ZBQStGO1FBQy9GLDJDQUEyQztRQUMzQyxNQUFNLE1BQU0sR0FDVCxLQUErQixFQUFFLElBQUksS0FBSyxrQkFBa0I7WUFDN0QsTUFBTSxDQUFFLEtBQWUsRUFBRSxPQUFPLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7UUFFdkQsTUFBTSxTQUFTLENBQ2IsTUFBTTtZQUNKLENBQUMsQ0FBQyxxQ0FBcUMsVUFBVSxnQ0FBZ0MsUUFBUSxJQUFJO1lBQzdGLENBQUMsQ0FBQyxxQ0FBcUMsVUFBVSwyQkFBMkIsUUFBUSxDQUNoRixLQUFLLENBQ04sRUFBRSxFQUNQLEtBQUssQ0FDTixDQUFDO0lBQ0osQ0FBQztJQUVELE1BQU0sUUFBUSxHQUFHLE1BQU0sRUFBRSxPQUFPLElBQUksTUFBTSxDQUFDO0lBQzNDLElBQUksT0FBdUMsQ0FBQztJQUU1QyxJQUFJLENBQUM7UUFDSCxPQUFPLEdBQUcsQ0FBQyxPQUFPLFFBQVEsS0FBSyxVQUFVLENBQUMsQ0FBQyxDQUFDLE1BQU0sUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBdUIsQ0FBQztJQUNqRyxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLDhGQUE4RjtRQUM5Riw4QkFBOEI7UUFDOUIsTUFBTSxTQUFTLENBQ2IscUNBQXFDLFVBQVUsd0NBQXdDLFFBQVEsQ0FDN0YsS0FBSyxDQUNOLEVBQUUsRUFDSCxLQUFLLENBQ04sQ0FBQztJQUNKLENBQUM7SUFFRCxpR0FBaUc7SUFDakcsNERBQTREO0lBQzVELElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDNUMsTUFBTSxJQUFJLEtBQUssQ0FDYixxQ0FBcUMsVUFBVSw4Q0FBOEM7WUFDM0YsZ0ZBQWdGLENBQ25GLENBQUM7SUFDSixDQUFDO0lBRUQsK0ZBQStGO0lBQy9GLDBGQUEwRjtJQUMxRixnR0FBZ0c7SUFDaEcsaUdBQWlHO0lBQ2pHLElBQUksU0FBUyxJQUFJLE9BQU8sRUFBRSxDQUFDO1FBQ3pCLE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxPQUF5RCxDQUFDO1FBQ2xGLE1BQU0sT0FBTyxHQUFHLENBQUMsaUJBQWlCLEVBQUUsVUFBVSxFQUFFLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FDL0QsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLE9BQU8sRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLFVBQVUsQ0FDbEQsQ0FBQztRQUVGLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxLQUFLLENBQ2IscUNBQXFDLFVBQVUsOEJBQThCO2dCQUMzRSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLDhEQUE4RDtnQkFDbkYsMkVBQTJFLENBQzlFLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVELE9BQU8sT0FBTyxDQUFDO0FBQ2pCLENBQUMifQ==

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/mcp-server",
-  "version": "1.21.1",
+  "version": "1.22.1",
   "description": "Model Context Protocol server for Forest Admin with OAuth authentication",
   "main": "dist/index.js",
   "bin": {
@@ -16,8 +16,8 @@
     "directory": "packages/mcp-server"
   },
   "dependencies": {
-    "@forestadmin/agent-client": "1.13.1",
-    "@forestadmin/forestadmin-client": "1.42.0",
+    "@forestadmin/agent-client": "1.14.0",
+    "@forestadmin/forestadmin-client": "1.42.1",
     "@modelcontextprotocol/sdk": "^1.28.0",
     "cors": "^2.8.5",
     "express": "^5.2.1",