@frontmcp/utils 1.12.0-rc.1 → 1.12.1

package/http/index.d.ts

@@ -1,3 +1,5 @@
 export { validateBaseUrl } from './http';
+export { readBodyWithLimit, readTextWithLimit, ResponseTooLargeError } from './limited-body';
+export type { LimitedBodySource } from './limited-body';
 export { buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest } from './cookie';
 export type { CookieOptions, SecureDetectionRequest } from './cookie';

package/http/limited-body.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Read an HTTP response body without holding more than a set number of bytes.
+ *
+ * `response.text()` and `response.arrayBuffer()` buffer the whole body before a caller can check its size, and the
+ * body `fetch` hands over is already decompressed, so a small compressed response can expand without limit. These
+ * helpers stop reading, and cancel the body, as soon as the limit is passed.
+ */
+/**
+ * Thrown when a response body is larger than the limit given to {@link readBodyWithLimit} or
+ * {@link readTextWithLimit}.
+ */
+export declare class ResponseTooLargeError extends Error {
+    readonly maxBytes: number;
+    constructor(maxBytes: number);
+}
+/** The parts of a fetch `Response` the readers use, so tests and wrappers can pass look-alikes. */
+export interface LimitedBodySource {
+    readonly headers?: {
+        get(name: string): string | null;
+    };
+    readonly body?: ReadableStream<Uint8Array> | null;
+    arrayBuffer?(): Promise<ArrayBuffer>;
+    text?(): Promise<string>;
+}
+/**
+ * Read a response body, failing with {@link ResponseTooLargeError} once it passes `maxBytes`.
+ *
+ * A `Content-Length` above the limit fails before any byte is read. Otherwise the body stream is read chunk by
+ * chunk and cancelled as soon as the running total passes the limit, so at most `maxBytes` plus one chunk is held.
+ * The limit applies to the bytes `fetch` delivers, which are already decompressed.
+ *
+ * A look-alike response without a `body` stream is read with `arrayBuffer()` or `text()` and then checked; only real
+ * streams are bounded while reading.
+ *
+ * @param response - A fetch `Response`, or an object with the same `headers`, `body`, `arrayBuffer` or `text`
+ * @param maxBytes - The largest body accepted, in bytes
+ * @returns The body bytes
+ * @throws ResponseTooLargeError when the body is larger than `maxBytes`
+ *
+ * @example
+ * ```typescript
+ * const res = await fetch(url);
+ * const bytes = await readBodyWithLimit(res, 1024 * 1024);
+ * ```
+ */
+export declare function readBodyWithLimit(response: LimitedBodySource, maxBytes: number): Promise<Uint8Array>;
+/**
+ * Read a response body as UTF-8 text, failing with {@link ResponseTooLargeError} once it passes `maxBytes`.
+ * See {@link readBodyWithLimit}.
+ *
+ * @param response - A fetch `Response`, or an object with the same `headers`, `body`, `arrayBuffer` or `text`
+ * @param maxBytes - The largest body accepted, in bytes (of UTF-8, before decoding)
+ * @returns The decoded text
+ * @throws ResponseTooLargeError when the body is larger than `maxBytes`
+ */
+export declare function readTextWithLimit(response: LimitedBodySource, maxBytes: number): Promise<string>;

package/index.d.ts

@@ -11,8 +11,8 @@ export { isValidMcpUri, extractUriScheme, isValidMcpUriTemplate, parseUriTemplat
 export type { ParsedUriTemplate } from './uri';
 export { trimSlashes, joinPath, pathResolve, pathJoin, basename, dirname, extname, isAbsolute, pathToFileURL, sep, } from './path';
 export { sanitizeToJson, inferMimeType, findNonFiniteNumber, findDroppedKeys } from './content';
-export { validateBaseUrl, buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest } from './http';
-export type { CookieOptions, SecureDetectionRequest } from './http';
+export { validateBaseUrl, buildSetCookie, parseCookies, getCookie, isLocalhost, isSecureRequest, readBodyWithLimit, readTextWithLimit, ResponseTooLargeError, } from './http';
+export type { CookieOptions, SecureDetectionRequest, LimitedBodySource } from './http';
 export { classifyIpAddress, expandIpv6, extractEmbeddedIpv4, isGloballyRoutableIp, parseIpv4, isRedirectResponse, validateOutboundUrl, sendOutboundRequest, outboundFailureCategory, OUTBOUND_TIMEOUT_MS, OUTBOUND_MAX_REQUEST_BYTES, } from './net';
 export type { IpAddressClassification, IpAddressRange, SpecialPurposeIpRange, RedirectCandidate, OutboundTargetOptions, OutboundUrlCheck, OutboundUrlProblem, OutboundRequest, OutboundAnswer, OutboundFailure, OutboundFailureReason, OutboundFailureCategory, OutboundResult, } from './net';
 export { readFile, readFileSync, readFileBuffer, writeFile, appendFile, mkdir, rename, unlink, stat, lstat, chmod, copyFile, cp, readdir, readdirSync, realpath, rm, mkdtemp, symlink, access, fileExists, fileExistsSync, readJSON, writeJSON, ensureDir, ensureDirSync, isDirEmpty, runCmd, watchFile, watchFiles, getSpawnFn, } from './fs';
@@ -23,8 +23,9 @@ export { DEV_BUFFER_FULL, DEV_ERROR_MESSAGE, DEV_RELOAD_DEADLINE, DEV_SERVER_UNR
 export type { BridgeState, BridgeStateMachine, BridgeStateMachineOptions, InflightRequest, JsonRpcFrame, StdioFramer, StdioFramerOptions, BridgeLogger, HttpUpstreamClient, HttpUpstreamOptions, PipeUpstreamOptions, UpstreamClient, UpstreamClientOptions, } from './stdio-bridge';
 export { redactFields, redactJson } from './redaction';
 export type { RedactedFields } from './redaction';
-export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript } from './escape';
+export { escapeHtml, escapeHtmlAttr, escapeJsString, escapeScriptClose, safeJsonForScript, escapeControlCharacters, } from './escape';
 export { brandClass, isBrandedInstance } from './class-brand';
+export { registerOptionalModule, requireOptionalModule } from './optional-module';
 export { safeStringify, canonicalJson } from './serialization';
 export { getCrypto, rsaVerify, rsaVerifySync, pemToPublicJwk, generateRsaKeyPair, rsaSignBase64Url, type RsaJwk, type RsaKeyPair, jwtAlgToNodeAlg, isRsaPssAlg, randomUUID, randomBytes, sha256, sha256Hex, sha256Base64url, hmacSha256, hkdfSha256, encryptAesGcm, decryptAesGcm, timingSafeEqual, bytesToHex, base64urlEncode, base64urlDecode, base64Encode, base64Decode, isNode, isBrowser, assertNode, EncryptedBlobError, encryptValue, decryptValue, tryDecryptValue, serializeBlob, deserializeBlob, tryDeserializeBlob, isValidEncryptedBlob, encryptAndSerialize, deserializeAndDecrypt, tryDeserializeAndDecrypt, generateCodeVerifier, generateCodeChallenge, verifyCodeChallenge, generatePkcePair, isValidCodeVerifier, isValidCodeChallenge, MIN_CODE_VERIFIER_LENGTH, MAX_CODE_VERIFIER_LENGTH, DEFAULT_CODE_VERIFIER_LENGTH, PkceError, type PkcePair, type SecretData, type SecretPersistenceOptions, type SecretValidationResult, secretDataSchema, validateSecretData, parseSecretData, isSecretPersistenceEnabled, resolveSecretPath, loadSecret, saveSecret, deleteSecret, generateSecret, createSecretData, getOrCreateSecret, clearCachedSecret, isSecretCached, type SignedData, type HmacSigningConfig, signData, verifyData, isSignedData, verifyOrParseData, WEBHOOK_ID_HEADER, WEBHOOK_TIMESTAMP_HEADER, WEBHOOK_SIGNATURE_HEADER, WEBHOOK_SIGNATURE_TOLERANCE_SECONDS, signingKeyOf, isStandardWebhookSecret, generateStandardWebhookSecret, generateWebhookMessageId, signWebhookMessage, webhookSignatureHeaders, verifyWebhookSignature, type WebhookMessage, type SignedWebhookMessage, type WebhookSignatureCheck, type BaseKeyData, type SecretKeyData, type AsymmetricKeyData, type AnyKeyData, type KeyPersistenceOptions, type CreateKeyPersistenceOptions, type CreateSecretOptions, type CreateAsymmetricOptions, type KeyValidationResult, asymmetricAlgSchema, secretKeyDataSchema, asymmetricKeyDataSchema, anyKeyDataSchema, validateKeyData, parseKeyData, isSecretKeyData, isAsymmetricKeyData, KeyPersistence, createKeyPersistence, createKeyPersistenceWithStorage, } from './crypto';
 export type { CryptoProvider, EncBlob, EncryptedBlob } from './crypto';
@@ -33,7 +34,7 @@ export { EventEmitter } from './event-emitter';
 export { getEnv, getNodeEnv, getCwd, isProduction, isDevelopment, getEnvFlag, isDebug, setEnv, isEdgeRuntime, isServerless, supportsAnsi, getRuntimeContext, resetRuntimeContext, detectRuntimeContext, isEntryAvailable, checkEntryAvailability, entryAvailabilitySchema, } from './env';
 export type { RuntimeContext, EntryAvailability } from './env';
 export { analyzePattern, isPatternSafe, createSafeRegExp, safeTest, safeMatch, safeReplace, safeExec, isInputLengthSafe, DEFAULT_MAX_INPUT_LENGTH, REDOS_THRESHOLDS, trimLeading, trimTrailing, trimBoth, trimChars, extractBracedParams, expandTemplate, hasTemplatePlaceholders, collapseChar, collapseWhitespace, type SafeRegexOptions, type PatternAnalysisResult, } from './regex';
-export { createStorage, createMemoryStorage, getDetectedStorageType, createChangeFeed, DEFAULT_CHANGE_FEED_COALESCE_MS, DEFAULT_CHANGE_FEED_POLL_INTERVAL_MS, NamespacedStorageImpl, createRootStorage, createNamespacedStorage, buildPrefix, NAMESPACE_SEPARATOR, StorageError, StorageConnectionError, StorageOperationError, StorageNotSupportedError, StorageConfigError, StorageTTLError, StoragePatternError, StorageNotConnectedError, EncryptedStorageError, BaseStorageAdapter, MemoryStorageAdapter, RedisStorageAdapter, createRedisClient, VercelKvStorageAdapter, createVercelKvClient, type VercelKvConnection, UpstashStorageAdapter, FileSystemStorageAdapter, type FileSystemAdapterOptions, TypedStorage, type TypedStorageOptions, type TypedSetOptions, type TypedSetEntry, EncryptedTypedStorage, type EncryptedTypedStorageOptions, type EncryptedSetOptions, type EncryptedSetEntry, type EncryptionKey, type StoredEncryptedBlob, type ClientKeyBinding, globToRegex, matchesPattern, validatePattern, escapeGlob, MAX_TTL_SECONDS, validateTTL, validateOptionalTTL, ttlToExpiresAt, expiresAtToTTL, isExpired, normalizeTTL, attachRedisErrorListener, DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS, mergeRedisUrlFields, describeRedisUrlConflicts, } from './storage';
+export { createStorage, createMemoryStorage, getDetectedStorageType, createChangeFeed, DEFAULT_CHANGE_FEED_COALESCE_MS, DEFAULT_CHANGE_FEED_POLL_INTERVAL_MS, NamespacedStorageImpl, createRootStorage, createNamespacedStorage, buildPrefix, NAMESPACE_SEPARATOR, StorageError, StorageConnectionError, StorageOperationError, StorageNotSupportedError, StorageConfigError, StorageTTLError, StoragePatternError, StorageNotConnectedError, EncryptedStorageError, BaseStorageAdapter, MemoryStorageAdapter, RedisStorageAdapter, createRedisClient, VercelKvStorageAdapter, createVercelKvClient, type VercelKvConnection, UpstashStorageAdapter, FileSystemStorageAdapter, type FileSystemAdapterOptions, TypedStorage, type TypedStorageOptions, type TypedSetOptions, type TypedSetEntry, EncryptedTypedStorage, type EncryptedTypedStorageOptions, type EncryptedSetOptions, type EncryptedSetEntry, type EncryptionKey, type StoredEncryptedBlob, type ClientKeyBinding, createGlobMatcher, globToRegex, matchesPattern, validatePattern, escapeGlob, MAX_TTL_SECONDS, validateTTL, validateOptionalTTL, ttlToExpiresAt, expiresAtToTTL, isExpired, normalizeTTL, attachRedisErrorListener, DEFAULT_REDIS_ERROR_LOG_INTERVAL_MS, mergeRedisUrlFields, describeRedisUrlConflicts, } from './storage';
 export type { StorageAdapter, NamespacedStorage, RootStorage, SetOptions, SetEntry, MessageHandler, Unsubscribe, MemoryAdapterOptions, RedisAdapterOptions, RedisHostConnectionConfig, RedisUrlConnectionConfig, RedisUrlFillInConfig, VercelKvAdapterOptions, UpstashAdapterOptions, SqliteAdapterOptions, StorageType, StorageConfig, RedisErrorListenerOptions, RedisUrlConnection, RedisUrlMerge, RedisUrlSiblingFields, CreateRedisClientOptions, ErrorEmitterClient, ChangeFeed, ChangeFeedKind, ChangeFeedOptions, } from './storage';
 export { processPlatformToolCalls } from './llm';
 export type { CallToolFn, OpenAIToolCallItem, OpenAIToolResponse, ClaudeToolUseBlock, ClaudeToolResultBlock, VercelToolCallInfo, PlatformToolCallsInput, PlatformToolCallsOutput, SupportedPlatform, } from './llm';