@george43g/mcp-kit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 George G
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,105 @@
+# @george43g/mcp-kit
+
+MCP server building blocks: a tool registry, a dispatcher with timeout / perf /
+abort / error-wrapping baked in, stdio + Streamable HTTP transports, `sanitize()`
+for untrusted content, and UUID-gated prompt-injection helpers.
+
+Not yet on npm. It is vendored into generated repos today; see `DEFERRED.md` #25
+in the template repo for the publish sequence.
+
+## The dispatcher is the point
+
+Every tool call goes through one function, and that function holds invariants
+that are easy to lose when each tool wires itself:
+
+1. Every handler runs inside `withTimeout` — per-tool `timeoutMs`, else
+   `MCP_TOOL_TIMEOUT_DEFAULT_MS` (30s).
+2. `noteActivity()` fires on every dispatch, feeding the idle watchdog.
+3. A `perf()` span wraps every handler; its duration lands in `_meta`.
+4. Errors are wrapped with the tool name and an actionable hint — never a bare
+   `error.message`.
+5. `AbortSignal` is passed through.
+6. Nothing writes to stdout after `StdioServerTransport.connect()` — JSON-RPC
+   owns it. Log through `@george43g/robustness`.
+
+```ts
+import { buildDispatcher, makeRegistry } from "@george43g/mcp-kit";
+
+const registry = makeRegistry([healthCheck, noop]);
+const dispatch = buildDispatcher({ registry, engineLabel: () => "ts" });
+```
+
+## Content blocks
+
+A tool may emit media alongside its JSON summary. `toContent` derives the extra
+blocks from the result, and the dispatcher emits them **ahead** of the text
+block:
+
+```ts
+const screenshot: ToolDefinition = {
+  // ...
+  handler: async () => ({ path: "/tmp/shot.png" }),
+  toContent: (r) => [{ type: "image", data: readBase64(r.path), mimeType: "image/png" }],
+};
+
+// dispatch("screenshot", {}) → content: [image, text]
+```
+
+Three things worth knowing before you use it:
+
+- **`[media, text]` is a contract, not an implementation detail.** `cli-kit`'s
+  renderer prints the image line above the payload, and consumers index on the
+  order.
+- **`data` is RAW base64** — no `data:` URI prefix, and not a path.
+- **A throwing `toContent` degrades to text.** The throw is caught, logged as
+  `to_content_failed`, and the tool still returns its answer. A tool that cannot
+  render its picture is not a tool that failed.
+
+`ContentBlock` is deliberately the same two members as `@george43g/cli-kit`'s,
+and deliberately has **no catch-all member**. A catch-all overlaps
+`type: "text"`, so every narrowing site needs a cast — and a compile error is
+*wanted* when a new block type appears: it lands exactly at the render site
+where somebody has to decide how to draw it. Reading a block's text narrows:
+
+```ts
+for (const block of result.content) {
+  if (block.type === "text") process.stdout.write(block.text);
+}
+```
+
+## Dev-only tools: hiding is not disabling
+
+`devOnly: true` was honoured only by `toMcpTools()`. The tool vanished from
+`tools/list` and **still executed if you named it**, and every non-MCP caller —
+a CLI, a REPL's tool list — bypassed the filter entirely.
+
+```ts
+const dispatch = buildDispatcher({
+  registry,
+  devOnlyEnabled: () => process.env.MCP_DEV === "1",
+});
+```
+
+- Read **per dispatch**, not at construction, so flipping the env mid-suite
+  takes effect.
+- A gated tool's response is **identical to an unknown tool name**. A distinct
+  "this tool is disabled" error confirms the tool exists, which is what the gate
+  is for.
+- **Omit it and nothing changes** — dev-only tools stay callable, which is what
+  this dispatcher did before the option existed.
+
+## Transports
+
+```ts
+import { startStdio } from "@george43g/mcp-kit/stdio";
+import { startHttpServer } from "@george43g/mcp-kit/http";
+```
+
+HTTP is single-tenant by design: one server process, one identity. The bearer
+token is caller-supplied or read from `MCP_HTTP_TOKEN`.
+
+## Untrusted content
+
+`sanitize()` strips control characters and bounds length. `wrapToolError()` and
+the UUID-gated helpers in `prompt-injection.ts` fence tool output so a tool's
+own error text cannot impersonate the host.

package/dist/dispatch.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Dispatcher — the single place every MCP tool call passes through.
+ *
+ * DISPATCHER INVARIANTS (do not weaken without consulting AGENTS.md):
+ *  1. Every tool runs through withTimeout — declare a per-tool timeout
+ *     in ToolDefinition.timeoutMs or rely on MCP_TOOL_TIMEOUT_DEFAULT_MS.
+ *  2. noteActivity() fires on every dispatch (feeds the idle watchdog).
+ *  3. perf() span around every handler.
+ *  4. Errors wrapped with actionable hint + tool name (never bare error.message).
+ *  5. AbortSignal honored — long-running handlers check signal?.aborted
+ *     between iterations and return early with a structured error.
+ *  6. NEVER console.log after StdioServerTransport.connect() — JSON-RPC owns
+ *     stdout. Log via @george43g/robustness/logger.
+ *  7. Tool responses return { content, structuredContent } per the MCP spec,
+ *     plus a perf footer (engine + dur_ms) in `_meta`.
+ *
+ * The exported `buildDispatcher` returns a function whose shape matches the
+ * SDK's `CallToolRequest` handler.
+ */
+import type { ContentBlock, ToolRegistry } from "./tool-registry.js";
+export interface ToolResult {
+    content: ContentBlock[];
+    structuredContent?: unknown;
+    isError?: boolean;
+    _meta?: Record<string, unknown>;
+}
+export interface DispatcherCounters {
+    /** Total successful + failed tool calls. */
+    toolCalls: number;
+    /** Errors in the last 5 minutes (caller maintains via dispatcher hook). */
+    recentErrors: number;
+}
+export interface BuildDispatcherOptions {
+    registry: ToolRegistry;
+    /** Called with the ToolTimeoutError / handler-thrown error to bump counters. */
+    onError?: (toolName: string, err: unknown) => void;
+    /** Called per dispatch (success or failure) to bump call counters. */
+    onCall?: (toolName: string) => void;
+    /** Engine label, e.g. "rust" or "ts". Surfaced in `_meta` and dev stats. */
+    engineLabel?: () => string;
+    /**
+     * Whether `devOnly` tools are callable. Evaluated PER DISPATCH, not once at
+     * construction, so flipping the env in a test takes effect immediately.
+     *
+     * Omitted, dev-only tools stay callable — which is what this dispatcher did
+     * before the option existed, so adding it changes nothing until you pass it.
+     *
+     * The gap it closes: `devOnly` was honoured only by `toMcpTools()`, so the
+     * tool was hidden from `tools/list` and still executed if you named it
+     * anyway, and every non-MCP caller (a CLI, a REPL tool list) bypassed the
+     * filter entirely. **Hiding a tool is not disabling it.** Found and fixed in
+     * browser-tab-mcp's vendored copy of this file.
+     */
+    devOnlyEnabled?: () => boolean;
+}
+export type Dispatch = (name: string, args: unknown, signal?: AbortSignal) => Promise<ToolResult>;
+export declare function buildDispatcher(opts: BuildDispatcherOptions): Dispatch;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,YAAY,CAAC;IACvB,gFAAgF;IAChF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,sEAAsE;IACtE,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,MAAM,CAAC;IAC3B;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;CAChC;AAED,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAUlG,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,QAAQ,CA0FtE"}

package/dist/dispatch.js

@@ -0,0 +1,110 @@
+/**
+ * Dispatcher — the single place every MCP tool call passes through.
+ *
+ * DISPATCHER INVARIANTS (do not weaken without consulting AGENTS.md):
+ *  1. Every tool runs through withTimeout — declare a per-tool timeout
+ *     in ToolDefinition.timeoutMs or rely on MCP_TOOL_TIMEOUT_DEFAULT_MS.
+ *  2. noteActivity() fires on every dispatch (feeds the idle watchdog).
+ *  3. perf() span around every handler.
+ *  4. Errors wrapped with actionable hint + tool name (never bare error.message).
+ *  5. AbortSignal honored — long-running handlers check signal?.aborted
+ *     between iterations and return early with a structured error.
+ *  6. NEVER console.log after StdioServerTransport.connect() — JSON-RPC owns
+ *     stdout. Log via @george43g/robustness/logger.
+ *  7. Tool responses return { content, structuredContent } per the MCP spec,
+ *     plus a perf footer (engine + dur_ms) in `_meta`.
+ *
+ * The exported `buildDispatcher` returns a function whose shape matches the
+ * SDK's `CallToolRequest` handler.
+ */
+import { envNum, error as logError, warn as logWarn, noteActivity, perf, ToolTimeoutError, withTimeout, } from "@george43g/robustness";
+import { wrapToolError } from "./prompt-injection.js";
+function defaultTimeoutMs() {
+    return envNum("MCP_TOOL_TIMEOUT_DEFAULT_MS", 30_000);
+}
+function formatZodError(err) {
+    return err.errors.map((e) => `  - ${e.path.join(".") || "(root)"}: ${e.message}`).join("\n");
+}
+export function buildDispatcher(opts) {
+    const fallback = defaultTimeoutMs();
+    return async (name, args, signal) => {
+        noteActivity();
+        opts.onCall?.(name);
+        const def = opts.registry.get(name);
+        // A dev-only tool that is not enabled must be INDISTINGUISHABLE from one
+        // that does not exist. A distinct "disabled" error confirms the tool is
+        // there, which is the thing a gate exists to avoid.
+        const devGated = def?.devOnly === true && opts.devOnlyEnabled !== undefined ? !opts.devOnlyEnabled() : false;
+        if (!def || devGated) {
+            opts.onError?.(name, new Error("unknown_tool"));
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: wrapToolError(name, "Unknown tool name.", "Check the result of tools/list."),
+                    },
+                ],
+                isError: true,
+            };
+        }
+        const parsed = def.input.safeParse(args ?? {});
+        if (!parsed.success) {
+            opts.onError?.(name, parsed.error);
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: wrapToolError(name, "Invalid arguments:", `\n${formatZodError(parsed.error)}`),
+                    },
+                ],
+                isError: true,
+            };
+        }
+        const span = perf(`dispatch.${name}`);
+        const timeoutMs = def.timeoutMs ?? fallback;
+        try {
+            const result = await withTimeout(name, () => def.handler(parsed.data, signal), timeoutMs);
+            const dur = span.end({ engine: opts.engineLabel?.() ?? "ts" });
+            const textBlock = {
+                type: "text",
+                text: typeof result === "string" ? result : JSON.stringify(result, null, 2),
+            };
+            // Media blocks lead, the JSON summary follows: a screenshot tool returns
+            // `[image, text]`. Renderers depend on that order — cli-kit's prints the
+            // image line above the payload — so it is a contract, not a detail.
+            let extra = [];
+            if (def.toContent) {
+                try {
+                    extra = def.toContent(result);
+                }
+                catch (err) {
+                    logWarn(`to_content_failed: ${name}`, { message: err?.message });
+                }
+            }
+            return {
+                content: [...extra, textBlock],
+                structuredContent: result,
+                _meta: {
+                    engine: opts.engineLabel?.() ?? "ts",
+                    duration_ms: Math.round(dur * 10) / 10,
+                },
+            };
+        }
+        catch (err) {
+            span.end({ error: true });
+            opts.onError?.(name, err);
+            logError(`dispatch_error: ${name}`, {
+                message: err?.message,
+                stack: err?.stack,
+            });
+            const message = err instanceof ToolTimeoutError
+                ? `Timed out after ${err.timeoutMs}ms. The server has unblocked; the underlying work may still be running.`
+                : (err?.message ?? String(err));
+            return {
+                content: [{ type: "text", text: wrapToolError(name, message) }],
+                isError: true,
+            };
+        }
+    };
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/dispatch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,IAAI,QAAQ,EACjB,IAAI,IAAI,OAAO,EACf,YAAY,EACZ,IAAI,EACJ,gBAAgB,EAChB,WAAW,GACZ,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA2CtD,SAAS,gBAAgB;IACvB,OAAO,MAAM,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,GAAa;IACnC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QAClC,YAAY,EAAE,CAAC;QACf,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAEpC,yEAAyE;QACzE,wEAAwE;QACxE,oDAAoD;QACpD,MAAM,QAAQ,GACZ,GAAG,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAE9F,IAAI,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;YAChD,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,oBAAoB,EAAE,iCAAiC,CAAC;qBACnF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,aAAa,CACjB,IAAI,EACJ,oBAAoB,EACpB,KAAK,cAAc,CAAC,MAAM,CAAC,KAAiB,CAAC,EAAE,CAChD;qBACF;iBACF;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,QAAQ,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM,SAAS,GAAiB;gBAC9B,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;aAC5E,CAAC;YACF,yEAAyE;YACzE,yEAAyE;YACzE,oEAAoE;YACpE,IAAI,KAAK,GAAmB,EAAE,CAAC;YAC/B,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;gBAClB,IAAI,CAAC;oBACH,KAAK,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,sBAAsB,IAAI,EAAE,EAAE,EAAE,OAAO,EAAG,GAAa,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACH,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,CAAC,GAAG,KAAK,EAAE,SAAS,CAAC;gBAC9B,iBAAiB,EAAE,MAAM;gBACzB,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI;oBACpC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,EAAE;iBACvC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1B,QAAQ,CAAC,mBAAmB,IAAI,EAAE,EAAE;gBAClC,OAAO,EAAG,GAAa,EAAE,OAAO;gBAChC,KAAK,EAAG,GAAa,EAAE,KAAK;aAC7B,CAAC,CAAC;YACH,MAAM,OAAO,GACX,GAAG,YAAY,gBAAgB;gBAC7B,CAAC,CAAC,mBAAmB,GAAG,CAAC,SAAS,yEAAyE;gBAC3G,CAAC,CAAC,CAAE,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export type { BuildDispatcherOptions, Dispatch, DispatcherCounters, ToolResult, } from "./dispatch.js";
+export { buildDispatcher } from "./dispatch.js";
+export { type WrapInstructionsResult, wrapInstructions, wrapToolError, wrapUntrusted, } from "./prompt-injection.js";
+export type { BuildResourcesHandlerOptions, ResourceContent, ResourceHandlers, ResourceListEntry, ResourcesProvider, ResourceTemplate, } from "./resources.js";
+export { buildResourcesHandler } from "./resources.js";
+export { sanitize } from "./sanitize.js";
+export type { AnyToolDefinition, ContentBlock, ToolDefinition, ToolRegistry, } from "./tool-registry.js";
+export { makeRegistry } from "./tool-registry.js";
+export type { HttpServerHandle, HttpServerOptions } from "./transports/http.js";
+export { startHttpServer } from "./transports/http.js";
+export type { StartStdioOptions } from "./transports/stdio.js";
+export { startStdio } from "./transports/stdio.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,sBAAsB,EACtB,QAAQ,EACR,kBAAkB,EAClB,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EACL,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,4BAA4B,EAC5B,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,YAAY,EACV,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export { buildDispatcher } from "./dispatch.js";
+export { wrapInstructions, wrapToolError, wrapUntrusted, } from "./prompt-injection.js";
+export { buildResourcesHandler } from "./resources.js";
+export { sanitize } from "./sanitize.js";
+export { makeRegistry } from "./tool-registry.js";
+export { startHttpServer } from "./transports/http.js";
+export { startStdio } from "./transports/stdio.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,aAAa,GACd,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAOzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/prompt-injection.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Prompt-injection defense helpers.
+ *
+ * Two primitives:
+ *
+ * 1. `wrapUntrusted(text)` — wrap arbitrary content with `<untrusted>...
+ *    </untrusted>` markers. Use whenever a tool returns content sourced
+ *    from an external system (user message, scraped page, etc.). The LLM
+ *    is trained to treat tagged content as data, not instructions.
+ *
+ * 2. `wrapInstructions(text, uuid)` — emit instructions to the LLM that
+ *    only "fire" when the same UUID is present in the user's most recent
+ *    message. Pattern documented in docs/GUARDRAILS_MCP_RESPONSES.md.
+ *
+ *    Tool returns:
+ *      <instructions uuid="d8a3..."> follow steps... </instructions>
+ *
+ *    The LLM, having been trained on this pattern, will refuse to follow
+ *    the embedded instructions unless the user's prior message contains
+ *    the UUID — proving the user genuinely wanted to authorize them.
+ *
+ *    Use sparingly: prefer not to embed instructions in tool responses
+ *    at all. When you must (multi-step workflows, follow-ups), use this
+ *    wrapper.
+ */
+export declare function wrapUntrusted(text: string): string;
+export interface WrapInstructionsResult {
+    text: string;
+    uuid: string;
+}
+export declare function wrapInstructions(text: string, uuid?: string): WrapInstructionsResult;
+/**
+ * Wrap an actionable error message so the LLM gets a hint without
+ * treating the rest of the response as instructions.
+ */
+export declare function wrapToolError(toolName: string, message: string, hint?: string): string;
+//# sourceMappingURL=prompt-injection.d.ts.map

package/dist/prompt-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection.d.ts","sourceRoot":"","sources":["../src/prompt-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAqB,GAC1B,sBAAsB,CAKxB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAItF"}

package/dist/prompt-injection.js

@@ -0,0 +1,46 @@
+/**
+ * Prompt-injection defense helpers.
+ *
+ * Two primitives:
+ *
+ * 1. `wrapUntrusted(text)` — wrap arbitrary content with `<untrusted>...
+ *    </untrusted>` markers. Use whenever a tool returns content sourced
+ *    from an external system (user message, scraped page, etc.). The LLM
+ *    is trained to treat tagged content as data, not instructions.
+ *
+ * 2. `wrapInstructions(text, uuid)` — emit instructions to the LLM that
+ *    only "fire" when the same UUID is present in the user's most recent
+ *    message. Pattern documented in docs/GUARDRAILS_MCP_RESPONSES.md.
+ *
+ *    Tool returns:
+ *      <instructions uuid="d8a3..."> follow steps... </instructions>
+ *
+ *    The LLM, having been trained on this pattern, will refuse to follow
+ *    the embedded instructions unless the user's prior message contains
+ *    the UUID — proving the user genuinely wanted to authorize them.
+ *
+ *    Use sparingly: prefer not to embed instructions in tool responses
+ *    at all. When you must (multi-step workflows, follow-ups), use this
+ *    wrapper.
+ */
+import { randomUUID } from "node:crypto";
+export function wrapUntrusted(text) {
+    return `<untrusted>\n${text}\n</untrusted>`;
+}
+export function wrapInstructions(text, uuid = randomUUID()) {
+    return {
+        text: `<instructions uuid="${uuid}">\n${text}\n</instructions>`,
+        uuid,
+    };
+}
+/**
+ * Wrap an actionable error message so the LLM gets a hint without
+ * treating the rest of the response as instructions.
+ */
+export function wrapToolError(toolName, message, hint) {
+    let out = `Tool "${toolName}" failed: ${message}`;
+    if (hint)
+        out += `\nHint: ${hint}`;
+    return out;
+}
+//# sourceMappingURL=prompt-injection.js.map

package/dist/prompt-injection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-injection.js","sourceRoot":"","sources":["../src/prompt-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,gBAAgB,IAAI,gBAAgB,CAAC;AAC9C,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,OAAe,UAAU,EAAE;IAE3B,OAAO;QACL,IAAI,EAAE,uBAAuB,IAAI,OAAO,IAAI,mBAAmB;QAC/D,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAe,EAAE,IAAa;IAC5E,IAAI,GAAG,GAAG,SAAS,QAAQ,aAAa,OAAO,EAAE,CAAC;IAClD,IAAI,IAAI;QAAE,GAAG,IAAI,WAAW,IAAI,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/resources.d.ts

@@ -0,0 +1,81 @@
+/**
+ * MCP Resources — the second handler shape MCP clients can talk to.
+ *
+ * Tools run a verb ("call this function"). Resources expose addressable
+ * read-only state ("read this URI"). Hosts can subscribe to resources or
+ * browse them without re-invoking tools — useful for log streams, health
+ * snapshots, document content, etc.
+ *
+ * This kit mirrors the spec's two request shapes:
+ *
+ *   - ListResourcesRequest / ListResourcesResult     (concrete URIs)
+ *   - ListResourceTemplatesRequest / ...Result       (URI templates)
+ *   - ReadResourceRequest / ReadResourceResult       (resolve a URI)
+ *
+ * Consumers wire the returned `{ onList, onListTemplates, onRead }` into
+ * `server.setRequestHandler(...)`. Each callback handles its own error
+ * shape per the SDK contract.
+ *
+ * INVARIANT: like the tools dispatcher, every read goes through a perf
+ * span + structured error wrap. Never throw bare errors; the caller can
+ * inspect `error.message` for the resource URI + hint.
+ */
+/** A directly-addressable resource (URI is the full address). */
+export interface ResourceListEntry {
+    uri: string;
+    name: string;
+    description?: string;
+    mimeType?: string;
+}
+/** A URI template (e.g. "logs://recent/{n}") clients fill in to read. */
+export interface ResourceTemplate {
+    uriTemplate: string;
+    name: string;
+    description?: string;
+    mimeType?: string;
+}
+/** Returned by the read callback when the URI is resolved. */
+export interface ResourceContent {
+    uri: string;
+    mimeType: string;
+    /** UTF-8 text body. Mutually exclusive with `blob`. */
+    text?: string;
+    /** base64-encoded binary body. Mutually exclusive with `text`. */
+    blob?: string;
+}
+export interface ResourcesProvider {
+    /** Concrete resources to expose; default: none. */
+    list?(): Promise<ResourceListEntry[]> | ResourceListEntry[];
+    /** URI templates to expose; default: none. */
+    listTemplates?(): Promise<ResourceTemplate[]> | ResourceTemplate[];
+    /**
+     * Resolve a URI. Throw if unknown — the wrapper turns it into a
+     * structured error the SDK propagates to the client.
+     */
+    read(uri: string): Promise<ResourceContent> | ResourceContent;
+}
+export interface BuildResourcesHandlerOptions {
+    provider: ResourcesProvider;
+    /** Optional engine label surfaced in perf spans. */
+    engineLabel?: string;
+}
+export interface ResourceHandlers {
+    /** Wire into `server.setRequestHandler(ListResourcesRequestSchema, ...)`. */
+    onList(): Promise<{
+        resources: ResourceListEntry[];
+    }>;
+    /** Wire into `server.setRequestHandler(ListResourceTemplatesRequestSchema, ...)`. */
+    onListTemplates(): Promise<{
+        resourceTemplates: ResourceTemplate[];
+    }>;
+    /** Wire into `server.setRequestHandler(ReadResourceRequestSchema, ...)`. */
+    onRead(request: {
+        params: {
+            uri: string;
+        };
+    }): Promise<{
+        contents: ResourceContent[];
+    }>;
+}
+export declare function buildResourcesHandler(opts: BuildResourcesHandlerOptions): ResourceHandlers;
+//# sourceMappingURL=resources.d.ts.map

package/dist/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,iEAAiE;AACjE,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,yEAAyE;AACzE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,IAAI,CAAC,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC;IAC5D,8CAA8C;IAC9C,aAAa,CAAC,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,EAAE,CAAC;IACnE;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;CAC/D;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,MAAM,IAAI,OAAO,CAAC;QAAE,SAAS,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC,CAAC;IACtD,qFAAqF;IACrF,eAAe,IAAI,OAAO,CAAC;QAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC,CAAC;IACtE,4EAA4E;IAC5E,MAAM,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;CACxF;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,4BAA4B,GAAG,gBAAgB,CAwC1F"}

package/dist/resources.js

@@ -0,0 +1,66 @@
+/**
+ * MCP Resources — the second handler shape MCP clients can talk to.
+ *
+ * Tools run a verb ("call this function"). Resources expose addressable
+ * read-only state ("read this URI"). Hosts can subscribe to resources or
+ * browse them without re-invoking tools — useful for log streams, health
+ * snapshots, document content, etc.
+ *
+ * This kit mirrors the spec's two request shapes:
+ *
+ *   - ListResourcesRequest / ListResourcesResult     (concrete URIs)
+ *   - ListResourceTemplatesRequest / ...Result       (URI templates)
+ *   - ReadResourceRequest / ReadResourceResult       (resolve a URI)
+ *
+ * Consumers wire the returned `{ onList, onListTemplates, onRead }` into
+ * `server.setRequestHandler(...)`. Each callback handles its own error
+ * shape per the SDK contract.
+ *
+ * INVARIANT: like the tools dispatcher, every read goes through a perf
+ * span + structured error wrap. Never throw bare errors; the caller can
+ * inspect `error.message` for the resource URI + hint.
+ */
+import { perf } from "@george43g/robustness";
+import { wrapToolError } from "./prompt-injection.js";
+export function buildResourcesHandler(opts) {
+    const { provider, engineLabel = "ts" } = opts;
+    async function onList() {
+        const span = perf("resources.list");
+        try {
+            const resources = provider.list ? await provider.list() : [];
+            return { resources };
+        }
+        finally {
+            span.end();
+        }
+    }
+    async function onListTemplates() {
+        const span = perf("resources.listTemplates");
+        try {
+            const resourceTemplates = provider.listTemplates ? await provider.listTemplates() : [];
+            return { resourceTemplates };
+        }
+        finally {
+            span.end();
+        }
+    }
+    async function onRead(request) {
+        const uri = request.params.uri;
+        const span = perf(`resources.read[${engineLabel}]`);
+        try {
+            const content = await provider.read(uri);
+            return { contents: [content] };
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            // wrapToolError produces a structured shape with an actionable
+            // hint — same pattern the tools dispatcher uses.
+            throw new Error(wrapToolError(`resources/read`, msg, `Unknown resource URI: "${uri}"`));
+        }
+        finally {
+            span.end();
+        }
+    }
+    return { onList, onListTemplates, onRead };
+}
+//# sourceMappingURL=resources.js.map

package/dist/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../src/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAuDtD,MAAM,UAAU,qBAAqB,CAAC,IAAkC;IACtE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAE9C,KAAK,UAAU,MAAM;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC/B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,OAAoC;QACxD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,WAAW,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,+DAA+D;YAC/D,iDAAiD;YACjD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,gBAAgB,EAAE,GAAG,EAAE,0BAA0B,GAAG,GAAG,CAAC,CAAC,CAAC;QAC1F,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC"}

package/dist/sanitize.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Sanitize untrusted user text before emitting via MCP or terminal.
+ *
+ * Lifted from imsg-mcp/src/sanitize.ts.
+ *
+ * - Strips ANSI CSI and OSC escape sequences to prevent terminal corruption.
+ * - Replaces NUL bytes and C0 control characters (except \n, \t, \r) with
+ *   U+FFFD (Replacement Character) — keeps text scannable while making the
+ *   substitution visible.
+ * - Truncates the string if it exceeds `maxLength` (default 4096),
+ *   appending a horizontal ellipsis.
+ *
+ * Call this on every user-content surface in tool responses: chat
+ * snippets, search results, anything originally typed by a human or
+ * sourced from a system you don't control.
+ */
+export declare function sanitize(text: string | null | undefined, maxLength?: number): string | null;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,SAAS,SAAO,GAAG,MAAM,GAAG,IAAI,CAQzF"}

package/dist/sanitize.js

@@ -0,0 +1,33 @@
+/**
+ * Sanitize untrusted user text before emitting via MCP or terminal.
+ *
+ * Lifted from imsg-mcp/src/sanitize.ts.
+ *
+ * - Strips ANSI CSI and OSC escape sequences to prevent terminal corruption.
+ * - Replaces NUL bytes and C0 control characters (except \n, \t, \r) with
+ *   U+FFFD (Replacement Character) — keeps text scannable while making the
+ *   substitution visible.
+ * - Truncates the string if it exceeds `maxLength` (default 4096),
+ *   appending a horizontal ellipsis.
+ *
+ * Call this on every user-content surface in tool responses: chat
+ * snippets, search results, anything originally typed by a human or
+ * sourced from a system you don't control.
+ */
+const ANSI_REGEX = new RegExp([
+    "[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)",
+    "(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))",
+].join("|"), "g");
+// Matches C0 control characters, excluding \t (0x09), \n (0x0A), and \r (0x0D)
+const CONTROL_CHAR_REGEX = /[\x00-\x08\x0B\x0C\x0E-\x1F]/g;
+export function sanitize(text, maxLength = 4096) {
+    if (text == null)
+        return null;
+    let sanitized = text.replace(ANSI_REGEX, "");
+    sanitized = sanitized.replace(CONTROL_CHAR_REGEX, "�");
+    if (sanitized.length > maxLength) {
+        sanitized = `${sanitized.slice(0, maxLength - 1)}…`;
+    }
+    return sanitized;
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B;IACE,8HAA8H;IAC9H,0DAA0D;CAC3D,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;AAEF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAE3D,MAAM,UAAU,QAAQ,CAAC,IAA+B,EAAE,SAAS,GAAG,IAAI;IACxE,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC7C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QACjC,SAAS,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}