@kubb/mcp 5.0.6 → 5.2.0

package/dist/index.d.ts

@@ -7,13 +7,12 @@ import { McpServer } from "tmcp";
  * @example
  * `const server = createMcpServer()`
  */
-declare function createMcpServer(): McpServer<import("valibot").GenericSchema, undefined>;
+export declare function createMcpServer(): McpServer<import("valibot").GenericSchema, undefined>;
 //#endregion
 //#region src/index.d.ts
 /**
  * Entry point that starts the MCP server over stdio.
  */
-declare function run(): Promise<void>;
+export declare function run(): Promise<void>;
 //#endregion
-export { createMcpServer, run };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -8,10 +8,10 @@ import { defineTool } from "tmcp/tool";
 import { tool } from "tmcp/utils";
 import * as v from "valibot";
 import fs, { existsSync } from "node:fs";
-import path from "node:path";
+import path, { isAbsolute, relative, resolve } from "node:path";
 import process$1 from "node:process";
 //#region package.json
-var version = "5.0.6";
+var version = "5.2.0";
 //#endregion
 //#region src/schemas/generateSchema.ts
 const generateSchema = v.object({
@@ -4335,12 +4335,12 @@ var import_jiti = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((expor
 					value: E
 				});
 			}, je.readInt = function(e, t, i) {
-				for (var n = this.options.ecmaVersion >= 12 && void 0 === t, a = i && 48 === this.input.charCodeAt(this.pos), c = this.pos, l = 0, y = 0, E = 0, w = null == t ? Infinity : t; E < w; ++E, ++this.pos) {
+				for (var n = this.options.ecmaVersion >= 12 && void 0 === t, a = i && 48 === this.input.charCodeAt(this.pos), c = this.pos, l = 0, y = 0, E = 0, w = null == t ? 1 / 0 : t; E < w; ++E, ++this.pos) {
 					var C = this.input.charCodeAt(this.pos);
 					var S = void 0;
 					if (n && 95 === C) a && this.raiseRecoverable(this.pos, "Numeric separator is not allowed in legacy octal numeric literals"), 95 === y && this.raiseRecoverable(this.pos, "Numeric separator must be exactly one underscore"), 0 === E && this.raiseRecoverable(this.pos, "Numeric separator is not allowed at the first of digits"), y = C;
 					else {
-						if ((S = C >= 97 ? C - 97 + 10 : C >= 65 ? C - 65 + 10 : C >= 48 && C <= 57 ? C - 48 : Infinity) >= e) break;
+						if ((S = C >= 97 ? C - 97 + 10 : C >= 65 ? C - 65 + 10 : C >= 48 && C <= 57 ? C - 48 : 1 / 0) >= e) break;
 						y = C, l = l * e + S;
 					}
 				}
@@ -4361,8 +4361,8 @@ var import_jiti = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMin(((expor
 					return ++this.pos, isIdentifierStart(this.fullCharCodeAtPos()) && this.raise(this.pos, "Identifier directly after number"), this.finishToken(O.num, a);
 				}
 				i && /[89]/.test(this.input.slice(t, this.pos)) && (i = !1), 46 !== n || i || (++this.pos, this.readInt(10), n = this.input.charCodeAt(this.pos)), 69 !== n && 101 !== n || i || (43 !== (n = this.input.charCodeAt(++this.pos)) && 45 !== n || ++this.pos, null === this.readInt(10) && this.raise(t, "Invalid number")), isIdentifierStart(this.fullCharCodeAtPos()) && this.raise(this.pos, "Identifier directly after number");
-				var c;
-				var l = (c = this.input.slice(t, this.pos), i ? parseInt(c, 8) : parseFloat(c.replace(/_/g, "")));
+				var c = this.input.slice(t, this.pos);
+				var l = i ? parseInt(c, 8) : parseFloat(c.replace(/_/g, ""));
 				return this.finishToken(O.num, l);
 			}, je.readCodePoint = function() {
 				var e;
@@ -5984,6 +5984,29 @@ function createModuleLoader() {
 	} };
 }
 //#endregion
+//#region ../../internals/utils/src/fs.ts
+/**
+* Resolves to `true` when `path` is `parent` itself or nested inside it. Both sides are resolved
+* to absolute paths first, so relative and `..`-containing inputs compare correctly.
+*
+* Guards a destructive or an out-of-tree operation: before wiping an output directory, check that
+* it does not contain the project root, and before loading a path a caller supplied, check that it
+* did not escape the directory it is allowed to read from.
+*
+* @example
+* isPathInside('./src/gen', '.')   // true  — nested inside the root
+* isPathInside('.', '.')           // true  — the same directory counts as inside
+* isPathInside('.', './src/gen')   // false — the root is not inside its own output
+* isPathInside('../other', '.')    // false — escapes the root
+*/
+function isPathInside(path, parent) {
+	const resolvedPath = resolve(path);
+	const resolvedParent = resolve(parent);
+	if (resolvedPath === resolvedParent) return true;
+	const rel = relative(resolvedParent, resolvedPath);
+	return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+//#endregion
 //#region ../../internals/utils/src/promise.ts
 /** Returns `true` when `result` is a thenable `Promise`.
 *
@@ -6055,8 +6078,7 @@ async function loadUserConfig(configPath, { notify }) {
 		}
 		const base = path.resolve(process.cwd());
 		const resolvedConfigPath = path.resolve(base, configPath);
-		const relative = path.relative(base, resolvedConfigPath);
-		if (relative.startsWith("..") || path.isAbsolute(relative)) {
+		if (!isPathInside(resolvedConfigPath, base)) {
 			const msg = "Invalid config file path: must be within the current working directory";
 			await notify("CONFIG_ERROR", msg);
 			throw new Error(msg);