@langwatch/mcp-server 2.1.0 → 2.2.0

package/dist/{chunk-EYXMLE5X.js → chunk-HGELNIVY.js}

@@ -1,6 +1,6 @@
 import {
   makeRequest
-} from "./chunk-GELJ2MQR.js";
+} from "./chunk-UWLE5T2F.js";
 
 // src/langwatch-api-agents.ts
 import { z } from "zod";
@@ -11,7 +11,7 @@ import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 import { isIP } from "net";
 
-// ../../packages/ssrf/src/index.ts
+// ../../packages/egress/src/ssrf/address.ts
 function ipv4ToBytes(input) {
   const parts = input.split(".");
   if (parts.length !== 4) return null;
@@ -24,6 +24,25 @@ function ipv4ToBytes(input) {
   }
   return bytes;
 }
+function parseIpv6Groups(part) {
+  if (part === "") return [];
+  const out = [];
+  for (const group of part.split(":")) {
+    if (!/^[0-9a-fA-F]{1,4}$/.test(group)) return null;
+    out.push(parseInt(group, 16));
+  }
+  return out;
+}
+function expandIpv6Groups(halves) {
+  const head = parseIpv6Groups(halves[0]);
+  if (head === null) return null;
+  if (halves.length !== 2) return head;
+  const tail = parseIpv6Groups(halves[1]);
+  if (tail === null) return null;
+  const missing = 8 - head.length - tail.length;
+  if (missing < 0) return null;
+  return [...head, ...Array.from({ length: missing }, () => 0), ...tail];
+}
 function ipv6ToBytes(input) {
   let s = input;
   const zone = s.indexOf("%");
@@ -39,27 +58,8 @@ function ipv6ToBytes(input) {
   }
   const halves = s.split("::");
   if (halves.length > 2) return null;
-  const parseGroups = (part) => {
-    if (part === "") return [];
-    const out = [];
-    for (const g of part.split(":")) {
-      if (!/^[0-9a-fA-F]{1,4}$/.test(g)) return null;
-      out.push(parseInt(g, 16));
-    }
-    return out;
-  };
-  const head = parseGroups(halves[0]);
-  if (head === null) return null;
-  let groups;
-  if (halves.length === 2) {
-    const tail = parseGroups(halves[1]);
-    if (tail === null) return null;
-    const missing = 8 - head.length - tail.length;
-    if (missing < 0) return null;
-    groups = [...head, ...new Array(missing).fill(0), ...tail];
-  } else {
-    groups = head;
-  }
+  const groups = expandIpv6Groups(halves);
+  if (groups === null) return null;
   if (groups.length !== 8) return null;
   const bytes = new Uint8Array(16);
   for (let i = 0; i < 8; i++) {
@@ -71,24 +71,31 @@ function ipv6ToBytes(input) {
 function ipToBytes(ip) {
   return ip.includes(":") ? ipv6ToBytes(ip) : ipv4ToBytes(ip);
 }
+function zeroBetween({
+  bytes,
+  from,
+  to
+}) {
+  for (let i = from; i < to; i++) {
+    if (bytes[i] !== 0) return false;
+  }
+  return true;
+}
 function unmap(bytes) {
   if (bytes.length !== 16) return bytes;
-  for (let i = 0; i < 10; i++) {
-    if (bytes[i] !== 0) return bytes;
-  }
-  if (bytes[10] === 255 && bytes[11] === 255) return bytes.slice(12, 16);
-  return bytes;
+  if (!zeroBetween({ bytes, from: 0, to: 8 })) return bytes;
+  const mapped = zeroBetween({ bytes, from: 8, to: 10 }) && bytes[10] === 255 && bytes[11] === 255;
+  const compatible = zeroBetween({ bytes, from: 8, to: 12 });
+  const translated = bytes[8] === 255 && bytes[9] === 255 && zeroBetween({ bytes, from: 10, to: 12 });
+  return mapped || compatible || translated ? bytes.slice(12, 16) : bytes;
 }
 function parsePrefix({ cidr, rfc }) {
   const slash = cidr.lastIndexOf("/");
   const bytes = ipToBytes(cidr.slice(0, slash));
-  if (!bytes) throw new Error(`@langwatch/ssrf: bad prefix ${cidr}`);
+  if (!bytes) throw new Error(`ssrf: bad prefix ${cidr}`);
   return { bytes, bits: Number(cidr.slice(slash + 1)), rfc };
 }
-function prefixContains({
-  prefix,
-  addr
-}) {
+function prefixContains({ prefix, addr }) {
   if (prefix.bytes.length !== addr.length) return false;
   let bits = prefix.bits;
   let i = 0;
@@ -110,6 +117,10 @@ var METADATA_ADDRESSES = [
   // AWS ECS/Fargate task metadata
   "168.63.129.16",
   // Azure WireServer / host DNS
+  "100.100.100.200",
+  // Alibaba Cloud ECS metadata
+  "192.0.0.192",
+  // Oracle Cloud metadata
   "fd00:ec2::254"
   // AWS EC2 IMDS over IPv6
 ].map((ip) => {
@@ -175,12 +186,14 @@ function bytesEqual({ a, b }) {
   }
   return true;
 }
+function isMetadataAddress(addr) {
+  return METADATA_ADDRESSES.some((m) => bytesEqual({ a: m, b: addr }));
+}
 function classify(ip) {
   const raw = ipToBytes(ip);
   if (!raw) return "special";
   const addr = unmap(raw);
-  if (METADATA_ADDRESSES.some((m) => bytesEqual({ a: m, b: addr })))
-    return "metadata";
+  if (isMetadataAddress(addr)) return "metadata";
   for (const prefix of SPECIAL_PREFIXES) {
     if (prefixContains({ prefix, addr })) return "special";
   }
@@ -203,7 +216,9 @@ var SENSITIVE_REDIRECT_HEADERS = /* @__PURE__ */ new Set([
   "x-access-token"
 ]);
 function unsafeDestinationError() {
-  return new Error("HTTP agent destinations must resolve only to globally routable public addresses");
+  return new Error(
+    "HTTP agent destinations must resolve only to globally routable public addresses"
+  );
 }
 function hostnameWithoutBrackets(hostname) {
   return hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
@@ -380,10 +395,7 @@ async function listAgents(params) {
   return makeRequest("GET", `/api/v1/agents${qs}`);
 }
 async function getAgent(id) {
-  return makeRequest(
-    "GET",
-    `/api/v1/agents/${encodeURIComponent(id)}`
-  );
+  return makeRequest("GET", `/api/v1/agents/${encodeURIComponent(id)}`);
 }
 async function createAgent(data) {
   return makeRequest("POST", "/api/v1/agents", data);
@@ -443,7 +455,7 @@ function buildRelayBody({
     }
     inputParams = parsed.data;
   }
-  if (inputParams || parameters) body.params = { ...inputParams ?? {}, ...parameters ?? {} };
+  if (inputParams || parameters) body.params = { ...inputParams, ...parameters };
   return body;
 }
 async function runAgent({
@@ -484,15 +496,12 @@ async function runAgent({
       `Agent "${agent.name}" (type: ${agent.type}) cannot be executed directly. Only connected agents, HTTP agents and workflow-linked agents can be run.`
     );
   }
-  const { runWorkflow } = await import("./langwatch-api-workflows-6UJL5U4Z.js");
+  const { runWorkflow } = await import("./langwatch-api-workflows-OKC4FXIF.js");
   const result = await runWorkflow(workflowId, input);
   return { agentType: agent.type, result };
 }
 async function deleteAgent(id) {
-  return makeRequest(
-    "DELETE",
-    `/api/v1/agents/${encodeURIComponent(id)}`
-  );
+  return makeRequest("DELETE", `/api/v1/agents/${encodeURIComponent(id)}`);
 }
 
 export {
@@ -504,4 +513,4 @@ export {
   runAgent,
   deleteAgent
 };
-//# sourceMappingURL=chunk-EYXMLE5X.js.map
+//# sourceMappingURL=chunk-HGELNIVY.js.map

package/dist/{chunk-UJPXFA26.js → chunk-HHMNZAPD.js}

@@ -79,7 +79,54 @@ function createRateLimiter({
     }
   };
 }
-var VERIFY_PATH = "/api/me/project";
+var VERIFY_PATH = "/api/v1/me/project";
+function sweepVerdicts(cache) {
+  const now = Date.now();
+  for (const [key, entry] of cache) {
+    if (now >= entry.expiresAt) cache.delete(key);
+  }
+}
+function rememberVerdict({
+  cache,
+  hashed,
+  valid,
+  maxEntries,
+  ttlMs
+}) {
+  if (cache.size >= maxEntries) {
+    sweepVerdicts(cache);
+    while (cache.size >= maxEntries) {
+      const oldest = cache.keys().next();
+      if (oldest.done) break;
+      cache.delete(oldest.value);
+    }
+  }
+  cache.set(hashed, { valid, expiresAt: Date.now() + ttlMs });
+}
+async function askVerifyEndpoint({
+  endpoint,
+  apiKey,
+  fetchImpl,
+  requestTimeoutMs
+}) {
+  let response;
+  try {
+    response = await fetchImpl(`${endpoint}${VERIFY_PATH}`, {
+      method: "GET",
+      headers: { "X-Auth-Token": apiKey },
+      // An upstream that accepts the connection and never answers would
+      // otherwise leave the in-flight promise unsettled, parking every
+      // request for this key behind it until the socket dies.
+      signal: AbortSignal.timeout(requestTimeoutMs)
+    });
+  } catch {
+    return null;
+  }
+  await response.body?.cancel().catch(() => void 0);
+  if (response.ok) return true;
+  if (response.status === 401 || response.status === 403) return false;
+  return null;
+}
 function createApiKeyVerifier({
   endpoint,
   positiveTtlMs = 6e4,
@@ -90,45 +137,15 @@ function createApiKeyVerifier({
 }) {
   const cache = /* @__PURE__ */ new Map();
   const inFlight = /* @__PURE__ */ new Map();
-  function sweep() {
-    const now = Date.now();
-    for (const [key, entry] of cache) {
-      if (now >= entry.expiresAt) cache.delete(key);
-    }
-  }
-  function remember(hashed, valid) {
-    if (cache.size >= maxEntries) {
-      sweep();
-      while (cache.size >= maxEntries) {
-        const oldest = cache.keys().next();
-        if (oldest.done) break;
-        cache.delete(oldest.value);
-      }
-    }
-    cache.set(hashed, {
-      valid,
-      expiresAt: Date.now() + (valid ? positiveTtlMs : negativeTtlMs)
-    });
-  }
-  async function askApi(apiKey) {
-    let response;
-    try {
-      response = await fetchImpl(`${endpoint}${VERIFY_PATH}`, {
-        method: "GET",
-        headers: { "X-Auth-Token": apiKey },
-        // An upstream that accepts the connection and never answers would
-        // otherwise leave the in-flight promise unsettled, parking every
-        // request for this key behind it until the socket dies.
-        signal: AbortSignal.timeout(requestTimeoutMs)
-      });
-    } catch {
-      return null;
-    }
-    await response.body?.cancel().catch(() => void 0);
-    if (response.ok) return true;
-    if (response.status === 401 || response.status === 403) return false;
-    return null;
-  }
+  const sweep = () => sweepVerdicts(cache);
+  const remember = (hashed, valid) => rememberVerdict({
+    cache,
+    hashed,
+    valid,
+    maxEntries,
+    ttlMs: valid ? positiveTtlMs : negativeTtlMs
+  });
+  const askApi = (apiKey) => askVerifyEndpoint({ endpoint, apiKey, fetchImpl, requestTimeoutMs });
   return {
     async verify(apiKey) {
       const hashed = hashApiKey(apiKey);
@@ -152,45 +169,55 @@ function createApiKeyVerifier({
     }
   };
 }
+function releaseSlot({ countByKey }, apiKey) {
+  const hashed = hashApiKey(apiKey);
+  const next = (countByKey.get(hashed) ?? 1) - 1;
+  if (next <= 0) countByKey.delete(hashed);
+  else countByKey.set(hashed, next);
+}
+function dropSession({
+  table,
+  sessionId,
+  record
+}) {
+  table.sessions.delete(sessionId);
+  releaseSlot(table, record.apiKey);
+}
+function reserveSlot({
+  table,
+  apiKey
+}) {
+  const hashed = hashApiKey(apiKey);
+  table.countByKey.set(hashed, (table.countByKey.get(hashed) ?? 0) + 1);
+  let settled = false;
+  return {
+    commit({ sessionId, transport }) {
+      if (settled) return;
+      settled = true;
+      const existing = table.sessions.get(sessionId);
+      if (existing) dropSession({ table, sessionId, record: existing });
+      table.sessions.set(sessionId, {
+        transport,
+        apiKey,
+        lastActivityAt: Date.now()
+      });
+    },
+    release() {
+      if (settled) return;
+      settled = true;
+      releaseSlot(table, apiKey);
+    }
+  };
+}
 function createSessionStore({
   maxAgeMs,
   closeTransport
 }) {
   const sessions = /* @__PURE__ */ new Map();
   const countByKey = /* @__PURE__ */ new Map();
-  function decrement(apiKey) {
-    const hashed = hashApiKey(apiKey);
-    const next = (countByKey.get(hashed) ?? 1) - 1;
-    if (next <= 0) countByKey.delete(hashed);
-    else countByKey.set(hashed, next);
-  }
-  function drop(sessionId, record) {
-    sessions.delete(sessionId);
-    decrement(record.apiKey);
-  }
-  function reserve(apiKey) {
-    const hashed = hashApiKey(apiKey);
-    countByKey.set(hashed, (countByKey.get(hashed) ?? 0) + 1);
-    let settled = false;
-    return {
-      commit({ sessionId, transport }) {
-        if (settled) return;
-        settled = true;
-        const existing = sessions.get(sessionId);
-        if (existing) drop(sessionId, existing);
-        sessions.set(sessionId, {
-          transport,
-          apiKey,
-          lastActivityAt: Date.now()
-        });
-      },
-      release() {
-        if (settled) return;
-        settled = true;
-        decrement(apiKey);
-      }
-    };
-  }
+  const table = { sessions, countByKey };
+  const reserve = (apiKey) => reserveSlot({ table, apiKey });
+  const drop = (sessionId, record) => dropSession({ table, sessionId, record });
   return {
     get(sessionId) {
       return sessions.get(sessionId);
@@ -264,4 +291,4 @@ export {
   createSessionStore,
   admitOAuthToken
 };
-//# sourceMappingURL=chunk-UJPXFA26.js.map
+//# sourceMappingURL=chunk-HHMNZAPD.js.map

package/dist/{chunk-RVAE2MEA.js → chunk-I7ATIZED.js}

@@ -1,32 +1,32 @@
 import {
   makeRequest
-} from "./chunk-GELJ2MQR.js";
+} from "./chunk-UWLE5T2F.js";
 
 // src/langwatch-api-scenarios.ts
 async function listScenarios() {
-  return makeRequest("GET", "/api/scenarios");
+  return makeRequest("GET", "/api/v1/scenarios");
 }
 async function getScenario(id) {
   return makeRequest(
     "GET",
-    `/api/scenarios/${encodeURIComponent(id)}`
+    `/api/v1/scenarios/${encodeURIComponent(id)}`
   );
 }
 async function createScenario(data) {
-  return makeRequest("POST", "/api/scenarios", data);
+  return makeRequest("POST", "/api/v1/scenarios", data);
 }
 async function updateScenario(params) {
   const { id, ...data } = params;
   return makeRequest(
     "PUT",
-    `/api/scenarios/${encodeURIComponent(id)}`,
+    `/api/v1/scenarios/${encodeURIComponent(id)}`,
     data
   );
 }
 async function archiveScenario(id) {
   return makeRequest(
     "DELETE",
-    `/api/scenarios/${encodeURIComponent(id)}`
+    `/api/v1/scenarios/${encodeURIComponent(id)}`
   );
 }
 
@@ -37,4 +37,4 @@ export {
   updateScenario,
   archiveScenario
 };
-//# sourceMappingURL=chunk-RVAE2MEA.js.map
+//# sourceMappingURL=chunk-I7ATIZED.js.map

package/dist/{chunk-S4GVX36W.js → chunk-ILZDO25L.js}

@@ -1,32 +1,29 @@
 import {
   makeRequest
-} from "./chunk-GELJ2MQR.js";
+} from "./chunk-UWLE5T2F.js";
 
 // src/langwatch-api-dashboards.ts
 async function listDashboards() {
-  return makeRequest("GET", "/api/dashboards");
+  return makeRequest("GET", "/api/v1/dashboards");
 }
 async function getDashboard(id) {
   return makeRequest(
     "GET",
-    `/api/dashboards/${encodeURIComponent(id)}`
+    `/api/v1/dashboards/${encodeURIComponent(id)}`
   );
 }
 async function createDashboard(data) {
-  return makeRequest("POST", "/api/dashboards", data);
+  return makeRequest("POST", "/api/v1/dashboards", data);
 }
 async function renameDashboard(id, data) {
   return makeRequest(
     "PATCH",
-    `/api/dashboards/${encodeURIComponent(id)}`,
+    `/api/v1/dashboards/${encodeURIComponent(id)}`,
     data
   );
 }
 async function deleteDashboard(id) {
-  return makeRequest(
-    "DELETE",
-    `/api/dashboards/${encodeURIComponent(id)}`
-  );
+  return makeRequest("DELETE", `/api/v1/dashboards/${encodeURIComponent(id)}`);
 }
 
 export {
@@ -36,4 +33,4 @@ export {
   renameDashboard,
   deleteDashboard
 };
-//# sourceMappingURL=chunk-S4GVX36W.js.map
+//# sourceMappingURL=chunk-ILZDO25L.js.map