@launchdarkly/mcp-server 0.6.2 → 0.7.0

package/bin/mcp-server.js

@@ -14880,7 +14880,54 @@ var init_stdio2 = __esm(() => {
   init_stdio();
 });
 
-// node_modules/statuses/codes.json
+// node_modules/@modelcontextprotocol/sdk/dist/esm/server/middleware/hostHeaderValidation.js
+function hostHeaderValidation(allowedHostnames) {
+  return (req, res, next) => {
+    const hostHeader = req.headers.host;
+    if (!hostHeader) {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32000,
+          message: "Missing Host header"
+        },
+        id: null
+      });
+      return;
+    }
+    let hostname;
+    try {
+      hostname = new URL(`http://${hostHeader}`).hostname;
+    } catch {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32000,
+          message: `Invalid Host header: ${hostHeader}`
+        },
+        id: null
+      });
+      return;
+    }
+    if (!allowedHostnames.includes(hostname)) {
+      res.status(403).json({
+        jsonrpc: "2.0",
+        error: {
+          code: -32000,
+          message: `Invalid Host: ${hostname}`
+        },
+        id: null
+      });
+      return;
+    }
+    next();
+  };
+}
+function localhostHostValidation() {
+  return hostHeaderValidation(["localhost", "127.0.0.1", "[::1]"]);
+}
+
+// node_modules/body-parser/node_modules/statuses/codes.json
 var require_codes2 = __commonJS((exports, module) => {
   module.exports = {
     "100": "Continue",
@@ -14949,7 +14996,7 @@ var require_codes2 = __commonJS((exports, module) => {
   };
 });
 
-// node_modules/statuses/index.js
+// node_modules/body-parser/node_modules/statuses/index.js
 var require_statuses2 = __commonJS((exports, module) => {
   /*!
    * statuses
@@ -15023,7 +15070,7 @@ var require_statuses2 = __commonJS((exports, module) => {
   }
 });
 
-// node_modules/http-errors/index.js
+// node_modules/body-parser/node_modules/http-errors/index.js
 var require_http_errors2 = __commonJS((exports, module) => {
   /*!
    * http-errors
@@ -15186,7 +15233,7 @@ var require_http_errors2 = __commonJS((exports, module) => {
     });
   }
   function toClassName(name) {
-    return name.substr(-5) !== "Error" ? name + "Error" : name;
+    return name.slice(-5) === "Error" ? name : name + "Error";
   }
 });
 
@@ -28314,12 +28361,15 @@ var require_json = __commonJS((exports, module) => {
   var JSON_SYNTAX_REGEXP = /#+/g;
   function json(options) {
     var opts = options || {};
-    var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+    var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
     var inflate = opts.inflate !== false;
     var reviver = opts.reviver;
     var strict = opts.strict !== false;
     var type = opts.type || "application/json";
     var verify = opts.verify || false;
+    if (limit === null) {
+      throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+    }
     if (verify !== false && typeof verify !== "function") {
       throw new TypeError("option verify must be function");
     }
@@ -28384,10 +28434,7 @@ var require_json = __commonJS((exports, module) => {
     var index = str.indexOf(char);
     var partial2 = "";
     if (index !== -1) {
-      partial2 = str.substring(0, index) + JSON_SYNTAX_CHAR;
-      for (var i = index + 1;i < str.length; i++) {
-        partial2 += JSON_SYNTAX_CHAR;
-      }
+      partial2 = str.substring(0, index) + new Array(str.length - index + 1).join(JSON_SYNTAX_CHAR);
     }
     try {
       JSON.parse(partial2);
@@ -28446,9 +28493,12 @@ var require_raw = __commonJS((exports, module) => {
   function raw(options) {
     var opts = options || {};
     var inflate = opts.inflate !== false;
-    var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+    var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
     var type = opts.type || "application/octet-stream";
     var verify = opts.verify || false;
+    if (limit === null) {
+      throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+    }
     if (verify !== false && typeof verify !== "function") {
       throw new TypeError("option verify must be function");
     }
@@ -28506,9 +28556,12 @@ var require_text = __commonJS((exports, module) => {
     var opts = options || {};
     var defaultCharset = opts.defaultCharset || "utf-8";
     var inflate = opts.inflate !== false;
-    var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+    var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
     var type = opts.type || "text/plain";
     var verify = opts.verify || false;
+    if (limit === null) {
+      throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+    }
     if (verify !== false && typeof verify !== "function") {
       throw new TypeError("option verify must be function");
     }
@@ -29149,9 +29202,8 @@ var require_side_channel_list = __commonJS((exports, module) => {
         }
       },
       delete: function(key) {
-        var root = $o && $o.next;
         var deletedNode = listDelete($o, key);
-        if (deletedNode && root && root === deletedNode) {
+        if (deletedNode && $o && !$o.next) {
           $o = undefined;
         }
         return !!deletedNode;
@@ -29997,7 +30049,8 @@ var require_side_channel = __commonJS((exports, module) => {
     var channel = {
       assert: function(key) {
         if (!channel.has(key)) {
-          throw new $TypeError("Side channel does not contain " + inspect(key));
+          var keyDesc = key && Object(key) === key ? "the given object key" : inspect(key);
+          throw new $TypeError("Side channel does not contain " + keyDesc);
         }
       },
       delete: function(key) {
@@ -30046,12 +30099,28 @@ var require_formats = __commonJS((exports, module) => {
 // node_modules/qs/lib/utils.js
 var require_utils = __commonJS((exports, module) => {
   var formats = require_formats();
+  var getSideChannel = require_side_channel();
+  var defineProperty = require_es_define_property();
   var has = Object.prototype.hasOwnProperty;
   var isArray = Array.isArray;
+  var overflowChannel = getSideChannel();
+  var markOverflow = function markOverflow(obj, maxIndex) {
+    overflowChannel.set(obj, maxIndex);
+    return obj;
+  };
+  var isOverflow = function isOverflow(obj) {
+    return overflowChannel.has(obj);
+  };
+  var getMaxIndex = function getMaxIndex(obj) {
+    return overflowChannel.get(obj);
+  };
+  var setMaxIndex = function setMaxIndex(obj, maxIndex) {
+    overflowChannel.set(obj, maxIndex);
+  };
   var hexTable = function() {
     var array2 = [];
     for (var i = 0;i < 256; ++i) {
-      array2.push("%" + ((i < 16 ? "0" : "") + i.toString(16)).toUpperCase());
+      array2[array2.length] = "%" + ((i < 16 ? "0" : "") + i.toString(16)).toUpperCase();
     }
     return array2;
   }();
@@ -30063,7 +30132,7 @@ var require_utils = __commonJS((exports, module) => {
         var compacted = [];
         for (var j2 = 0;j2 < obj.length; ++j2) {
           if (typeof obj[j2] !== "undefined") {
-            compacted.push(obj[j2]);
+            compacted[compacted.length] = obj[j2];
           }
         }
         item.obj[item.prop] = compacted;
@@ -30071,7 +30140,7 @@ var require_utils = __commonJS((exports, module) => {
     }
   };
   var arrayToObject = function arrayToObject(source, options) {
-    var obj = options && options.plainObjects ? Object.create(null) : {};
+    var obj = options && options.plainObjects ? { __proto__: null } : {};
     for (var i = 0;i < source.length; ++i) {
       if (typeof source[i] !== "undefined") {
         obj[i] = source[i];
@@ -30079,15 +30148,40 @@ var require_utils = __commonJS((exports, module) => {
     }
     return obj;
   };
+  var setProperty = function setProperty(obj, key, value) {
+    if (key === "__proto__" && defineProperty) {
+      defineProperty(obj, key, {
+        configurable: true,
+        enumerable: true,
+        value,
+        writable: true
+      });
+    } else {
+      obj[key] = value;
+    }
+  };
   var merge2 = function merge(target, source, options) {
     if (!source) {
       return target;
     }
-    if (typeof source !== "object") {
+    if (typeof source !== "object" && typeof source !== "function") {
       if (isArray(target)) {
-        target.push(source);
+        var nextIndex = target.length;
+        if (options && typeof options.arrayLimit === "number" && nextIndex >= options.arrayLimit) {
+          if (options.throwOnLimitExceeded) {
+            throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+          }
+          return markOverflow(arrayToObject(target.concat(source), options), nextIndex);
+        }
+        target[nextIndex] = source;
       } else if (target && typeof target === "object") {
-        if (options && (options.plainObjects || options.allowPrototypes) || !has.call(Object.prototype, source)) {
+        if (isOverflow(target)) {
+          var newIndex = getMaxIndex(target) + 1;
+          target[newIndex] = source;
+          setMaxIndex(target, newIndex);
+        } else if (options && options.strictMerge) {
+          return [target, source];
+        } else if (options && (options.plainObjects || options.allowPrototypes) || !has.call(Object.prototype, source)) {
           target[source] = true;
         }
       } else {
@@ -30096,7 +30190,23 @@ var require_utils = __commonJS((exports, module) => {
       return target;
     }
     if (!target || typeof target !== "object") {
-      return [target].concat(source);
+      if (isOverflow(source)) {
+        var sourceKeys = Object.keys(source);
+        var result = options && options.plainObjects ? { __proto__: null, 0: target } : { 0: target };
+        for (var m = 0;m < sourceKeys.length; m++) {
+          var oldKey = parseInt(sourceKeys[m], 10);
+          result[oldKey + 1] = source[sourceKeys[m]];
+        }
+        return markOverflow(result, getMaxIndex(source) + 1);
+      }
+      var combined = [target].concat(source);
+      if (options && typeof options.arrayLimit === "number" && combined.length > options.arrayLimit) {
+        if (options.throwOnLimitExceeded) {
+          throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+        }
+        return markOverflow(arrayToObject(combined, options), combined.length - 1);
+      }
+      return combined;
     }
     var mergeTarget = target;
     if (isArray(target) && !isArray(source)) {
@@ -30109,31 +30219,46 @@ var require_utils = __commonJS((exports, module) => {
           if (targetItem && typeof targetItem === "object" && item && typeof item === "object") {
             target[i] = merge(targetItem, item, options);
           } else {
-            target.push(item);
+            target[target.length] = item;
           }
         } else {
           target[i] = item;
         }
       });
+      if (options && typeof options.arrayLimit === "number" && target.length > options.arrayLimit) {
+        if (options.throwOnLimitExceeded) {
+          throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+        }
+        return markOverflow(arrayToObject(target, options), target.length - 1);
+      }
       return target;
     }
     return Object.keys(source).reduce(function(acc, key) {
       var value = source[key];
       if (has.call(acc, key)) {
-        acc[key] = merge(acc[key], value, options);
+        setProperty(acc, key, merge(acc[key], value, options));
       } else {
-        acc[key] = value;
+        setProperty(acc, key, value);
+      }
+      if (isOverflow(source) && !isOverflow(acc)) {
+        markOverflow(acc, getMaxIndex(source));
+      }
+      if (isOverflow(acc)) {
+        var keyNum = parseInt(key, 10);
+        if (String(keyNum) === key && keyNum >= 0 && keyNum > getMaxIndex(acc)) {
+          setMaxIndex(acc, keyNum);
+        }
       }
       return acc;
     }, mergeTarget);
   };
   var assign = function assignSingleSource(target, source) {
     return Object.keys(source).reduce(function(acc, key) {
-      acc[key] = source[key];
+      setProperty(acc, key, source[key]);
       return acc;
     }, target);
   };
-  var decode2 = function(str, decoder, charset) {
+  var decode2 = function(str, defaultDecoder, charset) {
     var strWithoutPlus = str.replace(/\+/g, " ");
     if (charset === "iso-8859-1") {
       return strWithoutPlus.replace(/%[0-9a-f]{2}/gi, unescape);
@@ -30163,6 +30288,13 @@ var require_utils = __commonJS((exports, module) => {
     var out = "";
     for (var j2 = 0;j2 < string3.length; j2 += limit) {
       var segment = string3.length >= limit ? string3.slice(j2, j2 + limit) : string3;
+      if (j2 + limit < string3.length) {
+        var last = segment.charCodeAt(segment.length - 1);
+        if (last >= 55296 && last <= 56319) {
+          segment = segment.slice(0, -1);
+          j2 -= 1;
+        }
+      }
       var arr = [];
       for (var i = 0;i < segment.length; ++i) {
         var c = segment.charCodeAt(i);
@@ -30192,7 +30324,7 @@ var require_utils = __commonJS((exports, module) => {
   };
   var compact = function compact(value) {
     var queue = [{ obj: { o: value }, prop: "o" }];
-    var refs = [];
+    var refs = getSideChannel();
     for (var i = 0;i < queue.length; ++i) {
       var item = queue[i];
       var obj = item.obj[item.prop];
@@ -30200,9 +30332,9 @@ var require_utils = __commonJS((exports, module) => {
       for (var j2 = 0;j2 < keys.length; ++j2) {
         var key = keys[j2];
         var val = obj[key];
-        if (typeof val === "object" && val !== null && refs.indexOf(val) === -1) {
-          queue.push({ obj, prop: key });
-          refs.push(val);
+        if (typeof val === "object" && val !== null && !refs.has(val)) {
+          queue[queue.length] = { obj, prop: key };
+          refs.set(val, true);
         }
       }
     }
@@ -30218,14 +30350,30 @@ var require_utils = __commonJS((exports, module) => {
     }
     return !!(obj.constructor && obj.constructor.isBuffer && obj.constructor.isBuffer(obj));
   };
-  var combine = function combine(a, b2) {
-    return [].concat(a, b2);
+  var combine = function combine(a, b2, arrayLimit, plainObjects, throwOnLimitExceeded) {
+    if (isOverflow(a)) {
+      if (throwOnLimitExceeded) {
+        throw new RangeError("Array limit exceeded. Only " + arrayLimit + " element" + (arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+      }
+      var newIndex = getMaxIndex(a) + 1;
+      a[newIndex] = b2;
+      setMaxIndex(a, newIndex);
+      return a;
+    }
+    var result = [].concat(a, b2);
+    if (result.length > arrayLimit) {
+      if (throwOnLimitExceeded) {
+        throw new RangeError("Array limit exceeded. Only " + arrayLimit + " element" + (arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+      }
+      return markOverflow(arrayToObject(result, { plainObjects }), result.length - 1);
+    }
+    return result;
   };
   var maybeMap = function maybeMap(val, fn) {
     if (isArray(val)) {
       var mapped = [];
       for (var i = 0;i < val.length; i += 1) {
-        mapped.push(fn(val[i]));
+        mapped[mapped.length] = fn(val[i]);
       }
       return mapped;
     }
@@ -30239,7 +30387,9 @@ var require_utils = __commonJS((exports, module) => {
     decode: decode2,
     encode: encode2,
     isBuffer,
+    isOverflow,
     isRegExp,
+    markOverflow,
     maybeMap,
     merge: merge2
   };
@@ -30277,11 +30427,13 @@ var require_stringify = __commonJS((exports, module) => {
     arrayFormat: "indices",
     charset: "utf-8",
     charsetSentinel: false,
+    commaRoundTrip: false,
     delimiter: "&",
     encode: true,
     encodeDotInKeys: false,
     encoder: utils.encode,
     encodeValuesOnly: false,
+    filter: undefined,
     format: defaultFormat,
     formatter: formats.formatters[defaultFormat],
     indices: false,
@@ -30328,7 +30480,7 @@ var require_stringify = __commonJS((exports, module) => {
     }
     if (obj === null) {
       if (strictNullHandling) {
-        return encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, "key", format) : prefix;
+        return formatter(encoder && !encodeValuesOnly ? encoder(prefix, defaults.encoder, charset, "key", format) : prefix);
       }
       obj = "";
     }
@@ -30346,7 +30498,9 @@ var require_stringify = __commonJS((exports, module) => {
     var objKeys;
     if (generateArrayPrefix === "comma" && isArray(obj)) {
       if (encodeValuesOnly && encoder) {
-        obj = utils.maybeMap(obj, encoder);
+        obj = utils.maybeMap(obj, function(v2) {
+          return v2 == null ? v2 : encoder(v2);
+        });
       }
       objKeys = [{ value: obj.length > 0 ? obj.join(",") || null : undefined }];
     } else if (isArray(filter)) {
@@ -30355,18 +30509,18 @@ var require_stringify = __commonJS((exports, module) => {
       var keys = Object.keys(obj);
       objKeys = sort ? keys.sort(sort) : keys;
     }
-    var encodedPrefix = encodeDotInKeys ? prefix.replace(/\./g, "%2E") : prefix;
+    var encodedPrefix = encodeDotInKeys ? String(prefix).replace(/\./g, "%2E") : String(prefix);
     var adjustedPrefix = commaRoundTrip && isArray(obj) && obj.length === 1 ? encodedPrefix + "[]" : encodedPrefix;
     if (allowEmptyArrays && isArray(obj) && obj.length === 0) {
       return adjustedPrefix + "[]";
     }
     for (var j2 = 0;j2 < objKeys.length; ++j2) {
       var key = objKeys[j2];
-      var value = typeof key === "object" && typeof key.value !== "undefined" ? key.value : obj[key];
+      var value = typeof key === "object" && key && typeof key.value !== "undefined" ? key.value : obj[key];
       if (skipNulls && value === null) {
         continue;
       }
-      var encodedKey = allowDots && encodeDotInKeys ? key.replace(/\./g, "%2E") : key;
+      var encodedKey = allowDots && encodeDotInKeys ? String(key).replace(/\./g, "%2E") : String(key);
       var keyPrefix = isArray(obj) ? typeof generateArrayPrefix === "function" ? generateArrayPrefix(adjustedPrefix, encodedKey) : adjustedPrefix : adjustedPrefix + (allowDots ? "." + encodedKey : "[" + encodedKey + "]");
       sideChannel.set(object2, step);
       var valueSideChannel = getSideChannel();
@@ -30423,7 +30577,7 @@ var require_stringify = __commonJS((exports, module) => {
       arrayFormat,
       charset,
       charsetSentinel: typeof opts.charsetSentinel === "boolean" ? opts.charsetSentinel : defaults.charsetSentinel,
-      commaRoundTrip: opts.commaRoundTrip,
+      commaRoundTrip: !!opts.commaRoundTrip,
       delimiter: typeof opts.delimiter === "undefined" ? defaults.delimiter : opts.delimiter,
       encode: typeof opts.encode === "boolean" ? opts.encode : defaults.encode,
       encodeDotInKeys: typeof opts.encodeDotInKeys === "boolean" ? opts.encodeDotInKeys : defaults.encodeDotInKeys,
@@ -30465,18 +30619,22 @@ var require_stringify = __commonJS((exports, module) => {
     var sideChannel = getSideChannel();
     for (var i = 0;i < objKeys.length; ++i) {
       var key = objKeys[i];
-      if (options.skipNulls && obj[key] === null) {
+      if (typeof key === "undefined" || key === null) {
         continue;
       }
-      pushToArray(keys, stringify(obj[key], key, generateArrayPrefix, commaRoundTrip, options.allowEmptyArrays, options.strictNullHandling, options.skipNulls, options.encodeDotInKeys, options.encode ? options.encoder : null, options.filter, options.sort, options.allowDots, options.serializeDate, options.format, options.formatter, options.encodeValuesOnly, options.charset, sideChannel));
+      var value = obj[key];
+      if (options.skipNulls && value === null) {
+        continue;
+      }
+      pushToArray(keys, stringify(value, key, generateArrayPrefix, commaRoundTrip, options.allowEmptyArrays, options.strictNullHandling, options.skipNulls, options.encodeDotInKeys, options.encode ? options.encoder : null, options.filter, options.sort, options.allowDots, options.serializeDate, options.format, options.formatter, options.encodeValuesOnly, options.charset, sideChannel));
     }
     var joined = keys.join(options.delimiter);
     var prefix = options.addQueryPrefix === true ? "?" : "";
     if (options.charsetSentinel) {
       if (options.charset === "iso-8859-1") {
-        prefix += "utf8=%26%2310003%3B&";
+        prefix += "utf8=%26%2310003%3B" + options.delimiter;
       } else {
-        prefix += "utf8=%E2%9C%93&";
+        prefix += "utf8=%E2%9C%93" + options.delimiter;
       }
     }
     return joined.length > 0 ? prefix + joined : "";
@@ -30508,17 +30666,33 @@ var require_parse = __commonJS((exports, module) => {
     parseArrays: true,
     plainObjects: false,
     strictDepth: false,
-    strictNullHandling: false
+    strictMerge: true,
+    strictNullHandling: false,
+    throwOnLimitExceeded: false
   };
   var interpretNumericEntities = function(str) {
     return str.replace(/&#(\d+);/g, function($0, numberStr) {
       return String.fromCharCode(parseInt(numberStr, 10));
     });
   };
-  var parseArrayValue = function(val, options) {
+  var parseArrayValue = function(val, options, currentArrayLength, isFlatArrayValue) {
     if (val && typeof val === "string" && options.comma && val.indexOf(",") > -1) {
+      if (isFlatArrayValue && options.throwOnLimitExceeded) {
+        var commaCount = 0;
+        var commaIndex = val.indexOf(",");
+        while (commaIndex > -1) {
+          commaCount += 1;
+          if (commaCount >= options.arrayLimit) {
+            throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+          }
+          commaIndex = val.indexOf(",", commaIndex + 1);
+        }
+      }
       return val.split(",");
     }
+    if (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {
+      throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+    }
     return val;
   };
   var isoSentinel = "utf8=%26%2310003%3B";
@@ -30528,7 +30702,10 @@ var require_parse = __commonJS((exports, module) => {
     var cleanStr = options.ignoreQueryPrefix ? str.replace(/^\?/, "") : str;
     cleanStr = cleanStr.replace(/%5B/gi, "[").replace(/%5D/gi, "]");
     var limit = options.parameterLimit === Infinity ? undefined : options.parameterLimit;
-    var parts = cleanStr.split(options.delimiter, limit);
+    var parts = cleanStr.split(options.delimiter, options.throwOnLimitExceeded && typeof limit !== "undefined" ? limit + 1 : limit);
+    if (options.throwOnLimitExceeded && typeof limit !== "undefined" && parts.length > limit) {
+      throw new RangeError("Parameter limit exceeded. Only " + limit + " parameter" + (limit === 1 ? "" : "s") + " allowed.");
+    }
     var skipIndex = -1;
     var i;
     var charset = options.charset;
@@ -30552,48 +30729,71 @@ var require_parse = __commonJS((exports, module) => {
       var part = parts[i];
       var bracketEqualsPos = part.indexOf("]=");
       var pos = bracketEqualsPos === -1 ? part.indexOf("=") : bracketEqualsPos + 1;
-      var key, val;
+      var key;
+      var val;
       if (pos === -1) {
         key = options.decoder(part, defaults.decoder, charset, "key");
         val = options.strictNullHandling ? null : "";
       } else {
         key = options.decoder(part.slice(0, pos), defaults.decoder, charset, "key");
-        val = utils.maybeMap(parseArrayValue(part.slice(pos + 1), options), function(encodedVal) {
-          return options.decoder(encodedVal, defaults.decoder, charset, "value");
-        });
+        if (key !== null) {
+          val = utils.maybeMap(parseArrayValue(part.slice(pos + 1), options, isArray(obj[key]) ? obj[key].length : 0, part.indexOf("[]=") === -1), function(encodedVal) {
+            return options.decoder(encodedVal, defaults.decoder, charset, "value");
+          });
+        }
       }
       if (val && options.interpretNumericEntities && charset === "iso-8859-1") {
-        val = interpretNumericEntities(val);
+        val = interpretNumericEntities(String(val));
       }
       if (part.indexOf("[]=") > -1) {
         val = isArray(val) ? [val] : val;
       }
-      var existing = has.call(obj, key);
-      if (existing && options.duplicates === "combine") {
-        obj[key] = utils.combine(obj[key], val);
-      } else if (!existing || options.duplicates === "last") {
-        obj[key] = val;
+      if (options.comma && isArray(val) && val.length > options.arrayLimit) {
+        val = utils.combine([], val, options.arrayLimit, options.plainObjects, options.throwOnLimitExceeded);
+      }
+      if (key !== null) {
+        var existing = has.call(obj, key);
+        if (existing && (options.duplicates === "combine" || part.indexOf("[]=") > -1)) {
+          obj[key] = utils.combine(obj[key], val, options.arrayLimit, options.plainObjects, options.throwOnLimitExceeded);
+        } else if (!existing || options.duplicates === "last") {
+          obj[key] = val;
+        }
       }
     }
     return obj;
   };
   var parseObject = function(chain, val, options, valuesParsed) {
-    var leaf = valuesParsed ? val : parseArrayValue(val, options);
+    var currentArrayLength = 0;
+    if (chain.length > 0 && chain[chain.length - 1] === "[]") {
+      var parentKey = chain.slice(0, -1).join("");
+      currentArrayLength = Array.isArray(val) && val[parentKey] ? val[parentKey].length : 0;
+    }
+    var leaf = valuesParsed ? val : parseArrayValue(val, options, currentArrayLength);
     for (var i = chain.length - 1;i >= 0; --i) {
       var obj;
       var root = chain[i];
       if (root === "[]" && options.parseArrays) {
-        obj = options.allowEmptyArrays && (leaf === "" || options.strictNullHandling && leaf === null) ? [] : [].concat(leaf);
+        if (utils.isOverflow(leaf)) {
+          obj = leaf;
+        } else {
+          obj = options.allowEmptyArrays && (leaf === "" || options.strictNullHandling && leaf === null) ? [] : utils.combine([], leaf, options.arrayLimit, options.plainObjects, options.throwOnLimitExceeded);
+        }
       } else {
-        obj = options.plainObjects ? Object.create(null) : {};
+        obj = options.plainObjects ? { __proto__: null } : {};
         var cleanRoot = root.charAt(0) === "[" && root.charAt(root.length - 1) === "]" ? root.slice(1, -1) : root;
         var decodedRoot = options.decodeDotInKeys ? cleanRoot.replace(/%2E/g, ".") : cleanRoot;
         var index = parseInt(decodedRoot, 10);
+        var isValidArrayIndex = !isNaN(index) && root !== decodedRoot && String(index) === decodedRoot && index >= 0 && options.parseArrays;
         if (!options.parseArrays && decodedRoot === "") {
           obj = { 0: leaf };
-        } else if (!isNaN(index) && root !== decodedRoot && String(index) === decodedRoot && index >= 0 && (options.parseArrays && index <= options.arrayLimit)) {
+        } else if (isValidArrayIndex && index < options.arrayLimit) {
           obj = [];
           obj[index] = leaf;
+        } else if (isValidArrayIndex && options.throwOnLimitExceeded) {
+          throw new RangeError("Array limit exceeded. Only " + options.arrayLimit + " element" + (options.arrayLimit === 1 ? "" : "s") + " allowed in an array.");
+        } else if (isValidArrayIndex) {
+          obj[index] = leaf;
+          utils.markOverflow(obj, index);
         } else if (decodedRoot !== "__proto__") {
           obj[decodedRoot] = leaf;
         }
@@ -30602,39 +30802,74 @@ var require_parse = __commonJS((exports, module) => {
     }
     return leaf;
   };
-  var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
-    if (!givenKey) {
-      return;
+  var splitKeyIntoSegments = function splitKeyIntoSegments(originalKey, options) {
+    var key = options.allowDots ? originalKey.replace(/\.([^.[]+)/g, "[$1]") : originalKey;
+    if (options.depth <= 0) {
+      if (!options.plainObjects && has.call(Object.prototype, key)) {
+        if (!options.allowPrototypes) {
+          return;
+        }
+      }
+      return [key];
     }
-    var key = options.allowDots ? givenKey.replace(/\.([^.[]+)/g, "[$1]") : givenKey;
-    var brackets = /(\[[^[\]]*])/;
-    var child = /(\[[^[\]]*])/g;
-    var segment = options.depth > 0 && brackets.exec(key);
-    var parent = segment ? key.slice(0, segment.index) : key;
-    var keys = [];
+    var segments = [];
+    var first = key.indexOf("[");
+    var parent = first >= 0 ? key.slice(0, first) : key;
     if (parent) {
       if (!options.plainObjects && has.call(Object.prototype, parent)) {
         if (!options.allowPrototypes) {
           return;
         }
       }
-      keys.push(parent);
+      segments[segments.length] = parent;
     }
-    var i = 0;
-    while (options.depth > 0 && (segment = child.exec(key)) !== null && i < options.depth) {
-      i += 1;
-      if (!options.plainObjects && has.call(Object.prototype, segment[1].slice(1, -1))) {
-        if (!options.allowPrototypes) {
-          return;
+    var n = key.length;
+    var open = first;
+    var collected = 0;
+    while (open >= 0 && collected < options.depth) {
+      var level = 1;
+      var i = open + 1;
+      var close = -1;
+      while (i < n && close < 0) {
+        var cu = key.charCodeAt(i);
+        if (cu === 91) {
+          level += 1;
+        } else if (cu === 93) {
+          level -= 1;
+          if (level === 0) {
+            close = i;
+          }
         }
+        i += 1;
+      }
+      if (close < 0) {
+        segments[segments.length] = "[" + key.slice(open) + "]";
+        return segments;
+      }
+      var seg = key.slice(open, close + 1);
+      var content = seg.slice(1, -1);
+      if (!options.plainObjects && has.call(Object.prototype, content) && !options.allowPrototypes) {
+        return;
       }
-      keys.push(segment[1]);
+      segments[segments.length] = seg;
+      collected += 1;
+      open = key.indexOf("[", close + 1);
     }
-    if (segment) {
+    if (open >= 0) {
       if (options.strictDepth === true) {
         throw new RangeError("Input depth exceeded depth option of " + options.depth + " and strictDepth is true");
       }
-      keys.push("[" + key.slice(segment.index) + "]");
+      segments[segments.length] = "[" + key.slice(open) + "]";
+    }
+    return segments;
+  };
+  var parseKeys = function parseQueryStringKeys(givenKey, val, options, valuesParsed) {
+    if (!givenKey) {
+      return;
+    }
+    var keys = splitKeyIntoSegments(givenKey, options);
+    if (!keys) {
+      return;
     }
     return parseObject(keys, val, options, valuesParsed);
   };
@@ -30654,6 +30889,9 @@ var require_parse = __commonJS((exports, module) => {
     if (typeof opts.charset !== "undefined" && opts.charset !== "utf-8" && opts.charset !== "iso-8859-1") {
       throw new TypeError("The charset option must be either utf-8, iso-8859-1, or undefined");
     }
+    if (typeof opts.throwOnLimitExceeded !== "undefined" && typeof opts.throwOnLimitExceeded !== "boolean") {
+      throw new TypeError("`throwOnLimitExceeded` option must be a boolean");
+    }
     var charset = typeof opts.charset === "undefined" ? defaults.charset : opts.charset;
     var duplicates = typeof opts.duplicates === "undefined" ? defaults.duplicates : opts.duplicates;
     if (duplicates !== "combine" && duplicates !== "first" && duplicates !== "last") {
@@ -30680,16 +30918,18 @@ var require_parse = __commonJS((exports, module) => {
       parseArrays: opts.parseArrays !== false,
       plainObjects: typeof opts.plainObjects === "boolean" ? opts.plainObjects : defaults.plainObjects,
       strictDepth: typeof opts.strictDepth === "boolean" ? !!opts.strictDepth : defaults.strictDepth,
-      strictNullHandling: typeof opts.strictNullHandling === "boolean" ? opts.strictNullHandling : defaults.strictNullHandling
+      strictMerge: typeof opts.strictMerge === "boolean" ? !!opts.strictMerge : defaults.strictMerge,
+      strictNullHandling: typeof opts.strictNullHandling === "boolean" ? opts.strictNullHandling : defaults.strictNullHandling,
+      throwOnLimitExceeded: typeof opts.throwOnLimitExceeded === "boolean" ? opts.throwOnLimitExceeded : false
     };
   };
   module.exports = function(str, opts) {
     var options = normalizeParseOptions(opts);
     if (str === "" || str === null || typeof str === "undefined") {
-      return options.plainObjects ? Object.create(null) : {};
+      return options.plainObjects ? { __proto__: null } : {};
     }
     var tempObj = typeof str === "string" ? parseValues(str, options) : str;
-    var obj = options.plainObjects ? Object.create(null) : {};
+    var obj = options.plainObjects ? { __proto__: null } : {};
     var keys = Object.keys(tempObj);
     for (var i = 0;i < keys.length; ++i) {
       var key = keys[i];
@@ -30739,10 +30979,12 @@ var require_urlencoded = __commonJS((exports, module) => {
     }
     var extended = opts.extended !== false;
     var inflate = opts.inflate !== false;
-    var limit = typeof opts.limit !== "number" ? bytes.parse(opts.limit || "100kb") : opts.limit;
+    var limit = typeof opts.limit === "undefined" || opts.limit === null ? 102400 : bytes.parse(opts.limit);
     var type = opts.type || "application/x-www-form-urlencoded";
     var verify = opts.verify || false;
-    var depth = typeof opts.depth !== "number" ? Number(opts.depth || 32) : opts.depth;
+    if (limit === null) {
+      throw new TypeError('option limit "' + String(opts.limit) + '" is invalid');
+    }
     if (verify !== false && typeof verify !== "function") {
       throw new TypeError("option verify must be function");
     }
@@ -30783,14 +31025,13 @@ var require_urlencoded = __commonJS((exports, module) => {
         encoding: charset,
         inflate,
         limit,
-        verify,
-        depth
+        verify
       });
     };
   }
   function extendedparser(options) {
     var parameterLimit = options.parameterLimit !== undefined ? options.parameterLimit : 1000;
-    var depth = typeof options.depth !== "number" ? Number(options.depth || 32) : options.depth;
+    var depth = options.depth !== undefined ? options.depth : 32;
     var parse5 = parser("qs");
     if (isNaN(parameterLimit) || parameterLimit < 1) {
       throw new TypeError("option parameterLimit must be a positive number");
@@ -30839,14 +31080,14 @@ var require_urlencoded = __commonJS((exports, module) => {
   }
   function parameterCount(body, limit) {
     var count = 0;
-    var index = 0;
-    while ((index = body.indexOf("&", index)) !== -1) {
+    var index = -1;
+    do {
       count++;
-      index++;
-      if (count === limit) {
+      if (count > limit) {
         return;
       }
-    }
+      index = body.indexOf("&", index + 1);
+    } while (index !== -1);
     return count;
   }
   function parser(name) {
@@ -31565,6 +31806,149 @@ var require_parseurl = __commonJS((exports, module) => {
   }
 });
 
+// node_modules/statuses/codes.json
+var require_codes3 = __commonJS((exports, module) => {
+  module.exports = {
+    "100": "Continue",
+    "101": "Switching Protocols",
+    "102": "Processing",
+    "103": "Early Hints",
+    "200": "OK",
+    "201": "Created",
+    "202": "Accepted",
+    "203": "Non-Authoritative Information",
+    "204": "No Content",
+    "205": "Reset Content",
+    "206": "Partial Content",
+    "207": "Multi-Status",
+    "208": "Already Reported",
+    "226": "IM Used",
+    "300": "Multiple Choices",
+    "301": "Moved Permanently",
+    "302": "Found",
+    "303": "See Other",
+    "304": "Not Modified",
+    "305": "Use Proxy",
+    "307": "Temporary Redirect",
+    "308": "Permanent Redirect",
+    "400": "Bad Request",
+    "401": "Unauthorized",
+    "402": "Payment Required",
+    "403": "Forbidden",
+    "404": "Not Found",
+    "405": "Method Not Allowed",
+    "406": "Not Acceptable",
+    "407": "Proxy Authentication Required",
+    "408": "Request Timeout",
+    "409": "Conflict",
+    "410": "Gone",
+    "411": "Length Required",
+    "412": "Precondition Failed",
+    "413": "Payload Too Large",
+    "414": "URI Too Long",
+    "415": "Unsupported Media Type",
+    "416": "Range Not Satisfiable",
+    "417": "Expectation Failed",
+    "418": "I'm a Teapot",
+    "421": "Misdirected Request",
+    "422": "Unprocessable Entity",
+    "423": "Locked",
+    "424": "Failed Dependency",
+    "425": "Too Early",
+    "426": "Upgrade Required",
+    "428": "Precondition Required",
+    "429": "Too Many Requests",
+    "431": "Request Header Fields Too Large",
+    "451": "Unavailable For Legal Reasons",
+    "500": "Internal Server Error",
+    "501": "Not Implemented",
+    "502": "Bad Gateway",
+    "503": "Service Unavailable",
+    "504": "Gateway Timeout",
+    "505": "HTTP Version Not Supported",
+    "506": "Variant Also Negotiates",
+    "507": "Insufficient Storage",
+    "508": "Loop Detected",
+    "509": "Bandwidth Limit Exceeded",
+    "510": "Not Extended",
+    "511": "Network Authentication Required"
+  };
+});
+
+// node_modules/statuses/index.js
+var require_statuses3 = __commonJS((exports, module) => {
+  /*!
+   * statuses
+   * Copyright(c) 2014 Jonathan Ong
+   * Copyright(c) 2016 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  var codes = require_codes3();
+  module.exports = status;
+  status.message = codes;
+  status.code = createMessageToStatusCodeMap(codes);
+  status.codes = createStatusCodeList(codes);
+  status.redirect = {
+    300: true,
+    301: true,
+    302: true,
+    303: true,
+    305: true,
+    307: true,
+    308: true
+  };
+  status.empty = {
+    204: true,
+    205: true,
+    304: true
+  };
+  status.retry = {
+    502: true,
+    503: true,
+    504: true
+  };
+  function createMessageToStatusCodeMap(codes2) {
+    var map = {};
+    Object.keys(codes2).forEach(function forEachCode(code) {
+      var message = codes2[code];
+      var status2 = Number(code);
+      map[message.toLowerCase()] = status2;
+    });
+    return map;
+  }
+  function createStatusCodeList(codes2) {
+    return Object.keys(codes2).map(function mapCode(code) {
+      return Number(code);
+    });
+  }
+  function getStatusCode(message) {
+    var msg = message.toLowerCase();
+    if (!Object.prototype.hasOwnProperty.call(status.code, msg)) {
+      throw new Error('invalid status message: "' + message + '"');
+    }
+    return status.code[msg];
+  }
+  function getStatusMessage(code) {
+    if (!Object.prototype.hasOwnProperty.call(status.message, code)) {
+      throw new Error("invalid status code: " + code);
+    }
+    return status.message[code];
+  }
+  function status(code) {
+    if (typeof code === "number") {
+      return getStatusMessage(code);
+    }
+    if (typeof code !== "string") {
+      throw new TypeError("code must be a number or string");
+    }
+    var n = parseInt(code, 10);
+    if (!isNaN(n)) {
+      return getStatusMessage(n);
+    }
+    return getStatusCode(code);
+  }
+});
+
 // node_modules/finalhandler/index.js
 var require_finalhandler = __commonJS((exports, module) => {
   /*!
@@ -31577,7 +31961,7 @@ var require_finalhandler = __commonJS((exports, module) => {
   var escapeHtml = require_escape_html();
   var onFinished = require_on_finished();
   var parseUrl = require_parseurl();
-  var statuses = require_statuses2();
+  var statuses = require_statuses3();
   var unpipe = require_unpipe();
   var DOUBLE_SPACE_REGEXP = /\x20{2}/g;
   var NEWLINE_REGEXP = /\n/g;
@@ -32234,6 +32618,7 @@ var require_path_to_regexp = __commonJS((exports, module) => {
       }
       pos = offset + match.length;
       if (match === "*") {
+        backtrack = "";
         extraOffset += 3;
         return "(.*)";
       }
@@ -32254,6 +32639,7 @@ var require_path_to_regexp = __commonJS((exports, module) => {
         offset: offset + extraOffset
       });
       var result = "(?:" + format + slash + capture + (star ? "((?:[/" + format + "].+?)?)" : "") + ")" + optional2;
+      backtrack = "";
       extraOffset += result.length - match.length;
       return result;
     });
@@ -33306,6 +33692,173 @@ var require_content_disposition = __commonJS((exports, module) => {
   }
 });
 
+// node_modules/http-errors/index.js
+var require_http_errors3 = __commonJS((exports, module) => {
+  /*!
+   * http-errors
+   * Copyright(c) 2014 Jonathan Ong
+   * Copyright(c) 2016 Douglas Christopher Wilson
+   * MIT Licensed
+   */
+  var deprecate = require_depd()("http-errors");
+  var setPrototypeOf = require_setprototypeof();
+  var statuses = require_statuses3();
+  var inherits = require_inherits();
+  var toIdentifier = require_toidentifier();
+  module.exports = createError;
+  module.exports.HttpError = createHttpErrorConstructor();
+  module.exports.isHttpError = createIsHttpErrorFunction(module.exports.HttpError);
+  populateConstructorExports(module.exports, statuses.codes, module.exports.HttpError);
+  function codeClass(status) {
+    return Number(String(status).charAt(0) + "00");
+  }
+  function createError() {
+    var err;
+    var msg;
+    var status = 500;
+    var props = {};
+    for (var i = 0;i < arguments.length; i++) {
+      var arg = arguments[i];
+      var type = typeof arg;
+      if (type === "object" && arg instanceof Error) {
+        err = arg;
+        status = err.status || err.statusCode || status;
+      } else if (type === "number" && i === 0) {
+        status = arg;
+      } else if (type === "string") {
+        msg = arg;
+      } else if (type === "object") {
+        props = arg;
+      } else {
+        throw new TypeError("argument #" + (i + 1) + " unsupported type " + type);
+      }
+    }
+    if (typeof status === "number" && (status < 400 || status >= 600)) {
+      deprecate("non-error status code; use only 4xx or 5xx status codes");
+    }
+    if (typeof status !== "number" || !statuses.message[status] && (status < 400 || status >= 600)) {
+      status = 500;
+    }
+    var HttpError = createError[status] || createError[codeClass(status)];
+    if (!err) {
+      err = HttpError ? new HttpError(msg) : new Error(msg || statuses.message[status]);
+      Error.captureStackTrace(err, createError);
+    }
+    if (!HttpError || !(err instanceof HttpError) || err.status !== status) {
+      err.expose = status < 500;
+      err.status = err.statusCode = status;
+    }
+    for (var key in props) {
+      if (key !== "status" && key !== "statusCode") {
+        err[key] = props[key];
+      }
+    }
+    return err;
+  }
+  function createHttpErrorConstructor() {
+    function HttpError() {
+      throw new TypeError("cannot construct abstract class");
+    }
+    inherits(HttpError, Error);
+    return HttpError;
+  }
+  function createClientErrorConstructor(HttpError, name, code) {
+    var className = toClassName(name);
+    function ClientError(message) {
+      var msg = message != null ? message : statuses.message[code];
+      var err = new Error(msg);
+      Error.captureStackTrace(err, ClientError);
+      setPrototypeOf(err, ClientError.prototype);
+      Object.defineProperty(err, "message", {
+        enumerable: true,
+        configurable: true,
+        value: msg,
+        writable: true
+      });
+      Object.defineProperty(err, "name", {
+        enumerable: false,
+        configurable: true,
+        value: className,
+        writable: true
+      });
+      return err;
+    }
+    inherits(ClientError, HttpError);
+    nameFunc(ClientError, className);
+    ClientError.prototype.status = code;
+    ClientError.prototype.statusCode = code;
+    ClientError.prototype.expose = true;
+    return ClientError;
+  }
+  function createIsHttpErrorFunction(HttpError) {
+    return function isHttpError(val) {
+      if (!val || typeof val !== "object") {
+        return false;
+      }
+      if (val instanceof HttpError) {
+        return true;
+      }
+      return val instanceof Error && typeof val.expose === "boolean" && typeof val.statusCode === "number" && val.status === val.statusCode;
+    };
+  }
+  function createServerErrorConstructor(HttpError, name, code) {
+    var className = toClassName(name);
+    function ServerError(message) {
+      var msg = message != null ? message : statuses.message[code];
+      var err = new Error(msg);
+      Error.captureStackTrace(err, ServerError);
+      setPrototypeOf(err, ServerError.prototype);
+      Object.defineProperty(err, "message", {
+        enumerable: true,
+        configurable: true,
+        value: msg,
+        writable: true
+      });
+      Object.defineProperty(err, "name", {
+        enumerable: false,
+        configurable: true,
+        value: className,
+        writable: true
+      });
+      return err;
+    }
+    inherits(ServerError, HttpError);
+    nameFunc(ServerError, className);
+    ServerError.prototype.status = code;
+    ServerError.prototype.statusCode = code;
+    ServerError.prototype.expose = false;
+    return ServerError;
+  }
+  function nameFunc(func, name) {
+    var desc = Object.getOwnPropertyDescriptor(func, "name");
+    if (desc && desc.configurable) {
+      desc.value = name;
+      Object.defineProperty(func, "name", desc);
+    }
+  }
+  function populateConstructorExports(exports2, codes, HttpError) {
+    codes.forEach(function forEachCode(code) {
+      var CodeError;
+      var name = toIdentifier(statuses.message[code]);
+      switch (codeClass(code)) {
+        case 400:
+          CodeError = createClientErrorConstructor(HttpError, name, code);
+          break;
+        case 500:
+          CodeError = createServerErrorConstructor(HttpError, name, code);
+          break;
+      }
+      if (CodeError) {
+        exports2[code] = CodeError;
+        exports2[name] = CodeError;
+      }
+    });
+  }
+  function toClassName(name) {
+    return name.substr(-5) !== "Error" ? name + "Error" : name;
+  }
+});
+
 // node_modules/send/node_modules/debug/node_modules/ms/index.js
 var require_ms4 = __commonJS((exports, module) => {
   var s = 1000;
@@ -34117,7 +34670,7 @@ var require_send = __commonJS((exports, module) => {
    * Copyright(c) 2014-2022 Douglas Christopher Wilson
    * MIT Licensed
    */
-  var createError = require_http_errors2();
+  var createError = require_http_errors3();
   var debug = require_src4()("send");
   var deprecate = require_depd()("send");
   var destroy = require_destroy();
@@ -34131,7 +34684,7 @@ var require_send = __commonJS((exports, module) => {
   var onFinished = require_on_finished();
   var parseRange = require_range_parser();
   var path = __require("path");
-  var statuses = require_statuses2();
+  var statuses = require_statuses3();
   var Stream = __require("stream");
   var util3 = __require("util");
   var extname = path.extname;
@@ -35633,7 +36186,8 @@ var require_utils2 = __commonJS((exports) => {
   }
   function parseExtendedQueryString(str) {
     return qs.parse(str, {
-      allowPrototypes: true
+      allowPrototypes: true,
+      arrayLimit: 1000
     });
   }
   function newObject() {
@@ -36950,7 +37504,7 @@ var require_response = __commonJS((exports, module) => {
    */
   var Buffer2 = require_safe_buffer().Buffer;
   var contentDisposition = require_content_disposition();
-  var createError = require_http_errors2();
+  var createError = require_http_errors3();
   var deprecate = require_depd()("express");
   var encodeUrl = require_encodeurl();
   var escapeHtml = require_escape_html();
@@ -36958,7 +37512,7 @@ var require_response = __commonJS((exports, module) => {
   var isAbsolute = require_utils2().isAbsolute;
   var onFinished = require_on_finished();
   var path = __require("path");
-  var statuses = require_statuses2();
+  var statuses = require_statuses3();
   var merge2 = require_utils_merge();
   var sign = require_cookie_signature().sign;
   var normalizeType = require_utils2().normalizeType;
@@ -43224,6 +43778,9 @@ var require_data = __commonJS((exports, module) => {
 var require_utils3 = __commonJS((exports, module) => {
   var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
   var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
+  var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
+  var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
+  var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code = 0;
@@ -43417,27 +43974,77 @@ var require_utils3 = __commonJS((exports, module) => {
     }
     return output.join("");
   }
-  function normalizeComponentEncoding(component, esc2) {
-    const func = esc2 !== true ? escape : unescape;
-    if (component.scheme !== undefined) {
-      component.scheme = func(component.scheme);
-    }
-    if (component.userinfo !== undefined) {
-      component.userinfo = func(component.userinfo);
-    }
-    if (component.host !== undefined) {
-      component.host = func(component.host);
+  var HOST_DELIMS = { "@": "%40", "/": "%2F", "?": "%3F", "#": "%23", ":": "%3A" };
+  var HOST_DELIM_RE = /[@/?#:]/g;
+  var HOST_DELIM_NO_COLON_RE = /[@/?#]/g;
+  function reescapeHostDelimiters(host, isIP) {
+    const re2 = isIP ? HOST_DELIM_NO_COLON_RE : HOST_DELIM_RE;
+    re2.lastIndex = 0;
+    return host.replace(re2, (ch) => HOST_DELIMS[ch]);
+  }
+  function normalizePercentEncoding(input, decodeUnreserved = false) {
+    if (input.indexOf("%") === -1) {
+      return input;
     }
-    if (component.path !== undefined) {
-      component.path = func(component.path);
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      if (input[i] === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (decodeUnreserved && isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      output += input[i];
     }
-    if (component.query !== undefined) {
-      component.query = func(component.query);
+    return output;
+  }
+  function normalizePathEncoding(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      if (input[i] === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (decoded !== "." && isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i += 2;
+          continue;
+        }
+      }
+      if (isPathCharacter(input[i])) {
+        output += input[i];
+      } else {
+        output += escape(input[i]);
+      }
     }
-    if (component.fragment !== undefined) {
-      component.fragment = func(component.fragment);
+    return output;
+  }
+  function escapePreservingEscapes(input) {
+    let output = "";
+    for (let i = 0;i < input.length; i++) {
+      if (input[i] === "%" && i + 2 < input.length) {
+        const hex = input.slice(i + 1, i + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i += 2;
+          continue;
+        }
+      }
+      output += escape(input[i]);
     }
-    return component;
+    return output;
   }
   function recomposeAuthority(component) {
     const uriTokens = [];
@@ -43452,7 +44059,7 @@ var require_utils3 = __commonJS((exports, module) => {
         if (ipV6res.isIPV6 === true) {
           host = `[${ipV6res.escapedHost}]`;
         } else {
-          host = component.host;
+          host = reescapeHostDelimiters(host, false);
         }
       }
       uriTokens.push(host);
@@ -43466,7 +44073,10 @@ var require_utils3 = __commonJS((exports, module) => {
   module.exports = {
     nonSimpleDomain,
     recomposeAuthority,
-    normalizeComponentEncoding,
+    reescapeHostDelimiters,
+    normalizePercentEncoding,
+    normalizePathEncoding,
+    escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
     isUUID,
@@ -43651,11 +44261,11 @@ var require_schemes = __commonJS((exports, module) => {
 
 // node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS((exports, module) => {
-  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizeComponentEncoding, isIPv4, nonSimpleDomain } = require_utils3();
+  var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils3();
   var { SCHEMES, getSchemeHandler } = require_schemes();
   function normalize(uri, options) {
     if (typeof uri === "string") {
-      uri = serialize(parse6(uri, options), options);
+      uri = normalizeString(uri, options);
     } else if (typeof uri === "object") {
       uri = parse6(serialize(uri, options), options);
     }
@@ -43663,7 +44273,12 @@ var require_fast_uri = __commonJS((exports, module) => {
   }
   function resolve(baseURI, relativeURI, options) {
     const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-    const resolved = resolveComponent(parse6(baseURI, schemelessOptions), parse6(relativeURI, schemelessOptions), schemelessOptions, true);
+    const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+    const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed) {
+      throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+    }
+    const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -43721,19 +44336,9 @@ var require_fast_uri = __commonJS((exports, module) => {
     return target;
   }
   function equal(uriA, uriB, options) {
-    if (typeof uriA === "string") {
-      uriA = unescape(uriA);
-      uriA = serialize(normalizeComponentEncoding(parse6(uriA, options), true), { ...options, skipEscape: true });
-    } else if (typeof uriA === "object") {
-      uriA = serialize(normalizeComponentEncoding(uriA, true), { ...options, skipEscape: true });
-    }
-    if (typeof uriB === "string") {
-      uriB = unescape(uriB);
-      uriB = serialize(normalizeComponentEncoding(parse6(uriB, options), true), { ...options, skipEscape: true });
-    } else if (typeof uriB === "object") {
-      uriB = serialize(normalizeComponentEncoding(uriB, true), { ...options, skipEscape: true });
-    }
-    return uriA.toLowerCase() === uriB.toLowerCase();
+    const normalizedA = normalizeComparableURI(uriA, options);
+    const normalizedB = normalizeComparableURI(uriB, options);
+    return normalizedA !== undefined && normalizedB !== undefined && normalizedA.toLowerCase() === normalizedB.toLowerCase();
   }
   function serialize(cmpts, opts) {
     const component = {
@@ -43759,12 +44364,12 @@ var require_fast_uri = __commonJS((exports, module) => {
       schemeHandler.serialize(component, options);
     if (component.path !== undefined) {
       if (!options.skipEscape) {
-        component.path = escape(component.path);
+        component.path = escapePreservingEscapes(component.path);
         if (component.scheme !== undefined) {
           component.path = component.path.split("%3A").join(":");
         }
       } else {
-        component.path = unescape(component.path);
+        component.path = normalizePercentEncoding(component.path);
       }
     }
     if (options.reference !== "suffix" && component.scheme) {
@@ -43799,7 +44404,18 @@ var require_fast_uri = __commonJS((exports, module) => {
     return uriTokens.join("");
   }
   var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
-  function parse6(uri, opts) {
+  var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+  var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
+  function getParseError(parsed, matches) {
+    if (matches[2] !== undefined && parsed.path && parsed.path[0] !== "/") {
+      return 'URI path must start with "/" when authority is present.';
+    }
+    if (typeof parsed.port === "number" && (parsed.port < 0 || parsed.port > 65535)) {
+      return "URI port is malformed.";
+    }
+    return;
+  }
+  function parseWithStatus(uri, opts) {
     const options = Object.assign({}, opts);
     const parsed = {
       scheme: undefined,
@@ -43810,6 +44426,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       query: undefined,
       fragment: undefined
     };
+    let malformedAuthorityOrPort = false;
     let isIP = false;
     if (options.reference === "suffix") {
       if (options.scheme) {
@@ -43818,6 +44435,25 @@ var require_fast_uri = __commonJS((exports, module) => {
         uri = "//" + uri;
       }
     }
+    const authorityMatch = uri.match(AUTHORITY_PREFIX);
+    if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+      parsed.error = "URI authority must not contain a literal backslash.";
+      malformedAuthorityOrPort = true;
+    }
+    const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+    if (introducerMatch !== null) {
+      const region = introducerMatch[1];
+      const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+      if (normalizedRegion.length >= 2) {
+        if (normalizedRegion.slice(0, 2) !== "//") {
+          parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+          malformedAuthorityOrPort = true;
+        } else if (region.length !== normalizedRegion.length) {
+          parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+          malformedAuthorityOrPort = true;
+        }
+      }
+    }
     const matches = uri.match(URI_PARSE);
     if (matches) {
       parsed.scheme = matches[1];
@@ -43830,6 +44466,11 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (isNaN(parsed.port)) {
         parsed.port = matches[5];
       }
+      const parseError = getParseError(parsed, matches);
+      if (parseError !== undefined) {
+        parsed.error = parsed.error || parseError;
+        malformedAuthorityOrPort = true;
+      }
       if (parsed.host) {
         const ipv4result = isIPv4(parsed.host);
         if (ipv4result === false) {
@@ -43856,7 +44497,7 @@ var require_fast_uri = __commonJS((exports, module) => {
       if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
         if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
           try {
-            parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+            parsed.host = new URL("http://" + parsed.host).hostname;
           } catch (e) {
             parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
           }
@@ -43868,14 +44509,18 @@ var require_fast_uri = __commonJS((exports, module) => {
             parsed.scheme = unescape(parsed.scheme);
           }
           if (parsed.host !== undefined) {
-            parsed.host = unescape(parsed.host);
+            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
           }
         }
         if (parsed.path) {
-          parsed.path = escape(unescape(parsed.path));
+          parsed.path = normalizePathEncoding(parsed.path);
         }
         if (parsed.fragment) {
-          parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+          try {
+            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+          } catch {
+            parsed.error = parsed.error || "URI malformed";
+          }
         }
       }
       if (schemeHandler && schemeHandler.parse) {
@@ -43884,7 +44529,29 @@ var require_fast_uri = __commonJS((exports, module) => {
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return parsed;
+    return { parsed, malformedAuthorityOrPort };
+  }
+  function parse6(uri, opts) {
+    return parseWithStatus(uri, opts).parsed;
+  }
+  function normalizeString(uri, opts) {
+    return normalizeStringWithStatus(uri, opts).normalized;
+  }
+  function normalizeStringWithStatus(uri, opts) {
+    const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri, opts);
+    return {
+      normalized: malformedAuthorityOrPort ? uri : serialize(parsed, opts),
+      malformedAuthorityOrPort
+    };
+  }
+  function normalizeComparableURI(uri, opts) {
+    if (typeof uri === "string") {
+      const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri, opts);
+      return malformedAuthorityOrPort ? undefined : normalized;
+    }
+    if (typeof uri === "object") {
+      return serialize(uri, opts);
+    }
   }
   var fastUri = {
     SCHEMES,
@@ -53672,9 +54339,9 @@ var init_config = __esm(() => {
   SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "2.0",
-    sdkVersion: "0.6.2",
+    sdkVersion: "0.7.0",
     genVersion: "2.845.15",
-    userAgent: "speakeasy-sdk/typescript 0.6.2 2.845.15 2.0 @launchdarkly/mcp-server"
+    userAgent: "speakeasy-sdk/typescript 0.7.0 2.845.15 2.0 @launchdarkly/mcp-server"
   };
 });
 
@@ -61397,7 +62064,7 @@ var init_featureFlagsPatch2 = __esm(() => {
 function createMCPServer(deps) {
   const server = new McpServer({
     name: "LaunchDarkly",
-    version: "0.6.2"
+    version: "0.7.0"
   });
   const client = new LaunchDarklyCore({
     apiKey: deps.apiKey,
@@ -61460,6 +62127,29 @@ var init_server3 = __esm(() => {
   init_featureFlagsPatch2();
 });
 
+// src/mcp-server/cli/start/sse-security.ts
+import { timingSafeEqual } from "node:crypto";
+function isLoopbackHost(host) {
+  return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
+function assertSafeSSEBind(host, authToken) {
+  if (!authToken && !isLoopbackHost(host)) {
+    throw new Error(`--auth-token is required when the SSE transport listens on a non-loopback host (${host})`);
+  }
+}
+function requireBearerToken(token) {
+  const expected = Buffer.from(`Bearer ${token}`);
+  return (req, res, next) => {
+    const actual = Buffer.from(req.headers.authorization ?? "");
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected)) {
+      res.status(401).send("Unauthorized");
+      return;
+    }
+    next();
+  };
+}
+var init_sse_security = () => {};
+
 // src/mcp-server/cli/start/impl.ts
 var exports_impl = {};
 __export(exports_impl, {
@@ -61501,34 +62191,68 @@ async function startStdio(flags) {
 }
 async function startSSE(flags) {
   const logger = createConsoleLogger(flags["log-level"]);
+  const host = flags.host;
+  const authToken = flags["auth-token"];
+  assertSafeSSEBind(host, authToken);
   const app = import_express.default();
-  const mcpServer = createMCPServer({
-    logger,
-    allowedTools: flags.tool,
-    scopes: flags.scope,
-    ...{ apiKey: flags["api-key"] ?? "" },
-    serverURL: flags["server-url"],
-    serverIdx: flags["server-index"]
-  });
-  let transport;
+  if (isLoopbackHost(host)) {
+    app.use(localhostHostValidation());
+  }
+  if (authToken) {
+    app.use(requireBearerToken(authToken));
+  }
+  const sessions = new Map;
   const controller = new AbortController;
   app.get("/sse", async (_req, res) => {
-    transport = new SSEServerTransport("/message", res);
-    await mcpServer.connect(transport);
-    mcpServer.server.onclose = async () => {
-      res.end();
-    };
+    const server = createMCPServer({
+      logger,
+      allowedTools: flags.tool,
+      scopes: flags.scope,
+      ...{ apiKey: flags["api-key"] ?? "" },
+      serverURL: flags["server-url"],
+      serverIdx: flags["server-index"]
+    });
+    const transport = new SSEServerTransport("/message", res);
+    sessions.set(transport.sessionId, { transport, server });
+    res.on("close", () => {
+      sessions.delete(transport.sessionId);
+      server.close();
+    });
+    try {
+      await server.connect(transport);
+    } catch (err) {
+      logger.error("Failed to open SSE session", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+      sessions.delete(transport.sessionId);
+      server.close();
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
+    }
   });
   app.post("/message", async (req, res) => {
-    if (!transport) {
-      throw new Error("Server transport not initialized");
+    const sessionId = typeof req.query["sessionId"] === "string" ? req.query["sessionId"] : "";
+    const session = sessions.get(sessionId);
+    if (!session) {
+      res.status(404).send("Unknown session");
+      return;
+    }
+    try {
+      await session.transport.handlePostMessage(req, res);
+    } catch (err) {
+      logger.error("Failed to handle SSE message", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+      if (!res.headersSent) {
+        res.status(500).send("Internal Server Error");
+      }
     }
-    await transport.handlePostMessage(req, res);
   });
-  const httpServer = app.listen(flags.port, "0.0.0.0", () => {
+  const httpServer = app.listen(flags.port, host, () => {
     const ha = httpServer.address();
-    const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
-    logger.info("MCP HTTP server started", { host });
+    const host2 = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
+    logger.info("MCP HTTP server started", { host: host2 });
   });
   let closing = false;
   controller.signal.addEventListener("abort", async () => {
@@ -61537,8 +62261,8 @@ async function startSSE(flags) {
       process.exit(1);
     }
     closing = true;
-    logger.info("Shutting down MCP server");
-    await mcpServer.close();
+    logger.info("Shutting down MCP servers");
+    await Promise.all([...sessions.values()].map(({ server }) => server.close()));
     logger.info("Shutting down HTTP server");
     const timer = setTimeout(() => {
       logger.info("Forcing shutdown");
@@ -61561,6 +62285,7 @@ var init_impl = __esm(() => {
   import_express = __toESM(require_express2(), 1);
   init_console_logger();
   init_server3();
+  init_sse_security();
 });
 
 // node_modules/@stricli/core/dist/index.js
@@ -62566,6 +63291,18 @@ var startCommand = on({
         default: "2718",
         parse: (val) => coerce.number().int().gte(0).lt(65536).parse(val)
       },
+      host: {
+        kind: "parsed",
+        brief: "The host to listen on when the SSE transport is enabled. Non-loopback hosts require --auth-token",
+        default: "127.0.0.1",
+        parse: (value) => stringType().nonempty().parse(value)
+      },
+      "auth-token": {
+        kind: "parsed",
+        brief: "Bearer token that SSE clients must send in the Authorization header",
+        optional: true,
+        parse: (value) => stringType().min(16).parse(value)
+      },
       tool: {
         kind: "parsed",
         brief: "Specify tools to mount on the server",
@@ -62649,7 +63386,7 @@ var routes = an({
 var app = He(routes, {
   name: "mcp",
   versionInfo: {
-    currentVersion: "0.6.2"
+    currentVersion: "0.7.0"
   }
 });
 zt(app, process4.argv.slice(2), buildContext(process4));
@@ -62657,5 +63394,5 @@ export {
   app
 };
 
-//# debugId=19F6727AF0E37D8A64756E2164756E21
+//# debugId=1BB1876EEFF45EEC64756E2164756E21
 //# sourceMappingURL=mcp-server.js.map