@mcp-abap-adt/core 7.1.1 → 7.2.0

package/CHANGELOG.md

@@ -2,6 +2,39 @@
 
 ## [Unreleased]
 
+## [7.2.0] - 2026-06-22
+
+### Added
+- **DNS-rebinding protection for the HTTP/SSE transports.** `--http-allowed-hosts`/`--sse-allowed-hosts`, `--http-allowed-origins`/`--sse-allowed-origins`, and `--http-enable-dns-protection`/`--sse-enable-dns-protection` (plus the matching `MCP_HTTP_*`/`MCP_SSE_*` env vars and the `http`/`sse` `allowed-hosts`/`allowed-origins`/`enable-dns-protection` YAML keys) now take effect: when enabled with an allowlist, requests with a non-allowlisted `Host`/`Origin` header are rejected with HTTP 403. Transport-aware (http uses `http*`, sse uses `sse*`); applied in `registerRoutes` so both standalone and embedded modes are protected; `/mcp/health` is ungated. Defaults off (no-op). This is Host/Origin allowlist validation, NOT browser CORS. Values are matched exactly (Host includes port, e.g. `localhost:3000`). Implemented as own Express middleware rather than the now-deprecated SDK transport options.
+
+## [7.1.3] - 2026-06-20
+
+> Fixes the SSE transport host/port resolution, removes a broken CLI bin entry,
+> and corrects the install documentation (`README.md`/`docs/` ship in `files`,
+> so the doc fixes reach npm users with this release).
+
+### Fixed
+- **SSE transport now honours its own host/port.** `--transport=sse` resolved the final host/port from the HTTP defaults/flags (`httpHost`/`httpPort`, so it listened on `3000`), ignoring `--sse-host`/`--sse-port` and `MCP_SSE_HOST`/`MCP_SSE_PORT`. Host/port resolution is now transport-aware: SSE falls back to the SSE defaults (host `127.0.0.1`, port `3001`) and its `--sse-*` flags / `MCP_SSE_*` env vars take effect; the generic `--host`/`--port` still win when provided. (`src/lib/config/ServerConfigManager.ts`.)
+- **Removed the dangling `mcp-abap-adt-v2` bin entry.** `package.json`/`package-lock.json` still mapped `mcp-abap-adt-v2` → `bin/mcp-abap-adt-v2.js`, a file removed in an earlier release, so a global install created a broken `mcp-abap-adt-v2` symlink. The only binary is `mcp-abap-adt`. Also fixed a stale `mcp-abap-adt-v2` example in `tools/show-storage-paths.js` help output.
+- **Documentation accuracy sweep:**
+  - Install docs/README used the wrong npm scope `@fr0ster/mcp-abap-adt`; corrected to `@mcp-abap-adt/core` (the GitHub repo path and the `io.github.fr0ster/…` registry id are unchanged).
+  - Stale local-pack tarball names / version pins (`…-1.1.0/1.2.0.tgz`) → version-independent `mcp-abap-adt-core-<version>.tgz` (so they no longer drift); Node requirement `18` → `22+` (matches `engines`); removed the non-existent `npm run start:legacy` / `dev:stdio` references and the `bin/mcp-abap-adt-v2.js` run examples.
+  - Corrected narrative drift: default transport is `stdio` (not HTTP); HTTP/SSE host default is `127.0.0.1` (not `0.0.0.0`); removed non-existent `--http`/`--sse` CLI shortcuts; refreshed handler-group tool counts and the `src/handlers/` directory list; the `system` handler group rides with `readonly` (it is not always included).
+  - Regenerated `docs/user-guide/AVAILABLE_TOOLS*.md` from the current `TOOL_DEFINITION`s (function-include tools, `GetStructuresList`, `GetIncludesList` tree, `GetProgFullCode` removal, refreshed counts).
+  - Removed documentation for the CORS / allowed-hosts / DNS-rebinding-protection options (`--http`/`--sse-allowed-origins`/`-allowed-hosts`/`-enable-dns-protection`, the matching `MCP_*` env vars, and the `http`/`sse` `allowed-origins`/`allowed-hosts`/`enable-dns-protection` YAML keys): they are parsed but not wired to the servers, so documenting them overstated capability. Actually implementing these is planned for a follow-up release.
+
+## [7.1.2] - 2026-06-20
+
+> **Test infrastructure only.** The published runtime (`dist/`) is unchanged from
+> 7.1.1 — no tool, handler, or library behaviour changed for consumers. This
+> release bundles integration-test reliability fixes and a stale-metadata fix.
+
+### Fixed
+- **`shared:setup` resilient to the cloud activation-run timeout.** Bulk-activating the ~24 shared objects in one activation run can exceed adt-clients' fixed ~45s request timeout; on a timeout the setup now skips the doomed full-group retries and falls back to batched activation (chunks of 5, with a second pass retrying only the leftovers) instead of failing.
+- **Runtime profiling test produces a trace.** The runnable class now does measurable CPU work so the profiler arms and a trace is written; a trivial single-statement class finished before tracing engaged, so the trace never resolved (`Failed to resolve traceId`).
+- **Runtime dump test actually creates and reads a dump** (was silently skipping or hitting a `400 session` error). It activates the division-by-zero class, triggers the dump on a separate connection (so the dumping run's server-side context loss does not poison the connection used to read the dump), fixes dump-id extraction from the feed entry (`id` field, plural `/runtime/dumps/<id>` path, URL-encoded, no decode), binds the read dump to the uniquely-named generated class, and fails (instead of skipping) when no dump is produced. `params.dump_id` remains the explicit opt-out for read-only environments.
+- **`server.json` version** was stale at `7.0.3`; bumped to match the package version.
+
 ## [7.1.1] - 2026-06-19
 
 ### Fixed

package/README.md

@@ -221,15 +221,15 @@ After installing globally with `npm install -g`, you can run from any directory:
 # Show help
 mcp-abap-adt --help
 
-# Default HTTP mode (works without .env file)
+# Default stdio mode (for MCP clients; requires .env file or --mcp parameter)
 mcp-abap-adt
 
-# HTTP mode on custom port
-mcp-abap-adt --http-port=8080
-
-# Use stdio mode (for MCP clients, requires .env file or --mcp parameter)
+# stdio mode (explicit; default when --transport is omitted)
 mcp-abap-adt --transport=stdio
 
+# HTTP mode on custom port (HTTP requires --transport=http)
+mcp-abap-adt --transport=http --port=8080
+
 # Use stdio mode with auth-broker (--mcp parameter)
 mcp-abap-adt --transport=stdio --mcp=TRIAL
 
@@ -240,7 +240,7 @@ mcp-abap-adt --env=trial
 mcp-abap-adt --env-path=/path/to/my.env
 
 # SSE mode (requires .env file or --mcp parameter)
-mcp-abap-adt --transport=sse --sse-port=3001
+mcp-abap-adt --transport=sse --port=3001
 
 # SSE mode with auth-broker (--mcp parameter)
 mcp-abap-adt --transport=sse --mcp=TRIAL
@@ -257,9 +257,6 @@ npm run start:http
 
 # SSE mode
 npm run start:sse
-
-# Legacy v1 server (for backward compatibility)
-npm run start:legacy
 ```
 
 ### Environment Configuration

package/dist/lib/config/IServerConfig.d.ts

@@ -48,6 +48,12 @@ export interface IServerConfig {
     host?: string;
     /** Server port */
     port?: number;
+    /** Allowed Host header values (DNS-rebinding protection; exact, incl. port) */
+    allowedHosts?: string[];
+    /** Allowed Origin header values (DNS-rebinding protection; exact, incl. scheme) */
+    allowedOrigins?: string[];
+    /** Enable DNS-rebinding protection (requires allowedHosts and/or allowedOrigins) */
+    enableDnsRebindingProtection?: boolean;
     /** Enable JSON response format for HTTP */
     httpJsonResponse?: boolean;
     /** HTTP endpoint path */

package/dist/lib/config/IServerConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IServerConfig.d.ts","sourceRoot":"","sources":["../../../src/lib/config/IServerConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,4CAA4C;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEjD,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,aAAa;IAK5B,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAMjC,qCAAqC;IACrC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,8DAA8D;IAC9D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IAMd,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,SAAS,CAAC;IAMhB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAM1B,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEhC,mFAAmF;IACnF,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IAM3C,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,MAAM,CAAC,EAAE,GAAG,CAAC;CACd"}
+{"version":3,"file":"IServerConfig.d.ts","sourceRoot":"","sources":["../../../src/lib/config/IServerConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,4CAA4C;AAC5C,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEjD,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;AAEjE,MAAM,WAAW,aAAa;IAK5B,wBAAwB;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kGAAkG;IAClG,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAMjC,qCAAqC;IACrC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,8DAA8D;IAC9D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oFAAoF;IACpF,4BAA4B,CAAC,EAAE,OAAO,CAAC;IAMvC,2CAA2C;IAC3C,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yBAAyB;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0BAA0B;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,SAAS,CAAC;IAMhB,6BAA6B;IAC7B,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;IAM1B,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,iDAAiD;IACjD,cAAc,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAEhC,mFAAmF;IACnF,UAAU,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IAM3C,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,4DAA4D;IAC5D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gCAAgC;IAChC,MAAM,CAAC,EAAE,GAAG,CAAC;CACd"}

package/dist/lib/config/ServerConfigManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ServerConfigManager.d.ts","sourceRoot":"","sources":["../../../src/lib/config/ServerConfigManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAc,aAAa,EAAa,MAAM,oBAAoB,CAAC;AAQ/E,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMhE;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAA8B;IAM5C;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAazC;;;OAGG;IACH,aAAa,IAAI,aAAa;IAW9B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAwCxB;;OAEG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,SAAS;IAKjB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,MAAM,CAAC,yBAAyB,IAAI,MAAM;IAkC1C;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM;CAqGzD"}
+{"version":3,"file":"ServerConfigManager.d.ts","sourceRoot":"","sources":["../../../src/lib/config/ServerConfigManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAc,aAAa,EAAa,MAAM,oBAAoB,CAAC;AAQ/E,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAMhE;;GAEG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAA8B;IAM5C;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC;IAazC;;;OAGG;IACH,aAAa,IAAI,aAAa;IAW9B;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAwB9B;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IA6DxB;;OAEG;IACH,OAAO,CAAC,cAAc;IAgBtB;;OAEG;IACH,OAAO,CAAC,SAAS;IAKjB;;;OAGG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,MAAM,CAAC,yBAAyB,IAAI,MAAM;IAkC1C;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM;CAqGzD"}

package/dist/lib/config/ServerConfigManager.js

@@ -86,12 +86,32 @@ class ServerConfigManager {
         const parsed = ArgumentsParser_js_1.ArgumentsParser.parse();
         const transport = this.parseTransport();
         const exposition = this.parseExposition();
+        // Resolve final host/port in a transport-aware way: SSE must fall back to
+        // the SSE-specific defaults/flags (--sse-host/--sse-port, MCP_SSE_HOST/PORT,
+        // 3001) rather than the HTTP ones, so `--transport=sse` listens on 3001 and
+        // the SSE flags/env actually take effect. The generic --host/--port still
+        // win when provided.
+        const isSse = transport === 'sse';
+        const transportHost = isSse ? parsed.sseHost : parsed.httpHost;
+        const transportPort = isSse ? parsed.ssePort : parsed.httpPort;
+        const transportAllowedOrigins = isSse
+            ? parsed.sseAllowedOrigins
+            : parsed.httpAllowedOrigins;
+        const transportAllowedHosts = isSse
+            ? parsed.sseAllowedHosts
+            : parsed.httpAllowedHosts;
+        const transportEnableDns = isSse
+            ? parsed.sseEnableDnsProtection
+            : parsed.httpEnableDnsProtection;
         return {
             transport: transport || 'stdio',
             exposition: exposition.length > 0 ? exposition : ['readonly', 'high'],
             configFile: (0, yamlConfig_js_1.parseConfigArg)(),
-            host: ArgumentsParser_js_1.ArgumentsParser.getArgument('--host') || parsed.httpHost,
-            port: this.parsePort() || parsed.httpPort,
+            host: ArgumentsParser_js_1.ArgumentsParser.getArgument('--host') || transportHost,
+            port: this.parsePort() || transportPort,
+            allowedOrigins: transportAllowedOrigins,
+            allowedHosts: transportAllowedHosts,
+            enableDnsRebindingProtection: transportEnableDns ?? false,
             httpJsonResponse: parsed.httpJsonResponse || undefined,
             httpPath: ArgumentsParser_js_1.ArgumentsParser.getArgument('--path') ||
                 ArgumentsParser_js_1.ArgumentsParser.getArgument('--http-path'),

package/dist/lib/config/ServerConfigManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ServerConfigManager.js","sourceRoot":"","sources":["../../../src/lib/config/ServerConfigManager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,6DAAuD;AAEvD,mDAKyB;AAIzB,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;GAEG;AACH,MAAa,mBAAmB;IACtB,MAAM,GAAyB,IAAI,CAAC;IAE5C,6EAA6E;IAC7E,oCAAoC;IACpC,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE9B,4DAA4D;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,uCAAuC;IACvC,6EAA6E;IAE7E;;;OAGG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,IAAA,8BAAc,GAAE,CAAC;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,IAAA,8CAA8B,EAAC,UAAU,CAAC,CAAC;QACrE,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mEAAmE,CACpE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,IAAA,8BAAc,EAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,qCAAqB,EAAC,UAAU,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iCAAiC;IACjC,6EAA6E;IAE7E;;;;OAIG;IACK,gBAAgB;QACtB,2CAA2C;QAC3C,MAAM,MAAM,GAAG,oCAAe,CAAC,KAAK,EAAE,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAE1C,OAAO;YACL,SAAS,EAAE,SAAS,IAAI,OAAO;YAC/B,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC;YACrE,UAAU,EAAE,IAAA,8BAAc,GAAE;YAC5B,IAAI,EAAE,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ;YAC9D,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,MAAM,CAAC,QAAQ;YACzC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;YACtD,QAAQ,EACN,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACrC,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC;YAC5C,OAAO,EAAE,oCAAe,CAAC,WAAW,CAAC,YAAY,CAAC;YAClD,QAAQ,EAAE,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,MAAM,CAAC,GAAG;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,EACD,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM;gBAC7B,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,MAAM;oBAClB,EAAE,EAAE,MAAM,CAAC,KAAK;iBACjB;gBACH,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,gDAAgD;QAChD,MAAM,QAAQ,GAAG,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QACzE,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAEzC,iDAAiD;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC3C,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QACzE,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAEzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,SAAS;QACf,MAAM,IAAI,GAAG,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,eAAe;QACrB,MAAM,KAAK,GAAG,oCAAe,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAEtB,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CACL,CAAC,CAAC,EAAmB,EAAE,CACrB,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,CACrE,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,gCAAgC;IAChC,6EAA6E;IAE7E;;OAEG;IACH,MAAM,CAAC,yBAAyB;QAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BV,CAAC;IACA,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,kBAA2B;QAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CT,mBAAmB,CAAC,yBAAyB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD/C,kBAAkB,IAAI,EAAE;CACzB,CAAC;IACA,CAAC;CACF;AA7SD,kDA6SC"}
+{"version":3,"file":"ServerConfigManager.js","sourceRoot":"","sources":["../../../src/lib/config/ServerConfigManager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,6DAAuD;AAEvD,mDAKyB;AAIzB,+EAA+E;AAC/E,qCAAqC;AACrC,+EAA+E;AAE/E;;GAEG;AACH,MAAa,mBAAmB;IACtB,MAAM,GAAyB,IAAI,CAAC;IAE5C,6EAA6E;IAC7E,oCAAoC;IACpC,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE9B,4DAA4D;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACH,aAAa;QACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,uCAAuC;IACvC,6EAA6E;IAE7E;;;OAGG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,IAAA,8BAAc,GAAE,CAAC;QACpC,IAAI,CAAC,UAAU;YAAE,OAAO;QAExB,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,IAAA,8CAA8B,EAAC,UAAU,CAAC,CAAC;QACrE,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mEAAmE,CACpE,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,6CAA6C;QAC7C,MAAM,UAAU,GAAG,IAAA,8BAAc,EAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,qCAAqB,EAAC,UAAU,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,iCAAiC;IACjC,6EAA6E;IAE7E;;;;OAIG;IACK,gBAAgB;QACtB,2CAA2C;QAC3C,MAAM,MAAM,GAAG,oCAAe,CAAC,KAAK,EAAE,CAAC;QAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAE1C,0EAA0E;QAC1E,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,qBAAqB;QACrB,MAAM,KAAK,GAAG,SAAS,KAAK,KAAK,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/D,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC/D,MAAM,uBAAuB,GAAG,KAAK;YACnC,CAAC,CAAC,MAAM,CAAC,iBAAiB;YAC1B,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC9B,MAAM,qBAAqB,GAAG,KAAK;YACjC,CAAC,CAAC,MAAM,CAAC,eAAe;YACxB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC5B,MAAM,kBAAkB,GAAG,KAAK;YAC9B,CAAC,CAAC,MAAM,CAAC,sBAAsB;YAC/B,CAAC,CAAC,MAAM,CAAC,uBAAuB,CAAC;QAEnC,OAAO;YACL,SAAS,EAAE,SAAS,IAAI,OAAO;YAC/B,UAAU,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC;YACrE,UAAU,EAAE,IAAA,8BAAc,GAAE;YAC5B,IAAI,EAAE,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,aAAa;YAC5D,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,aAAa;YACvC,cAAc,EAAE,uBAAuB;YACvC,YAAY,EAAE,qBAAqB;YACnC,4BAA4B,EAAE,kBAAkB,IAAI,KAAK;YACzD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,IAAI,SAAS;YACtD,QAAQ,EACN,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC;gBACrC,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC;YAC5C,OAAO,EAAE,oCAAe,CAAC,WAAW,CAAC,YAAY,CAAC;YAClD,QAAQ,EAAE,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,WAAW,EAAE,MAAM,CAAC,GAAG;YACvB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,cAAc,EAAE,MAAM,CAAC,GAAG;YAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,EACD,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM;gBAC7B,CAAC,CAAC;oBACE,IAAI,EAAE,MAAM,CAAC,OAAO;oBACpB,GAAG,EAAE,MAAM,CAAC,MAAM;oBAClB,EAAE,EAAE,MAAM,CAAC,KAAK;iBACjB;gBACH,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,cAAc;QACpB,gDAAgD;QAChD,MAAM,QAAQ,GAAG,oCAAe,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QACzE,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAEzC,iDAAiD;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAC3C,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACrC,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,MAAM,CAAC;QACzE,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,OAAO,CAAC;QAEzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,SAAS;QACf,MAAM,IAAI,GAAG,oCAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,eAAe;QACrB,MAAM,KAAK,GAAG,oCAAe,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QAEtB,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CACL,CAAC,CAAC,EAAmB,EAAE,CACrB,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,SAAS,CACrE,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,gCAAgC;IAChC,6EAA6E;IAE7E;;OAEG;IACH,MAAM,CAAC,yBAAyB;QAC9B,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BV,CAAC;IACA,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,kBAA2B;QAC7C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+CT,mBAAmB,CAAC,yBAAyB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkD/C,kBAAkB,IAAI,EAAE;CACzB,CAAC;IACA,CAAC;CACF;AAlUD,kDAkUC"}

package/dist/server/SseServer.d.ts

@@ -51,6 +51,12 @@ export interface SseServerOptions {
      * @default false
      */
     allowDestinationHeader?: boolean;
+    /** Allowed Host header values (DNS-rebinding protection; exact, incl. port) */
+    allowedHosts?: string[];
+    /** Allowed Origin header values (DNS-rebinding protection; exact, incl. scheme) */
+    allowedOrigins?: string[];
+    /** Enable DNS-rebinding protection (requires allowedHosts and/or allowedOrigins) */
+    enableDnsRebindingProtection?: boolean;
 }
 /**
  * Minimal SSE server: creates a new BaseMcpServer per GET connection, routes POST by sessionId.
@@ -74,6 +80,9 @@ export declare class SseServer {
     private standaloneServer?;
     private readonly tls?;
     private readonly allowDestinationHeader;
+    private readonly allowedHosts?;
+    private readonly allowedOrigins?;
+    private readonly enableDnsRebindingProtection?;
     constructor(handlersRegistry: IHandlersRegistry, authBrokerFactory: AuthBrokerFactory, opts?: SseServerOptions);
     /**
      * Register routes on an external HTTP application

package/dist/server/SseServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SseServer.d.ts","sourceRoot":"","sources":["../../src/server/SseServer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAOD;;;;;;GAMG;AACH,qBAAa,SAAS;IAelB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAfpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAmB;IAChD,OAAO,CAAC,gBAAgB,CAAC,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;gBAG9B,gBAAgB,EAAE,iBAAiB,EACnC,iBAAiB,EAAE,iBAAiB,EACrD,IAAI,CAAC,EAAE,gBAAgB;IAczB;;;;;;OAMG;IACH,cAAc,CACZ,GAAG,EAAE,gBAAgB,EACrB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,IAAI;IA+BP;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAmCd,SAAS;YAuGT,UAAU;IAiDxB;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAShC"}
+{"version":3,"file":"SseServer.d.ts","sourceRoot":"","sources":["../../src/server/SseServer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAGvE,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oFAAoF;IACpF,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAOD;;;;;;GAMG;AACH,qBAAa,SAAS;IAkBlB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAlBpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAmB;IAChD,OAAO,CAAC,gBAAgB,CAAC,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAW;IAC3C,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAU;gBAGrC,gBAAgB,EAAE,iBAAiB,EACnC,iBAAiB,EAAE,iBAAiB,EACrD,IAAI,CAAC,EAAE,gBAAgB;IAiBzB;;;;;;OAMG;IACH,cAAc,CACZ,GAAG,EAAE,gBAAgB,EACrB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,IAAI;IAiDP;;OAEG;IACH,UAAU,IAAI,MAAM;IAIpB;;OAEG;IACH,WAAW,IAAI,MAAM;IAIrB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAmCd,SAAS;YAuGT,UAAU;IAiDxB;;OAEG;IACH,OAAO,CAAC,uBAAuB;CAShC"}

package/dist/server/SseServer.js

@@ -8,6 +8,7 @@ const sse_js_1 = require("@modelcontextprotocol/sdk/server/sse.js");
 const express_1 = __importDefault(require("express"));
 const handlerLogger_js_1 = require("../lib/handlerLogger.js");
 const BaseMcpServer_js_1 = require("./BaseMcpServer.js");
+const dnsRebindingProtection_js_1 = require("./dnsRebindingProtection.js");
 const tlsUtils_js_1 = require("./tlsUtils.js");
 const DEFAULT_VERSION = process.env.npm_package_version ?? '1.0.0';
 /**
@@ -32,6 +33,9 @@ class SseServer {
     standaloneServer;
     tls;
     allowDestinationHeader;
+    allowedHosts;
+    allowedOrigins;
+    enableDnsRebindingProtection;
     constructor(handlersRegistry, authBrokerFactory, opts) {
         this.handlersRegistry = handlersRegistry;
         this.authBrokerFactory = authBrokerFactory;
@@ -45,6 +49,9 @@ class SseServer {
         this.externalApp = opts?.app;
         this.tls = opts?.tls;
         this.allowDestinationHeader = opts?.allowDestinationHeader ?? false;
+        this.allowedHosts = opts?.allowedHosts;
+        this.allowedOrigins = opts?.allowedOrigins;
+        this.enableDnsRebindingProtection = opts?.enableDnsRebindingProtection;
     }
     /**
      * Register routes on an external HTTP application
@@ -64,13 +71,18 @@ class SseServer {
                 activeSessions: this.sessions.size,
             });
         }));
-        app.get(this.ssePath, (async (req, res) => {
+        const dnsOpts = {
+            enable: this.enableDnsRebindingProtection,
+            allowedHosts: this.allowedHosts,
+            allowedOrigins: this.allowedOrigins,
+        };
+        app.get(this.ssePath, (0, dnsRebindingProtection_js_1.withDnsRebindingProtection)((async (req, res) => {
             await this.handleGet(req, res);
-        }));
-        app.post(this.postPath, (async (req, res) => {
+        }), dnsOpts));
+        app.post(this.postPath, (0, dnsRebindingProtection_js_1.withDnsRebindingProtection)((async (req, res) => {
             const url = new URL(req.originalUrl, `http://${req.headers.host}`);
             await this.handlePost(req, res, url);
-        }));
+        }), dnsOpts));
         console.error(`[SseServer] Routes registered on external app`);
         console.error(`[SseServer] SSE endpoint: ${this.ssePath}`);
         console.error(`[SseServer] POST endpoint: ${this.postPath}`);

package/dist/server/SseServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"SseServer.js","sourceRoot":"","sources":["../../src/server/SseServer.ts"],"names":[],"mappings":";;;;;;AAGA,oEAA6E;AAC7E,sDAA8B;AAG9B,8DAAqD;AAErD,yDAAmD;AAKnD,+CAAkE;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC;AAyDnE;;;;;;GAMG;AACH,MAAa,SAAS;IAeD;IACA;IAfF,IAAI,CAAS;IACb,IAAI,CAAS;IACb,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,kBAAkB,CAAU;IAC5B,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,WAAW,CAAoB;IACxC,gBAAgB,CAA4B;IACnC,GAAG,CAAa;IAChB,sBAAsB,CAAU;IAEjD,YACmB,gBAAmC,EACnC,iBAAoC,EACrD,IAAuB;QAFN,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,WAAW,CAAC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,6BAAU,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,IAAI,EAAE,sBAAsB,IAAI,KAAK,CAAC;IACtE,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,GAAqB,EACrB,QAAmC;QAEnC,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,IAAS,EAAE,GAAQ,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACnC,CAAC,CAAC;QACL,CAAC,CAAQ,CAAC,CAAC;QAEX,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAClD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAQ,CAAC,CAAC;QAEX,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC,CAAQ,CAAC,CAAC;QAEX,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,oCAAoC,IAAI,CAAC,kBAAkB,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,CAAC,cAAc,CAAC,GAAkC,CAAC,CAAC;QAExD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAA,kCAAoB,EAAC,GAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC5B,OAAO,CAAC,KAAK,CACX,iCAAiC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAC1D,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CACnF,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CACrF,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAQ,EAAE,GAAQ;QACxC,IAAI,WAA+B,CAAC;QACpC,IAAI,MAAW,CAAC;QAEhB,oFAAoF;QACpF,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB;YACnD,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB;gBACxD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,iBAAiB,EAAE,CAAC;YACtB,WAAW,GAAG,iBAAiB,CAAC;YAChC,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QACD,qEAAqE;QACrE,gEAAgE;aAC3D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,iEAAiE;YACjE,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,sCAAsC;aACjC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACtC,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QACD,sDAAsD;aACjD,CAAC;YACJ,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,aAAc,SAAQ,gCAAa;YAEpB;YACR;YACA;YAHX,YACmB,QAA2B,EACnC,UAAkB,EAClB,GAAW;gBAEpB,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBAJrD,aAAQ,GAAR,QAAQ,CAAmB;gBACnC,eAAU,GAAV,UAAU,CAAQ;gBAClB,QAAG,GAAH,GAAG,CAAQ;YAGtB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAwB,EAAE,CAAM,EAAE,IAAU;gBACrD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3C,CAAC;qBAAM,IAAI,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;SACF;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAC9B,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CACb,CAAC;QACF,MAAM,MAAM,CAAC,IAAI,CACf,WAAW,EACX,MAAM,EACN,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,2BAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QAEtC,OAAO,CAAC,KAAK,CACX,6BAA6B,SAAS,oBAAoB,WAAW,EAAE,CACxE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,6CAA6C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAClE,CAAC;QAEF,+DAA+D;QAC/D,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjH,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAClD,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAQ,EAAE,GAAQ,EAAE,GAAS;QACpD,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAC3B,EAAE,CAAW,CAAC;QAEhB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAA4B,CAAC;QACzD,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;QAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,wBAAwB,SAAS,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjI,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACX,8BAA8B,SAAS,uBAAuB,CAC/D,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,sFAAsF;QACtF,gEAAgE;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,kEAAkE,SAAS,EAAE,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,iDAAiD,SAAS,EAAE,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,iCAAiC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,OAAY;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAChB,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE3D,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AAnSD,8BAmSC"}
+{"version":3,"file":"SseServer.js","sourceRoot":"","sources":["../../src/server/SseServer.ts"],"names":[],"mappings":";;;;;;AAGA,oEAA6E;AAC7E,sDAA8B;AAG9B,8DAAqD;AAErD,yDAAmD;AACnD,2EAAyE;AAKzE,+CAAkE;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC;AA+DnE;;;;;;GAMG;AACH,MAAa,SAAS;IAkBD;IACA;IAlBF,IAAI,CAAS;IACb,IAAI,CAAS;IACb,OAAO,CAAS;IAChB,QAAQ,CAAS;IACjB,kBAAkB,CAAU;IAC5B,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC3C,MAAM,CAAS;IACf,OAAO,CAAS;IAChB,WAAW,CAAoB;IACxC,gBAAgB,CAA4B;IACnC,GAAG,CAAa;IAChB,sBAAsB,CAAU;IAChC,YAAY,CAAY;IACxB,cAAc,CAAY;IAC1B,4BAA4B,CAAW;IAExD,YACmB,gBAAmC,EACnC,iBAAoC,EACrD,IAAuB;QAFN,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAmB;QAGrD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,MAAM,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,WAAW,CAAC;QAC9C,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;QACnD,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,6BAAU,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,IAAI,EAAE,sBAAsB,IAAI,KAAK,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,IAAI,EAAE,YAAY,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,4BAA4B,GAAG,IAAI,EAAE,4BAA4B,CAAC;IACzE,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,GAAqB,EACrB,QAAmC;QAEnC,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,IAAS,EAAE,GAAQ,EAAE,EAAE;YAC9C,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACnC,CAAC,CAAC;QACL,CAAC,CAAQ,CAAC,CAAC;QAEX,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,4BAA4B;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,OAAO,EACZ,IAAA,sDAA0B,EACxB,CAAC,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC,CAAQ,EACT,OAAO,CACD,CACT,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,IAAI,CAAC,QAAQ,EACb,IAAA,sDAA0B,EACxB,CAAC,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC,CAAQ,EACT,OAAO,CACD,CACT,CAAC;QAEF,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,KAAK,CAAC,6BAA6B,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,8BAA8B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7D,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,oCAAoC,IAAI,CAAC,kBAAkB,EAAE,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,CAAC,cAAc,CAAC,GAAkC,CAAC,CAAC;QAExD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAA,kCAAoB,EAAC,GAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC5B,OAAO,CAAC,KAAK,CACX,iCAAiC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAC1D,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,6BAA6B,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CACnF,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,8BAA8B,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CACrF,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAQ,EAAE,GAAQ;QACxC,IAAI,WAA+B,CAAC;QACpC,IAAI,MAAW,CAAC;QAEhB,oFAAoF;QACpF,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB;YACnD,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB;gBACxD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,CAAC;YAC3D,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,iBAAiB,EAAE,CAAC;YACtB,WAAW,GAAG,iBAAiB,CAAC;YAChC,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QACD,qEAAqE;QACrE,gEAAgE;aAC3D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,iEAAiE;YACjE,WAAW,GAAG,SAAS,CAAC;YACxB,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,sCAAsC;aACjC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;YACtC,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QACD,sDAAsD;aACjD,CAAC;YACJ,GAAG;iBACA,MAAM,CAAC,GAAG,CAAC;iBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;YACJ,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,WAAW,IAAI,MAAM,EAAE,CAAC,CAAC;QAEnE,MAAM,aAAc,SAAQ,gCAAa;YAEpB;YACR;YACA;YAHX,YACmB,QAA2B,EACnC,UAAkB,EAClB,GAAW;gBAEpB,KAAK,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;gBAJrD,aAAQ,GAAR,QAAQ,CAAmB;gBACnC,eAAU,GAAV,UAAU,CAAQ;gBAClB,QAAG,GAAH,GAAG,CAAQ;YAGtB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAwB,EAAE,CAAM,EAAE,IAAU;gBACrD,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;oBACd,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC3C,CAAC;qBAAM,IAAI,IAAI,EAAE,CAAC;oBAChB,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC;gBAC7C,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;SACF;QAED,MAAM,MAAM,GAAG,IAAI,aAAa,CAC9B,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,OAAO,CACb,CAAC;QACF,MAAM,MAAM,CAAC,IAAI,CACf,WAAW,EACX,MAAM,EACN,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,2BAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QAEtC,OAAO,CAAC,KAAK,CACX,6BAA6B,SAAS,oBAAoB,WAAW,EAAE,CACxE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CACX,6CAA6C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAClE,CAAC;QAEF,+DAA+D;QAC/D,uEAAuE;QACvE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACjH,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAClD,CAAC;YACD,OAAO;QACT,CAAC;QAED,uDAAuD;QACvD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,OAAO,CAAC,KAAK,CAAC,6CAA6C,SAAS,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAQ,EAAE,GAAQ,EAAE,GAAS;QACpD,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YACnD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC;YAC3B,EAAE,CAAW,CAAC;QAEhB,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAA4B,CAAC;QACzD,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;QAEpC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,wBAAwB,SAAS,oBAAoB,IAAI,CAAC,QAAQ,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACjI,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CACX,8BAA8B,SAAS,uBAAuB,CAC/D,CAAC;YACF,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,sFAAsF;QACtF,gEAAgE;QAChE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CACX,kEAAkE,SAAS,EAAE,CAC9E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,iDAAiD,SAAS,EAAE,CAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CACX,iCAAiC,SAAS,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxG,CAAC;YACF,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAC,OAAY;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAChB,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE3D,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC;CACF;AA3TD,8BA2TC"}

package/dist/server/StreamableHttpServer.d.ts

@@ -52,6 +52,12 @@ export interface StreamableHttpServerOptions {
      * @default false
      */
     allowDestinationHeader?: boolean;
+    /** Allowed Host header values (DNS-rebinding protection; exact, incl. port) */
+    allowedHosts?: string[];
+    /** Allowed Origin header values (DNS-rebinding protection; exact, incl. scheme) */
+    allowedOrigins?: string[];
+    /** Enable DNS-rebinding protection (requires allowedHosts and/or allowedOrigins) */
+    enableDnsRebindingProtection?: boolean;
 }
 /**
  * Minimal Streamable HTTP server implementation.
@@ -75,6 +81,9 @@ export declare class StreamableHttpServer extends BaseMcpServer {
     private standaloneServer?;
     private readonly tls?;
     private readonly allowDestinationHeader;
+    private readonly allowedHosts?;
+    private readonly allowedOrigins?;
+    private readonly enableDnsRebindingProtection?;
     /** Per-destination lock to serialize token acquisition (prevents concurrent OAuth flows) */
     private readonly authLocks;
     constructor(handlersRegistry: IHandlersRegistry, authBrokerFactory: AuthBrokerFactory, opts?: StreamableHttpServerOptions);

package/dist/server/StreamableHttpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"StreamableHttpServer.d.ts","sourceRoot":"","sources":["../../src/server/StreamableHttpServer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IAenD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAfpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;gBAG3C,gBAAgB,EAAE,iBAAiB,EACnC,iBAAiB,EAAE,iBAAiB,EACrD,IAAI,CAAC,EAAE,2BAA2B;IAoBpC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoI5B;;;;;;OAMG;IACH,cAAc,CACZ,GAAG,EAAE,gBAAgB,EACrB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,IAAI;IAkCP;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,sBAAsB;CA0C/B"}
+{"version":3,"file":"StreamableHttpServer.d.ts","sourceRoot":"","sources":["../../src/server/StreamableHttpServer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,KAAK,EACV,gBAAgB,EAChB,wBAAwB,EACzB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;OAEG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB;;OAEG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,oFAAoF;IACpF,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IAkBnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAlBpC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAU;IAC7C,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAS;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAmB;IAChD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,gBAAgB,CAAC,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;IACjD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAW;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAW;IAC3C,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAU;IACxD,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoC;gBAG3C,gBAAgB,EAAE,iBAAiB,EACnC,iBAAiB,EAAE,iBAAiB,EACrD,IAAI,CAAC,EAAE,2BAA2B;IAuBpC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAoI5B;;;;;;OAMG;IACH,cAAc,CACZ,GAAG,EAAE,gBAAgB,EACrB,QAAQ,CAAC,EAAE,wBAAwB,GAClC,IAAI;IA2CP;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;;;;OAKG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgC5B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IAY/B,OAAO,CAAC,sBAAsB;CA0C/B"}

package/dist/server/StreamableHttpServer.js

@@ -8,6 +8,7 @@ const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamable
 const express_1 = __importDefault(require("express"));
 const handlerLogger_js_1 = require("../lib/handlerLogger.js");
 const BaseMcpServer_js_1 = require("./BaseMcpServer.js");
+const dnsRebindingProtection_js_1 = require("./dnsRebindingProtection.js");
 const tlsUtils_js_1 = require("./tlsUtils.js");
 const DEFAULT_VERSION = process.env.npm_package_version ?? '1.0.0';
 /**
@@ -32,6 +33,9 @@ class StreamableHttpServer extends BaseMcpServer_js_1.BaseMcpServer {
     standaloneServer;
     tls;
     allowDestinationHeader;
+    allowedHosts;
+    allowedOrigins;
+    enableDnsRebindingProtection;
     /** Per-destination lock to serialize token acquisition (prevents concurrent OAuth flows) */
     authLocks = new Map();
     constructor(handlersRegistry, authBrokerFactory, opts) {
@@ -51,6 +55,9 @@ class StreamableHttpServer extends BaseMcpServer_js_1.BaseMcpServer {
         this.externalApp = opts?.app;
         this.tls = opts?.tls;
         this.allowDestinationHeader = opts?.allowDestinationHeader ?? false;
+        this.allowedHosts = opts?.allowedHosts;
+        this.allowedOrigins = opts?.allowedOrigins;
+        this.enableDnsRebindingProtection = opts?.enableDnsRebindingProtection;
         // Register handlers once for shared MCP server
         this.registerHandlers(this.handlersRegistry);
     }
@@ -180,12 +187,17 @@ class StreamableHttpServer extends BaseMcpServer_js_1.BaseMcpServer {
                 transport: 'http',
             });
         });
+        const dnsOpts = {
+            enable: this.enableDnsRebindingProtection,
+            allowedHosts: this.allowedHosts,
+            allowedOrigins: this.allowedOrigins,
+        };
         // Only handle POST requests - GET SSE streams cause abort errors on disconnect
-        app.post(this.path, handler);
+        app.post(this.path, (0, dnsRebindingProtection_js_1.withDnsRebindingProtection)(handler, dnsOpts));
         // Return 405 for other methods to avoid SSE stream issues
-        app.all(this.path, (_req, res) => {
+        app.all(this.path, (0, dnsRebindingProtection_js_1.withDnsRebindingProtection)((_req, res) => {
             res.status(405).send('Method Not Allowed');
-        });
+        }, dnsOpts));
         console.error(`[StreamableHttpServer] Routes registered on external app at ${this.path}`);
         console.error(`[StreamableHttpServer] JSON response mode: ${this.enableJsonResponse}`);
         if (this.defaultDestination) {

package/dist/server/StreamableHttpServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"StreamableHttpServer.js","sourceRoot":"","sources":["../../src/server/StreamableHttpServer.ts"],"names":[],"mappings":";;;;;;AAGA,0FAAmG;AACnG,sDAA+D;AAG/D,8DAAqD;AAErD,yDAAmD;AAKnD,+CAAkE;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC;AAoDnE;;;;;;;;GAQG;AACH,MAAa,oBAAqB,SAAQ,gCAAa;IAelC;IACA;IAfF,IAAI,CAAS;IACb,IAAI,CAAS;IACb,kBAAkB,CAAU;IAC5B,kBAAkB,CAAU;IAC5B,IAAI,CAAS;IACb,WAAW,CAAoB;IAC/B,OAAO,CAAS;IACzB,gBAAgB,CAA4B;IACnC,GAAG,CAAa;IAChB,sBAAsB,CAAU;IACjD,4FAA4F;IAC3E,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE9D,YACmB,gBAAmC,EACnC,iBAAoC,EACrD,IAAkC;QAElC,KAAK,CAAC;YACJ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,6BAAU;SACnC,CAAC,CAAC;QARc,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAmB;QAQrD,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,IAAI,EAAE,sBAAsB,IAAI,KAAK,CAAC;QACpE,+CAA+C;QAC/C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,oBAAoB;QAI1B,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACxE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAA4B,CAAC;YACzD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,QAAQ,GACZ,SAAS,KAAK,YAAY;gBACxB,CAAC,CAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAA2B;gBAChD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,GAAG,SAAS,OAAO,QAAQ,EAAE;gBAC/B,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,SAAS,QAAQ,MAAM,UAAU,QAAQ,KAAK,IAAI,GAAG,GAAG,CACzG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC7C,IAAI,WAA+B,CAAC;gBACpC,IAAI,MAEH,CAAC;gBAEF,oFAAoF;gBACpF,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB;oBACnD,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB;wBACxD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,CAAC;oBAC3D,CAAC,CAAC,SAAS,CAAC;gBAEd,IAAI,iBAAiB,EAAE,CAAC;oBACtB,WAAW,GAAG,iBAAiB,CAAC;oBAChC,MAAM;wBACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACpE,CAAC;gBACD,qEAAqE;gBACrE,gEAAgE;qBAC3D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,sEAAsE;oBACtE,WAAW,GAAG,SAAS,CAAC;oBACxB,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,sCAAsC;qBACjC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACjC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;oBACtC,yDAAyD;oBACzD,MAAM;wBACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACpE,CAAC;gBACD,sDAAsD;qBACjD,CAAC;oBACJ,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,gDAAgD,WAAW,EAAE,CAC9D,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC,MAAM,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;oBACrC,oEAAoE;oBACpE,qDAAqD;oBACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,YAAY,CAAC;oBACrB,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM;yBACvB,0BAA0B,CAAC,WAAW,EAAE,MAAM,CAAC;yBAC/C,OAAO,CAAC,GAAG,EAAE;wBACZ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;4BACpD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBACrC,CAAC;oBACH,CAAC,CAAC,CAAC;oBACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;oBAC7C,MAAM,WAAW,CAAC;gBACpB,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW;oBAC5B,CAAC,CAAC,eAAe,WAAW,EAAE;oBAC9B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC;wBACzC,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,MAAM,CAAC;gBACb,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,YAAY,UAAU,EAAE,CAC7D,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS,EAAE,wCAAwC;oBACvE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;iBAC5C,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACzB,CAAC,CAAC,CAAC;gBAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,QAAQ,KAAK,IAAI,GAAG,aAAa,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,QAAQ,KAAK,IAAI,GAAG,WAAW,EACnE,GAAG,CACJ,CAAC;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,GAAqB,EACrB,QAAmC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YACtD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAE7B,0DAA0D;QAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAClD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,KAAK,CACX,+DAA+D,IAAI,CAAC,IAAI,EAAE,CAC3E,CAAC;QACF,OAAO,CAAC,KAAK,CACX,8CAA8C,IAAI,CAAC,kBAAkB,EAAE,CACxE,CAAC;QACF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,+CAA+C,IAAI,CAAC,kBAAkB,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,CAAC,cAAc,CAAC,GAAkC,CAAC,CAAC;QAExD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAA,kCAAoB,EAAC,GAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC5B,OAAO,CAAC,KAAK,CACX,4CAA4C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CACrE,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,oCAAoC,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CACvF,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,OAAsD;QAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAChB,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE3D,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,sBAAsB;QAU5B,MAAM,gBAAiB,SAAQ,gCAAa;YAEvB;YADnB,YACmB,QAA2B,EAC5C,OAAe,EACf,MAAc;gBAEd,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAJhC,aAAQ,GAAR,QAAQ,CAAmB;gBAK5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YAEM,0BAA0B,CAC/B,WAAmB,EACnB,MAAuE;gBAEvE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;YAEM,qCAAqC,CAC1C,OAAsD;gBAEtD,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;SACF;QACD,OAAO,IAAI,gBAAgB,CACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;CACF;AA/TD,oDA+TC"}
+{"version":3,"file":"StreamableHttpServer.js","sourceRoot":"","sources":["../../src/server/StreamableHttpServer.ts"],"names":[],"mappings":";;;;;;AAGA,0FAAmG;AACnG,sDAA+D;AAG/D,8DAAqD;AAErD,yDAAmD;AACnD,2EAAyE;AAKzE,+CAAkE;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC;AA0DnE;;;;;;;;GAQG;AACH,MAAa,oBAAqB,SAAQ,gCAAa;IAkBlC;IACA;IAlBF,IAAI,CAAS;IACb,IAAI,CAAS;IACb,kBAAkB,CAAU;IAC5B,kBAAkB,CAAU;IAC5B,IAAI,CAAS;IACb,WAAW,CAAoB;IAC/B,OAAO,CAAS;IACzB,gBAAgB,CAA4B;IACnC,GAAG,CAAa;IAChB,sBAAsB,CAAU;IAChC,YAAY,CAAY;IACxB,cAAc,CAAY;IAC1B,4BAA4B,CAAW;IACxD,4FAA4F;IAC3E,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE9D,YACmB,gBAAmC,EACnC,iBAAoC,EACrD,IAAkC;QAElC,KAAK,CAAC;YACJ,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,eAAe;YACzC,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,6BAAU;SACnC,CAAC,CAAC;QARc,qBAAgB,GAAhB,gBAAgB,CAAmB;QACnC,sBAAiB,GAAjB,iBAAiB,CAAmB;QAQrD,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,eAAe,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,WAAW,CAAC;QACtC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC;QAC/B,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,IAAI,CAAC;QAC3D,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,kBAAkB,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,IAAI,EAAE,GAAG,CAAC;QAC7B,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,GAAG,CAAC;QACrB,IAAI,CAAC,sBAAsB,GAAG,IAAI,EAAE,sBAAsB,IAAI,KAAK,CAAC;QACpE,IAAI,CAAC,YAAY,GAAG,IAAI,EAAE,YAAY,CAAC;QACvC,IAAI,CAAC,cAAc,GAAG,IAAI,EAAE,cAAc,CAAC;QAC3C,IAAI,CAAC,4BAA4B,GAAG,IAAI,EAAE,4BAA4B,CAAC;QACvE,+CAA+C;QAC/C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,oBAAoB;QAI1B,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;YAC3C,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACxE,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,MAA4B,CAAC;YACzD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,QAAQ,GACZ,SAAS,KAAK,YAAY;gBACxB,CAAC,CAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAA2B;gBAChD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,UAAU,GAAG,QAAQ;gBACzB,CAAC,CAAC,GAAG,SAAS,OAAO,QAAQ,EAAE;gBAC/B,CAAC,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;YACpC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,SAAS,QAAQ,MAAM,UAAU,QAAQ,KAAK,IAAI,GAAG,GAAG,CACzG,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC7C,IAAI,WAA+B,CAAC;gBACpC,IAAI,MAEH,CAAC;gBAEF,oFAAoF;gBACpF,MAAM,iBAAiB,GAAG,IAAI,CAAC,sBAAsB;oBACnD,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB;wBACxD,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAwB,CAAC;oBAC3D,CAAC,CAAC,SAAS,CAAC;gBAEd,IAAI,iBAAiB,EAAE,CAAC;oBACtB,WAAW,GAAG,iBAAiB,CAAC;oBAChC,MAAM;wBACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACpE,CAAC;gBACD,qEAAqE;gBACrE,gEAAgE;qBAC3D,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACnD,sEAAsE;oBACtE,WAAW,GAAG,SAAS,CAAC;oBACxB,MAAM,GAAG,SAAS,CAAC;oBACnB,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,CAAC,qCAAqC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBACD,sCAAsC;qBACjC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBACjC,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;oBACtC,yDAAyD;oBACzD,MAAM;wBACJ,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACpE,CAAC;gBACD,sDAAsD;qBACjD,CAAC;oBACJ,GAAG;yBACA,MAAM,CAAC,GAAG,CAAC;yBACX,IAAI,CACH,8IAA8I,CAC/I,CAAC;oBACJ,OAAO;gBACT,CAAC;gBAED,IAAI,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,gDAAgD,WAAW,EAAE,CAC9D,CAAC;gBACJ,CAAC;gBAED,oEAAoE;gBACpE,0DAA0D;gBAC1D,IAAI,CAAC,MAAM,IAAI,WAAW,IAAI,MAAM,EAAE,CAAC;oBACrC,oEAAoE;oBACpE,qDAAqD;oBACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,YAAY,CAAC;oBACrB,CAAC;oBACD,MAAM,WAAW,GAAG,MAAM;yBACvB,0BAA0B,CAAC,WAAW,EAAE,MAAM,CAAC;yBAC/C,OAAO,CAAC,GAAG,EAAE;wBACZ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,WAAW,EAAE,CAAC;4BACpD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;wBACrC,CAAC;oBACH,CAAC,CAAC,CAAC;oBACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;oBAC7C,MAAM,WAAW,CAAC;gBACpB,CAAC;gBAED,MAAM,UAAU,GAAG,WAAW;oBAC5B,CAAC,CAAC,eAAe,WAAW,EAAE;oBAC9B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC;wBACzC,CAAC,CAAC,iBAAiB;wBACnB,CAAC,CAAC,MAAM,CAAC;gBACb,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,YAAY,UAAU,EAAE,CAC7D,CAAC;gBACJ,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;oBAClD,kBAAkB,EAAE,SAAS,EAAE,wCAAwC;oBACvE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;iBAC5C,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;gBACzB,CAAC,CAAC,CAAC;gBAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,QAAQ,KAAK,IAAI,GAAG,aAAa,CACtE,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CACX,0BAA0B,UAAU,QAAQ,KAAK,IAAI,GAAG,WAAW,EACnE,GAAG,CACJ,CAAC;gBACF,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;gBAChD,CAAC;YACH,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,cAAc,CACZ,GAAqB,EACrB,QAAmC;QAEnC,MAAM,OAAO,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5C,6DAA6D;QAC7D,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YACtD,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,MAAM;aAClB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG;YACd,MAAM,EAAE,IAAI,CAAC,4BAA4B;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC;QAEF,+EAA+E;QAC/E,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAA,sDAA0B,EAAC,OAAO,EAAE,OAAO,CAAQ,CAAC,CAAC;QAEzE,0DAA0D;QAC1D,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,IAAI,EACT,IAAA,sDAA0B,EAAC,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7C,CAAC,EAAE,OAAO,CAAQ,CACnB,CAAC;QAEF,OAAO,CAAC,KAAK,CACX,+DAA+D,IAAI,CAAC,IAAI,EAAE,CAC3E,CAAC;QACF,OAAO,CAAC,KAAK,CACX,8CAA8C,IAAI,CAAC,kBAAkB,EAAE,CACxE,CAAC;QACF,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,CAAC,KAAK,CACX,+CAA+C,IAAI,CAAC,kBAAkB,EAAE,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK;QACT,qEAAqE;QACrE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,CAAC,cAAc,CAAC,GAAkC,CAAC,CAAC;QAExD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,QAAQ,GAAG,IAAA,yBAAW,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAA,kCAAoB,EAAC,GAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1D,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC;YAE/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;gBAC5B,OAAO,CAAC,KAAK,CACX,4CAA4C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CACrE,CAAC;gBACF,OAAO,CAAC,KAAK,CACX,oCAAoC,QAAQ,MAAM,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CACvF,CAAC;gBACF,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,OAAsD;QAEtD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC5E,MAAM,YAAY,GAChB,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;YAClD,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAE3D,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC;IAEO,sBAAsB;QAU5B,MAAM,gBAAiB,SAAQ,gCAAa;YAEvB;YADnB,YACmB,QAA2B,EAC5C,OAAe,EACf,MAAc;gBAEd,KAAK,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBAJhC,aAAQ,GAAR,QAAQ,CAAmB;gBAK5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YAEM,0BAA0B,CAC/B,WAAmB,EACnB,MAAuE;gBAEvE,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;gBACD,OAAO,IAAI,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACxD,CAAC;YAEM,qCAAqC,CAC1C,OAAsD;gBAEtD,IAAI,CAAC,+BAA+B,CAAC,OAAO,CAAC,CAAC;YAChD,CAAC;SACF;QACD,OAAO,IAAI,gBAAgB,CACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;CACF;AA9UD,oDA8UC"}

package/dist/server/dnsRebindingProtection.d.ts

@@ -0,0 +1,21 @@
+import type { NextFunction, Request, Response } from 'express';
+export interface DnsRebindingOptions {
+    enable?: boolean;
+    /** Exact raw Host header values, including port (e.g. "localhost:3000"). */
+    allowedHosts?: string[];
+    /** Exact raw Origin header values, including scheme (e.g. "https://app.example.com"). */
+    allowedOrigins?: string[];
+}
+type RouteHandler = (req: Request, res: Response, next?: NextFunction) => void | Promise<void>;
+/** Returns a 403 descriptor if the request must be rejected, else null. */
+export declare function checkDnsRebinding(headers: {
+    host?: string;
+    origin?: string;
+}, opts: DnsRebindingOptions): {
+    status: number;
+    body: unknown;
+} | null;
+/** Wrap an MCP route handler so it validates Host/Origin before delegating. */
+export declare function withDnsRebindingProtection(handler: RouteHandler, opts: DnsRebindingOptions): RouteHandler;
+export {};
+//# sourceMappingURL=dnsRebindingProtection.d.ts.map

package/dist/server/dnsRebindingProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsRebindingProtection.d.ts","sourceRoot":"","sources":["../../src/server/dnsRebindingProtection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,KAAK,YAAY,GAAG,CAClB,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,QAAQ,EACb,IAAI,CAAC,EAAE,YAAY,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAS1B,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,IAAI,EAAE,mBAAmB,GACxB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAiB1C;AAED,+EAA+E;AAC/E,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,IAAI,EAAE,mBAAmB,GACxB,YAAY,CAed"}

package/dist/server/dnsRebindingProtection.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkDnsRebinding = checkDnsRebinding;
+exports.withDnsRebindingProtection = withDnsRebindingProtection;
+function reject(message) {
+    return {
+        status: 403,
+        body: { jsonrpc: '2.0', error: { code: -32000, message }, id: null },
+    };
+}
+/** Returns a 403 descriptor if the request must be rejected, else null. */
+function checkDnsRebinding(headers, opts) {
+    if (opts.enable !== true)
+        return null;
+    const hosts = opts.allowedHosts ?? [];
+    const origins = opts.allowedOrigins ?? [];
+    if (hosts.length > 0) {
+        const host = headers.host;
+        if (!host || !hosts.includes(host)) {
+            return reject(`Invalid Host header: ${host ?? ''}`);
+        }
+    }
+    if (origins.length > 0) {
+        const origin = headers.origin;
+        if (origin && !origins.includes(origin)) {
+            return reject(`Invalid Origin header: ${origin}`);
+        }
+    }
+    return null;
+}
+/** Wrap an MCP route handler so it validates Host/Origin before delegating. */
+function withDnsRebindingProtection(handler, opts) {
+    return (req, res, next) => {
+        const rejection = checkDnsRebinding({
+            host: req.headers?.host,
+            origin: req.headers?.origin,
+        }, opts);
+        if (rejection) {
+            res.status(rejection.status).json(rejection.body);
+            return;
+        }
+        return handler(req, res, next);
+    };
+}
+//# sourceMappingURL=dnsRebindingProtection.js.map

package/dist/server/dnsRebindingProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dnsRebindingProtection.js","sourceRoot":"","sources":["../../src/server/dnsRebindingProtection.ts"],"names":[],"mappings":";;AAwBA,8CAoBC;AAGD,gEAkBC;AAjDD,SAAS,MAAM,CAAC,OAAe;IAC7B,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;KACrE,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAgB,iBAAiB,CAC/B,OAA2C,EAC3C,IAAyB;IAEzB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,MAAM,CAAC,wBAAwB,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,MAAM,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAgB,0BAA0B,CACxC,OAAqB,EACrB,IAAyB;IAEzB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACxB,MAAM,SAAS,GAAG,iBAAiB,CACjC;YACE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAA0B;YAC7C,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,MAA4B;SAClD,EACD,IAAI,CACL,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/launcher.js

@@ -338,6 +338,9 @@ async function main() {
             logger: loggerForTransport,
             tls: config.tls,
             allowDestinationHeader: config.allowDestinationHeader,
+            allowedHosts: config.allowedHosts,
+            allowedOrigins: config.allowedOrigins,
+            enableDnsRebindingProtection: config.enableDnsRebindingProtection,
         });
         activeServer = server;
         await server.start();
@@ -353,6 +356,9 @@ async function main() {
         logger: loggerForTransport,
         tls: config.tls,
         allowDestinationHeader: config.allowDestinationHeader,
+        allowedHosts: config.allowedHosts,
+        allowedOrigins: config.allowedOrigins,
+        enableDnsRebindingProtection: config.enableDnsRebindingProtection,
     });
     activeServer = server;
     await server.start();

package/dist/server/launcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../src/server/launcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,gDAAkC;AAClC,+CAAiC;AACjC,mDAAyD;AACzD,qDAA6D;AAC7D,+EAAyE;AACzE,8DAOyC;AACzC,yEAAoF;AAKpF,wGAAkG;AAClG,8CAGyB;AACzB,+DAAyD;AACzD,iDAA2C;AAC3C,qDAA+C;AAC/C,uEAAiE;AAEjE,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAChD,IAAI,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAC;AACF,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;AAItE,8EAA8E;AAC9E,IAAI,YAAwE,CAAC;AAE7E,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,+BAA+B,CAAC,WAAoB;IAC3D,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAmC;YAC3C,mBAAmB;YACnB,iBAAiB;YACjB,cAAc;YACd,YAAY;YACZ,qBAAqB;YACrB,iBAAiB;SAClB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;IACzF,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwExB,CAAC;AAEF,SAAS,QAAQ;IACf,OAAO,CAAC,KAAK,CAAC,8BAAmB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,8BAAmB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC;IAC/C,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,SAAgB;QAC5B,MAAM,EAAE,SAAS;KACO,CAAC;IAE3B,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAA,0CAAkB,EAAC,UAAU,CAAC,CAAC;IAE/B,0EAA0E;IAC1E,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAoB,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,gBAAgB,CAAC,IAAI,CAAC,IAAI,iCAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,gBAAgB,CAAC,IAAI,CAAC,IAAI,gCAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,gBAAgB,CAAC,IAAI,CAAC,IAAI,+BAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAChC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,IAAI,CAChB,IAAI,gCAAqB,CACvB,WAAW,EACX,mBAAmB,EACnB,IAAI,iCAAsB,EAAE,CAC7B,CACF,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,IAAI,8BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;IACxC,yCAAyC;IACzC,aAAa,CAAC,IAAI,CAAC,IAAI,8BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,IAAI,wDAAyB,CAAC,aAAa,CAAC,CAAC;IAEtE,0CAA0C;IAC1C,MAAM,YAAY,GAAG,sCAAgB,CAAC,gBAAgB,CACpD,MAAM,EACN,kBAAkB,CACnB,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,4BAAiB,CAAC,YAAY,CAAC,CAAC;IAE9D,8DAA8D;IAC9D,MAAM,iBAAiB,CAAC,uBAAuB,EAAE,CAAC;IAElD,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,+CAA+C;YAC/C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,mBAAmB,CACxD,MAAM,CAAC,cAAc,IAAI,SAAS,CACnC,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,aAAa,GAAsB;oBACvC,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,kBAAkB;iBACxC,CAAC;gBAEF,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MACjB,aACD,CAAC,YAAY,EAAE,sBAAsB,EAAE,CACtC,MAAM,CAAC,cAAc,IAAI,SAAS,CACnC,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;wBACzC,aAAa,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;wBACnD,aAAa,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;wBAC3D,aAAa,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;gBAED,mBAAmB;gBACnB,IAAI,MAAM,GAAG,SAAS,CAAC;gBACvB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACnD,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC1B,CAAC;gBAED,OAAO,CAAC,KAAK,CAAC,IAAA,qCAA0B,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACnD,6CAA6C;QAC7C,OAAO,CAAC,KAAK,CACX,8DAA8D,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,4EAA4E;QAC5E,MAAM,mBAAmB,GACvB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,gBAAgB,GAAG,mBAAmB;YAC1C,CAAC,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;YACpE,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,MAA+B,CAAC;QACpC,IAAI,SAAiB,CAAC;QAEtB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,gBAAgB,CAAC;YAC1B,SAAS,GAAG,mBAAoB,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,0DAA0D;YAC1D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;YAChD,MAAM,GAAG;gBACP,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBACvB,UAAU,EAAE,cAAqB;oBACjC,MAAM,EAAE,EAAS;oBACjB,MAAM,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAS;oBACxD,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;iBACvB,CAAC;gBACF,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBAChC,UAAU,EAAE,aAAa;oBACzB,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBACF,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;aACzB,CAAC;YACT,SAAS,GAAG,MAAM,CAAC;YACnB,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,4BAAW,CAAC,gBAAgB,EAAE,MAAO,EAAE;YACxD,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,YAAY,GAAG,MAAM,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,wBAAS,CAAC,gBAAgB,EAAE,iBAAiB,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,kBAAkB,EAChB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,MAAM,EAAE,kBAAkB;YAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;SACtD,CAAC,CAAC;QACH,YAAY,GAAG,MAAM,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO;IACP,MAAM,MAAM,GAAG,IAAI,8CAAoB,CAAC,gBAAgB,EAAE,iBAAiB,EAAE;QAC3E,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,kBAAkB,EAChB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,EAAE,kBAAkB;QAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACtD,CAAC,CAAC;IACH,YAAY,GAAG,MAAM,CAAC;IACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,sCAAsC;IACtC,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"launcher.js","sourceRoot":"","sources":["../../src/server/launcher.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,4CAA8B;AAC9B,gDAAkC;AAClC,+CAAiC;AACjC,mDAAyD;AACzD,qDAA6D;AAC7D,+EAAyE;AACzE,8DAOyC;AACzC,yEAAoF;AAKpF,wGAAkG;AAClG,8CAGyB;AACzB,+DAAyD;AACzD,iDAA2C;AAC3C,qDAA+C;AAC/C,uEAAiE;AAEjE,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAChD,IAAI,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IAChD,KAAK,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACjD,KAAK,EAAE,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC;IACd,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;IACf,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC;CAChB,CAAC;AACF,MAAM,kBAAkB,GACtB,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;AAItE,8EAA8E;AAC9E,IAAI,YAAwE,CAAC;AAE7E,SAAS,MAAM,CAAC,IAAY;IAC1B,OAAO,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,SAAS,+BAA+B,CAAC,WAAoB;IAC3D,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChD,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,IAAI,GAAmC;YAC3C,mBAAmB;YACnB,iBAAiB;YACjB,cAAc;YACd,YAAY;YACZ,qBAAqB;YACrB,iBAAiB;SAClB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uFAAuF;IACzF,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwExB,CAAC;AAEF,SAAS,QAAQ;IACf,OAAO,CAAC,KAAK,CAAC,8BAAmB,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,iDAAiD;IACjD,MAAM,aAAa,GAAG,IAAI,8BAAmB,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC;IAC/C,+BAA+B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC,cAAc,CAAC;IAC1D,CAAC;IAED,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE,SAAgB;QAC5B,MAAM,EAAE,SAAS;KACO,CAAC;IAE3B,uEAAuE;IACvE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC7D,IAAA,0CAAkB,EAAC,UAAU,CAAC,CAAC;IAE/B,0EAA0E;IAC1E,kEAAkE;IAClE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAoB,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,gBAAgB,CAAC,IAAI,CAAC,IAAI,iCAAsB,CAAC,WAAW,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,gBAAgB,CAAC,IAAI,CAAC,IAAI,gCAAqB,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,gBAAgB,CAAC,IAAI,CAAC,IAAI,+BAAoB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAChC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAoB,EAAE,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,aAAa,CAAC,IAAI,CAChB,IAAI,gCAAqB,CACvB,WAAW,EACX,mBAAmB,EACnB,IAAI,iCAAsB,EAAE,CAC7B,CACF,CAAC;QACF,aAAa,CAAC,IAAI,CAAC,IAAI,8BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,aAAa,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC;IACxC,yCAAyC;IACzC,aAAa,CAAC,IAAI,CAAC,IAAI,8BAAmB,CAAC,WAAW,CAAC,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,IAAI,wDAAyB,CAAC,aAAa,CAAC,CAAC;IAEtE,0CAA0C;IAC1C,MAAM,YAAY,GAAG,sCAAgB,CAAC,gBAAgB,CACpD,MAAM,EACN,kBAAkB,CACnB,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,4BAAiB,CAAC,YAAY,CAAC,CAAC;IAE9D,8DAA8D;IAC9D,MAAM,iBAAiB,CAAC,uBAAuB,EAAE,CAAC;IAElD,uEAAuE;IACvE,MAAM,aAAa,GAAG,iBAAiB,CAAC,gBAAgB,EAAE,CAAC;IAC3D,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,+CAA+C;YAC/C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,mBAAmB,CACxD,MAAM,CAAC,cAAc,IAAI,SAAS,CACnC,CAAC;YAEF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,aAAa,GAAsB;oBACvC,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,QAAQ,EAAE,UAAU,CAAC,kBAAkB;iBACxC,CAAC;gBAEF,yCAAyC;gBACzC,IAAI,CAAC;oBACH,MAAM,UAAU,GAAG,MACjB,aACD,CAAC,YAAY,EAAE,sBAAsB,EAAE,CACtC,MAAM,CAAC,cAAc,IAAI,SAAS,CACnC,CAAC;oBACF,IAAI,UAAU,EAAE,CAAC;wBACf,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;wBACzC,aAAa,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;wBACnD,aAAa,CAAC,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;wBAC3D,aAAa,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,mCAAmC;gBACrC,CAAC;gBAED,mBAAmB;gBACnB,IAAI,MAAM,GAAG,SAAS,CAAC;gBACvB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;oBAC1B,MAAM,GAAG,gBAAgB,MAAM,CAAC,cAAc,EAAE,CAAC;gBACnD,CAAC;qBAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC1B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;gBAC1B,CAAC;gBAED,OAAO,CAAC,KAAK,CAAC,IAAA,qCAA0B,EAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gDAAgD;YAChD,OAAO,CAAC,KAAK,CACX,iDAAiD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC1G,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACnD,6CAA6C;QAC7C,OAAO,CAAC,KAAK,CACX,8DAA8D,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,4EAA4E;QAC5E,MAAM,mBAAmB,GACvB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpE,MAAM,gBAAgB,GAAG,mBAAmB;YAC1C,CAAC,CAAC,MAAM,iBAAiB,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;YACpE,CAAC,CAAC,SAAS,CAAC;QAEd,IAAI,MAA+B,CAAC;QACpC,IAAI,SAAiB,CAAC;QAEtB,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,GAAG,gBAAgB,CAAC;YAC1B,SAAS,GAAG,mBAAoB,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,0DAA0D;YAC1D,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACvE,MAAM,cAAc,GAAG,IAAI,kBAAkB,EAAE,CAAC;YAChD,MAAM,GAAG;gBACP,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBACvB,UAAU,EAAE,cAAqB;oBACjC,MAAM,EAAE,EAAS;oBACjB,MAAM,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAS;oBACxD,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;iBACvB,CAAC;gBACF,mBAAmB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;oBAChC,UAAU,EAAE,aAAa;oBACzB,QAAQ,EAAE,OAAO;oBACjB,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBACF,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;aACzB,CAAC;YACT,SAAS,GAAG,MAAM,CAAC;YACnB,OAAO,CAAC,KAAK,CACX,oEAAoE,CACrE,CAAC;YACF,OAAO,CAAC,KAAK,CACX,8EAA8E,CAC/E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,4BAAW,CAAC,gBAAgB,EAAE,MAAO,EAAE;YACxD,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;QACH,YAAY,GAAG,MAAM,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,wBAAS,CAAC,gBAAgB,EAAE,iBAAiB,EAAE;YAChE,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,kBAAkB,EAChB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACnE,MAAM,EAAE,kBAAkB;YAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;YACrD,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,4BAA4B,EAAE,MAAM,CAAC,4BAA4B;SAClE,CAAC,CAAC;QACH,YAAY,GAAG,MAAM,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IAED,OAAO;IACP,MAAM,MAAM,GAAG,IAAI,8CAAoB,CAAC,gBAAgB,EAAE,iBAAiB,EAAE;QAC3E,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,kBAAkB,EAChB,MAAM,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,EAAE,kBAAkB;QAC1B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;QACrD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,4BAA4B,EAAE,MAAM,CAAC,4BAA4B;KAClE,CAAC,CAAC;IACH,YAAY,GAAG,MAAM,CAAC;IACtB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,sCAAsC;IACtC,OAAO,CAAC,KAAK,CACX,wBAAwB,EACxB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/docs/architecture/ARCHITECTURE.md

@@ -288,13 +288,15 @@ launcher.ts main()
 
 Handlers are organized into groups by access level:
 
-| Group | Purpose | Typical Tool Count |
+| Group | Purpose | Approx. Tool Count |
 |:---|:---|:---|
-| `ReadOnlyHandlersGroup` | Get operations (read source, metadata) | ~10 |
-| `HighLevelHandlersGroup` | Full CRUD (Create, Update, Delete, Get) | ~90 |
-| `LowLevelHandlersGroup` | Fine-grained (lock, unlock, activate, validate) | ~40 |
-| `SearchHandlersGroup` | Repository search, where-used | ~5 |
-| `SystemHandlersGroup` | System info, discovery | ~3 |
+| `ReadOnlyHandlersGroup` | Get operations (read source, metadata) | ~29 |
+| `HighLevelHandlersGroup` | Full CRUD (Create, Update, Delete, Get) | ~121 |
+| `LowLevelHandlersGroup` | Fine-grained (lock, unlock, activate, validate) | ~120 |
+| `SearchHandlersGroup` | Repository search, where-used | ~4 |
+| `SystemHandlersGroup` | System info, discovery | ~30 |
+
+Counts drift as tools are added; see [AVAILABLE_TOOLS.md](../user-guide/AVAILABLE_TOOLS.md) for the authoritative, up-to-date list.
 
 The `exposition` configuration controls which groups are active, enabling read-only deployments or full-access modes.