@mindstone/mcp-server-elevenlabs 0.2.2 → 0.4.0

package/dist/types.js

@@ -1,4 +1,6 @@
 export const REQUEST_TIMEOUT_MS = 30_000;
+/** Per-call override for slow synchronous endpoints (dialogue, voice design). */
+export const LONG_REQUEST_TIMEOUT_MS = 120_000;
 export class ElevenLabsError extends Error {
     code;
     resolution;
@@ -9,6 +11,9 @@ export class ElevenLabsError extends Error {
         this.name = 'ElevenLabsError';
     }
 }
+import { envelopeApiErrorDetail } from './error-detail.js';
+/** Actionable resolution when a voice_id or voice_name cannot be resolved. */
+export const VOICE_NOT_FOUND_RESOLUTION = 'Use list_voices to browse voices on this account, or search_shared_voices to find voices in the public library. Pass the exact voice_id to generate_speech.';
 /**
  * Resolve an error status code to an actionable resolution string.
  */
@@ -18,17 +23,28 @@ export function getErrorResolution(status, detail) {
         return 'Authentication failed. Check your ElevenLabs API key in Settings. Get one at https://elevenlabs.io/app/settings/api-keys';
     }
     if (status === 403 || msg.includes('quota') || msg.includes('limit') || msg.includes('credits')) {
-        return 'Insufficient credits or quota exceeded. Check usage at https://elevenlabs.io/app/usage';
+        return ('Insufficient credits or quota exceeded. Call check_subscription to see remaining characters and the next reset date, ' +
+            'or check usage at https://elevenlabs.io/app/usage');
     }
     if (status === 422 || msg.includes('validation')) {
-        return 'Invalid request parameters. Check the input values and try again.';
+        const base = 'Invalid request parameters. Check the input values and try again.';
+        if (detail) {
+            return `${base} Field issues: ${envelopeApiErrorDetail(detail)}`;
+        }
+        return base;
     }
     if (status === 429) {
         return 'Rate limited. Wait a moment and try again.';
     }
-    if (msg.includes('content') || msg.includes('policy') || msg.includes('moderation')) {
+    if (msg.includes('unsupported_content_type')) {
+        return "The uploaded file type isn't supported for this operation. Provide a supported audio/video format (mp3, wav, mp4, …).";
+    }
+    if (msg.includes('content policy') ||
+        msg.includes('moderation') ||
+        msg.includes('flagged') ||
+        msg.includes('policy violation')) {
         return 'Content policy violation. Try a different prompt.';
     }
-    return 'Please try again. If the issue persists, check your API key and credits at https://elevenlabs.io/app/settings/api-keys';
+    return 'Please try again. If the issue persists, call check_subscription for credit status or check your API key at https://elevenlabs.io/app/settings/api-keys';
 }
 //# sourceMappingURL=types.js.map

package/dist/untrusted-content.d.ts

@@ -0,0 +1,45 @@
+/**
+ * AGENTS.md security invariant #6 — content fetched from an external system
+ * MUST be wrapped in an `<untrusted-content source="…">…</untrusted-content>`
+ * envelope (with close-tag breakout escaping) before it is returned to the
+ * LLM, so the model treats third-party / attacker-controllable text as DATA,
+ * not as instructions.
+ *
+ * This is the canonical implementation a new connector ships with. It is a
+ * VENDORED copy of the shared reference in `test-harness/src/untrusted-content.ts`
+ * — connectors cannot `import` the test-harness at runtime (it is a
+ * test/dev-only `file:` dependency that is never published into a connector's
+ * `dist/`), so the helper lives in the connector's own runtime source. Keep
+ * this byte-for-byte in sync with the shared reference; do NOT weaken the
+ * escaping back to a simple `replaceAll` (that family misses whitespace / case
+ * close-tag variants like `</untrusted-content >` / `</UNTRUSTED-CONTENT>`).
+ *
+ * `scripts/check-untrusted-coverage.mjs` greps for a reference to
+ * `untrusted-content` in any connector that talks to an external system; this
+ * file (and the call sites that import from it) is what satisfies that gate.
+ */
+/**
+ * Wrap a single untrusted string in an `<untrusted-content source="…">`
+ * envelope, escaping any embedded close-tag variant so the envelope cannot be
+ * broken out of. `undefined` passes through untouched. Idempotent for the same
+ * `source`.
+ */
+export declare function wrapUntrusted(text: string | undefined, source: string): string | undefined;
+/**
+ * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
+ * strings unchanged. This is intentionally one-layer and idempotent for already
+ * raw input so callers can accept either displayed wrapped content or manually
+ * authored content.
+ */
+export declare function unwrapUntrusted(text: string): string;
+/**
+ * Recursively wrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export declare function wrapUntrustedJsonStrings<T>(value: T, source: string): T;
+/**
+ * Recursively unwrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export declare function unwrapUntrustedJsonStrings<T>(value: T): T;
+//# sourceMappingURL=untrusted-content.d.ts.map

package/dist/untrusted-content.js

@@ -0,0 +1,104 @@
+/**
+ * AGENTS.md security invariant #6 — content fetched from an external system
+ * MUST be wrapped in an `<untrusted-content source="…">…</untrusted-content>`
+ * envelope (with close-tag breakout escaping) before it is returned to the
+ * LLM, so the model treats third-party / attacker-controllable text as DATA,
+ * not as instructions.
+ *
+ * This is the canonical implementation a new connector ships with. It is a
+ * VENDORED copy of the shared reference in `test-harness/src/untrusted-content.ts`
+ * — connectors cannot `import` the test-harness at runtime (it is a
+ * test/dev-only `file:` dependency that is never published into a connector's
+ * `dist/`), so the helper lives in the connector's own runtime source. Keep
+ * this byte-for-byte in sync with the shared reference; do NOT weaken the
+ * escaping back to a simple `replaceAll` (that family misses whitespace / case
+ * close-tag variants like `</untrusted-content >` / `</UNTRUSTED-CONTENT>`).
+ *
+ * `scripts/check-untrusted-coverage.mjs` greps for a reference to
+ * `untrusted-content` in any connector that talks to an external system; this
+ * file (and the call sites that import from it) is what satisfies that gate.
+ */
+const UNTRUSTED_CLOSE_TAG_VARIANT = /<\/untrusted-content\s*>/gi;
+const ESCAPED_UNTRUSTED_CLOSE_TAG = '<\\/untrusted-content>';
+const UNTRUSTED_ENVELOPE = /^<untrusted-content source="[^"]*">([\s\S]*)<\/untrusted-content>$/;
+function escapeAttr(s) {
+    return s.replaceAll('&', '&amp;').replaceAll('"', '&quot;').replaceAll('<', '&lt;').replaceAll('>', '&gt;');
+}
+function escapeCloseTagSentinels(s) {
+    return s.replace(UNTRUSTED_CLOSE_TAG_VARIANT, ESCAPED_UNTRUSTED_CLOSE_TAG);
+}
+function unescapeCloseTagSentinels(s) {
+    return s.replaceAll(ESCAPED_UNTRUSTED_CLOSE_TAG, '</untrusted-content>');
+}
+/**
+ * Wrap a single untrusted string in an `<untrusted-content source="…">`
+ * envelope, escaping any embedded close-tag variant so the envelope cannot be
+ * broken out of. `undefined` passes through untouched. Idempotent for the same
+ * `source`.
+ */
+export function wrapUntrusted(text, source) {
+    if (text === undefined)
+        return undefined;
+    const open = `<untrusted-content source="${escapeAttr(source)}">`;
+    const close = '</untrusted-content>';
+    if (text.startsWith(open) && text.endsWith(close) && text.length >= open.length + close.length) {
+        const inner = text.slice(open.length, text.length - close.length);
+        if (!UNTRUSTED_CLOSE_TAG_VARIANT.test(inner)) {
+            UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
+            return text;
+        }
+        UNTRUSTED_CLOSE_TAG_VARIANT.lastIndex = 0;
+    }
+    return `${open}${escapeCloseTagSentinels(text)}${close}`;
+}
+/**
+ * Strip one `<untrusted-content>` envelope from `text` if present, returning raw
+ * strings unchanged. This is intentionally one-layer and idempotent for already
+ * raw input so callers can accept either displayed wrapped content or manually
+ * authored content.
+ */
+export function unwrapUntrusted(text) {
+    const match = UNTRUSTED_ENVELOPE.exec(text);
+    if (!match)
+        return text;
+    return unescapeCloseTagSentinels(match[1]);
+}
+/**
+ * Recursively wrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export function wrapUntrustedJsonStrings(value, source) {
+    if (typeof value === 'string') {
+        return wrapUntrusted(value, source);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => wrapUntrustedJsonStrings(item, source));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            wrapUntrusted(key, source) ?? key,
+            wrapUntrustedJsonStrings(item, source),
+        ]));
+    }
+    return value;
+}
+/**
+ * Recursively unwrap every string key and value reachable inside `value`.
+ * Non-string leaves pass through unchanged.
+ */
+export function unwrapUntrustedJsonStrings(value) {
+    if (typeof value === 'string') {
+        return unwrapUntrusted(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => unwrapUntrustedJsonStrings(item));
+    }
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+            unwrapUntrusted(key),
+            unwrapUntrustedJsonStrings(item),
+        ]));
+    }
+    return value;
+}
+//# sourceMappingURL=untrusted-content.js.map

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@mindstone/mcp-server-elevenlabs",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "mcpName": "io.github.mindstone/mcp-server-elevenlabs",
-  "description": "ElevenLabs MCP server for Model Context Protocol hosts \u2014 music, TTS, sound effects, voices, transcription",
+  "description": "ElevenLabs MCP server for Model Context Protocol hosts — music, TTS, sound effects, voices, transcription",
   "license": "FSL-1.1-MIT",
   "type": "module",
   "bin": {