@modelcontextprotocol/inspector 1.0.1 → 1.0.2

package/client/dist/assets/{OAuthCallback-DKaW5Tk8.js → OAuthCallback-at8T3Iwi.js}

@@ -1,4 +1,4 @@
-import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-CH-qD91V.js";
+import { u as useToast, r as reactExports, j as jsxRuntimeExports, p as parseOAuthCallbackParams, g as generateOAuthErrorDescription, S as SESSION_KEYS, I as InspectorOAuthClientProvider, a as auth } from "./index-DdyO6kfY.js";
 const OAuthCallback = ({ onConnect }) => {
   const { toast } = useToast();
   const hasProcessedRef = reactExports.useRef(false);

package/client/dist/assets/{OAuthDebugCallback-Bx3X7Zkh.js → OAuthDebugCallback-ZJ9hxfpr.js}

@@ -1,4 +1,4 @@
-import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-CH-qD91V.js";
+import { r as reactExports, S as SESSION_KEYS, p as parseOAuthCallbackParams, j as jsxRuntimeExports, g as generateOAuthErrorDescription } from "./index-DdyO6kfY.js";
 const OAuthDebugCallback = ({ onConnect }) => {
   reactExports.useEffect(() => {
     let isProcessed = false;

package/client/dist/assets/{index-CH-qD91V.js → index-DdyO6kfY.js}

@@ -17228,7 +17228,7 @@ object({
   token_type_hint: string().optional()
 }).strip();
 const name = "@modelcontextprotocol/inspector-client";
-const version$1 = "1.0.1";
+const version$1 = "1.0.2";
 const packageJson = {
   name,
   version: version$1
@@ -32742,7 +32742,25 @@ function requireUtils() {
   const isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
   const isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
   const isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
-  const isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+  const isPathCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/]$/u);
+  const isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:@/?]$/u);
+  const isUserinfoCharacter = RegExp.prototype.test.bind(/^[A-Za-z0-9\-._~!$&'()*+,;=:]$/u);
+  const BYTE_HEX = new Array(256);
+  {
+    const HEX_DIGITS = "0123456789ABCDEF";
+    for (let i2 = 0; i2 < 256; i2++) {
+      BYTE_HEX[i2] = "%" + HEX_DIGITS[i2 >> 4] + HEX_DIGITS[i2 & 15];
+    }
+  }
+  function percentEncodeNonAscii(cp2) {
+    if (cp2 < 2048) {
+      return BYTE_HEX[192 | cp2 >> 6] + BYTE_HEX[128 | cp2 & 63];
+    }
+    if (cp2 < 65536) {
+      return BYTE_HEX[224 | cp2 >> 12] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
+    }
+    return BYTE_HEX[240 | cp2 >> 18] + BYTE_HEX[128 | cp2 >> 12 & 63] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
+  }
   function stringArrayToHexStripped(input) {
     let acc = "";
     let code2 = 0;
@@ -32767,91 +32785,105 @@ function requireUtils() {
     }
     return acc;
   }
+  const isHextet = RegExp.prototype.test.bind(/^[\dA-Fa-f]{1,4}$/);
+  const isIPvFuture = RegExp.prototype.test.bind(/^[vV][\dA-Fa-f]+\.[A-Za-z\d\-._~!$&'()*+,;=:]+$/);
+  const isZoneCharacter = RegExp.prototype.test.bind(/^[A-Za-z\d\-._~]$/);
   const nonSimpleDomain = RegExp.prototype.test.bind(/[^!"$&'()*+,\-.;=_`a-z{}~]/u);
-  function consumeIsZone(buffer) {
-    buffer.length = 0;
-    return true;
-  }
-  function consumeHextets(buffer, address, output) {
-    if (buffer.length) {
-      const hex = stringArrayToHexStripped(buffer);
-      if (hex !== "") {
-        address.push(hex);
-      } else {
-        output.error = true;
-        return false;
+  function isZoneIdentifier(zone) {
+    if (zone.length === 0) return false;
+    for (let i2 = 0; i2 < zone.length; i2++) {
+      if (isZoneCharacter(zone[i2])) continue;
+      if (zone[i2] === "%" && i2 + 2 < zone.length && isHexPair(zone.slice(i2 + 1, i2 + 3))) {
+        i2 += 2;
+        continue;
       }
-      buffer.length = 0;
+      return false;
     }
     return true;
   }
-  function getIPV6(input) {
-    let tokenCount = 0;
-    const output = { error: false, address: "", zone: "" };
-    const address = [];
-    const buffer = [];
-    let endipv6Encountered = false;
-    let endIpv6 = false;
-    let consume = consumeHextets;
-    for (let i2 = 0; i2 < input.length; i2++) {
-      const cursor = input[i2];
-      if (cursor === "[" || cursor === "]") {
-        continue;
-      }
-      if (cursor === ":") {
-        if (endipv6Encountered === true) {
-          endIpv6 = true;
-        }
-        if (!consume(buffer, address, output)) {
-          break;
-        }
-        if (++tokenCount > 7) {
-          output.error = true;
-          break;
+  function compressIPv6ZeroRun(hextets) {
+    let bestStart = -1;
+    let bestLength = 0;
+    let runStart = -1;
+    let runLength = 0;
+    for (let i2 = 0; i2 < hextets.length; i2++) {
+      if (hextets[i2] === "0") {
+        if (runStart === -1) runStart = i2;
+        runLength++;
+        if (runLength > bestLength) {
+          bestLength = runLength;
+          bestStart = runStart;
         }
-        if (i2 > 0 && input[i2 - 1] === ":") {
-          endipv6Encountered = true;
-        }
-        address.push(":");
-        continue;
-      } else if (cursor === "%") {
-        if (!consume(buffer, address, output)) {
-          break;
-        }
-        consume = consumeIsZone;
       } else {
-        buffer.push(cursor);
+        runStart = -1;
+        runLength = 0;
+      }
+    }
+    if (bestLength < 2) return hextets.join(":");
+    const head = hextets.slice(0, bestStart).join(":");
+    const tail = hextets.slice(bestStart + bestLength).join(":");
+    return head + "::" + tail;
+  }
+  function normalizeIPv6Address(input) {
+    const compression = input.indexOf("::");
+    if (compression !== -1 && input.indexOf("::", compression + 1) !== -1) return void 0;
+    const left = compression === -1 ? input.split(":") : input.slice(0, compression).split(":");
+    const right = compression === -1 ? [] : input.slice(compression + 2).split(":");
+    if (compression !== -1) {
+      if (left.length === 1 && left[0] === "") left.length = 0;
+      if (right.length === 1 && right[0] === "") right.length = 0;
+    }
+    const parts = left.concat(right);
+    let hextetCount = 0;
+    for (let i2 = 0; i2 < parts.length; i2++) {
+      const part = parts[i2];
+      if (part === "") return void 0;
+      if (part.indexOf(".") !== -1) {
+        if (i2 !== parts.length - 1 || compression !== -1 && right.length === 0 || !isIPv4(part)) return void 0;
+        hextetCount += 2;
         continue;
       }
+      if (!isHextet(part)) return void 0;
+      parts[i2] = parseInt(part, 16).toString(16);
+      hextetCount++;
     }
-    if (buffer.length) {
-      if (consume === consumeIsZone) {
-        output.zone = buffer.join("");
-      } else if (endIpv6) {
-        address.push(buffer.join(""));
-      } else {
-        address.push(stringArrayToHexStripped(buffer));
-      }
+    if (compression === -1) {
+      if (hextetCount !== 8) return void 0;
+      return compressIPv6ZeroRun(parts);
     }
-    output.address = address.join("");
-    return output;
+    if (hextetCount >= 8) return void 0;
+    const expanded = parts.slice(0, left.length);
+    for (let i2 = hextetCount; i2 < 8; i2++) expanded.push("0");
+    for (let i2 = left.length; i2 < parts.length; i2++) expanded.push(parts[i2]);
+    return compressIPv6ZeroRun(expanded);
   }
   function normalizeIPv6(host) {
-    if (findToken(host, ":") < 2) {
-      return { host, isIPV6: false };
-    }
-    const ipv62 = getIPV6(host);
-    if (!ipv62.error) {
-      let newHost = ipv62.address;
-      let escapedHost = ipv62.address;
-      if (ipv62.zone) {
-        newHost += "%" + ipv62.zone;
-        escapedHost += "%25" + ipv62.zone;
-      }
-      return { host: newHost, isIPV6: true, escapedHost };
-    } else {
-      return { host, isIPV6: false };
-    }
+    const bracketed = host[0] === "[" && host[host.length - 1] === "]";
+    const hasBracket = host[0] === "[" || host[host.length - 1] === "]";
+    if (hasBracket && !bracketed) return { host, isIPV6: false, error: true };
+    let input = bracketed ? host.slice(1, -1) : host;
+    if (bracketed && isIPvFuture(input)) {
+      input = input.toLowerCase();
+      return { host: `[${input}]`, escapedHost: input, isIPV6: false, isIPVFuture: true };
+    }
+    if (findToken(input, ":") < 2) {
+      return { host, isIPV6: false, error: bracketed };
+    }
+    let zoneIdentifier = "";
+    const zoneSeparator = input.indexOf("%");
+    if (zoneSeparator !== -1) {
+      const separatorLength = input.slice(zoneSeparator, zoneSeparator + 3).toLowerCase() === "%25" ? 3 : 1;
+      zoneIdentifier = input.slice(zoneSeparator + separatorLength);
+      if (!isZoneIdentifier(zoneIdentifier)) return { host, isIPV6: false, error: true };
+      input = input.slice(0, zoneSeparator);
+    }
+    const address = normalizeIPv6Address(input);
+    if (address === void 0) return { host, isIPV6: false, error: true };
+    return {
+      host: address + (zoneIdentifier ? "%" + zoneIdentifier : ""),
+      escapedHost: address + (zoneIdentifier ? "%25" + zoneIdentifier : ""),
+      isIPV6: true
+    };
   }
   function findToken(str, token) {
     let ind = 0;
@@ -32970,7 +33002,8 @@ function requireUtils() {
   function normalizePathEncoding(input) {
     let output = "";
     for (let i2 = 0; i2 < input.length; i2++) {
-      if (input[i2] === "%" && i2 + 2 < input.length) {
+      const ch = input[i2];
+      if (ch === "%" && i2 + 2 < input.length) {
         const hex = input.slice(i2 + 1, i2 + 3);
         if (isHexPair(hex)) {
           const normalizedHex = hex.toUpperCase();
@@ -32984,10 +33017,152 @@ function requireUtils() {
           continue;
         }
       }
-      if (isPathCharacter(input[i2])) {
-        output += input[i2];
+      if (isPathCharacter(ch)) {
+        output += ch;
+      } else {
+        const code2 = input.charCodeAt(i2);
+        if (code2 < 128) {
+          output += isEscapeSafe(code2) ? ch : BYTE_HEX[code2];
+        } else if (code2 < 55296 || code2 > 57343) {
+          output += percentEncodeNonAscii(code2);
+        } else if (code2 <= 56319 && i2 + 1 < input.length) {
+          const low = input.charCodeAt(i2 + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
+            i2++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function serializePathEncoding(input, pathNoScheme = false) {
+    let output = "";
+    let firstSegment = pathNoScheme && input[0] !== "/";
+    for (let i2 = 0; i2 < input.length; i2++) {
+      const ch = input[i2];
+      if (ch === "%" && i2 + 2 < input.length) {
+        const hex = input.slice(i2 + 1, i2 + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i2 += 2;
+          continue;
+        }
+      }
+      if (ch === "/") {
+        firstSegment = false;
+      }
+      if (isPathCharacter(ch) && (ch !== ":" || !firstSegment)) {
+        output += ch;
+      } else {
+        const code2 = input.charCodeAt(i2);
+        if (code2 < 128) {
+          output += BYTE_HEX[code2];
+        } else if (code2 < 55296 || code2 > 57343) {
+          output += percentEncodeNonAscii(code2);
+        } else if (code2 <= 56319 && i2 + 1 < input.length) {
+          const low = input.charCodeAt(i2 + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
+            i2++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeComponent(input, isAllowed) {
+    let output = "";
+    for (let i2 = 0; i2 < input.length; i2++) {
+      const ch = input[i2];
+      if (ch === "%" && i2 + 2 < input.length) {
+        const hex = input.slice(i2 + 1, i2 + 3);
+        if (isHexPair(hex)) {
+          output += "%" + hex.toUpperCase();
+          i2 += 2;
+          continue;
+        }
+      }
+      if (isAllowed(ch)) {
+        output += ch;
+      } else {
+        const code2 = input.charCodeAt(i2);
+        if (code2 < 128) {
+          output += BYTE_HEX[code2];
+        } else if (code2 < 55296 || code2 > 57343) {
+          output += percentEncodeNonAscii(code2);
+        } else if (code2 <= 56319 && i2 + 1 < input.length) {
+          const low = input.charCodeAt(i2 + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
+            i2++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
+      }
+    }
+    return output;
+  }
+  function encodeUserinfo(input) {
+    return encodeComponent(input, isUserinfoCharacter);
+  }
+  function encodeQuery(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function encodeFragment(input) {
+    return encodeComponent(input, isQueryFragmentCharacter);
+  }
+  function isEscapeSafe(cp2) {
+    return cp2 >= 48 && cp2 <= 57 || cp2 >= 65 && cp2 <= 90 || cp2 >= 97 && cp2 <= 122 || cp2 === 42 || cp2 === 43 || cp2 === 45 || cp2 === 46 || cp2 === 47 || cp2 === 64 || cp2 === 95;
+  }
+  function normalizeQueryFragmentEncoding(input) {
+    let output = "";
+    for (let i2 = 0; i2 < input.length; i2++) {
+      const ch = input[i2];
+      if (ch === "%" && i2 + 2 < input.length) {
+        const hex = input.slice(i2 + 1, i2 + 3);
+        if (isHexPair(hex)) {
+          const normalizedHex = hex.toUpperCase();
+          const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+          if (isUnreserved(decoded)) {
+            output += decoded;
+          } else {
+            output += "%" + normalizedHex;
+          }
+          i2 += 2;
+          continue;
+        }
+      }
+      if (isQueryFragmentCharacter(ch)) {
+        output += ch;
       } else {
-        output += escape(input[i2]);
+        const code2 = input.charCodeAt(i2);
+        if (code2 < 128) {
+          output += isEscapeSafe(code2) ? ch : BYTE_HEX[code2];
+        } else if (code2 < 55296 || code2 > 57343) {
+          output += percentEncodeNonAscii(code2);
+        } else if (code2 <= 56319 && i2 + 1 < input.length) {
+          const low = input.charCodeAt(i2 + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code2 - 55296 << 10) + (low - 56320));
+            i2++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
     }
     return output;
@@ -33010,14 +33185,18 @@ function requireUtils() {
   function recomposeAuthority(component) {
     const uriTokens = [];
     if (component.userinfo !== void 0) {
-      uriTokens.push(component.userinfo);
+      uriTokens.push(encodeUserinfo(component.userinfo));
       uriTokens.push("@");
     }
     if (component.host !== void 0) {
-      let host = unescape(component.host);
+      let host = component.host;
       if (!isIPv4(host)) {
-        const ipV6res = normalizeIPv6(host);
-        if (ipV6res.isIPV6 === true) {
+        let ipV6res = normalizeIPv6(host);
+        if (ipV6res.isIPV6 !== true && ipV6res.isIPVFuture !== true) {
+          host = normalizePercentEncoding(host, true);
+          ipV6res = normalizeIPv6(host);
+        }
+        if (ipV6res.isIPV6 === true || ipV6res.isIPVFuture === true) {
           host = `[${ipV6res.escapedHost}]`;
         } else {
           host = reescapeHostDelimiters(host, false);
@@ -33037,6 +33216,11 @@ function requireUtils() {
     reescapeHostDelimiters,
     normalizePercentEncoding,
     normalizePathEncoding,
+    serializePathEncoding,
+    normalizeQueryFragmentEncoding,
+    encodeUserinfo,
+    encodeQuery,
+    encodeFragment,
     escapePreservingEscapes,
     removeDotSegments,
     isIPv4,
@@ -33052,7 +33236,7 @@ function requireSchemes() {
   if (hasRequiredSchemes) return schemes;
   hasRequiredSchemes = 1;
   const { isUUID } = requireUtils();
-  const URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
+  const URN_REG = /^([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-./:;=@]|%[\da-f]{2})+)$/iu;
   const supportedSchemeNames = (
     /** @type {const} */
     [
@@ -33113,9 +33297,10 @@ function requireSchemes() {
       wsComponent.secure = void 0;
     }
     if (wsComponent.resourceName) {
-      const [path, query] = wsComponent.resourceName.split("?");
+      const queryIndex = wsComponent.resourceName.indexOf("?");
+      const path = queryIndex === -1 ? wsComponent.resourceName : wsComponent.resourceName.slice(0, queryIndex);
       wsComponent.path = path && path !== "/" ? path : void 0;
-      wsComponent.query = query;
+      wsComponent.query = queryIndex === -1 ? void 0 : wsComponent.resourceName.slice(queryIndex + 1);
       wsComponent.resourceName = void 0;
     }
     wsComponent.fragment = void 0;
@@ -33127,7 +33312,7 @@ function requireSchemes() {
       return urnComponent;
     }
     const matches = urnComponent.path.match(URN_REG);
-    if (matches) {
+    if (matches && matches[0] === urnComponent.path) {
       const scheme = options2.scheme || urnComponent.scheme || "urn";
       urnComponent.nid = matches[1].toLowerCase();
       urnComponent.nss = matches[2];
@@ -33260,8 +33445,17 @@ var hasRequiredFastUri;
 function requireFastUri() {
   if (hasRequiredFastUri) return fastUri.exports;
   hasRequiredFastUri = 1;
-  const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = requireUtils();
+  const { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, serializePathEncoding, normalizeQueryFragmentEncoding, encodeQuery, encodeFragment, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = requireUtils();
   const { SCHEMES, getSchemeHandler } = requireSchemes();
+  const VALID_SCHEME = /^[A-Za-z][A-Za-z0-9+.-]*$/u;
+  const MALFORMED_SCHEME_ERROR = "URI scheme is malformed.";
+  function decodeValidScheme(scheme) {
+    const decodedScheme = unescape(String(scheme));
+    if (!VALID_SCHEME.test(decodedScheme)) {
+      throw new TypeError(MALFORMED_SCHEME_ERROR);
+    }
+    return decodedScheme;
+  }
   function normalize(uri2, options2) {
     if (typeof uri2 === "string") {
       uri2 = /** @type {T} */
@@ -33274,7 +33468,34 @@ function requireFastUri() {
   }
   function resolve2(baseURI, relativeURI, options2) {
     const schemelessOptions = options2 ? Object.assign({ scheme: "null" }, options2) : { scheme: "null" };
-    const resolved = resolveComponent(parse2(baseURI, schemelessOptions), parse2(relativeURI, schemelessOptions), schemelessOptions, true);
+    const {
+      parsed: baseParsed,
+      malformedAuthorityOrPort: baseMalformed,
+      malformedPercentEncoding: baseMalformedPercentEncoding,
+      malformedSchemeSpecific: baseMalformedSchemeSpecific,
+      malformedHost: baseMalformedHost,
+      malformedScheme: baseMalformedScheme
+    } = parseWithStatus(baseURI, schemelessOptions);
+    const {
+      parsed: relativeParsed,
+      malformedAuthorityOrPort: relativeMalformed,
+      malformedPercentEncoding: relativeMalformedPercentEncoding,
+      malformedSchemeSpecific: relativeMalformedSchemeSpecific,
+      malformedHost: relativeMalformedHost,
+      malformedScheme: relativeMalformedScheme
+    } = parseWithStatus(relativeURI, schemelessOptions);
+    if (baseMalformed || relativeMalformed || baseMalformedPercentEncoding || relativeMalformedPercentEncoding || baseMalformedSchemeSpecific || relativeMalformedSchemeSpecific || baseMalformedHost || relativeMalformedHost || baseMalformedScheme || relativeMalformedScheme) {
+      throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+    }
+    const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
+    const resolvedSchemeHandler = getSchemeHandler(options2 && options2.scheme || resolved.scheme);
+    const resolvedHost = resolved.host;
+    const resolvedHostIsIP = resolvedHost !== void 0 && resolvedHost !== "" && (isIPv4(resolvedHost) || normalizeIPv6(resolvedHost).isIPV6);
+    canonicalizeHost(resolved, options2 || {}, resolvedSchemeHandler, resolvedHostIsIP);
+    const encodedASCIIHost = resolvedHost && resolvedHost.indexOf("%") !== -1 && !new RegExp("\\P{ASCII}", "u").test(resolvedHost);
+    if (resolved.error && !encodedASCIIHost) {
+      throw new Error(resolved.error);
+    }
     schemelessOptions.skipEscape = true;
     return serialize(resolved, schemelessOptions);
   }
@@ -33334,7 +33555,7 @@ function requireFastUri() {
   function equal2(uriA, uriB, options2) {
     const normalizedA = normalizeComparableURI(uriA, options2);
     const normalizedB = normalizeComparableURI(uriB, options2);
-    return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA.toLowerCase() === normalizedB.toLowerCase();
+    return normalizedA !== void 0 && normalizedB !== void 0 && normalizedA === normalizedB;
   }
   function serialize(cmpts, opts) {
     const component = {
@@ -33355,19 +33576,22 @@ function requireFastUri() {
     };
     const options2 = Object.assign({}, opts);
     const uriTokens = [];
+    if (component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
+    }
     const schemeHandler = getSchemeHandler(options2.scheme || component.scheme);
     if (schemeHandler && schemeHandler.serialize) schemeHandler.serialize(component, options2);
+    const hasAuthority = component.userinfo !== void 0 || component.host !== void 0 || component.port !== void 0;
+    const pathNoScheme = !options2.skipEscape && component.scheme === void 0 && !hasAuthority;
     if (component.path !== void 0) {
       if (!options2.skipEscape) {
-        component.path = escapePreservingEscapes(component.path);
-        if (component.scheme !== void 0) {
-          component.path = component.path.split("%3A").join(":");
-        }
+        component.path = serializePathEncoding(component.path, pathNoScheme);
       } else {
         component.path = normalizePercentEncoding(component.path);
       }
     }
     if (options2.reference !== "suffix" && component.scheme) {
+      component.scheme = decodeValidScheme(component.scheme);
       uriTokens.push(component.scheme, ":");
     }
     const authority = recomposeAuthority(component);
@@ -33385,21 +33609,25 @@ function requireFastUri() {
       if (!options2.absolutePath && (!schemeHandler || !schemeHandler.absolutePath)) {
         s2 = removeDotSegments(s2);
       }
+      if (pathNoScheme) {
+        s2 = serializePathEncoding(s2, true);
+      }
       if (authority === void 0 && s2[0] === "/" && s2[1] === "/") {
         s2 = "/%2F" + s2.slice(2);
       }
       uriTokens.push(s2);
     }
     if (component.query !== void 0) {
-      uriTokens.push("?", component.query);
+      uriTokens.push("?", encodeQuery(component.query));
     }
     if (component.fragment !== void 0) {
-      uriTokens.push("#", component.fragment);
+      uriTokens.push("#", encodeFragment(component.fragment));
     }
     return uriTokens.join("");
   }
   const URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
   const AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+  const AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
   function getParseError(parsed, matches) {
     if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
       return 'URI path must start with "/" when authority is present.';
@@ -33409,6 +33637,32 @@ function requireFastUri() {
     }
     return void 0;
   }
+  function hasMalformedPercentEncoding(component) {
+    if (component === void 0) return false;
+    let percent = component.indexOf("%");
+    while (percent !== -1) {
+      if (percent + 2 >= component.length || !/^[\da-f]{2}$/iu.test(component.slice(percent + 1, percent + 3))) {
+        return true;
+      }
+      percent = component.indexOf("%", percent + 3);
+    }
+    return false;
+  }
+  function hasMalformedComponentPercentEncoding(matches) {
+    const host = matches[4];
+    return hasMalformedPercentEncoding(matches[3]) || host !== void 0 && !(host[0] === "[" && host[host.length - 1] === "]") && hasMalformedPercentEncoding(host) || hasMalformedPercentEncoding(matches[6]) || hasMalformedPercentEncoding(matches[7]) || hasMalformedPercentEncoding(matches[8]);
+  }
+  function canonicalizeHost(parsed, options2, schemeHandler, isIP) {
+    if (!options2.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport) && parsed.host && parsed.host[0] !== "[" && (options2.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
+      try {
+        parsed.host = new URL("http://" + parsed.host).hostname;
+      } catch (e2) {
+        parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e2;
+        return true;
+      }
+    }
+    return false;
+  }
   function parseWithStatus(uri2, opts) {
     const options2 = Object.assign({}, opts);
     const parsed = {
@@ -33421,6 +33675,11 @@ function requireFastUri() {
       fragment: void 0
     };
     let malformedAuthorityOrPort = false;
+    let malformedPercentEncoding = false;
+    let malformedSchemeSpecific = false;
+    let malformedHost = false;
+    let malformedIPLiteral = false;
+    let malformedScheme = false;
     let isIP = false;
     if (options2.reference === "suffix") {
       if (options2.scheme) {
@@ -33434,6 +33693,20 @@ function requireFastUri() {
       parsed.error = "URI authority must not contain a literal backslash.";
       malformedAuthorityOrPort = true;
     }
+    const introducerMatch = uri2.match(AUTHORITY_INTRODUCER_REGION);
+    if (introducerMatch !== null) {
+      const region = introducerMatch[1];
+      const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+      if (normalizedRegion.length >= 2) {
+        if (normalizedRegion.slice(0, 2) !== "//") {
+          parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+          malformedAuthorityOrPort = true;
+        } else if (region.length !== normalizedRegion.length) {
+          parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+          malformedAuthorityOrPort = true;
+        }
+      }
+    }
     const matches = uri2.match(URI_PARSE);
     if (matches) {
       parsed.scheme = matches[1];
@@ -33443,6 +33716,19 @@ function requireFastUri() {
       parsed.path = matches[6] || "";
       parsed.query = matches[7];
       parsed.fragment = matches[8];
+      if (parsed.scheme !== void 0) {
+        const decodedScheme = unescape(parsed.scheme);
+        if (VALID_SCHEME.test(decodedScheme)) {
+          parsed.scheme = decodedScheme.toLowerCase();
+        } else {
+          parsed.error = parsed.error || MALFORMED_SCHEME_ERROR;
+          malformedScheme = true;
+        }
+      }
+      malformedPercentEncoding = hasMalformedComponentPercentEncoding(matches);
+      if (malformedPercentEncoding) {
+        parsed.error = parsed.error || "URI contains malformed percent-encoding.";
+      }
       if (isNaN(parsed.port)) {
         parsed.port = matches[5];
       }
@@ -33454,9 +33740,15 @@ function requireFastUri() {
       if (parsed.host) {
         const ipv4result = isIPv4(parsed.host);
         if (ipv4result === false) {
+          const bracketedIPLiteral = parsed.host[0] === "[" && parsed.host[parsed.host.length - 1] === "]";
           const ipv6result = normalizeIPv6(parsed.host);
-          parsed.host = ipv6result.host.toLowerCase();
-          isIP = ipv6result.isIPV6;
+          isIP = ipv6result.isIPV6 || ipv6result.isIPVFuture === true;
+          malformedIPLiteral = bracketedIPLiteral && ipv6result.error === true;
+          parsed.host = isIP ? ipv6result.host : ipv6result.host.toLowerCase();
+          if (malformedIPLiteral) {
+            parsed.error = parsed.error || "URI host is malformed.";
+            malformedAuthorityOrPort = true;
+          }
         } else {
           isIP = true;
         }
@@ -33474,42 +33766,34 @@ function requireFastUri() {
         parsed.error = parsed.error || "URI is not a " + options2.reference + " reference.";
       }
       const schemeHandler = getSchemeHandler(options2.scheme || parsed.scheme);
-      if (!options2.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
-        if (parsed.host && (options2.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
-          try {
-            parsed.host = new URL("http://" + parsed.host).hostname;
-          } catch (e2) {
-            parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e2;
-          }
-        }
-      }
+      malformedHost = canonicalizeHost(parsed, options2, schemeHandler, isIP);
       if (!schemeHandler || schemeHandler && !schemeHandler.skipNormalize) {
         if (uri2.indexOf("%") !== -1) {
-          if (parsed.scheme !== void 0) {
-            parsed.scheme = unescape(parsed.scheme);
-          }
-          if (parsed.host !== void 0) {
-            parsed.host = reescapeHostDelimiters(unescape(parsed.host), isIP);
+          if (parsed.host !== void 0 && !malformedIPLiteral) {
+            const host = isIP ? parsed.host : normalizePercentEncoding(parsed.host, true);
+            parsed.host = reescapeHostDelimiters(host, isIP);
           }
         }
         if (parsed.path) {
           parsed.path = normalizePathEncoding(parsed.path);
         }
+        if (parsed.query) {
+          parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+        }
         if (parsed.fragment) {
-          try {
-            parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-          } catch {
-            parsed.error = parsed.error || "URI malformed";
-          }
+          parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
         }
       }
       if (schemeHandler && schemeHandler.parse) {
         schemeHandler.parse(parsed, options2);
+        if (schemeHandler === SCHEMES.urn && parsed.nid === void 0) {
+          malformedSchemeSpecific = true;
+        }
       }
     } else {
       parsed.error = parsed.error || "URI can not be parsed.";
     }
-    return { parsed, malformedAuthorityOrPort };
+    return { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme };
   }
   function parse2(uri2, opts) {
     return parseWithStatus(uri2, opts).parsed;
@@ -33518,20 +33802,28 @@ function requireFastUri() {
     return normalizeStringWithStatus(uri2, opts).normalized;
   }
   function normalizeStringWithStatus(uri2, opts) {
-    const { parsed, malformedAuthorityOrPort } = parseWithStatus(uri2, opts);
+    const { parsed, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = parseWithStatus(uri2, opts);
     return {
-      normalized: malformedAuthorityOrPort ? uri2 : serialize(parsed, opts),
-      malformedAuthorityOrPort
+      normalized: malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? uri2 : serialize(parsed, opts),
+      malformedAuthorityOrPort,
+      malformedPercentEncoding,
+      malformedSchemeSpecific,
+      malformedHost,
+      malformedScheme
     };
   }
   function normalizeComparableURI(uri2, opts) {
-    if (typeof uri2 === "string") {
-      const { normalized, malformedAuthorityOrPort } = normalizeStringWithStatus(uri2, opts);
-      return malformedAuthorityOrPort ? void 0 : normalized;
+    if (typeof uri2 !== "string" && typeof uri2 !== "object") {
+      return void 0;
     }
-    if (typeof uri2 === "object") {
-      return serialize(uri2, opts);
+    let value;
+    try {
+      value = typeof uri2 === "string" ? uri2 : serialize(uri2, opts);
+    } catch {
+      return void 0;
     }
+    const { normalized, malformedAuthorityOrPort, malformedPercentEncoding, malformedSchemeSpecific, malformedHost, malformedScheme } = normalizeStringWithStatus(value, opts);
+    return malformedAuthorityOrPort || malformedPercentEncoding || malformedSchemeSpecific || malformedHost || malformedScheme ? void 0 : normalized;
   }
   const fastUri$1 = {
     SCHEMES,
@@ -42799,7 +43091,7 @@ ${value2}`, dataLines++;
     }
     if (firstCharCode === 105 && chunk.charCodeAt(start + 1) === 100 && chunk.charCodeAt(start + 2) === 58) {
       const value2 = chunk.slice(chunk.charCodeAt(start + 3) === SPACE ? start + 4 : start + 3, end);
-      id2 = value2.includes("\0") ? void 0 : value2;
+      value2.includes("\0") || (id2 = value2);
       return;
     }
     if (firstCharCode === 58) {
@@ -42827,7 +43119,7 @@ ${value2}`, dataLines++;
 ${value}`, dataLines++;
         break;
       case "id":
-        id2 = value.includes("\0") ? void 0 : value;
+        value.includes("\0") || (id2 = value);
         break;
       case "retry":
         /^\d+$/.test(value) ? onRetry(parseInt(value, 10)) : onError(
@@ -56144,7 +56436,7 @@ const useTheme = () => {
     [theme, setThemeWithSideEffect]
   );
 };
-const version = "1.0.1";
+const version = "1.0.2";
 var __defProp$2 = Object.defineProperty;
 var __name$2 = (target, value) => __defProp$2(target, "name", { value, configurable: true });
 var [createTooltipContext, createTooltipScope] = /* @__PURE__ */ createContextScope("Tooltip", [
@@ -67002,13 +67294,13 @@ const App = () => {
   ) });
   if (window.location.pathname === "/oauth/callback") {
     const OAuthCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthCallback-DKaW5Tk8.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthCallback-at8T3Iwi.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthCallback, { onConnect: onOAuthConnect }) });
   }
   if (window.location.pathname === "/oauth/callback/debug") {
     const OAuthDebugCallback = React.lazy(
-      () => __vitePreload(() => import("./OAuthDebugCallback-Bx3X7Zkh.js"), true ? [] : void 0)
+      () => __vitePreload(() => import("./OAuthDebugCallback-ZJ9hxfpr.js"), true ? [] : void 0)
     );
     return /* @__PURE__ */ jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: /* @__PURE__ */ jsxRuntimeExports.jsx("div", { children: "Loading..." }), children: /* @__PURE__ */ jsxRuntimeExports.jsx(OAuthDebugCallback, { onConnect: onOAuthDebugConnect }) });
   }

package/client/dist/index.html

@@ -5,7 +5,7 @@
     <link rel="icon" type="image/svg+xml" href="/mcp.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>MCP Inspector</title>
-    <script type="module" crossorigin src="/assets/index-CH-qD91V.js"></script>
+    <script type="module" crossorigin src="/assets/index-DdyO6kfY.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-DXy0twoH.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modelcontextprotocol/inspector",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Model Context Protocol inspector",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Model Context Protocol a Series of LF Projects, LLC.",
@@ -42,19 +42,20 @@
     "start-client": "cd client && npm run preview",
     "test": "npm run prettier-check && cd client && npm test",
     "test-cli": "cd cli && npm run test",
+    "test-server": "cd server && npm run test",
     "test:e2e": "MCP_AUTO_OPEN_ENABLED=false npm run test:e2e --workspace=client",
     "prettier-fix": "prettier --write .",
     "prettier-check": "prettier --check .",
     "lint": "prettier --check . && cd client && npm run lint",
     "prepare": "husky && npm run build",
-    "publish-all": "npm publish --workspaces --access public && npm publish --access public",
+    "publish-all": "npm publish --workspaces --access public --tag v1-latest && npm publish --access public --tag v1-latest",
     "update-version": "node scripts/update-version.js",
     "check-version": "node scripts/check-version-consistency.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/inspector-cli": "^1.0.1",
-    "@modelcontextprotocol/inspector-client": "^1.0.1",
-    "@modelcontextprotocol/inspector-server": "^1.0.1",
+    "@modelcontextprotocol/inspector-cli": "^1.0.2",
+    "@modelcontextprotocol/inspector-client": "^1.0.2",
+    "@modelcontextprotocol/inspector-server": "^1.0.2",
     "@modelcontextprotocol/sdk": "^1.25.2",
     "concurrently": "^9.2.0",
     "node-fetch": "^3.3.2",
@@ -80,13 +81,20 @@
   "overrides": {
     "get-intrinsic": "1.3.0",
     "shell-quote": "^1.8.4",
-    "hono": "^4.12.25",
+    "hono": "^4.13.3",
     "form-data": "^4.0.6",
     "@babel/core@<=7.29.0": "^7.29.6",
     "esbuild@<0.28.1": "^0.28.1",
     "minimatch@<3.1.4": "3.1.5",
-    "js-yaml@<4": "3.15.0",
-    "js-yaml@>=4": "4.2.0"
+    "js-yaml@<4": "3.15.1",
+    "js-yaml@>=4": "4.3.1",
+    "@hono/node-server@<1.19.15": "^1.19.15",
+    "ip-address@<=10.3.0": "^10.5.0",
+    "fast-uri@<3.1.5": "^3.1.5",
+    "brace-expansion@<2": "^1.1.18",
+    "brace-expansion@>=4": "^5.0.9",
+    "nanoid@<3.3.18": "^3.3.18",
+    "postcss@<=8.5.22": "^8.5.26"
   },
   "engines": {
     "node": ">=22.7.5"
@@ -95,5 +103,9 @@
     "**/*.{js,ts,jsx,tsx,json,md}": [
       "prettier --write"
     ]
+  },
+  "allowScripts": {
+    "esbuild": false,
+    "fsevents": false
   }
 }

package/server/build/index.js

@@ -3,6 +3,7 @@ import cors from "cors";
 import { parseArgs } from "node:util";
 import { parse as shellParseArgs } from "shell-quote";
 import nodeFetch, { Headers as NodeHeaders } from "node-fetch";
+import { assertSafeProxyTarget, createPinnedAgent, ProxyTargetError, } from "./proxy-security.js";
 // Type-compatible wrappers for node-fetch to work with browser-style types
 const fetch = nodeFetch;
 const Headers = NodeHeaders;
@@ -16,8 +17,6 @@ import rateLimit from "express-rate-limit";
 import { findActualExecutable } from "spawn-rx";
 import mcpProxy from "./mcpProxy.js";
 import { randomUUID, randomBytes, timingSafeEqual } from "node:crypto";
-import { lookup as dnsLookup } from "node:dns/promises";
-import { isIP } from "node:net";
 import { fileURLToPath } from "url";
 import { dirname, join } from "path";
 import { readFileSync } from "fs";
@@ -675,83 +674,16 @@ app.get("/health", (req, res) => {
         status: "ok",
     });
 });
-// Raised when the /fetch proxy is asked to reach a disallowed target, so the
-// route can distinguish an SSRF rejection (403) from an upstream failure (500).
-class ProxyTargetError extends Error {
-}
 const MAX_PROXY_REDIRECTS = 5;
-// The /fetch proxy is used by the client to reach OAuth discovery/token
-// endpoints on the connected MCP server (bypassing browser CORS). Connecting
-// to loopback and RFC1918/private LAN hosts is a core use case (testing local
-// or self-hosted MCP servers), so those stay reachable. We only block
-// link-local addresses — 169.254.0.0/16 (the AWS/GCP/Azure/etc. cloud metadata
-// endpoint 169.254.169.254 lives here) and IPv6 link-local / the AWS IPv6 IMDS
-// address — which are never legitimate proxy targets and are the real SSRF
-// exfiltration vector.
-function isBlockedProxyAddress(ip) {
-    const kind = isIP(ip);
-    if (kind === 4) {
-        const parts = ip.split(".").map(Number);
-        // 169.254.0.0/16 — IPv4 link-local (incl. cloud metadata 169.254.169.254)
-        return parts[0] === 169 && parts[1] === 254;
-    }
-    if (kind === 6) {
-        const addr = ip.toLowerCase();
-        // IPv4-mapped IPv6 (::ffff:x). The WHATWG URL parser serializes the embedded
-        // IPv4 in hex (::ffff:a9fe:a9fe for 169.254.169.254), while DNS and other
-        // sources may use the dotted form (::ffff:169.254.169.254) — handle both by
-        // extracting the IPv4 and re-checking it.
-        const mapped = addr.match(/^::ffff:(.+)$/);
-        if (mapped) {
-            const tail = mapped[1];
-            if (isIP(tail) === 4) {
-                return isBlockedProxyAddress(tail);
-            }
-            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
-            if (hex) {
-                const high = parseInt(hex[1], 16);
-                const low = parseInt(hex[2], 16);
-                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
-            }
-        }
-        // fe80::/10 — IPv6 link-local
-        if (/^fe[89ab]/.test(addr)) {
-            return true;
-        }
-        // fd00:ec2::254 — AWS IPv6 instance metadata endpoint
-        return addr === "fd00:ec2::254";
-    }
-    return false;
-}
-// Resolves the target host and rejects it if any resolved address is a blocked
-// (link-local/metadata) address, mitigating SSRF including the DNS case where a
-// hostname resolves to the cloud metadata IP.
-async function assertSafeProxyTarget(parsedUrl) {
-    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
-    let addresses;
-    if (isIP(host)) {
-        addresses = [host];
-    }
-    else {
-        try {
-            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
-        }
-        catch {
-            throw new ProxyTargetError(`Could not resolve host: ${host}`);
-        }
-    }
-    if (addresses.length === 0) {
-        throw new ProxyTargetError(`Could not resolve host: ${host}`);
-    }
-    for (const address of addresses) {
-        if (isBlockedProxyAddress(address)) {
-            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
-        }
-    }
-}
 // Fetch that follows redirects manually so every hop's target is re-validated
 // against assertSafeProxyTarget — otherwise an allowed host could redirect the
 // proxy into a blocked internal/metadata address.
+//
+// On each hop we call assertSafeProxyTarget (which resolves DNS and validates
+// every returned IP) and then pass a createPinnedAgent to node-fetch so it
+// connects to the IP we just validated instead of re-resolving the hostname.
+// This eliminates the TOCTOU window between the block-list check and the
+// actual TCP connection that a DNS-rebinding attack would exploit.
 async function safeProxyFetch(initialUrl, init) {
     let currentUrl = new URL(initialUrl);
     let method = init?.method ?? "GET";
@@ -761,12 +693,18 @@ async function safeProxyFetch(initialUrl, init) {
         if (!["http:", "https:"].includes(currentUrl.protocol)) {
             throw new ProxyTargetError("Only http/https URLs are allowed");
         }
-        await assertSafeProxyTarget(currentUrl);
+        // Resolve DNS once, validate every address, and pin the connection to that
+        // validated set so node-fetch never does a second DNS lookup. All of them
+        // are passed through, so Node's address-family fallback still works while
+        // the reachable set stays limited to what was just validated.
+        const validatedAddresses = await assertSafeProxyTarget(currentUrl);
+        const agent = createPinnedAgent(currentUrl.protocol, validatedAddresses);
         const response = await fetch(currentUrl.toString(), {
             method,
             headers,
             body,
             redirect: "manual",
+            agent,
         });
         if (response.status >= 300 && response.status < 400) {
             const location = response.headers.get("location");

package/server/build/proxy-security.js

@@ -0,0 +1,154 @@
+/**
+ * SSRF-prevention helpers for the /fetch reverse proxy.
+ *
+ * Extracted from index.ts so they can be unit-tested independently.
+ *
+ * ## DNS-rebinding / TOCTOU threat model
+ *
+ * `assertSafeProxyTarget` resolves the target hostname and validates every
+ * returned IP against the block-list.  The resolved IPs are returned to the
+ * caller so they can be passed to `createPinnedAgent`, which builds an
+ * http/https.Agent whose `lookup` callback unconditionally returns the
+ * pre-validated IP.  The agent is then passed to `node-fetch`, which calls the
+ * lookup hook instead of doing its own DNS query.
+ *
+ * Without this pinning there is a TOCTOU race: an attacker who controls the
+ * target domain can flip its DNS record to 169.254.169.254 (AWS/GCP/Azure
+ * instance-metadata) in the window between `assertSafeProxyTarget` returning
+ * and `fetch` performing its own resolution.  Pinning eliminates that window.
+ */
+import http from "node:http";
+import https from "node:https";
+import { isIP } from "node:net";
+import { lookup as dnsLookup } from "node:dns/promises";
+// ---------------------------------------------------------------------------
+// Block-list
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `ip` is a link-local or cloud-metadata address that must
+ * never be reachable through the proxy.
+ *
+ * Blocked ranges:
+ *  - 169.254.0.0/16  (IPv4 link-local; includes 169.254.169.254 IMDS)
+ *  - ::ffff:169.254.x.x  (IPv4-mapped IPv6 variants of the above)
+ *  - fe80::/10  (IPv6 link-local)
+ *  - fd00:ec2::254  (AWS IPv6 instance-metadata)
+ */
+export function isBlockedProxyAddress(ip) {
+    const kind = isIP(ip);
+    if (kind === 4) {
+        const parts = ip.split(".").map(Number);
+        return parts[0] === 169 && parts[1] === 254;
+    }
+    if (kind === 6) {
+        const addr = ip.toLowerCase();
+        // IPv4-mapped IPv6 — two serialization forms:
+        //   dotted   ::ffff:169.254.169.254
+        //   hex      ::ffff:a9fe:a9fe
+        const mapped = addr.match(/^::ffff:(.+)$/);
+        if (mapped) {
+            const tail = mapped[1];
+            if (isIP(tail) === 4) {
+                return isBlockedProxyAddress(tail);
+            }
+            const hex = tail.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+            if (hex) {
+                const high = parseInt(hex[1], 16);
+                const low = parseInt(hex[2], 16);
+                return isBlockedProxyAddress(`${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`);
+            }
+        }
+        if (/^fe[89ab]/.test(addr))
+            return true; // fe80::/10
+        return addr === "fd00:ec2::254"; // AWS IPv6 IMDS
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// DNS validation
+// ---------------------------------------------------------------------------
+/** Raised when the /fetch proxy is asked to reach a disallowed target. */
+export class ProxyTargetError extends Error {
+}
+/**
+ * Resolves `parsedUrl`'s hostname and asserts that every returned IP is
+ * outside the block-list.
+ *
+ * Returns the list of validated IP strings so the caller can pin one of them
+ * into an HTTP agent (see `createPinnedAgent`), eliminating the TOCTOU window
+ * between this check and the actual `fetch()` call.
+ *
+ * @throws {ProxyTargetError} if the host cannot be resolved or any resolved
+ *   address falls inside the block-list.
+ */
+export async function assertSafeProxyTarget(parsedUrl) {
+    const host = parsedUrl.hostname.replace(/^\[|\]$/g, ""); // strip IPv6 brackets
+    let addresses;
+    if (isIP(host)) {
+        addresses = [host];
+    }
+    else {
+        try {
+            addresses = (await dnsLookup(host, { all: true })).map((r) => r.address);
+        }
+        catch {
+            throw new ProxyTargetError(`Could not resolve host: ${host}`);
+        }
+    }
+    if (addresses.length === 0) {
+        throw new ProxyTargetError(`Could not resolve host: ${host}`);
+    }
+    for (const address of addresses) {
+        if (isBlockedProxyAddress(address)) {
+            throw new ProxyTargetError(`Refusing to proxy request to blocked address (${address})`);
+        }
+    }
+    return addresses;
+}
+// ---------------------------------------------------------------------------
+// IP-pinned agent factory
+// ---------------------------------------------------------------------------
+/**
+ * Creates an `http.Agent` or `https.Agent` whose internal `lookup` hook always
+ * returns `pinnedIps`, bypassing the OS resolver entirely.
+ *
+ * Pass this agent to `node-fetch` on every hop of `safeProxyFetch` so the TCP
+ * connection always goes to an IP that was validated by `assertSafeProxyTarget`
+ * — even if the domain's DNS record changes mid-flight.
+ *
+ * Every address `assertSafeProxyTarget` returned is handed to the hook, not
+ * just the first, so Node keeps its normal address-family fallback: a
+ * dual-stack host whose first address is unreachable (IPv6 on an IPv4-only
+ * network, say) still connects via a later one. The set it may choose from is
+ * exactly the prevalidated set, so the TOCTOU guarantee is unchanged.
+ *
+ * @param protocol - `"http:"` or `"https:"` (from `URL.protocol`)
+ * @param pinnedIps - Validated IPv4/IPv6 address strings, in preference order
+ */
+export function createPinnedAgent(protocol, pinnedIps) {
+    if (pinnedIps.length === 0) {
+        throw new ProxyTargetError("No validated address to connect to");
+    }
+    const resolved = pinnedIps.map((address) => ({
+        address,
+        family: isIP(address) === 6 ? 6 : 4,
+    }));
+    // Node.js lookup signature: (hostname, options, callback).
+    //
+    // The callback shape depends on `options.all`. Node's `net.connect` runs with
+    // `autoSelectFamily` enabled by default (Node >= 20), so it calls the hook
+    // with `{ all: true }` and expects an ARRAY of `{ address, family }` — handing
+    // it the scalar form there fails the connection with ERR_INVALID_IP_ADDRESS.
+    // Both shapes are supported so the agent works on either call path.
+    const lookup = (_hostname, opts, callback) => {
+        if (opts?.all) {
+            callback(null, resolved);
+            return;
+        }
+        callback(null, resolved[0].address, resolved[0].family);
+    };
+    if (protocol === "https:") {
+        return new https.Agent({ lookup });
+    }
+    return new http.Agent({ lookup });
+}