@modelcontextprotocol/server-pdf 1.2.2 → 1.3.1

package/dist/server.d.ts

@@ -10,6 +10,15 @@
  * - read_pdf_bytes: Stream PDF data in chunks (used by viewer)
  */
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/**
+ * PDF Standard-14 fonts from CDN. Used by both server and viewer so we
+ * declare a single well-known origin in CSP connectDomains.
+ *
+ * pdf.js in Node defaults to NodeStandardFontDataFactory (fs.readFile) which
+ * can't fetch URLs, so we pass {@link FetchStandardFontDataFactory} alongside.
+ * The browser viewer uses the DOM factory by default and just needs the URL.
+ */
+export declare const STANDARD_FONT_DATA_URL: string;
 export declare const DEFAULT_PDF = "https://arxiv.org/pdf/1706.03762";
 export declare const MAX_CHUNK_BYTES: number;
 export declare const RESOURCE_URI = "ui://pdf-viewer/mcp-app.html";
@@ -19,10 +28,54 @@ export declare const CACHE_INACTIVITY_TIMEOUT_MS = 10000;
 export declare const CACHE_MAX_LIFETIME_MS = 60000;
 /** Max size for cached PDFs (defensive limit to prevent memory exhaustion) */
 export declare const CACHE_MAX_PDF_SIZE_BYTES: number;
-/** Allowed local file paths (populated from CLI args) */
+/** Allowed local file paths (CLI args + file roots — read access). */
 export declare const allowedLocalFiles: Set<string>;
-/** Allowed local directories (populated from MCP roots) */
+/** Allowed local directories (CLI args + directory roots — read access). */
 export declare const allowedLocalDirs: Set<string>;
+/**
+ * Subset of allowedLocalFiles that came from CLI args (not MCP roots).
+ * Only these individual files are writable. File roots from the client
+ * are uploaded copies in ad-hoc hidden folders — treat as read-only.
+ * Directory roots are mounted folders; files UNDER them are writable.
+ */
+export declare const cliLocalFiles: Set<string>;
+/**
+ * Write-permission flags. Object wrapper (not a bare `let`) so main.ts can
+ * mutate via the exported binding without re-import gymnastics — same
+ * pattern as the Sets above.
+ */
+export declare const writeFlags: {
+    /**
+     * Claude Desktop mounts its per-conversation drop folder as a directory
+     * root whose basename is literally `uploads`. Files in there are one-shot
+     * copies the client doesn't expect us to overwrite. Default: read-only.
+     * `--writeable-uploads-root` flips this for local testing.
+     */
+    allowUploadsRoot: boolean;
+};
+/**
+ * Saving is allowed iff:
+ *   (a) the file was passed as a CLI arg — the user explicitly named it
+ *       when starting the server, so overwriting is clearly intentional; OR
+ *   (b) the file is STRICTLY UNDER a directory root at any depth
+ *       (isAncestorDir excludes rel === "", so the root itself never
+ *       counts), AND the client did not ALSO send it as a file root.
+ *       A file root is the client's way of saying "here's an upload" —
+ *       treat that signal as authoritative even when the path happens
+ *       to fall inside a mounted directory.
+ *
+ *   EXCEPTION to (b): a dir root whose basename is `uploads` is treated
+ *   as read-only unless `writeFlags.allowUploadsRoot` is set. This is how
+ *   Claude Desktop surfaces attached files — writing back to them
+ *   surprises the user (the attachment doesn't update).
+ *
+ * With no directory roots and no CLI files, nothing is writable.
+ */
+export declare function isWritablePath(resolved: string): boolean;
+import type { PdfCommand } from "./src/commands.js";
+export type { PdfCommand };
+export declare function startFileWatch(viewUUID: string, filePath: string): void;
+export declare function stopFileWatch(viewUUID: string): void;
 export declare function isFileUrl(url: string): boolean;
 export declare function isArxivUrl(url: string): boolean;
 export declare function normalizeArxivUrl(url: string): string;
@@ -64,6 +117,13 @@ export interface PdfCache {
  */
 export declare function createPdfCache(): PdfCache;
 export interface CreateServerOptions {
+    /**
+     * Enable the `interact` tool and related command-queue infrastructure
+     * (in-memory command queue, `poll_pdf_commands`, `submit_page_data`).
+     * Only suitable for single-instance deployments (e.g. stdio transport).
+     * Defaults to false — server exposes only `list_pdfs` and `display_pdf` (read-only).
+     */
+    enableInteract?: boolean;
     /**
      * Whether to honour MCP roots sent by the client.
      *
@@ -83,5 +143,10 @@ export interface CreateServerOptions {
      * @default false
      */
     useClientRoots?: boolean;
+    /**
+     * Emit debug metadata to the viewer (currently: allowed roots shown
+     * in a floating bubble). Toggled by the `--debug` CLI flag.
+     */
+    debug?: boolean;
 }
 export declare function createServer(options?: CreateServerOptions): McpServer;