@modootoday/pmcp 0.8.1 → 0.8.3

package/README.md

@@ -191,12 +191,13 @@ export default { fetch: (request: Request) => skills.fetch(request) };
 
 The handler checks requests before they reach MCP:
 
-| Option            | Default | Effect                                                                                                                                                                                                         |
-| ----------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `allowedOrigins`  | none    | A request with an `Origin` other than the server's own gets 403. Listed origins are served with CORS headers, and their preflight is answered. Requests without `Origin` are not from a browser page and pass. |
-| `allowedHosts`    | any     | When set, a `Host` outside the list gets 403 (DNS rebinding).                                                                                                                                                  |
-| `maxRequestBytes` | 1 MiB   | A larger body gets 413; a declared length is refused before reading.                                                                                                                                           |
-| `rateLimit`       | off     | `{ perMinute }` per caller id; past it, 429 with `retry-after`.                                                                                                                                                |
+| Option            | Default | Effect                                                                                                                                                                                                                                  |
+| ----------------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `allowedOrigins`  | none    | A request with an `Origin` other than the server's own gets 403. Listed origins are served with CORS headers, and their preflight is answered. `"*"` admits any origin. Requests without `Origin` are not from a browser page and pass. |
+| `publicOrigins`   | none    | The server's own origins as browsers see them, when a proxy ends TLS and the request URL is `http://`. Without it, a same-site page behind such a proxy gets 403.                                                                       |
+| `allowedHosts`    | any     | When set, a `Host` outside the list gets 403 (DNS rebinding).                                                                                                                                                                           |
+| `maxRequestBytes` | 1 MiB   | A larger body gets 413; a declared length is refused before reading.                                                                                                                                                                    |
+| `rateLimit`       | off     | `{ perMinute }` per caller id; past it, 429 with `retry-after`.                                                                                                                                                                         |
 
 An MCP config (`.mcp.json`) is never served as written: every `env` and `headers` value is
 replaced with `<redacted>`, whichever entry reaches the file, and listed digests describe

package/dist/{chunk-K7BX33LH.js → chunk-2VWT5IW3.js}

@@ -1,6 +1,6 @@
 import {
   createSkillServer
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 
 // src/stdio.ts
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
@@ -38,4 +38,4 @@ export {
   serve,
   main
 };
-//# sourceMappingURL=chunk-K7BX33LH.js.map
+//# sourceMappingURL=chunk-2VWT5IW3.js.map

package/dist/{chunk-HB4VJ5VW.js → chunk-LCB3ZIPN.js}

@@ -1590,7 +1590,7 @@ function registerReadTool(server, tools) {
 
 // src/mcp.ts
 var SERVER_NAME = "pmcp";
-var SERVER_VERSION = "0.8.1";
+var SERVER_VERSION = "0.8.3";
 function registerSkillTools(server, tools) {
   registerCatalogTool(server, tools);
   registerFindTool(server, tools);
@@ -1661,4 +1661,4 @@ export {
   registerSkillTools,
   createSkillServer
 };
-//# sourceMappingURL=chunk-HB4VJ5VW.js.map
+//# sourceMappingURL=chunk-LCB3ZIPN.js.map

package/dist/{chunk-MO3LLVVY.js → chunk-MP3KQDP3.js}

@@ -1,6 +1,6 @@
 import {
   normaliseIntent
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 
 // src/cache.ts
 async function openDatabase(path) {
@@ -131,4 +131,4 @@ export {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
 };
-//# sourceMappingURL=chunk-MO3LLVVY.js.map
+//# sourceMappingURL=chunk-MP3KQDP3.js.map

package/dist/{chunk-DTQAN33I.js → chunk-OWRJWWMP.js}

@@ -2,7 +2,7 @@ import {
   frontmatterObject,
   readCatalog,
   specProblems
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
@@ -1139,4 +1139,4 @@ export {
   validateSkillDir,
   validateCatalog
 };
-//# sourceMappingURL=chunk-DTQAN33I.js.map
+//# sourceMappingURL=chunk-OWRJWWMP.js.map

package/dist/{chunk-STBBSQ3R.js → chunk-WXDC24UC.js}

@@ -1,6 +1,6 @@
 import {
   openDatabase
-} from "./chunk-MO3LLVVY.js";
+} from "./chunk-MP3KQDP3.js";
 
 // src/embed.ts
 var DEFAULT_MODEL_ID = "Xenova/multilingual-e5-small";
@@ -157,4 +157,4 @@ export {
   encodeEntries,
   openEntryVectors
 };
-//# sourceMappingURL=chunk-STBBSQ3R.js.map
+//# sourceMappingURL=chunk-WXDC24UC.js.map

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   loadEmbedder,
   openEntryVectors
-} from "./chunk-STBBSQ3R.js";
+} from "./chunk-WXDC24UC.js";
 import {
   ConfigError,
   ProjectError,
@@ -17,15 +17,15 @@ import {
   splitFrontmatter,
   validateCatalog,
   validateSkillDir
-} from "./chunk-DTQAN33I.js";
-import "./chunk-MO3LLVVY.js";
+} from "./chunk-OWRJWWMP.js";
+import "./chunk-MP3KQDP3.js";
 import {
   serve
-} from "./chunk-K7BX33LH.js";
+} from "./chunk-2VWT5IW3.js";
 import {
   kindOf,
   readCatalog
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 
 // src/cli/command.ts
 var ArgumentError = class extends Error {
@@ -2347,7 +2347,7 @@ function dispatch(argv, options = {}) {
   }
   return run(command, rest, { ui, env, cwd });
 }
-var VERSION = "0.8.1";
+var VERSION = "0.8.3";
 async function run(command, argv, context) {
   try {
     return await command.run({

package/dist/http.d.ts

@@ -74,6 +74,7 @@ interface SkillCaller {
     readonly claims?: Readonly<Record<string, unknown>>;
 }
 interface SkillHttpOptions extends SkillServerOptions {
+    /** Gets the Request the host's fetch received; read headers only, the body is still unread. */
     readonly authorize: (request: Request) => SkillCaller | undefined | Promise<SkillCaller | undefined>;
     /** Tiers a caller may list and load. Package skills without a tier count as open. */
     readonly tiersFor?: (caller: SkillCaller) => readonly string[];
@@ -88,8 +89,10 @@ interface SkillHttpOptions extends SkillServerOptions {
      * here, so "private" unless the host knows every caller sees the same list.
      */
     readonly cacheScope?: "public" | "private";
-    /** Browser origins, besides the server's own, whose pages may call; others get 403. */
+    /** Browser origins, besides the server's own, whose pages may call; others get 403. "*" admits any. */
     readonly allowedOrigins?: readonly string[];
+    /** The server's own public origins when a proxy ends TLS, e.g. "https://skills.example.com". */
+    readonly publicOrigins?: readonly string[];
     /** Host header values the server answers to; unset means any. */
     readonly allowedHosts?: readonly string[];
     /** Largest request body accepted; larger ones get 413. */

package/dist/http.js

@@ -2,12 +2,12 @@ import {
   DEFAULT_MODEL_ID,
   encodeEntries,
   loadEmbedder
-} from "./chunk-STBBSQ3R.js";
-import "./chunk-MO3LLVVY.js";
+} from "./chunk-WXDC24UC.js";
+import "./chunk-MP3KQDP3.js";
 import {
   createSkillServer,
   readCatalog
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 
 // src/http.ts
 import {
@@ -22,11 +22,15 @@ var json = (status, body, headers = {}) => new Response(JSON.stringify(body), {
   status,
   headers: { "content-type": "application/json", ...headers }
 });
-function checkOrigin(request, allowedOrigins = []) {
+function checkOrigin(request, allowedOrigins = [], publicOrigins = []) {
   const origin = request.headers.get("origin");
   if (origin === null) return { kind: "none" };
-  if (origin === new URL(request.url).origin) return { kind: "same" };
-  if (allowedOrigins.includes(origin)) return { kind: "allowed", origin };
+  if (origin === new URL(request.url).origin || publicOrigins.includes(origin)) {
+    return { kind: "same" };
+  }
+  if (allowedOrigins.includes(origin) || allowedOrigins.includes("*")) {
+    return { kind: "allowed", origin };
+  }
   return {
     kind: "refused",
     response: json(403, { error: "origin_not_allowed" })
@@ -162,12 +166,7 @@ function createSkillHttpHandler(options) {
   };
   const limit = options.rateLimit ? createRateLimiter(options.rateLimit) : void 0;
   const serve = async (request) => {
-    const capped = await capBody(
-      request,
-      options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES
-    );
-    if (capped instanceof Response) return capped;
-    const caller = await options.authorize(capped);
+    const caller = await options.authorize(request);
     if (!caller) {
       return new Response(JSON.stringify({ error: "unauthorized" }), {
         status: 401,
@@ -179,6 +178,11 @@ function createSkillHttpHandler(options) {
     }
     const limited = limit?.(caller.id);
     if (limited) return limited;
+    const capped = await capBody(
+      request,
+      options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES
+    );
+    if (capped instanceof Response) return capped;
     return handlerFor(tiersFor(caller)).fetch(capped, {
       authInfo: {
         token: "",
@@ -192,7 +196,11 @@ function createSkillHttpHandler(options) {
     async fetch(request) {
       const wrongHost = checkHost(request, options.allowedHosts);
       if (wrongHost) return wrongHost;
-      const origin = checkOrigin(request, options.allowedOrigins);
+      const origin = checkOrigin(
+        request,
+        options.allowedOrigins,
+        options.publicOrigins
+      );
       if (origin.kind === "refused") return origin.response;
       if (origin.kind !== "allowed") return serve(request);
       if (request.method === "OPTIONS") return preflight(origin.origin);

package/dist/index.d.ts

@@ -304,7 +304,7 @@ declare function resolveSkillFileUri(uri: string, entries: readonly SkillEntry[]
 
 /** Reported to the host on connect. */
 declare const SERVER_NAME = "pmcp";
-declare const SERVER_VERSION = "0.8.1";
+declare const SERVER_VERSION = "0.8.3";
 /**
  * Registers the skill_* tools on a server.
  *

package/dist/index.js

@@ -14,11 +14,11 @@ import {
   readSpec,
   validateCatalog,
   validateSkillDir
-} from "./chunk-DTQAN33I.js";
+} from "./chunk-OWRJWWMP.js";
 import {
   DEFAULT_INTENT_CACHE_LIMIT,
   openIntentCache
-} from "./chunk-MO3LLVVY.js";
+} from "./chunk-MP3KQDP3.js";
 import {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,
@@ -70,7 +70,7 @@ import {
   skillFileUri,
   specProblems,
   withoutBody
-} from "./chunk-HB4VJ5VW.js";
+} from "./chunk-LCB3ZIPN.js";
 export {
   ASSET_KINDS,
   CATALOG_PAGE_MAX,

package/dist/stdio.js

@@ -3,8 +3,8 @@ import {
   main,
   resolveRoots,
   serve
-} from "./chunk-K7BX33LH.js";
-import "./chunk-HB4VJ5VW.js";
+} from "./chunk-2VWT5IW3.js";
+import "./chunk-LCB3ZIPN.js";
 export {
   main,
   resolveRoots,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@modootoday/pmcp",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "license": "Elastic-2.0",
   "author": "modootoday",
   "description": "An MCP server that finds the skills your installed packages already ship. Reads SKILL.md out of node_modules by shape rather than by path, so it sees the skills, .agent, .claude, .gemini and .codex conventions alike, and keeps session startup flat as the number of installed skills grows.",