@nextblock-cms/cortex 0.20.3 → 0.21.0

package/lib/fetch-host-guard.es.js

@@ -0,0 +1,30 @@
+//#region libs/cortex/src/lib/fetch-host-guard.ts
+function e(e) {
+	let t = e.match(/^::ffff:(.+)$/i);
+	if (!t) return null;
+	let n = t[1];
+	if (/^\d{1,3}(\.\d{1,3}){3}$/.test(n)) return n;
+	let r = n.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+	if (!r) return null;
+	let i = Number.parseInt(r[1], 16), a = Number.parseInt(r[2], 16);
+	return [
+		i >> 8 & 255,
+		i & 255,
+		a >> 8 & 255,
+		a & 255
+	].join(".");
+}
+function t(n) {
+	let r = n.trim().toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
+	if (!r || r === "localhost" || r.endsWith(".localhost") || r.endsWith(".local") || r.endsWith(".internal") || r === "metadata.google.internal" || r === "0.0.0.0" || r === "::" || r === "::1" || r.startsWith("fe80:") || r.startsWith("fc") || r.startsWith("fd")) return !0;
+	let i = e(r);
+	if (i) return t(i);
+	let a = r.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (a) {
+		let e = Number(a[1]), t = Number(a[2]);
+		if (e === 10 || e === 127 || e === 0 || e === 192 && t === 168 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31) return !0;
+	}
+	return !1;
+}
+//#endregion
+export { t as isBlockedFetchHost };

package/lib/mcp-server.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const l=require("./mcp-tool-registry.cjs.js"),C="nextblock-cortex-ai",E="NextBlock Cortex AI",M="2025-06-18",f="2025-11-25",R="2026-07-28",T=[R,f,"2025-06-18","2025-03-26","2024-11-05"],x=-32700,p=-32600,S=-32601,_=-32602,O=-32603;function u(t,o){return{body:{id:t,jsonrpc:"2.0",result:o},status:200}}function a(t,o,i,e=200,c){return{body:{error:{code:o,message:i},id:t,jsonrpc:"2.0"},status:e}}const s={body:null,status:202};function N(t){return typeof t.method=="string"&&t.id===void 0}function b(t,o){const i=t.params?._meta;if(i&&typeof i=="object"){const e=i["io.modelcontextprotocol/protocolVersion"];if(typeof e=="string"&&e>=R)return!0}return!!(o&&o>=R)}function g(t){return typeof t!="string"||!t?M:T.includes(t)?t:f}function A(t,o){const i=t.scopes.includes("write");return{capabilities:{prompts:{},resources:{},tools:{}},instructions:t.instructions??["NextBlock Cortex AI exposes this CMS through typed tools.","Call get_database_schema first when you are unsure what exists.","Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.",i?"Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly.":"This connection is READ-ONLY. Mutating tools are not available on this token."].join(" "),protocolVersion:g(o),serverInfo:{name:C,title:E,version:t.serverVersion,websiteUrl:"https://nextblock.dev"}}}function v(t){return{authentication:{header:"Authorization",instructions:"POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",required:!0,schemes:["bearer"]},capabilities:{prompts:{},resources:{},tools:{}},endpoint:{transport:"streamable-http",url:t.endpointUrl},name:C,protocolVersions:T,serverCard:t.serverCardUrl,status:"ok",title:E,version:t.serverVersion,websiteUrl:"https://nextblock.dev"}}function y(t){return!!(t&&t.toLowerCase().includes("text/event-stream"))}async function I(t,o){if(t===null||typeof t!="object"||Array.isArray(t))return a(null,p,"Expected a single JSON-RPC message.",400);if(typeof t.method!="string")return"result"in t||"error"in t?s:a(t.id??null,p,'Missing "method".',400);const{method:i}=t,e=t.id??null,c=N(t);if(i.startsWith("notifications/"))return s;switch(i){case"initialize":return c?s:u(e,A(o,t.params?.protocolVersion));case"ping":return c?s:u(e,{});case"tools/list":return c?s:u(e,{tools:l.buildCortexMcpToolDefinitions({context:o.context,scopes:o.scopes})});case"tools/call":{if(c)return s;const n=t.params?.name;if(typeof n!="string"||!n)return a(e,_,"tools/call requires params.name.");try{const r=await l.callCortexMcpTool({args:t.params?.arguments,context:o.context,name:n,scopes:o.scopes});return u(e,r)}catch(r){return r instanceof l.CortexMcpUnknownToolError||r instanceof l.CortexMcpForbiddenToolError?a(e,_,r.message):a(e,O,r instanceof Error?r.message:"Tool execution failed.")}}case"resources/list":return c?s:u(e,{resources:l.CORTEX_MCP_RESOURCES});case"resources/templates/list":return c?s:u(e,{resourceTemplates:[]});case"resources/read":{if(c)return s;const n=t.params?.uri;if(typeof n!="string"||!n)return a(e,_,"resources/read requires params.uri.");try{const r=await l.readCortexMcpResource({context:o.context,uri:n});return r?u(e,{contents:[r]}):a(e,_,`Unknown resource: ${n}`)}catch(r){return a(e,O,r instanceof Error?r.message:"Resource read failed.")}}case"prompts/list":return c?s:u(e,{prompts:l.CORTEX_MCP_PROMPTS});case"prompts/get":{if(c)return s;const n=t.params?.name;if(typeof n!="string"||!n)return a(e,_,"prompts/get requires params.name.");const r=t.params?.arguments,P={};if(r&&typeof r=="object")for(const[m,d]of Object.entries(r))typeof d=="string"&&(P[m]=d);const h=l.getCortexMcpPrompt({args:P,name:n});return h?u(e,h):a(e,_,`Unknown prompt: ${n}`)}default:return c?s:a(e,S,`Method not found: ${i}`)}}exports.CORTEX_MCP_DEFAULT_PROTOCOL_VERSION=M;exports.CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION=f;exports.CORTEX_MCP_MODERN_PROTOCOL_VERSION=R;exports.CORTEX_MCP_SERVER_NAME=C;exports.CORTEX_MCP_SERVER_TITLE=E;exports.CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS=T;exports.JSON_RPC_INTERNAL_ERROR=O;exports.JSON_RPC_INVALID_PARAMS=_;exports.JSON_RPC_INVALID_REQUEST=p;exports.JSON_RPC_METHOD_NOT_FOUND=S;exports.JSON_RPC_PARSE_ERROR=x;exports.buildCortexMcpDiscoveryDocument=v;exports.handleCortexMcpMessage=I;exports.isJsonRpcNotification=N;exports.isModernEraMessage=b;exports.wantsMcpEventStream=y;
+const e=require("./mcp-tool-registry.cjs.js");var t=`nextblock-cortex-ai`,n=`NextBlock Cortex AI`,r=`2025-06-18`,i=`2025-11-25`,a=`2026-07-28`,o=[a,i,`2025-06-18`,`2025-03-26`,`2024-11-05`],s=-32700,c=-32600,l=-32601,u=-32602,d=-32603;function f(e,t){return{body:{id:e,jsonrpc:`2.0`,result:t},status:200}}function p(e,t,n,r=200,i){return{body:{error:{code:t,message:n,...i===void 0?{}:{data:i}},id:e,jsonrpc:`2.0`},status:r}}var m={body:null,status:202};function h(e){return typeof e.method==`string`&&e.id===void 0}function g(e,t){let n=e.params?._meta;if(n&&typeof n==`object`){let e=n[`io.modelcontextprotocol/protocolVersion`];if(typeof e==`string`&&e>=`2026-07-28`)return!0}return!!(t&&t>=`2026-07-28`)}function _(e){return typeof e!=`string`||!e?r:o.includes(e)?e:i}function v(e,r){let i=e.scopes.includes(`write`);return{capabilities:{prompts:{},resources:{},tools:{}},instructions:e.instructions??[`NextBlock Cortex AI exposes this CMS through typed tools.`,`Call get_database_schema first when you are unsure what exists.`,`Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.`,i?`Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly.`:`This connection is READ-ONLY. Mutating tools are not available on this token.`].join(` `),protocolVersion:_(r),serverInfo:{name:t,title:n,version:e.serverVersion,websiteUrl:`https://nextblock.dev`}}}function y(e){return{authentication:{header:`Authorization`,instructions:"POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",required:!0,schemes:[`bearer`]},capabilities:{prompts:{},resources:{},tools:{}},endpoint:{transport:`streamable-http`,url:e.endpointUrl},name:t,protocolVersions:o,serverCard:e.serverCardUrl,status:`ok`,title:n,version:e.serverVersion,websiteUrl:`https://nextblock.dev`}}function b(e){return!!(e&&e.toLowerCase().includes(`text/event-stream`))}async function x(t,n){if(typeof t!=`object`||!t||Array.isArray(t))return p(null,c,`Expected a single JSON-RPC message.`,400);if(typeof t.method!=`string`)return`result`in t||`error`in t?m:p(t.id??null,c,`Missing "method".`,400);let{method:r}=t,i=t.id??null,a=h(t);if(r.startsWith(`notifications/`))return m;switch(r){case`initialize`:return a?m:f(i,v(n,t.params?.protocolVersion));case`ping`:return a?m:f(i,{});case`tools/list`:return a?m:f(i,{tools:e.buildCortexMcpToolDefinitions({context:n.context,scopes:n.scopes})});case`tools/call`:{if(a)return m;let r=t.params?.name;if(typeof r!=`string`||!r)return p(i,u,`tools/call requires params.name.`);try{return f(i,await e.callCortexMcpTool({args:t.params?.arguments,context:n.context,name:r,scopes:n.scopes}))}catch(t){return t instanceof e.CortexMcpUnknownToolError||t instanceof e.CortexMcpForbiddenToolError?p(i,u,t.message):p(i,d,t instanceof Error?t.message:`Tool execution failed.`)}}case`resources/list`:return a?m:f(i,{resources:e.CORTEX_MCP_RESOURCES});case`resources/templates/list`:return a?m:f(i,{resourceTemplates:[]});case`resources/read`:{if(a)return m;let r=t.params?.uri;if(typeof r!=`string`||!r)return p(i,u,`resources/read requires params.uri.`);try{let t=await e.readCortexMcpResource({context:n.context,uri:r});return t?f(i,{contents:[t]}):p(i,u,`Unknown resource: ${r}`)}catch(e){return p(i,d,e instanceof Error?e.message:`Resource read failed.`)}}case`prompts/list`:return a?m:f(i,{prompts:e.CORTEX_MCP_PROMPTS});case`prompts/get`:{if(a)return m;let n=t.params?.name;if(typeof n!=`string`||!n)return p(i,u,`prompts/get requires params.name.`);let r=t.params?.arguments,o={};if(r&&typeof r==`object`)for(let[e,t]of Object.entries(r))typeof t==`string`&&(o[e]=t);let s=e.getCortexMcpPrompt({args:o,name:n});return s?f(i,s):p(i,u,`Unknown prompt: ${n}`)}default:return a?m:p(i,l,`Method not found: ${r}`)}}exports.CORTEX_MCP_DEFAULT_PROTOCOL_VERSION=r,exports.CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION=i,exports.CORTEX_MCP_MODERN_PROTOCOL_VERSION=a,exports.CORTEX_MCP_SERVER_NAME=t,exports.CORTEX_MCP_SERVER_TITLE=n,exports.CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS=o,exports.JSON_RPC_INTERNAL_ERROR=d,exports.JSON_RPC_INVALID_PARAMS=u,exports.JSON_RPC_INVALID_REQUEST=c,exports.JSON_RPC_METHOD_NOT_FOUND=l,exports.JSON_RPC_PARSE_ERROR=s,exports.buildCortexMcpDiscoveryDocument=y,exports.handleCortexMcpMessage=x,exports.isJsonRpcNotification=h,exports.isModernEraMessage=g,exports.wantsMcpEventStream=b;

package/lib/mcp-server.es.js

@@ -1,182 +1,164 @@
-import { getCortexMcpPrompt as x, readCortexMcpResource as M, callCortexMcpTool as P, CortexMcpUnknownToolError as b, CortexMcpForbiddenToolError as g, buildCortexMcpToolDefinitions as v, CORTEX_MCP_PROMPTS as S, CORTEX_MCP_RESOURCES as y } from "./mcp-tool-registry.es.js";
-const E = "nextblock-cortex-ai", d = "NextBlock Cortex AI", N = "2025-06-18", O = "2025-11-25", p = "2026-07-28", m = [
-  p,
-  O,
-  "2025-06-18",
-  "2025-03-26",
-  "2024-11-05"
-], V = -32700, R = -32600, w = -32601, l = -32602, h = -32603;
-function u(t, o) {
-  return { body: { id: t, jsonrpc: "2.0", result: o }, status: 200 };
+import { CORTEX_MCP_PROMPTS as e, CORTEX_MCP_RESOURCES as t, CortexMcpForbiddenToolError as n, CortexMcpUnknownToolError as r, buildCortexMcpToolDefinitions as i, callCortexMcpTool as a, getCortexMcpPrompt as o, readCortexMcpResource as s } from "./mcp-tool-registry.es.js";
+//#region libs/cortex/src/lib/mcp-server.ts
+var c = "nextblock-cortex-ai", l = "NextBlock Cortex AI", u = "2025-06-18", d = "2025-11-25", f = "2026-07-28", p = [
+	f,
+	d,
+	"2025-06-18",
+	"2025-03-26",
+	"2024-11-05"
+], m = -32700, h = -32600, g = -32601, _ = -32602, v = -32603;
+function y(e, t) {
+	return {
+		body: {
+			id: e,
+			jsonrpc: "2.0",
+			result: t
+		},
+		status: 200
+	};
 }
-function a(t, o, i, e = 200, c) {
-  return {
-    body: {
-      error: { code: o, message: i },
-      id: t,
-      jsonrpc: "2.0"
-    },
-    status: e
-  };
+function b(e, t, n, r = 200, i) {
+	return {
+		body: {
+			error: {
+				code: t,
+				message: n,
+				...i === void 0 ? {} : { data: i }
+			},
+			id: e,
+			jsonrpc: "2.0"
+		},
+		status: r
+	};
 }
-const s = { body: null, status: 202 };
-function A(t) {
-  return typeof t.method == "string" && t.id === void 0;
+var x = {
+	body: null,
+	status: 202
+};
+function S(e) {
+	return typeof e.method == "string" && e.id === void 0;
 }
-function D(t, o) {
-  const i = t.params?._meta;
-  if (i && typeof i == "object") {
-    const e = i["io.modelcontextprotocol/protocolVersion"];
-    if (typeof e == "string" && e >= p)
-      return !0;
-  }
-  return !!(o && o >= p);
+function C(e, t) {
+	let n = e.params?._meta;
+	if (n && typeof n == "object") {
+		let e = n["io.modelcontextprotocol/protocolVersion"];
+		if (typeof e == "string" && e >= "2026-07-28") return !0;
+	}
+	return !!(t && t >= "2026-07-28");
 }
-function k(t) {
-  return typeof t != "string" || !t ? N : m.includes(t) ? t : O;
+function w(e) {
+	return typeof e != "string" || !e ? u : p.includes(e) ? e : d;
 }
-function I(t, o) {
-  const i = t.scopes.includes("write");
-  return {
-    capabilities: {
-      // listChanged is deliberately absent: the tool set is static per token, so
-      // advertising change notifications we never send would be a lie a client
-      // could wait on.
-      prompts: {},
-      resources: {},
-      tools: {}
-    },
-    instructions: t.instructions ?? [
-      "NextBlock Cortex AI exposes this CMS through typed tools.",
-      "Call get_database_schema first when you are unsure what exists.",
-      "Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.",
-      i ? "Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly." : "This connection is READ-ONLY. Mutating tools are not available on this token."
-    ].join(" "),
-    protocolVersion: k(o),
-    serverInfo: {
-      name: E,
-      title: d,
-      version: t.serverVersion,
-      websiteUrl: "https://nextblock.dev"
-    }
-  };
+function T(e, t) {
+	let n = e.scopes.includes("write");
+	return {
+		capabilities: {
+			prompts: {},
+			resources: {},
+			tools: {}
+		},
+		instructions: e.instructions ?? [
+			"NextBlock Cortex AI exposes this CMS through typed tools.",
+			"Call get_database_schema first when you are unsure what exists.",
+			"Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.",
+			n ? "Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly." : "This connection is READ-ONLY. Mutating tools are not available on this token."
+		].join(" "),
+		protocolVersion: w(t),
+		serverInfo: {
+			name: c,
+			title: l,
+			version: e.serverVersion,
+			websiteUrl: "https://nextblock.dev"
+		}
+	};
 }
-function U(t) {
-  return {
-    authentication: {
-      header: "Authorization",
-      instructions: "POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",
-      required: !0,
-      schemes: ["bearer"]
-    },
-    capabilities: { prompts: {}, resources: {}, tools: {} },
-    endpoint: { transport: "streamable-http", url: t.endpointUrl },
-    name: E,
-    protocolVersions: m,
-    serverCard: t.serverCardUrl,
-    status: "ok",
-    title: d,
-    version: t.serverVersion,
-    websiteUrl: "https://nextblock.dev"
-  };
+function E(e) {
+	return {
+		authentication: {
+			header: "Authorization",
+			instructions: "POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",
+			required: !0,
+			schemes: ["bearer"]
+		},
+		capabilities: {
+			prompts: {},
+			resources: {},
+			tools: {}
+		},
+		endpoint: {
+			transport: "streamable-http",
+			url: e.endpointUrl
+		},
+		name: c,
+		protocolVersions: p,
+		serverCard: e.serverCardUrl,
+		status: "ok",
+		title: l,
+		version: e.serverVersion,
+		websiteUrl: "https://nextblock.dev"
+	};
 }
-function j(t) {
-  return !!(t && t.toLowerCase().includes("text/event-stream"));
+function D(e) {
+	return !!(e && e.toLowerCase().includes("text/event-stream"));
 }
-async function J(t, o) {
-  if (t === null || typeof t != "object" || Array.isArray(t))
-    return a(null, R, "Expected a single JSON-RPC message.", 400);
-  if (typeof t.method != "string")
-    return "result" in t || "error" in t ? s : a(t.id ?? null, R, 'Missing "method".', 400);
-  const { method: i } = t, e = t.id ?? null, c = A(t);
-  if (i.startsWith("notifications/"))
-    return s;
-  switch (i) {
-    case "initialize":
-      return c ? s : u(e, I(o, t.params?.protocolVersion));
-    case "ping":
-      return c ? s : u(e, {});
-    case "tools/list":
-      return c ? s : u(e, {
-        tools: v({ context: o.context, scopes: o.scopes })
-      });
-    case "tools/call": {
-      if (c)
-        return s;
-      const n = t.params?.name;
-      if (typeof n != "string" || !n)
-        return a(e, l, "tools/call requires params.name.");
-      try {
-        const r = await P({
-          args: t.params?.arguments,
-          context: o.context,
-          name: n,
-          scopes: o.scopes
-        });
-        return u(e, r);
-      } catch (r) {
-        return r instanceof b || r instanceof g ? a(e, l, r.message) : a(
-          e,
-          h,
-          r instanceof Error ? r.message : "Tool execution failed."
-        );
-      }
-    }
-    case "resources/list":
-      return c ? s : u(e, { resources: y });
-    case "resources/templates/list":
-      return c ? s : u(e, { resourceTemplates: [] });
-    case "resources/read": {
-      if (c)
-        return s;
-      const n = t.params?.uri;
-      if (typeof n != "string" || !n)
-        return a(e, l, "resources/read requires params.uri.");
-      try {
-        const r = await M({ context: o.context, uri: n });
-        return r ? u(e, { contents: [r] }) : a(e, l, `Unknown resource: ${n}`);
-      } catch (r) {
-        return a(
-          e,
-          h,
-          r instanceof Error ? r.message : "Resource read failed."
-        );
-      }
-    }
-    case "prompts/list":
-      return c ? s : u(e, { prompts: S });
-    case "prompts/get": {
-      if (c)
-        return s;
-      const n = t.params?.name;
-      if (typeof n != "string" || !n)
-        return a(e, l, "prompts/get requires params.name.");
-      const r = t.params?.arguments, f = {};
-      if (r && typeof r == "object")
-        for (const [T, C] of Object.entries(r))
-          typeof C == "string" && (f[T] = C);
-      const _ = x({ args: f, name: n });
-      return _ ? u(e, _) : a(e, l, `Unknown prompt: ${n}`);
-    }
-    default:
-      return c ? s : a(e, w, `Method not found: ${i}`);
-  }
+async function O(c, l) {
+	if (typeof c != "object" || !c || Array.isArray(c)) return b(null, h, "Expected a single JSON-RPC message.", 400);
+	if (typeof c.method != "string") return "result" in c || "error" in c ? x : b(c.id ?? null, h, "Missing \"method\".", 400);
+	let { method: u } = c, d = c.id ?? null, f = S(c);
+	if (u.startsWith("notifications/")) return x;
+	switch (u) {
+		case "initialize": return f ? x : y(d, T(l, c.params?.protocolVersion));
+		case "ping": return f ? x : y(d, {});
+		case "tools/list": return f ? x : y(d, { tools: i({
+			context: l.context,
+			scopes: l.scopes
+		}) });
+		case "tools/call": {
+			if (f) return x;
+			let e = c.params?.name;
+			if (typeof e != "string" || !e) return b(d, _, "tools/call requires params.name.");
+			try {
+				return y(d, await a({
+					args: c.params?.arguments,
+					context: l.context,
+					name: e,
+					scopes: l.scopes
+				}));
+			} catch (e) {
+				return e instanceof r || e instanceof n ? b(d, _, e.message) : b(d, v, e instanceof Error ? e.message : "Tool execution failed.");
+			}
+		}
+		case "resources/list": return f ? x : y(d, { resources: t });
+		case "resources/templates/list": return f ? x : y(d, { resourceTemplates: [] });
+		case "resources/read": {
+			if (f) return x;
+			let e = c.params?.uri;
+			if (typeof e != "string" || !e) return b(d, _, "resources/read requires params.uri.");
+			try {
+				let t = await s({
+					context: l.context,
+					uri: e
+				});
+				return t ? y(d, { contents: [t] }) : b(d, _, `Unknown resource: ${e}`);
+			} catch (e) {
+				return b(d, v, e instanceof Error ? e.message : "Resource read failed.");
+			}
+		}
+		case "prompts/list": return f ? x : y(d, { prompts: e });
+		case "prompts/get": {
+			if (f) return x;
+			let e = c.params?.name;
+			if (typeof e != "string" || !e) return b(d, _, "prompts/get requires params.name.");
+			let t = c.params?.arguments, n = {};
+			if (t && typeof t == "object") for (let [e, r] of Object.entries(t)) typeof r == "string" && (n[e] = r);
+			let r = o({
+				args: n,
+				name: e
+			});
+			return r ? y(d, r) : b(d, _, `Unknown prompt: ${e}`);
+		}
+		default: return f ? x : b(d, g, `Method not found: ${u}`);
+	}
 }
-export {
-  N as CORTEX_MCP_DEFAULT_PROTOCOL_VERSION,
-  O as CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION,
-  p as CORTEX_MCP_MODERN_PROTOCOL_VERSION,
-  E as CORTEX_MCP_SERVER_NAME,
-  d as CORTEX_MCP_SERVER_TITLE,
-  m as CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS,
-  h as JSON_RPC_INTERNAL_ERROR,
-  l as JSON_RPC_INVALID_PARAMS,
-  R as JSON_RPC_INVALID_REQUEST,
-  w as JSON_RPC_METHOD_NOT_FOUND,
-  V as JSON_RPC_PARSE_ERROR,
-  U as buildCortexMcpDiscoveryDocument,
-  J as handleCortexMcpMessage,
-  A as isJsonRpcNotification,
-  D as isModernEraMessage,
-  j as wantsMcpEventStream
-};
+//#endregion
+export { u as CORTEX_MCP_DEFAULT_PROTOCOL_VERSION, d as CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION, f as CORTEX_MCP_MODERN_PROTOCOL_VERSION, c as CORTEX_MCP_SERVER_NAME, l as CORTEX_MCP_SERVER_TITLE, p as CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS, v as JSON_RPC_INTERNAL_ERROR, _ as JSON_RPC_INVALID_PARAMS, h as JSON_RPC_INVALID_REQUEST, g as JSON_RPC_METHOD_NOT_FOUND, m as JSON_RPC_PARSE_ERROR, E as buildCortexMcpDiscoveryDocument, O as handleCortexMcpMessage, S as isJsonRpcNotification, C as isModernEraMessage, D as wantsMcpEventStream };

package/lib/mcp-tokens.cjs.js

@@ -1 +1 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const i=require("node:crypto"),M="Cortex AI MCP token utilities can only be imported from server-side code.";function c(){if(!(typeof window>"u"))throw new Error(M)}const E="cortex_ai_mcp_settings",l="mcp_access_tokens",_="nbmcp_",m=32,k=8,C=["read","write"],a={allowLocalhostWithoutToken:!0,enabled:!1};function d(e){const t=e&&typeof e=="object"&&!Array.isArray(e)?e:{};return{allowLocalhostWithoutToken:typeof t.allowLocalhostWithoutToken=="boolean"?t.allowLocalhostWithoutToken:a.allowLocalhostWithoutToken,enabled:typeof t.enabled=="boolean"?t.enabled:a.enabled}}async function O(e){if(e)try{const{data:t}=await e.from("site_settings").select("value").eq("key",E).maybeSingle();if(t?.value)return d(t.value)}catch{}return{...a}}function r(e){return c(),i.createHash("sha256").update(e.trim(),"utf8").digest("hex")}function R(){c();const e=`${_}${i.randomBytes(m).toString("base64url")}`;return{token:e,tokenHash:r(e),tokenPrefix:e.slice(0,_.length+k)}}function v(e){const t=e?.trim();if(!t)return null;const o=/^Bearer\s+(.+)$/i.exec(t);return(o?o[1]:t).trim()||null}function x(e){const o=(Array.isArray(e)?e:[]).filter(n=>C.includes(n));return o.length>0?Array.from(new Set(o)):["read"]}async function I(e,t,o=new Date){c();const n=t?.trim();if(!n||n.length<16)return{reason:"malformed",valid:!1};const f=r(n),{data:T,error:p}=await e.from(l).select("id, name, scopes, token_prefix, created_at, created_by, expires_at, last_used_at, revoked_at").eq("token_hash",f).maybeSingle();if(p||!T)return{reason:"unknown",valid:!1};const S=Buffer.from(f,"utf8");if(!i.timingSafeEqual(S,Buffer.from(r(n),"utf8")))return{reason:"unknown",valid:!1};const s=T;return s.revoked_at?{reason:"revoked",valid:!1}:s.expires_at&&new Date(s.expires_at).getTime()<=o.getTime()?{reason:"expired",valid:!1}:{scopes:x(s.scopes),token:s,valid:!0}}async function N(e,t,o=new Date){try{await e.from(l).update({last_used_at:o.toISOString()}).eq("id",t)}catch{}}const y=new Set(["localhost","127.0.0.1","[::1]","::1","0.0.0.0"]);function A(e){const t=e?.trim().toLowerCase();if(!t)return!1;const o=t.startsWith("[")?t.replace(/\]:\d+$/,"]"):t.replace(/:\d+$/,"");return y.has(o)||o.endsWith(".localhost")}function P(e){return!e.settings.allowLocalhostWithoutToken||process.env.NODE_ENV==="production"?!1:A(e.hostHeader)}const h="MCP_BEARER_TOKEN",u=32;function g(e=process.env){const t=e[h]?.trim();return!t||t.length<u?null:t}function L(e,t){c();const o=e?.trim(),n=t?.trim();return!o||!n||n.length<u?!1:i.timingSafeEqual(Buffer.from(r(o),"utf8"),Buffer.from(r(n),"utf8"))}exports.CORTEX_AI_MCP_ENV_TOKEN_MIN_LENGTH=u;exports.CORTEX_AI_MCP_ENV_TOKEN_VAR=h;exports.CORTEX_AI_MCP_SCOPES=C;exports.CORTEX_AI_MCP_SETTINGS_DEFAULTS=a;exports.CORTEX_AI_MCP_SETTINGS_KEY=E;exports.CORTEX_AI_MCP_TOKENS_TABLE=l;exports.CORTEX_AI_MCP_TOKEN_PREFIX=_;exports.hashCortexAiMcpToken=r;exports.isLocalhostHost=A;exports.matchesCortexAiMcpEnvToken=L;exports.mintCortexAiMcpToken=R;exports.normalizeCortexAiMcpSettings=d;exports.parseBearerToken=v;exports.readCortexAiMcpEnvToken=g;exports.resolveCortexAiMcpSettings=O;exports.shouldTrustLocalMcpRequest=P;exports.touchCortexAiMcpToken=N;exports.verifyCortexAiMcpToken=I;
+let e=require("node:crypto");var t=`Cortex AI MCP token utilities can only be imported from server-side code.`;function n(){if(typeof window<`u`)throw Error(t)}var r=`cortex_ai_mcp_settings`,i=`mcp_access_tokens`,a=`nbmcp_`,o=32,s=[`read`,`write`],c={allowLocalhostWithoutToken:!0,enabled:!1};function l(e){let t=e&&typeof e==`object`&&!Array.isArray(e)?e:{};return{allowLocalhostWithoutToken:typeof t.allowLocalhostWithoutToken==`boolean`?t.allowLocalhostWithoutToken:c.allowLocalhostWithoutToken,enabled:typeof t.enabled==`boolean`?t.enabled:c.enabled}}async function u(e){if(e)try{let{data:t}=await e.from(`site_settings`).select(`value`).eq(`key`,r).maybeSingle();if(t?.value)return l(t.value)}catch{}return{...c}}function d(t){return n(),(0,e.createHash)(`sha256`).update(t.trim(),`utf8`).digest(`hex`)}function f(){n();let t=`${a}${(0,e.randomBytes)(o).toString(`base64url`)}`;return{token:t,tokenHash:d(t),tokenPrefix:t.slice(0,14)}}function p(e){let t=e?.trim();if(!t)return null;let n=/^Bearer\s+(.+)$/i.exec(t);return(n?n[1]:t).trim()||null}function m(e){let t=(Array.isArray(e)?e:[]).filter(e=>s.includes(e));return t.length>0?Array.from(new Set(t)):[`read`]}async function h(t,r,a=new Date){n();let o=r?.trim();if(!o||o.length<16)return{reason:`malformed`,valid:!1};let s=d(o),{data:c,error:l}=await t.from(i).select(`id, name, scopes, token_prefix, created_at, created_by, expires_at, last_used_at, revoked_at`).eq(`token_hash`,s).maybeSingle();if(l||!c)return{reason:`unknown`,valid:!1};let u=Buffer.from(s,`utf8`);if(!(0,e.timingSafeEqual)(u,Buffer.from(d(o),`utf8`)))return{reason:`unknown`,valid:!1};let f=c;return f.revoked_at?{reason:`revoked`,valid:!1}:f.expires_at&&new Date(f.expires_at).getTime()<=a.getTime()?{reason:`expired`,valid:!1}:{scopes:m(f.scopes),token:f,valid:!0}}async function g(e,t,n=new Date){try{await e.from(i).update({last_used_at:n.toISOString()}).eq(`id`,t)}catch{}}var _=new Set([`localhost`,`127.0.0.1`,`[::1]`,`::1`,`0.0.0.0`]);function v(e){let t=e?.trim().toLowerCase();if(!t)return!1;let n=t.startsWith(`[`)?t.replace(/\]:\d+$/,`]`):t.replace(/:\d+$/,``);return _.has(n)||n.endsWith(`.localhost`)}function y(e){return!e.settings.allowLocalhostWithoutToken||process.env.NODE_ENV===`production`?!1:v(e.hostHeader)}var b=`MCP_BEARER_TOKEN`,x=32;function S(e=process.env){let t=e[b]?.trim();return!t||t.length<32?null:t}function C(t,r){n();let i=t?.trim(),a=r?.trim();return!i||!a||a.length<32?!1:(0,e.timingSafeEqual)(Buffer.from(d(i),`utf8`),Buffer.from(d(a),`utf8`))}exports.CORTEX_AI_MCP_ENV_TOKEN_MIN_LENGTH=x,exports.CORTEX_AI_MCP_ENV_TOKEN_VAR=b,exports.CORTEX_AI_MCP_SCOPES=s,exports.CORTEX_AI_MCP_SETTINGS_DEFAULTS=c,exports.CORTEX_AI_MCP_SETTINGS_KEY=r,exports.CORTEX_AI_MCP_TOKENS_TABLE=i,exports.CORTEX_AI_MCP_TOKEN_PREFIX=a,exports.hashCortexAiMcpToken=d,exports.isLocalhostHost=v,exports.matchesCortexAiMcpEnvToken=C,exports.mintCortexAiMcpToken=f,exports.normalizeCortexAiMcpSettings=l,exports.parseBearerToken=p,exports.readCortexAiMcpEnvToken=S,exports.resolveCortexAiMcpSettings=u,exports.shouldTrustLocalMcpRequest=y,exports.touchCortexAiMcpToken=g,exports.verifyCortexAiMcpToken=h;