@nextblock-cms/cortex 0.20.3 → 0.21.1

package/lib/fetch-host-guard.es.js

@@ -0,0 +1,30 @@
+//#region src/lib/fetch-host-guard.ts
+function e(e) {
+	let t = e.match(/^::ffff:(.+)$/i);
+	if (!t) return null;
+	let n = t[1];
+	if (/^\d{1,3}(\.\d{1,3}){3}$/.test(n)) return n;
+	let r = n.match(/^([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+	if (!r) return null;
+	let i = Number.parseInt(r[1], 16), a = Number.parseInt(r[2], 16);
+	return [
+		i >> 8 & 255,
+		i & 255,
+		a >> 8 & 255,
+		a & 255
+	].join(".");
+}
+function t(n) {
+	let r = n.trim().toLowerCase().replace(/\.$/, "").replace(/^\[|\]$/g, "");
+	if (!r || r === "localhost" || r.endsWith(".localhost") || r.endsWith(".local") || r.endsWith(".internal") || r === "metadata.google.internal" || r === "0.0.0.0" || r === "::" || r === "::1" || r.startsWith("fe80:") || r.startsWith("fc") || r.startsWith("fd")) return !0;
+	let i = e(r);
+	if (i) return t(i);
+	let a = r.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+	if (a) {
+		let e = Number(a[1]), t = Number(a[2]);
+		if (e === 10 || e === 127 || e === 0 || e === 192 && t === 168 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31) return !0;
+	}
+	return !1;
+}
+//#endregion
+export { t as isBlockedFetchHost };

package/lib/mcp-server.cjs

@@ -0,0 +1 @@
+const e=require("./mcp-tool-registry.cjs");var t=`nextblock-cortex-ai`,n=`NextBlock Cortex AI`,r=`2025-06-18`,i=`2025-11-25`,a=`2026-07-28`,o=[a,i,`2025-06-18`,`2025-03-26`,`2024-11-05`],s=-32700,c=-32600,l=-32601,u=-32602,d=-32603;function f(e,t){return{body:{id:e,jsonrpc:`2.0`,result:t},status:200}}function p(e,t,n,r=200,i){return{body:{error:{code:t,message:n,...i===void 0?{}:{data:i}},id:e,jsonrpc:`2.0`},status:r}}var m={body:null,status:202};function h(e){return typeof e.method==`string`&&e.id===void 0}function g(e,t){let n=e.params?._meta;if(n&&typeof n==`object`){let e=n[`io.modelcontextprotocol/protocolVersion`];if(typeof e==`string`&&e>=`2026-07-28`)return!0}return!!(t&&t>=`2026-07-28`)}function _(e){return typeof e!=`string`||!e?r:o.includes(e)?e:i}function v(e,r){let i=e.scopes.includes(`write`);return{capabilities:{prompts:{},resources:{},tools:{}},instructions:e.instructions??[`NextBlock Cortex AI exposes this CMS through typed tools.`,`Call get_database_schema first when you are unsure what exists.`,`Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.`,i?`Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly.`:`This connection is READ-ONLY. Mutating tools are not available on this token.`].join(` `),protocolVersion:_(r),serverInfo:{name:t,title:n,version:e.serverVersion,websiteUrl:`https://nextblock.dev`}}}function y(e){return{authentication:{header:`Authorization`,instructions:"POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",required:!0,schemes:[`bearer`]},capabilities:{prompts:{},resources:{},tools:{}},endpoint:{transport:`streamable-http`,url:e.endpointUrl},name:t,protocolVersions:o,serverCard:e.serverCardUrl,status:`ok`,title:n,version:e.serverVersion,websiteUrl:`https://nextblock.dev`}}function b(e){return!!(e&&e.toLowerCase().includes(`text/event-stream`))}async function x(t,n){if(typeof t!=`object`||!t||Array.isArray(t))return p(null,c,`Expected a single JSON-RPC message.`,400);if(typeof t.method!=`string`)return`result`in t||`error`in t?m:p(t.id??null,c,`Missing "method".`,400);let{method:r}=t,i=t.id??null,a=h(t);if(r.startsWith(`notifications/`))return m;switch(r){case`initialize`:return a?m:f(i,v(n,t.params?.protocolVersion));case`ping`:return a?m:f(i,{});case`tools/list`:return a?m:f(i,{tools:e.buildCortexMcpToolDefinitions({context:n.context,scopes:n.scopes})});case`tools/call`:{if(a)return m;let r=t.params?.name;if(typeof r!=`string`||!r)return p(i,u,`tools/call requires params.name.`);try{return f(i,await e.callCortexMcpTool({args:t.params?.arguments,context:n.context,name:r,scopes:n.scopes}))}catch(t){return t instanceof e.CortexMcpUnknownToolError||t instanceof e.CortexMcpForbiddenToolError?p(i,u,t.message):p(i,d,t instanceof Error?t.message:`Tool execution failed.`)}}case`resources/list`:return a?m:f(i,{resources:e.CORTEX_MCP_RESOURCES});case`resources/templates/list`:return a?m:f(i,{resourceTemplates:[]});case`resources/read`:{if(a)return m;let r=t.params?.uri;if(typeof r!=`string`||!r)return p(i,u,`resources/read requires params.uri.`);try{let t=await e.readCortexMcpResource({context:n.context,uri:r});return t?f(i,{contents:[t]}):p(i,u,`Unknown resource: ${r}`)}catch(e){return p(i,d,e instanceof Error?e.message:`Resource read failed.`)}}case`prompts/list`:return a?m:f(i,{prompts:e.CORTEX_MCP_PROMPTS});case`prompts/get`:{if(a)return m;let n=t.params?.name;if(typeof n!=`string`||!n)return p(i,u,`prompts/get requires params.name.`);let r=t.params?.arguments,o={};if(r&&typeof r==`object`)for(let[e,t]of Object.entries(r))typeof t==`string`&&(o[e]=t);let s=e.getCortexMcpPrompt({args:o,name:n});return s?f(i,s):p(i,u,`Unknown prompt: ${n}`)}default:return a?m:p(i,l,`Method not found: ${r}`)}}exports.CORTEX_MCP_DEFAULT_PROTOCOL_VERSION=r,exports.CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION=i,exports.CORTEX_MCP_MODERN_PROTOCOL_VERSION=a,exports.CORTEX_MCP_SERVER_NAME=t,exports.CORTEX_MCP_SERVER_TITLE=n,exports.CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS=o,exports.JSON_RPC_INTERNAL_ERROR=d,exports.JSON_RPC_INVALID_PARAMS=u,exports.JSON_RPC_INVALID_REQUEST=c,exports.JSON_RPC_METHOD_NOT_FOUND=l,exports.JSON_RPC_PARSE_ERROR=s,exports.buildCortexMcpDiscoveryDocument=y,exports.handleCortexMcpMessage=x,exports.isJsonRpcNotification=h,exports.isModernEraMessage=g,exports.wantsMcpEventStream=b;

package/lib/mcp-server.es.js

@@ -1,182 +1,164 @@
-import { getCortexMcpPrompt as x, readCortexMcpResource as M, callCortexMcpTool as P, CortexMcpUnknownToolError as b, CortexMcpForbiddenToolError as g, buildCortexMcpToolDefinitions as v, CORTEX_MCP_PROMPTS as S, CORTEX_MCP_RESOURCES as y } from "./mcp-tool-registry.es.js";
-const E = "nextblock-cortex-ai", d = "NextBlock Cortex AI", N = "2025-06-18", O = "2025-11-25", p = "2026-07-28", m = [
-  p,
-  O,
-  "2025-06-18",
-  "2025-03-26",
-  "2024-11-05"
-], V = -32700, R = -32600, w = -32601, l = -32602, h = -32603;
-function u(t, o) {
-  return { body: { id: t, jsonrpc: "2.0", result: o }, status: 200 };
+import { CORTEX_MCP_PROMPTS as e, CORTEX_MCP_RESOURCES as t, CortexMcpForbiddenToolError as n, CortexMcpUnknownToolError as r, buildCortexMcpToolDefinitions as i, callCortexMcpTool as a, getCortexMcpPrompt as o, readCortexMcpResource as s } from "./mcp-tool-registry.es.js";
+//#region src/lib/mcp-server.ts
+var c = "nextblock-cortex-ai", l = "NextBlock Cortex AI", u = "2025-06-18", d = "2025-11-25", f = "2026-07-28", p = [
+	f,
+	d,
+	"2025-06-18",
+	"2025-03-26",
+	"2024-11-05"
+], m = -32700, h = -32600, g = -32601, _ = -32602, v = -32603;
+function y(e, t) {
+	return {
+		body: {
+			id: e,
+			jsonrpc: "2.0",
+			result: t
+		},
+		status: 200
+	};
 }
-function a(t, o, i, e = 200, c) {
-  return {
-    body: {
-      error: { code: o, message: i },
-      id: t,
-      jsonrpc: "2.0"
-    },
-    status: e
-  };
+function b(e, t, n, r = 200, i) {
+	return {
+		body: {
+			error: {
+				code: t,
+				message: n,
+				...i === void 0 ? {} : { data: i }
+			},
+			id: e,
+			jsonrpc: "2.0"
+		},
+		status: r
+	};
 }
-const s = { body: null, status: 202 };
-function A(t) {
-  return typeof t.method == "string" && t.id === void 0;
+var x = {
+	body: null,
+	status: 202
+};
+function S(e) {
+	return typeof e.method == "string" && e.id === void 0;
 }
-function D(t, o) {
-  const i = t.params?._meta;
-  if (i && typeof i == "object") {
-    const e = i["io.modelcontextprotocol/protocolVersion"];
-    if (typeof e == "string" && e >= p)
-      return !0;
-  }
-  return !!(o && o >= p);
+function C(e, t) {
+	let n = e.params?._meta;
+	if (n && typeof n == "object") {
+		let e = n["io.modelcontextprotocol/protocolVersion"];
+		if (typeof e == "string" && e >= "2026-07-28") return !0;
+	}
+	return !!(t && t >= "2026-07-28");
 }
-function k(t) {
-  return typeof t != "string" || !t ? N : m.includes(t) ? t : O;
+function w(e) {
+	return typeof e != "string" || !e ? u : p.includes(e) ? e : d;
 }
-function I(t, o) {
-  const i = t.scopes.includes("write");
-  return {
-    capabilities: {
-      // listChanged is deliberately absent: the tool set is static per token, so
-      // advertising change notifications we never send would be a lie a client
-      // could wait on.
-      prompts: {},
-      resources: {},
-      tools: {}
-    },
-    instructions: t.instructions ?? [
-      "NextBlock Cortex AI exposes this CMS through typed tools.",
-      "Call get_database_schema first when you are unsure what exists.",
-      "Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.",
-      i ? "Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly." : "This connection is READ-ONLY. Mutating tools are not available on this token."
-    ].join(" "),
-    protocolVersion: k(o),
-    serverInfo: {
-      name: E,
-      title: d,
-      version: t.serverVersion,
-      websiteUrl: "https://nextblock.dev"
-    }
-  };
+function T(e, t) {
+	let n = e.scopes.includes("write");
+	return {
+		capabilities: {
+			prompts: {},
+			resources: {},
+			tools: {}
+		},
+		instructions: e.instructions ?? [
+			"NextBlock Cortex AI exposes this CMS through typed tools.",
+			"Call get_database_schema first when you are unsure what exists.",
+			"Conventions: a page or post feature_image_id renders as a full-width title banner above the content and is its share preview — give posts one, never the home page or a page with its own hero section (use update_site_identity social_image for the site-wide preview); mark hero sections is_hero:true; slider:true plus slides makes a carousel.",
+			n ? "Page builds should go through generate_jsonb_layout, which stages a reviewable Live Draft rather than publishing directly." : "This connection is READ-ONLY. Mutating tools are not available on this token."
+		].join(" "),
+		protocolVersion: w(t),
+		serverInfo: {
+			name: c,
+			title: l,
+			version: e.serverVersion,
+			websiteUrl: "https://nextblock.dev"
+		}
+	};
 }
-function U(t) {
-  return {
-    authentication: {
-      header: "Authorization",
-      instructions: "POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",
-      required: !0,
-      schemes: ["bearer"]
-    },
-    capabilities: { prompts: {}, resources: {}, tools: {} },
-    endpoint: { transport: "streamable-http", url: t.endpointUrl },
-    name: E,
-    protocolVersions: m,
-    serverCard: t.serverCardUrl,
-    status: "ok",
-    title: d,
-    version: t.serverVersion,
-    websiteUrl: "https://nextblock.dev"
-  };
+function E(e) {
+	return {
+		authentication: {
+			header: "Authorization",
+			instructions: "POST JSON-RPC 2.0 messages with `Authorization: Bearer <token>`. Create the token in the NextBlock CMS (Settings → Cortex AI → MCP server access) or set MCP_BEARER_TOKEN in the environment. Cortex AI must be active on the site.",
+			required: !0,
+			schemes: ["bearer"]
+		},
+		capabilities: {
+			prompts: {},
+			resources: {},
+			tools: {}
+		},
+		endpoint: {
+			transport: "streamable-http",
+			url: e.endpointUrl
+		},
+		name: c,
+		protocolVersions: p,
+		serverCard: e.serverCardUrl,
+		status: "ok",
+		title: l,
+		version: e.serverVersion,
+		websiteUrl: "https://nextblock.dev"
+	};
 }
-function j(t) {
-  return !!(t && t.toLowerCase().includes("text/event-stream"));
+function D(e) {
+	return !!(e && e.toLowerCase().includes("text/event-stream"));
 }
-async function J(t, o) {
-  if (t === null || typeof t != "object" || Array.isArray(t))
-    return a(null, R, "Expected a single JSON-RPC message.", 400);
-  if (typeof t.method != "string")
-    return "result" in t || "error" in t ? s : a(t.id ?? null, R, 'Missing "method".', 400);
-  const { method: i } = t, e = t.id ?? null, c = A(t);
-  if (i.startsWith("notifications/"))
-    return s;
-  switch (i) {
-    case "initialize":
-      return c ? s : u(e, I(o, t.params?.protocolVersion));
-    case "ping":
-      return c ? s : u(e, {});
-    case "tools/list":
-      return c ? s : u(e, {
-        tools: v({ context: o.context, scopes: o.scopes })
-      });
-    case "tools/call": {
-      if (c)
-        return s;
-      const n = t.params?.name;
-      if (typeof n != "string" || !n)
-        return a(e, l, "tools/call requires params.name.");
-      try {
-        const r = await P({
-          args: t.params?.arguments,
-          context: o.context,
-          name: n,
-          scopes: o.scopes
-        });
-        return u(e, r);
-      } catch (r) {
-        return r instanceof b || r instanceof g ? a(e, l, r.message) : a(
-          e,
-          h,
-          r instanceof Error ? r.message : "Tool execution failed."
-        );
-      }
-    }
-    case "resources/list":
-      return c ? s : u(e, { resources: y });
-    case "resources/templates/list":
-      return c ? s : u(e, { resourceTemplates: [] });
-    case "resources/read": {
-      if (c)
-        return s;
-      const n = t.params?.uri;
-      if (typeof n != "string" || !n)
-        return a(e, l, "resources/read requires params.uri.");
-      try {
-        const r = await M({ context: o.context, uri: n });
-        return r ? u(e, { contents: [r] }) : a(e, l, `Unknown resource: ${n}`);
-      } catch (r) {
-        return a(
-          e,
-          h,
-          r instanceof Error ? r.message : "Resource read failed."
-        );
-      }
-    }
-    case "prompts/list":
-      return c ? s : u(e, { prompts: S });
-    case "prompts/get": {
-      if (c)
-        return s;
-      const n = t.params?.name;
-      if (typeof n != "string" || !n)
-        return a(e, l, "prompts/get requires params.name.");
-      const r = t.params?.arguments, f = {};
-      if (r && typeof r == "object")
-        for (const [T, C] of Object.entries(r))
-          typeof C == "string" && (f[T] = C);
-      const _ = x({ args: f, name: n });
-      return _ ? u(e, _) : a(e, l, `Unknown prompt: ${n}`);
-    }
-    default:
-      return c ? s : a(e, w, `Method not found: ${i}`);
-  }
+async function O(c, l) {
+	if (typeof c != "object" || !c || Array.isArray(c)) return b(null, h, "Expected a single JSON-RPC message.", 400);
+	if (typeof c.method != "string") return "result" in c || "error" in c ? x : b(c.id ?? null, h, "Missing \"method\".", 400);
+	let { method: u } = c, d = c.id ?? null, f = S(c);
+	if (u.startsWith("notifications/")) return x;
+	switch (u) {
+		case "initialize": return f ? x : y(d, T(l, c.params?.protocolVersion));
+		case "ping": return f ? x : y(d, {});
+		case "tools/list": return f ? x : y(d, { tools: i({
+			context: l.context,
+			scopes: l.scopes
+		}) });
+		case "tools/call": {
+			if (f) return x;
+			let e = c.params?.name;
+			if (typeof e != "string" || !e) return b(d, _, "tools/call requires params.name.");
+			try {
+				return y(d, await a({
+					args: c.params?.arguments,
+					context: l.context,
+					name: e,
+					scopes: l.scopes
+				}));
+			} catch (e) {
+				return e instanceof r || e instanceof n ? b(d, _, e.message) : b(d, v, e instanceof Error ? e.message : "Tool execution failed.");
+			}
+		}
+		case "resources/list": return f ? x : y(d, { resources: t });
+		case "resources/templates/list": return f ? x : y(d, { resourceTemplates: [] });
+		case "resources/read": {
+			if (f) return x;
+			let e = c.params?.uri;
+			if (typeof e != "string" || !e) return b(d, _, "resources/read requires params.uri.");
+			try {
+				let t = await s({
+					context: l.context,
+					uri: e
+				});
+				return t ? y(d, { contents: [t] }) : b(d, _, `Unknown resource: ${e}`);
+			} catch (e) {
+				return b(d, v, e instanceof Error ? e.message : "Resource read failed.");
+			}
+		}
+		case "prompts/list": return f ? x : y(d, { prompts: e });
+		case "prompts/get": {
+			if (f) return x;
+			let e = c.params?.name;
+			if (typeof e != "string" || !e) return b(d, _, "prompts/get requires params.name.");
+			let t = c.params?.arguments, n = {};
+			if (t && typeof t == "object") for (let [e, r] of Object.entries(t)) typeof r == "string" && (n[e] = r);
+			let r = o({
+				args: n,
+				name: e
+			});
+			return r ? y(d, r) : b(d, _, `Unknown prompt: ${e}`);
+		}
+		default: return f ? x : b(d, g, `Method not found: ${u}`);
+	}
 }
-export {
-  N as CORTEX_MCP_DEFAULT_PROTOCOL_VERSION,
-  O as CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION,
-  p as CORTEX_MCP_MODERN_PROTOCOL_VERSION,
-  E as CORTEX_MCP_SERVER_NAME,
-  d as CORTEX_MCP_SERVER_TITLE,
-  m as CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS,
-  h as JSON_RPC_INTERNAL_ERROR,
-  l as JSON_RPC_INVALID_PARAMS,
-  R as JSON_RPC_INVALID_REQUEST,
-  w as JSON_RPC_METHOD_NOT_FOUND,
-  V as JSON_RPC_PARSE_ERROR,
-  U as buildCortexMcpDiscoveryDocument,
-  J as handleCortexMcpMessage,
-  A as isJsonRpcNotification,
-  D as isModernEraMessage,
-  j as wantsMcpEventStream
-};
+//#endregion
+export { u as CORTEX_MCP_DEFAULT_PROTOCOL_VERSION, d as CORTEX_MCP_LATEST_LEGACY_PROTOCOL_VERSION, f as CORTEX_MCP_MODERN_PROTOCOL_VERSION, c as CORTEX_MCP_SERVER_NAME, l as CORTEX_MCP_SERVER_TITLE, p as CORTEX_MCP_SUPPORTED_PROTOCOL_VERSIONS, v as JSON_RPC_INTERNAL_ERROR, _ as JSON_RPC_INVALID_PARAMS, h as JSON_RPC_INVALID_REQUEST, g as JSON_RPC_METHOD_NOT_FOUND, m as JSON_RPC_PARSE_ERROR, E as buildCortexMcpDiscoveryDocument, O as handleCortexMcpMessage, S as isJsonRpcNotification, C as isModernEraMessage, D as wantsMcpEventStream };

package/lib/mcp-tokens.cjs

@@ -0,0 +1 @@
+let e=require("node:crypto");var t=`Cortex AI MCP token utilities can only be imported from server-side code.`;function n(){if(typeof window<`u`)throw Error(t)}var r=`cortex_ai_mcp_settings`,i=`mcp_access_tokens`,a=`nbmcp_`,o=32,s=[`read`,`write`],c={allowLocalhostWithoutToken:!0,enabled:!1};function l(e){let t=e&&typeof e==`object`&&!Array.isArray(e)?e:{};return{allowLocalhostWithoutToken:typeof t.allowLocalhostWithoutToken==`boolean`?t.allowLocalhostWithoutToken:c.allowLocalhostWithoutToken,enabled:typeof t.enabled==`boolean`?t.enabled:c.enabled}}async function u(e){if(e)try{let{data:t}=await e.from(`site_settings`).select(`value`).eq(`key`,r).maybeSingle();if(t?.value)return l(t.value)}catch{}return{...c}}function d(t){return n(),(0,e.createHash)(`sha256`).update(t.trim(),`utf8`).digest(`hex`)}function f(){n();let t=`${a}${(0,e.randomBytes)(o).toString(`base64url`)}`;return{token:t,tokenHash:d(t),tokenPrefix:t.slice(0,14)}}function p(e){let t=e?.trim();if(!t)return null;let n=/^Bearer\s+(.+)$/i.exec(t);return(n?n[1]:t).trim()||null}function m(e){let t=(Array.isArray(e)?e:[]).filter(e=>s.includes(e));return t.length>0?Array.from(new Set(t)):[`read`]}async function h(t,r,a=new Date){n();let o=r?.trim();if(!o||o.length<16)return{reason:`malformed`,valid:!1};let s=d(o),{data:c,error:l}=await t.from(i).select(`id, name, scopes, token_prefix, created_at, created_by, expires_at, last_used_at, revoked_at`).eq(`token_hash`,s).maybeSingle();if(l||!c)return{reason:`unknown`,valid:!1};let u=Buffer.from(s,`utf8`);if(!(0,e.timingSafeEqual)(u,Buffer.from(d(o),`utf8`)))return{reason:`unknown`,valid:!1};let f=c;return f.revoked_at?{reason:`revoked`,valid:!1}:f.expires_at&&new Date(f.expires_at).getTime()<=a.getTime()?{reason:`expired`,valid:!1}:{scopes:m(f.scopes),token:f,valid:!0}}async function g(e,t,n=new Date){try{await e.from(i).update({last_used_at:n.toISOString()}).eq(`id`,t)}catch{}}var _=new Set([`localhost`,`127.0.0.1`,`[::1]`,`::1`,`0.0.0.0`]);function v(e){let t=e?.trim().toLowerCase();if(!t)return!1;let n=t.startsWith(`[`)?t.replace(/\]:\d+$/,`]`):t.replace(/:\d+$/,``);return _.has(n)||n.endsWith(`.localhost`)}function y(e){return!e.settings.allowLocalhostWithoutToken||process.env.NODE_ENV===`production`?!1:v(e.hostHeader)}var b=`MCP_BEARER_TOKEN`,x=32;function S(e=process.env){let t=e[b]?.trim();return!t||t.length<32?null:t}function C(t,r){n();let i=t?.trim(),a=r?.trim();return!i||!a||a.length<32?!1:(0,e.timingSafeEqual)(Buffer.from(d(i),`utf8`),Buffer.from(d(a),`utf8`))}exports.CORTEX_AI_MCP_ENV_TOKEN_MIN_LENGTH=x,exports.CORTEX_AI_MCP_ENV_TOKEN_VAR=b,exports.CORTEX_AI_MCP_SCOPES=s,exports.CORTEX_AI_MCP_SETTINGS_DEFAULTS=c,exports.CORTEX_AI_MCP_SETTINGS_KEY=r,exports.CORTEX_AI_MCP_TOKENS_TABLE=i,exports.CORTEX_AI_MCP_TOKEN_PREFIX=a,exports.hashCortexAiMcpToken=d,exports.isLocalhostHost=v,exports.matchesCortexAiMcpEnvToken=C,exports.mintCortexAiMcpToken=f,exports.normalizeCortexAiMcpSettings=l,exports.parseBearerToken=p,exports.readCortexAiMcpEnvToken=S,exports.resolveCortexAiMcpSettings=u,exports.shouldTrustLocalMcpRequest=y,exports.touchCortexAiMcpToken=g,exports.verifyCortexAiMcpToken=h;

package/lib/mcp-tokens.es.js

@@ -1,121 +1,109 @@
-import { createHash as E, timingSafeEqual as f, randomBytes as m } from "node:crypto";
-const p = "Cortex AI MCP token utilities can only be imported from server-side code.";
-function a() {
-  if (!(typeof window > "u"))
-    throw new Error(p);
+import { createHash as e, randomBytes as t, timingSafeEqual as n } from "node:crypto";
+//#region src/lib/mcp-tokens.ts
+var r = "Cortex AI MCP token utilities can only be imported from server-side code.";
+function i() {
+	if (typeof window < "u") throw Error(r);
 }
-const C = "cortex_ai_mcp_settings", _ = "mcp_access_tokens", u = "nbmcp_", A = 32, k = 8, S = ["read", "write"], i = {
-  allowLocalhostWithoutToken: !0,
-  enabled: !1
+var a = "cortex_ai_mcp_settings", o = "mcp_access_tokens", s = "nbmcp_", c = 32, l = ["read", "write"], u = {
+	allowLocalhostWithoutToken: !0,
+	enabled: !1
 };
-function O(e) {
-  const t = e && typeof e == "object" && !Array.isArray(e) ? e : {};
-  return {
-    allowLocalhostWithoutToken: typeof t.allowLocalhostWithoutToken == "boolean" ? t.allowLocalhostWithoutToken : i.allowLocalhostWithoutToken,
-    enabled: typeof t.enabled == "boolean" ? t.enabled : i.enabled
-  };
+function d(e) {
+	let t = e && typeof e == "object" && !Array.isArray(e) ? e : {};
+	return {
+		allowLocalhostWithoutToken: typeof t.allowLocalhostWithoutToken == "boolean" ? t.allowLocalhostWithoutToken : u.allowLocalhostWithoutToken,
+		enabled: typeof t.enabled == "boolean" ? t.enabled : u.enabled
+	};
 }
-async function R(e) {
-  if (e)
-    try {
-      const { data: t } = await e.from("site_settings").select("value").eq("key", C).maybeSingle();
-      if (t?.value)
-        return O(t.value);
-    } catch {
-    }
-  return { ...i };
+async function f(e) {
+	if (e) try {
+		let { data: t } = await e.from("site_settings").select("value").eq("key", a).maybeSingle();
+		if (t?.value) return d(t.value);
+	} catch {}
+	return { ...u };
 }
-function s(e) {
-  return a(), E("sha256").update(e.trim(), "utf8").digest("hex");
+function p(t) {
+	return i(), e("sha256").update(t.trim(), "utf8").digest("hex");
 }
-function g() {
-  a();
-  const e = `${u}${m(A).toString(
-    "base64url"
-  )}`;
-  return {
-    token: e,
-    tokenHash: s(e),
-    tokenPrefix: e.slice(
-      0,
-      u.length + k
-    )
-  };
+function m() {
+	i();
+	let e = `${s}${t(c).toString("base64url")}`;
+	return {
+		token: e,
+		tokenHash: p(e),
+		tokenPrefix: e.slice(0, 14)
+	};
 }
-function N(e) {
-  const t = e?.trim();
-  if (!t)
-    return null;
-  const o = /^Bearer\s+(.+)$/i.exec(t);
-  return (o ? o[1] : t).trim() || null;
+function h(e) {
+	let t = e?.trim();
+	if (!t) return null;
+	let n = /^Bearer\s+(.+)$/i.exec(t);
+	return (n ? n[1] : t).trim() || null;
 }
-function M(e) {
-  const o = (Array.isArray(e) ? e : []).filter(
-    (n) => S.includes(n)
-  );
-  return o.length > 0 ? Array.from(new Set(o)) : ["read"];
+function g(e) {
+	let t = (Array.isArray(e) ? e : []).filter((e) => l.includes(e));
+	return t.length > 0 ? Array.from(new Set(t)) : ["read"];
 }
-async function I(e, t, o = /* @__PURE__ */ new Date()) {
-  a();
-  const n = t?.trim();
-  if (!n || n.length < 16)
-    return { reason: "malformed", valid: !1 };
-  const c = s(n), { data: l, error: h } = await e.from(_).select("id, name, scopes, token_prefix, created_at, created_by, expires_at, last_used_at, revoked_at").eq("token_hash", c).maybeSingle();
-  if (h || !l)
-    return { reason: "unknown", valid: !1 };
-  const T = Buffer.from(c, "utf8");
-  if (!f(T, Buffer.from(s(n), "utf8")))
-    return { reason: "unknown", valid: !1 };
-  const r = l;
-  return r.revoked_at ? { reason: "revoked", valid: !1 } : r.expires_at && new Date(r.expires_at).getTime() <= o.getTime() ? { reason: "expired", valid: !1 } : { scopes: M(r.scopes), token: r, valid: !0 };
+async function _(e, t, r = /* @__PURE__ */ new Date()) {
+	i();
+	let a = t?.trim();
+	if (!a || a.length < 16) return {
+		reason: "malformed",
+		valid: !1
+	};
+	let s = p(a), { data: c, error: l } = await e.from(o).select("id, name, scopes, token_prefix, created_at, created_by, expires_at, last_used_at, revoked_at").eq("token_hash", s).maybeSingle();
+	if (l || !c) return {
+		reason: "unknown",
+		valid: !1
+	};
+	let u = Buffer.from(s, "utf8");
+	if (!n(u, Buffer.from(p(a), "utf8"))) return {
+		reason: "unknown",
+		valid: !1
+	};
+	let d = c;
+	return d.revoked_at ? {
+		reason: "revoked",
+		valid: !1
+	} : d.expires_at && new Date(d.expires_at).getTime() <= r.getTime() ? {
+		reason: "expired",
+		valid: !1
+	} : {
+		scopes: g(d.scopes),
+		token: d,
+		valid: !0
+	};
 }
-async function L(e, t, o = /* @__PURE__ */ new Date()) {
-  try {
-    await e.from(_).update({ last_used_at: o.toISOString() }).eq("id", t);
-  } catch {
-  }
+async function v(e, t, n = /* @__PURE__ */ new Date()) {
+	try {
+		await e.from(o).update({ last_used_at: n.toISOString() }).eq("id", t);
+	} catch {}
 }
-const v = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1", "0.0.0.0"]);
-function y(e) {
-  const t = e?.trim().toLowerCase();
-  if (!t)
-    return !1;
-  const o = t.startsWith("[") ? t.replace(/\]:\d+$/, "]") : t.replace(/:\d+$/, "");
-  return v.has(o) || o.endsWith(".localhost");
+var y = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1",
+	"0.0.0.0"
+]);
+function b(e) {
+	let t = e?.trim().toLowerCase();
+	if (!t) return !1;
+	let n = t.startsWith("[") ? t.replace(/\]:\d+$/, "]") : t.replace(/:\d+$/, "");
+	return y.has(n) || n.endsWith(".localhost");
 }
-function P(e) {
-  return !e.settings.allowLocalhostWithoutToken || process.env.NODE_ENV === "production" ? !1 : y(e.hostHeader);
+function x(e) {
+	return !e.settings.allowLocalhostWithoutToken || process.env.NODE_ENV === "production" ? !1 : b(e.hostHeader);
 }
-const w = "MCP_BEARER_TOKEN", d = 32;
-function b(e = process.env) {
-  const t = e[w]?.trim();
-  return !t || t.length < d ? null : t;
+var S = "MCP_BEARER_TOKEN", C = 32;
+function w(e = process.env) {
+	let t = e[S]?.trim();
+	return !t || t.length < 32 ? null : t;
 }
-function B(e, t) {
-  a();
-  const o = e?.trim(), n = t?.trim();
-  return !o || !n || n.length < d ? !1 : f(
-    Buffer.from(s(o), "utf8"),
-    Buffer.from(s(n), "utf8")
-  );
+function T(e, t) {
+	i();
+	let r = e?.trim(), a = t?.trim();
+	return !r || !a || a.length < 32 ? !1 : n(Buffer.from(p(r), "utf8"), Buffer.from(p(a), "utf8"));
 }
-export {
-  d as CORTEX_AI_MCP_ENV_TOKEN_MIN_LENGTH,
-  w as CORTEX_AI_MCP_ENV_TOKEN_VAR,
-  S as CORTEX_AI_MCP_SCOPES,
-  i as CORTEX_AI_MCP_SETTINGS_DEFAULTS,
-  C as CORTEX_AI_MCP_SETTINGS_KEY,
-  _ as CORTEX_AI_MCP_TOKENS_TABLE,
-  u as CORTEX_AI_MCP_TOKEN_PREFIX,
-  s as hashCortexAiMcpToken,
-  y as isLocalhostHost,
-  B as matchesCortexAiMcpEnvToken,
-  g as mintCortexAiMcpToken,
-  O as normalizeCortexAiMcpSettings,
-  N as parseBearerToken,
-  b as readCortexAiMcpEnvToken,
-  R as resolveCortexAiMcpSettings,
-  P as shouldTrustLocalMcpRequest,
-  L as touchCortexAiMcpToken,
-  I as verifyCortexAiMcpToken
-};
+//#endregion
+export { C as CORTEX_AI_MCP_ENV_TOKEN_MIN_LENGTH, S as CORTEX_AI_MCP_ENV_TOKEN_VAR, l as CORTEX_AI_MCP_SCOPES, u as CORTEX_AI_MCP_SETTINGS_DEFAULTS, a as CORTEX_AI_MCP_SETTINGS_KEY, o as CORTEX_AI_MCP_TOKENS_TABLE, s as CORTEX_AI_MCP_TOKEN_PREFIX, p as hashCortexAiMcpToken, b as isLocalhostHost, T as matchesCortexAiMcpEnvToken, m as mintCortexAiMcpToken, d as normalizeCortexAiMcpSettings, h as parseBearerToken, w as readCortexAiMcpEnvToken, f as resolveCortexAiMcpSettings, x as shouldTrustLocalMcpRequest, v as touchCortexAiMcpToken, _ as verifyCortexAiMcpToken };