@nitrostack/core 1.0.15 → 1.0.16

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (111) hide show
  1. package/dist/auth/cimd.d.ts +90 -0
  2. package/dist/auth/cimd.d.ts.map +1 -0
  3. package/dist/auth/cimd.js +344 -0
  4. package/dist/auth/cimd.js.map +1 -0
  5. package/dist/auth/client.d.ts +21 -0
  6. package/dist/auth/client.d.ts.map +1 -1
  7. package/dist/auth/client.js +48 -0
  8. package/dist/auth/client.js.map +1 -1
  9. package/dist/auth/index.d.ts +2 -1
  10. package/dist/auth/index.d.ts.map +1 -1
  11. package/dist/auth/index.js +3 -1
  12. package/dist/auth/index.js.map +1 -1
  13. package/dist/auth/middleware.d.ts.map +1 -1
  14. package/dist/auth/middleware.js +15 -3
  15. package/dist/auth/middleware.js.map +1 -1
  16. package/dist/auth/server-metadata.d.ts +5 -0
  17. package/dist/auth/server-metadata.d.ts.map +1 -1
  18. package/dist/auth/server-metadata.js +7 -1
  19. package/dist/auth/server-metadata.js.map +1 -1
  20. package/dist/auth/token-store.d.ts +12 -1
  21. package/dist/auth/token-store.d.ts.map +1 -1
  22. package/dist/auth/token-store.js +23 -1
  23. package/dist/auth/token-store.js.map +1 -1
  24. package/dist/auth/token-validation.d.ts +1 -1
  25. package/dist/auth/token-validation.d.ts.map +1 -1
  26. package/dist/auth/token-validation.js +20 -6
  27. package/dist/auth/token-validation.js.map +1 -1
  28. package/dist/auth/types.d.ts +17 -0
  29. package/dist/auth/types.d.ts.map +1 -1
  30. package/dist/core/app-decorator.d.ts +10 -0
  31. package/dist/core/app-decorator.d.ts.map +1 -1
  32. package/dist/core/app-decorator.js +25 -11
  33. package/dist/core/app-decorator.js.map +1 -1
  34. package/dist/core/builders.d.ts.map +1 -1
  35. package/dist/core/builders.js +5 -0
  36. package/dist/core/builders.js.map +1 -1
  37. package/dist/core/errors.d.ts +6 -0
  38. package/dist/core/errors.d.ts.map +1 -1
  39. package/dist/core/errors.js +9 -0
  40. package/dist/core/errors.js.map +1 -1
  41. package/dist/core/guards/oauth.guard.d.ts +13 -6
  42. package/dist/core/guards/oauth.guard.d.ts.map +1 -1
  43. package/dist/core/guards/oauth.guard.js +90 -1
  44. package/dist/core/guards/oauth.guard.js.map +1 -1
  45. package/dist/core/index.d.ts +7 -0
  46. package/dist/core/index.d.ts.map +1 -1
  47. package/dist/core/index.js +7 -0
  48. package/dist/core/index.js.map +1 -1
  49. package/dist/core/oauth-module.d.ts +5 -0
  50. package/dist/core/oauth-module.d.ts.map +1 -1
  51. package/dist/core/oauth-module.js +15 -6
  52. package/dist/core/oauth-module.js.map +1 -1
  53. package/dist/core/protocol/adapter.d.ts +97 -0
  54. package/dist/core/protocol/adapter.d.ts.map +1 -0
  55. package/dist/core/protocol/adapter.js +21 -0
  56. package/dist/core/protocol/adapter.js.map +1 -0
  57. package/dist/core/protocol/features/cache-hints.d.ts +64 -0
  58. package/dist/core/protocol/features/cache-hints.d.ts.map +1 -0
  59. package/dist/core/protocol/features/cache-hints.js +56 -0
  60. package/dist/core/protocol/features/cache-hints.js.map +1 -0
  61. package/dist/core/protocol/features/errors.d.ts +34 -0
  62. package/dist/core/protocol/features/errors.d.ts.map +1 -0
  63. package/dist/core/protocol/features/errors.js +48 -0
  64. package/dist/core/protocol/features/errors.js.map +1 -0
  65. package/dist/core/protocol/features/extensions.d.ts +39 -0
  66. package/dist/core/protocol/features/extensions.d.ts.map +1 -0
  67. package/dist/core/protocol/features/extensions.js +42 -0
  68. package/dist/core/protocol/features/extensions.js.map +1 -0
  69. package/dist/core/protocol/features/mrtr.d.ts +75 -0
  70. package/dist/core/protocol/features/mrtr.d.ts.map +1 -0
  71. package/dist/core/protocol/features/mrtr.js +66 -0
  72. package/dist/core/protocol/features/mrtr.js.map +1 -0
  73. package/dist/core/protocol/features/schema.d.ts +39 -0
  74. package/dist/core/protocol/features/schema.d.ts.map +1 -0
  75. package/dist/core/protocol/features/schema.js +96 -0
  76. package/dist/core/protocol/features/schema.js.map +1 -0
  77. package/dist/core/protocol/features/trace-context.d.ts +31 -0
  78. package/dist/core/protocol/features/trace-context.d.ts.map +1 -0
  79. package/dist/core/protocol/features/trace-context.js +45 -0
  80. package/dist/core/protocol/features/trace-context.js.map +1 -0
  81. package/dist/core/protocol/modern-v2.adapter.d.ts +92 -0
  82. package/dist/core/protocol/modern-v2.adapter.d.ts.map +1 -0
  83. package/dist/core/protocol/modern-v2.adapter.js +939 -0
  84. package/dist/core/protocol/modern-v2.adapter.js.map +1 -0
  85. package/dist/core/protocol/version.d.ts +72 -0
  86. package/dist/core/protocol/version.d.ts.map +1 -0
  87. package/dist/core/protocol/version.js +99 -0
  88. package/dist/core/protocol/version.js.map +1 -0
  89. package/dist/core/resource.d.ts +15 -0
  90. package/dist/core/resource.d.ts.map +1 -1
  91. package/dist/core/resource.js +13 -0
  92. package/dist/core/resource.js.map +1 -1
  93. package/dist/core/server.d.ts +48 -5
  94. package/dist/core/server.d.ts.map +1 -1
  95. package/dist/core/server.js +305 -90
  96. package/dist/core/server.js.map +1 -1
  97. package/dist/core/task.d.ts +126 -40
  98. package/dist/core/task.d.ts.map +1 -1
  99. package/dist/core/task.js +166 -56
  100. package/dist/core/task.js.map +1 -1
  101. package/dist/core/tool.d.ts +20 -0
  102. package/dist/core/tool.d.ts.map +1 -1
  103. package/dist/core/tool.js +16 -2
  104. package/dist/core/tool.js.map +1 -1
  105. package/dist/core/transports/streamable-http.d.ts +23 -0
  106. package/dist/core/transports/streamable-http.d.ts.map +1 -1
  107. package/dist/core/transports/streamable-http.js +66 -10
  108. package/dist/core/transports/streamable-http.js.map +1 -1
  109. package/dist/core/types.d.ts +86 -0
  110. package/dist/core/types.d.ts.map +1 -1
  111. package/package.json +5 -2
@@ -0,0 +1,64 @@
1
+ /**
2
+ * SEP-2549 cache hints (`ttlMs` / `cacheScope`).
3
+ *
4
+ * On the 2026-07-28 revision, `tools/list`, `prompts/list`, `resources/list`,
5
+ * `resources/templates/list`, `resources/read`, and `server/discover` results
6
+ * carry `ttlMs` (freshness hint in ms) and `cacheScope` (`public` | `private`).
7
+ *
8
+ * NitroStack maps its existing caching signals onto these hints:
9
+ * - a tool's `@Cache({ ttl })` (seconds) or explicit `cacheHint` → per-tool hint
10
+ * - a resource's `metadata.cacheMaxAge` (seconds) or explicit `cacheHint` → hint
11
+ *
12
+ * The 2025-era path never emits these fields, so this module is only consulted
13
+ * by the modern adapter. The conservative default (`ttlMs: 0`,
14
+ * `cacheScope: 'private'`) is left to the SDK when no hint is resolved.
15
+ *
16
+ * @module
17
+ */
18
+ /**
19
+ * Cache scope for a cacheable result (SEP-2549).
20
+ */
21
+ export type CacheScope = 'public' | 'private';
22
+ /**
23
+ * A NitroStack cache hint. Mirrors the v2 SDK `CacheHint` shape so it can be
24
+ * handed to `registerResource(..., { cacheHint })` / `ServerOptions.cacheHints`
25
+ * without coupling non-modern code to the v2 types.
26
+ */
27
+ export interface NitroCacheHint {
28
+ /** Cache lifetime in milliseconds (non-negative). */
29
+ ttlMs?: number;
30
+ /** Whether shared caches may store the result. */
31
+ cacheScope?: CacheScope;
32
+ }
33
+ /**
34
+ * Minimal shape of a tool for hint resolution (avoids importing the Tool class
35
+ * to keep this feature dependency-light and testable).
36
+ */
37
+ export interface CacheHintToolLike {
38
+ cacheHint?: NitroCacheHint;
39
+ /** Seconds — typically propagated from `@Cache({ ttl })`. */
40
+ cacheTtlSeconds?: number;
41
+ }
42
+ /**
43
+ * Minimal shape of a resource for hint resolution.
44
+ */
45
+ export interface CacheHintResourceLike {
46
+ cacheHint?: NitroCacheHint;
47
+ metadata?: {
48
+ cacheable?: boolean;
49
+ cacheMaxAge?: number;
50
+ };
51
+ }
52
+ /**
53
+ * Resolve a cache hint for a tool, or `undefined` when it has no caching signal.
54
+ */
55
+ export declare function resolveToolCacheHint(tool: CacheHintToolLike): NitroCacheHint | undefined;
56
+ /**
57
+ * Resolve a cache hint for a resource, or `undefined` when it has none.
58
+ */
59
+ export declare function resolveResourceCacheHint(resource: CacheHintResourceLike): NitroCacheHint | undefined;
60
+ /**
61
+ * Clamp/validate a hint into safe values.
62
+ */
63
+ export declare function normalizeHint(hint: NitroCacheHint): NitroCacheHint;
64
+ //# sourceMappingURL=cache-hints.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cache-hints.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/cache-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE9C;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,UAAU,CAAC,EAAE,UAAU,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1D;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,GAAG,SAAS,CAQxF;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,CASpG;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CASlE"}
@@ -0,0 +1,56 @@
1
+ /**
2
+ * SEP-2549 cache hints (`ttlMs` / `cacheScope`).
3
+ *
4
+ * On the 2026-07-28 revision, `tools/list`, `prompts/list`, `resources/list`,
5
+ * `resources/templates/list`, `resources/read`, and `server/discover` results
6
+ * carry `ttlMs` (freshness hint in ms) and `cacheScope` (`public` | `private`).
7
+ *
8
+ * NitroStack maps its existing caching signals onto these hints:
9
+ * - a tool's `@Cache({ ttl })` (seconds) or explicit `cacheHint` → per-tool hint
10
+ * - a resource's `metadata.cacheMaxAge` (seconds) or explicit `cacheHint` → hint
11
+ *
12
+ * The 2025-era path never emits these fields, so this module is only consulted
13
+ * by the modern adapter. The conservative default (`ttlMs: 0`,
14
+ * `cacheScope: 'private'`) is left to the SDK when no hint is resolved.
15
+ *
16
+ * @module
17
+ */
18
+ /**
19
+ * Resolve a cache hint for a tool, or `undefined` when it has no caching signal.
20
+ */
21
+ export function resolveToolCacheHint(tool) {
22
+ if (tool.cacheHint && (tool.cacheHint.ttlMs !== undefined || tool.cacheHint.cacheScope !== undefined)) {
23
+ return normalizeHint(tool.cacheHint);
24
+ }
25
+ if (typeof tool.cacheTtlSeconds === 'number' && tool.cacheTtlSeconds > 0) {
26
+ return { ttlMs: Math.round(tool.cacheTtlSeconds * 1000), cacheScope: 'private' };
27
+ }
28
+ return undefined;
29
+ }
30
+ /**
31
+ * Resolve a cache hint for a resource, or `undefined` when it has none.
32
+ */
33
+ export function resolveResourceCacheHint(resource) {
34
+ if (resource.cacheHint && (resource.cacheHint.ttlMs !== undefined || resource.cacheHint.cacheScope !== undefined)) {
35
+ return normalizeHint(resource.cacheHint);
36
+ }
37
+ const maxAge = resource.metadata?.cacheMaxAge;
38
+ if (typeof maxAge === 'number' && maxAge > 0) {
39
+ return { ttlMs: Math.round(maxAge * 1000), cacheScope: 'private' };
40
+ }
41
+ return undefined;
42
+ }
43
+ /**
44
+ * Clamp/validate a hint into safe values.
45
+ */
46
+ export function normalizeHint(hint) {
47
+ const out = {};
48
+ if (typeof hint.ttlMs === 'number' && Number.isFinite(hint.ttlMs) && hint.ttlMs >= 0) {
49
+ out.ttlMs = Math.floor(hint.ttlMs);
50
+ }
51
+ if (hint.cacheScope === 'public' || hint.cacheScope === 'private') {
52
+ out.cacheScope = hint.cacheScope;
53
+ }
54
+ return out;
55
+ }
56
+ //# sourceMappingURL=cache-hints.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cache-hints.js","sourceRoot":"","sources":["../../../../src/core/protocol/features/cache-hints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAqCH;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QACtG,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA+B;IACtE,IAAI,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,UAAU,KAAK,SAAS,CAAC,EAAE,CAAC;QAClH,OAAO,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoB;IAChD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -0,0 +1,34 @@
1
+ /**
2
+ * Era-aware JSON-RPC error mapping.
3
+ *
4
+ * The 2026-07-28 revision changed the error for a missing resource
5
+ * (SEP-2164): `resources/read` on an unknown URI now returns `-32602`
6
+ * (Invalid Params) instead of the 2025-era `-32002` (Resource Not Found).
7
+ * NitroStack keeps the 2025 mapping on the legacy path; the modern adapter
8
+ * uses `mapToJsonRpcError` so its handlers throw the right code.
9
+ *
10
+ * @module
11
+ */
12
+ /** Standard JSON-RPC / MCP error codes. */
13
+ export declare const JSON_RPC: {
14
+ readonly PARSE_ERROR: -32700;
15
+ readonly INVALID_REQUEST: -32600;
16
+ readonly METHOD_NOT_FOUND: -32601;
17
+ readonly INVALID_PARAMS: -32602;
18
+ readonly INTERNAL_ERROR: -32603;
19
+ /** SEP-2243: request header/body mismatch. */
20
+ readonly HEADER_BODY_MISMATCH: -32020;
21
+ };
22
+ /** A JSON-RPC error object. */
23
+ export interface JsonRpcError {
24
+ code: number;
25
+ message: string;
26
+ data?: unknown;
27
+ }
28
+ /**
29
+ * Map a thrown error to a JSON-RPC error for the modern (2026-07-28) path.
30
+ *
31
+ * Key difference vs legacy: `ResourceNotFoundError` → `-32602` (SEP-2164).
32
+ */
33
+ export declare function mapToJsonRpcError(error: unknown): JsonRpcError;
34
+ //# sourceMappingURL=errors.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAWH,2CAA2C;AAC3C,eAAO,MAAM,QAAQ;;;;;;IAMnB,8CAA8C;;CAEtC,CAAC;AAEX,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAmB9D"}
@@ -0,0 +1,48 @@
1
+ /**
2
+ * Era-aware JSON-RPC error mapping.
3
+ *
4
+ * The 2026-07-28 revision changed the error for a missing resource
5
+ * (SEP-2164): `resources/read` on an unknown URI now returns `-32602`
6
+ * (Invalid Params) instead of the 2025-era `-32002` (Resource Not Found).
7
+ * NitroStack keeps the 2025 mapping on the legacy path; the modern adapter
8
+ * uses `mapToJsonRpcError` so its handlers throw the right code.
9
+ *
10
+ * @module
11
+ */
12
+ import { McpError, ValidationError, ToolNotFoundError, ResourceNotFoundError, PromptNotFoundError, RateLimitError, } from '../../errors.js';
13
+ /** Standard JSON-RPC / MCP error codes. */
14
+ export const JSON_RPC = {
15
+ PARSE_ERROR: -32700,
16
+ INVALID_REQUEST: -32600,
17
+ METHOD_NOT_FOUND: -32601,
18
+ INVALID_PARAMS: -32602,
19
+ INTERNAL_ERROR: -32603,
20
+ /** SEP-2243: request header/body mismatch. */
21
+ HEADER_BODY_MISMATCH: -32020,
22
+ };
23
+ /**
24
+ * Map a thrown error to a JSON-RPC error for the modern (2026-07-28) path.
25
+ *
26
+ * Key difference vs legacy: `ResourceNotFoundError` → `-32602` (SEP-2164).
27
+ */
28
+ export function mapToJsonRpcError(error) {
29
+ if (error instanceof ResourceNotFoundError) {
30
+ // SEP-2164: unknown resource is Invalid Params on 2026-07-28.
31
+ return { code: JSON_RPC.INVALID_PARAMS, message: error.message };
32
+ }
33
+ if (error instanceof ValidationError) {
34
+ return { code: JSON_RPC.INVALID_PARAMS, message: error.message, data: error.details };
35
+ }
36
+ if (error instanceof ToolNotFoundError || error instanceof PromptNotFoundError) {
37
+ return { code: JSON_RPC.METHOD_NOT_FOUND, message: error.message };
38
+ }
39
+ if (error instanceof RateLimitError) {
40
+ return { code: JSON_RPC.INTERNAL_ERROR, message: error.message };
41
+ }
42
+ if (error instanceof McpError) {
43
+ return { code: JSON_RPC.INTERNAL_ERROR, message: error.message, data: error.details };
44
+ }
45
+ const message = error instanceof Error ? error.message : String(error);
46
+ return { code: JSON_RPC.INTERNAL_ERROR, message };
47
+ }
48
+ //# sourceMappingURL=errors.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/core/protocol/features/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,2CAA2C;AAC3C,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;IACtB,8CAA8C;IAC9C,oBAAoB,EAAE,CAAC,KAAK;CACpB,CAAC;AASX;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,IAAI,KAAK,YAAY,qBAAqB,EAAE,CAAC;QAC3C,8DAA8D;QAC9D,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;QACrC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC;AACpD,CAAC"}
@@ -0,0 +1,39 @@
1
+ /**
2
+ * SEP-2133 extensions map (modern path).
3
+ *
4
+ * On 2026-07-28, capabilities that used to be baked into the core spec are
5
+ * negotiated as named extensions advertised on `server/discover`. NitroStack
6
+ * derives this map from what the app actually registered:
7
+ *
8
+ * - `io.modelcontextprotocol/app` — advertised when any tool ships a UI
9
+ * component / `@Widget` (MCP Apps).
10
+ * - `io.modelcontextprotocol/tasks` — advertised when any tool declares
11
+ * `taskSupport` other than `forbidden`.
12
+ *
13
+ * Apps may declare extra extensions via `@McpApp({ extensions })`, which are
14
+ * merged in verbatim.
15
+ *
16
+ * @module
17
+ */
18
+ /** Canonical extension identifier for MCP Apps. */
19
+ export declare const EXT_APP = "io.modelcontextprotocol/app";
20
+ /** Canonical extension identifier for the Tasks extension. */
21
+ export declare const EXT_TASKS = "io.modelcontextprotocol/tasks";
22
+ /** Per-extension advertisement payload (opaque capability object). */
23
+ export type ExtensionEntry = Record<string, unknown>;
24
+ /** The `extensions` capabilities map advertised on `server/discover`. */
25
+ export type ExtensionsMap = Record<string, ExtensionEntry>;
26
+ /** Inputs used to derive the advertised extensions. */
27
+ export interface ExtensionSignals {
28
+ /** True when at least one tool is task-capable. */
29
+ hasTasks: boolean;
30
+ /** True when at least one tool ships a UI component/widget. */
31
+ hasApps: boolean;
32
+ /** Extra extensions declared by the app author. */
33
+ declared?: ExtensionsMap;
34
+ }
35
+ /**
36
+ * Build the extensions capability map for `server/discover`.
37
+ */
38
+ export declare function buildExtensionsMap(signals: ExtensionSignals): ExtensionsMap;
39
+ //# sourceMappingURL=extensions.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"extensions.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mDAAmD;AACnD,eAAO,MAAM,OAAO,gCAAgC,CAAC;AACrD,8DAA8D;AAC9D,eAAO,MAAM,SAAS,kCAAkC,CAAC;AAEzD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAErD,yEAAyE;AACzE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE3D,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,QAAQ,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,mDAAmD;IACnD,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,aAAa,CAkB3E"}
@@ -0,0 +1,42 @@
1
+ /**
2
+ * SEP-2133 extensions map (modern path).
3
+ *
4
+ * On 2026-07-28, capabilities that used to be baked into the core spec are
5
+ * negotiated as named extensions advertised on `server/discover`. NitroStack
6
+ * derives this map from what the app actually registered:
7
+ *
8
+ * - `io.modelcontextprotocol/app` — advertised when any tool ships a UI
9
+ * component / `@Widget` (MCP Apps).
10
+ * - `io.modelcontextprotocol/tasks` — advertised when any tool declares
11
+ * `taskSupport` other than `forbidden`.
12
+ *
13
+ * Apps may declare extra extensions via `@McpApp({ extensions })`, which are
14
+ * merged in verbatim.
15
+ *
16
+ * @module
17
+ */
18
+ /** Canonical extension identifier for MCP Apps. */
19
+ export const EXT_APP = 'io.modelcontextprotocol/app';
20
+ /** Canonical extension identifier for the Tasks extension. */
21
+ export const EXT_TASKS = 'io.modelcontextprotocol/tasks';
22
+ /**
23
+ * Build the extensions capability map for `server/discover`.
24
+ */
25
+ export function buildExtensionsMap(signals) {
26
+ const map = {};
27
+ if (signals.hasApps) {
28
+ map[EXT_APP] = { version: '2026-07-28' };
29
+ }
30
+ if (signals.hasTasks) {
31
+ // Tasks extension: server-directed task creation is supported; the
32
+ // in-process TaskManager answers tasks/get, tasks/update, tasks/cancel.
33
+ map[EXT_TASKS] = { version: '2026-07-28' };
34
+ }
35
+ if (signals.declared) {
36
+ for (const [id, entry] of Object.entries(signals.declared)) {
37
+ map[id] = { ...(map[id] || {}), ...entry };
38
+ }
39
+ }
40
+ return map;
41
+ }
42
+ //# sourceMappingURL=extensions.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"extensions.js","sourceRoot":"","sources":["../../../../src/core/protocol/features/extensions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,mDAAmD;AACnD,MAAM,CAAC,MAAM,OAAO,GAAG,6BAA6B,CAAC;AACrD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAkBzD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,GAAG,GAAkB,EAAE,CAAC;IAE9B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,mEAAmE;QACnE,wEAAwE;QACxE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -0,0 +1,75 @@
1
+ /**
2
+ * SEP-2322 Multi Round-Trip Requests (MRTR).
3
+ *
4
+ * On 2026-07-28 a handler can pause and ask the client for more input without a
5
+ * persistent connection: it returns an `input_required` result carrying
6
+ * `inputRequests` and an opaque `requestState`; the client re-invokes the same
7
+ * request with `inputResponses` (plus the echoed `requestState`).
8
+ *
9
+ * NitroStack has no elicitation/sampling handlers today, so this is a net-new,
10
+ * additive API. Handlers are written **once**: they call `inputRequired(...)`
11
+ * and read prior answers with `acceptedContent(...)`. These helpers produce an
12
+ * era-agnostic marker object; the modern adapter translates it into the real
13
+ * v2 `InputRequiredResult`, while the legacy adapter surfaces it via the
14
+ * session stream (or treats it as an error result if the client cannot elicit).
15
+ *
16
+ * @module
17
+ */
18
+ import type { JsonValue } from '../../types.js';
19
+ /** Marker symbol identifying a NitroStack input-required result. */
20
+ export declare const NITRO_INPUT_REQUIRED: unique symbol;
21
+ /**
22
+ * A single request for client-provided input (elicitation-style).
23
+ */
24
+ export interface NitroInputRequest {
25
+ /** Identifier the client echoes back in `inputResponses`. */
26
+ id: string;
27
+ /** Human-facing message describing what is being asked. */
28
+ message?: string;
29
+ /** JSON Schema describing the expected response shape. */
30
+ schema?: Record<string, JsonValue>;
31
+ /** Optional request kind (defaults to form elicitation). */
32
+ kind?: 'form' | 'url';
33
+ /** For `url` elicitations, the URL the user must visit. */
34
+ url?: string;
35
+ }
36
+ /**
37
+ * The era-agnostic input-required marker returned by `inputRequired()`.
38
+ */
39
+ export interface NitroInputRequiredResult {
40
+ [NITRO_INPUT_REQUIRED]: true;
41
+ inputRequests: NitroInputRequest[];
42
+ /** Opaque state echoed to the client and returned on retry. */
43
+ requestState?: JsonValue;
44
+ /** Optional message shown alongside the requests. */
45
+ message?: string;
46
+ }
47
+ /**
48
+ * Signal that a handler needs more input from the client before it can finish.
49
+ *
50
+ * @example
51
+ * ```ts
52
+ * if (!acceptedContent(ctx.inputResponses, 'confirm')) {
53
+ * return inputRequired({
54
+ * requests: [{ id: 'confirm', message: 'Delete all rows?', schema: { type: 'boolean' } }],
55
+ * requestState: { pendingDelete: table },
56
+ * });
57
+ * }
58
+ * ```
59
+ */
60
+ export declare function inputRequired(spec: {
61
+ requests: NitroInputRequest[];
62
+ requestState?: JsonValue;
63
+ message?: string;
64
+ }): NitroInputRequiredResult;
65
+ /**
66
+ * Type guard for the input-required marker.
67
+ */
68
+ export declare function isInputRequired(value: unknown): value is NitroInputRequiredResult;
69
+ /**
70
+ * Read a previously-supplied input response by id from `ctx.inputResponses`.
71
+ * Returns `undefined` when the client has not answered that request yet, which
72
+ * is the signal to return `inputRequired(...)`.
73
+ */
74
+ export declare function acceptedContent<T = JsonValue>(inputResponses: Record<string, unknown> | undefined, id: string): T | undefined;
75
+ //# sourceMappingURL=mrtr.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mrtr.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/mrtr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,oBAAoB,eAAyC,CAAC;AAE3E;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,6DAA6D;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACnC,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IACtB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,CAAC,oBAAoB,CAAC,EAAE,IAAI,CAAC;IAC7B,aAAa,EAAE,iBAAiB,EAAE,CAAC;IACnC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAClC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,wBAAwB,CAO3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,wBAAwB,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,CAAC,GAAG,SAAS,EAC3C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACnD,EAAE,EAAE,MAAM,GACT,CAAC,GAAG,SAAS,CAaf"}
@@ -0,0 +1,66 @@
1
+ /**
2
+ * SEP-2322 Multi Round-Trip Requests (MRTR).
3
+ *
4
+ * On 2026-07-28 a handler can pause and ask the client for more input without a
5
+ * persistent connection: it returns an `input_required` result carrying
6
+ * `inputRequests` and an opaque `requestState`; the client re-invokes the same
7
+ * request with `inputResponses` (plus the echoed `requestState`).
8
+ *
9
+ * NitroStack has no elicitation/sampling handlers today, so this is a net-new,
10
+ * additive API. Handlers are written **once**: they call `inputRequired(...)`
11
+ * and read prior answers with `acceptedContent(...)`. These helpers produce an
12
+ * era-agnostic marker object; the modern adapter translates it into the real
13
+ * v2 `InputRequiredResult`, while the legacy adapter surfaces it via the
14
+ * session stream (or treats it as an error result if the client cannot elicit).
15
+ *
16
+ * @module
17
+ */
18
+ /** Marker symbol identifying a NitroStack input-required result. */
19
+ export const NITRO_INPUT_REQUIRED = Symbol.for('nitrostack.inputRequired');
20
+ /**
21
+ * Signal that a handler needs more input from the client before it can finish.
22
+ *
23
+ * @example
24
+ * ```ts
25
+ * if (!acceptedContent(ctx.inputResponses, 'confirm')) {
26
+ * return inputRequired({
27
+ * requests: [{ id: 'confirm', message: 'Delete all rows?', schema: { type: 'boolean' } }],
28
+ * requestState: { pendingDelete: table },
29
+ * });
30
+ * }
31
+ * ```
32
+ */
33
+ export function inputRequired(spec) {
34
+ return {
35
+ [NITRO_INPUT_REQUIRED]: true,
36
+ inputRequests: spec.requests,
37
+ requestState: spec.requestState,
38
+ message: spec.message,
39
+ };
40
+ }
41
+ /**
42
+ * Type guard for the input-required marker.
43
+ */
44
+ export function isInputRequired(value) {
45
+ return !!value && typeof value === 'object' && value[NITRO_INPUT_REQUIRED] === true;
46
+ }
47
+ /**
48
+ * Read a previously-supplied input response by id from `ctx.inputResponses`.
49
+ * Returns `undefined` when the client has not answered that request yet, which
50
+ * is the signal to return `inputRequired(...)`.
51
+ */
52
+ export function acceptedContent(inputResponses, id) {
53
+ if (!inputResponses || typeof inputResponses !== 'object') {
54
+ return undefined;
55
+ }
56
+ const entry = inputResponses[id];
57
+ if (entry === undefined || entry === null) {
58
+ return undefined;
59
+ }
60
+ // Responses may be bare values or `{ content: ... }` wrappers.
61
+ if (typeof entry === 'object' && entry !== null && 'content' in entry) {
62
+ return entry.content;
63
+ }
64
+ return entry;
65
+ }
66
+ //# sourceMappingURL=mrtr.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mrtr.js","sourceRoot":"","sources":["../../../../src/core/protocol/features/mrtr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;AA8B3E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,IAI7B;IACC,OAAO;QACL,CAAC,oBAAoB,CAAC,EAAE,IAAI;QAC5B,aAAa,EAAE,IAAI,CAAC,QAAQ;QAC5B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAiC,CAAC,oBAAoB,CAAC,KAAK,IAAI,CAAC;AACnH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,cAAmD,EACnD,EAAU;IAEV,IAAI,CAAC,cAAc,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,+DAA+D;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,IAAK,KAAgB,EAAE,CAAC;QAClF,OAAQ,KAAwB,CAAC,OAAO,CAAC;IAC3C,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC"}
@@ -0,0 +1,39 @@
1
+ /**
2
+ * SEP-2106 full JSON Schema 2020-12 for tools (modern path only).
3
+ *
4
+ * The legacy path converts Zod with `target: 'jsonSchema7'` and inlines refs
5
+ * (`$refStrategy: 'none'`), forcing `type: "object"` on both input and output —
6
+ * unchanged so 2025-era clients never see unexpected keywords.
7
+ *
8
+ * On 2026-07-28 tool schemas are lifted to full JSON Schema 2020-12:
9
+ * - input keeps an object root but may carry `oneOf`/`anyOf`/`allOf`,
10
+ * conditionals, and `$ref`/`$defs`
11
+ * - output is unrestricted (not forced to an object)
12
+ * - external `$ref` URIs are never auto-dereferenced and schema depth is bounded
13
+ *
14
+ * @module
15
+ */
16
+ /** JSON Schema object (loose). */
17
+ export type JsonSchemaObject = Record<string, unknown>;
18
+ /** Maximum schema nesting depth accepted on the modern path (DoS guard). */
19
+ export declare const MAX_SCHEMA_DEPTH = 64;
20
+ /**
21
+ * Bound the depth of a JSON schema object, replacing anything deeper than
22
+ * `maxDepth` with a permissive `{}` so a pathological `$defs` graph cannot blow
23
+ * the stack or the validator. External `$ref` URIs are left intact but are
24
+ * never dereferenced by NitroStack.
25
+ */
26
+ export declare function boundSchemaDepth(value: unknown, maxDepth?: number, depth?: number): unknown;
27
+ /**
28
+ * Convert a Zod or JSON schema to JSON Schema 2020-12 for the modern era,
29
+ * preserving composition (`oneOf`/`anyOf`/`allOf`), conditionals, and
30
+ * `$ref`/`$defs`.
31
+ *
32
+ * @param schema - Zod schema or a pre-built JSON schema.
33
+ * @param opts.root - `'input'` forces an object root (spec requirement for tool
34
+ * input); `'output'` leaves the schema unrestricted.
35
+ */
36
+ export declare function convertToModernJsonSchema(schema: unknown, opts: {
37
+ root: 'input' | 'output';
38
+ }): Promise<JsonSchemaObject>;
39
+ //# sourceMappingURL=schema.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,kCAAkC;AAClC,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEvD,4EAA4E;AAC5E,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAMnC;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAmB,EAAE,KAAK,SAAI,GAAG,OAAO,CAehG;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,OAAO,EACf,IAAI,EAAE;IAAE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;CAAE,GACjC,OAAO,CAAC,gBAAgB,CAAC,CA2C3B"}
@@ -0,0 +1,96 @@
1
+ /**
2
+ * SEP-2106 full JSON Schema 2020-12 for tools (modern path only).
3
+ *
4
+ * The legacy path converts Zod with `target: 'jsonSchema7'` and inlines refs
5
+ * (`$refStrategy: 'none'`), forcing `type: "object"` on both input and output —
6
+ * unchanged so 2025-era clients never see unexpected keywords.
7
+ *
8
+ * On 2026-07-28 tool schemas are lifted to full JSON Schema 2020-12:
9
+ * - input keeps an object root but may carry `oneOf`/`anyOf`/`allOf`,
10
+ * conditionals, and `$ref`/`$defs`
11
+ * - output is unrestricted (not forced to an object)
12
+ * - external `$ref` URIs are never auto-dereferenced and schema depth is bounded
13
+ *
14
+ * @module
15
+ */
16
+ /** Maximum schema nesting depth accepted on the modern path (DoS guard). */
17
+ export const MAX_SCHEMA_DEPTH = 64;
18
+ function isZodSchema(schema) {
19
+ return !!schema && typeof schema === 'object' && '_def' in schema;
20
+ }
21
+ /**
22
+ * Bound the depth of a JSON schema object, replacing anything deeper than
23
+ * `maxDepth` with a permissive `{}` so a pathological `$defs` graph cannot blow
24
+ * the stack or the validator. External `$ref` URIs are left intact but are
25
+ * never dereferenced by NitroStack.
26
+ */
27
+ export function boundSchemaDepth(value, maxDepth = MAX_SCHEMA_DEPTH, depth = 0) {
28
+ if (value === null || typeof value !== 'object') {
29
+ return value;
30
+ }
31
+ if (depth >= maxDepth) {
32
+ return {};
33
+ }
34
+ if (Array.isArray(value)) {
35
+ return value.map((v) => boundSchemaDepth(v, maxDepth, depth + 1));
36
+ }
37
+ const out = {};
38
+ for (const [k, v] of Object.entries(value)) {
39
+ out[k] = boundSchemaDepth(v, maxDepth, depth + 1);
40
+ }
41
+ return out;
42
+ }
43
+ /**
44
+ * Convert a Zod or JSON schema to JSON Schema 2020-12 for the modern era,
45
+ * preserving composition (`oneOf`/`anyOf`/`allOf`), conditionals, and
46
+ * `$ref`/`$defs`.
47
+ *
48
+ * @param schema - Zod schema or a pre-built JSON schema.
49
+ * @param opts.root - `'input'` forces an object root (spec requirement for tool
50
+ * input); `'output'` leaves the schema unrestricted.
51
+ */
52
+ export async function convertToModernJsonSchema(schema, opts) {
53
+ let json;
54
+ if (isZodSchema(schema)) {
55
+ try {
56
+ const mod = await import('zod-to-json-schema');
57
+ const zodToJsonSchema = mod.zodToJsonSchema
58
+ || mod.default;
59
+ // 2019-09 target keeps $ref/$defs and composition (closest widely-supported
60
+ // preset to 2020-12 in zod-to-json-schema); root strategy emits $defs.
61
+ json = zodToJsonSchema(schema, {
62
+ target: 'jsonSchema2019-09',
63
+ $refStrategy: 'root',
64
+ });
65
+ // Advertise the 2020-12 dialect explicitly (SEP-2106). zod-to-json-schema
66
+ // stamps a 2019-09 `$schema`; the emitted keywords are 2020-12-compatible
67
+ // for tool schemas, so relabel to the revision the spec requires.
68
+ json.$schema = 'https://json-schema.org/draft/2020-12/schema';
69
+ }
70
+ catch {
71
+ json = { type: 'object', properties: {}, additionalProperties: true };
72
+ }
73
+ }
74
+ else if (schema && typeof schema === 'object') {
75
+ json = { ...schema };
76
+ }
77
+ else {
78
+ json = {};
79
+ }
80
+ json = boundSchemaDepth(json);
81
+ if (opts.root === 'input') {
82
+ // Input schema root must be an object per spec; composition/refs are allowed
83
+ // alongside it but the root type stays 'object'.
84
+ if (!('type' in json) && !('$ref' in json)) {
85
+ json.type = 'object';
86
+ }
87
+ else if (json.type && json.type !== 'object') {
88
+ json.type = 'object';
89
+ }
90
+ // Allow additionalProperties on input schemas so clients (ChatGPT, Codex, Studio)
91
+ // passing _meta and other contextual parameters are not rejected with INVALID_ARGUMENT (-32602).
92
+ json.additionalProperties = true;
93
+ }
94
+ return json;
95
+ }
96
+ //# sourceMappingURL=schema.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../../src/core/protocol/features/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,SAAS,WAAW,CAAC,MAAe;IAClC,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAK,MAAiB,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,QAAQ,GAAG,gBAAgB,EAAE,KAAK,GAAG,CAAC;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAe,EACf,IAAkC;IAElC,IAAI,IAAsB,CAAC;IAE3B,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC/C,MAAM,eAAe,GAAI,GAAwD,CAAC,eAAe;mBAC3F,GAA6B,CAAC,OAAO,CAAC;YAC5C,4EAA4E;YAC5E,uEAAuE;YACvE,IAAI,GAAI,eAAgE,CAAC,MAAM,EAAE;gBAC/E,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,MAAM;aACrB,CAAC,CAAC;YACH,0EAA0E;YAC1E,0EAA0E;YAC1E,kEAAkE;YAClE,IAAI,CAAC,OAAO,GAAG,8CAA8C,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAChD,IAAI,GAAG,EAAE,GAAI,MAA2B,EAAE,CAAC;IAC7C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAqB,CAAC;IAElD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,6EAA6E;QAC7E,iDAAiD;QACjD,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,CAAC;QACD,kFAAkF;QAClF,iGAAiG;QACjG,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACnC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
@@ -0,0 +1,31 @@
1
+ /**
2
+ * SEP-414 W3C Trace Context propagation.
3
+ *
4
+ * On the 2026-07-28 revision, distributed-tracing keys travel in the per-request
5
+ * `_meta` envelope under fixed names: `traceparent`, `tracestate`, `baggage`.
6
+ * NitroStack lifts them into `ExecutionContext.trace` so guards, interceptors,
7
+ * and loggers can correlate a tool call across the host, this server, and any
8
+ * downstream call — without NitroStack introducing its own tracing backend.
9
+ *
10
+ * @module
11
+ */
12
+ /**
13
+ * W3C Trace Context extracted from a request `_meta` envelope.
14
+ */
15
+ export interface TraceContext {
16
+ /** `traceparent` header value (W3C Trace Context). */
17
+ traceparent?: string;
18
+ /** `tracestate` header value. */
19
+ tracestate?: string;
20
+ /** `baggage` header value (W3C Baggage). */
21
+ baggage?: string;
22
+ }
23
+ /**
24
+ * Extract a `TraceContext` from an envelope/meta object, or `undefined` when no
25
+ * trace keys are present. Accepts either the lifted `_meta` envelope
26
+ * (`ctx.mcpReq.envelope`) or a raw `_meta` record; both the bare
27
+ * (`traceparent`) and reverse-DNS (`io.modelcontextprotocol/traceparent`)
28
+ * forms are recognized.
29
+ */
30
+ export declare function extractTraceContext(source: Record<string, unknown> | undefined | null): TraceContext | undefined;
31
+ //# sourceMappingURL=trace-context.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"trace-context.d.ts","sourceRoot":"","sources":["../../../../src/core/protocol/features/trace-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,GACjD,YAAY,GAAG,SAAS,CAqB1B"}