@nocobase/plugin-mcp-server 2.1.0-alpha.16 → 2.1.0-alpha.18

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/util/errors.ts

@@ -1,5 +1,4 @@
-import { Ono } from "@jsdevtools/ono";
-import { stripHash, toFileSystemPath } from "./url.js";
+import { getHash, stripHash, toFileSystemPath } from "./url.js";
 import type $RefParser from "../index.js";
 import type { ParserOptions } from "../index.js";
 import type { JSONSchema } from "../index.js";
@@ -14,7 +13,57 @@ export type JSONParserErrorType =
   | "EUNMATCHEDRESOLVER"
   | "EMISSINGPOINTER"
   | "EINVALIDPOINTER";
+const nonJsonTypes = ["function", "symbol", "undefined"];
+const protectedProps = ["constructor", "prototype", "__proto__"];
+const objectPrototype = Object.getPrototypeOf({});
+
+/**
+ * Custom JSON serializer for Error objects.
+ * Returns all built-in error properties, as well as extended properties.
+ */
+export function toJSON<T extends Error>(this: T): Error & T {
+  // HACK: We have to cast the objects to `any` so we can use symbol indexers.
+  // see https://github.com/Microsoft/TypeScript/issues/1863
+  const pojo: any = {};
+  const error = this as any;
+
+  for (const key of getDeepKeys(error)) {
+    if (typeof key === "string") {
+      const value = error[key];
+      const type = typeof value;
+
+      if (!nonJsonTypes.includes(type)) {
+        pojo[key] = value;
+      }
+    }
+  }
+
+  return pojo as Error & T;
+}
+
+/**
+ * Returns own, inherited, enumerable, non-enumerable, string, and symbol keys of `obj`.
+ * Does NOT return members of the base Object prototype, or the specified omitted keys.
+ */
+export function getDeepKeys(obj: object, omit: Array<string | symbol> = []): Set<string | symbol> {
+  let keys: Array<string | symbol> = [];
+
+  // Crawl the prototype chain, finding all the string and symbol keys
+  while (obj && obj !== objectPrototype) {
+    keys = keys.concat(Object.getOwnPropertyNames(obj), Object.getOwnPropertySymbols(obj));
+    obj = Object.getPrototypeOf(obj) as object;
+  }
+
+  // De-duplicate the list of keys
+  const uniqueKeys = new Set(keys);
 
+  // Remove any omitted keys
+  for (const key of omit.concat(protectedProps)) {
+    uniqueKeys.delete(key);
+  }
+
+  return uniqueKeys;
+}
 export class JSONParserError extends Error {
   public readonly name: string;
   public readonly message: string;
@@ -29,10 +78,10 @@ export class JSONParserError extends Error {
     this.message = message;
     this.source = source;
     this.path = null;
-
-    Ono.extend(this);
   }
 
+  toJSON = toJSON.bind(this);
+
   get footprint() {
     return `${this.path}+${this.source}+${this.code}+${this.message}`;
   }
@@ -52,9 +101,8 @@ export class JSONParserErrorGroup<
     this.message = `${this.errors.length} error${
       this.errors.length > 1 ? "s" : ""
     } occurred while reading '${toFileSystemPath(parser.$refs._root$Ref!.path)}'`;
-
-    Ono.extend(this);
   }
+  toJSON = toJSON.bind(this);
 
   static getParserErrors<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
     parser: $RefParser<S, O>,
@@ -121,10 +169,19 @@ export class UnmatchedResolverError extends JSONParserError {
 }
 
 export class MissingPointerError extends JSONParserError {
-  code = "EUNMATCHEDRESOLVER" as JSONParserErrorType;
+  code = "EMISSINGPOINTER" as JSONParserErrorType;
   name = "MissingPointerError";
-  constructor(token: any, path: any) {
-    super(`Token "${token}" does not exist.`, stripHash(path));
+  public targetToken: any;
+  public targetRef: string;
+  public targetFound: string;
+  public parentPath: string;
+  constructor(token: any, path: any, targetRef: any, targetFound: any, parentPath: any) {
+    super(`Missing $ref pointer "${getHash(path)}". Token "${token}" does not exist.`, stripHash(path));
+
+    this.targetToken = token;
+    this.targetRef = targetRef;
+    this.targetFound = targetFound;
+    this.parentPath = parentPath;
   }
 }
 
@@ -139,7 +196,7 @@ export class TimeoutError extends JSONParserError {
 export class InvalidPointerError extends JSONParserError {
   code = "EUNMATCHEDRESOLVER" as JSONParserErrorType;
   name = "InvalidPointerError";
-  constructor(pointer: any, path: any) {
+  constructor(pointer: string, path: string) {
     super(`Invalid $ref pointer "${pointer}". Pointers must begin with "#/"`, stripHash(path));
   }
 }

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/util/plugins.ts

@@ -45,8 +45,7 @@ export function sort(plugins: Plugin[]) {
   });
 }
 
-// @ts-ignore
-export interface PluginResult<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>> {
+export interface PluginResult<S extends object = JSONSchema> {
   plugin: Plugin;
   result?: string | Buffer | S;
   error?: any;
@@ -67,10 +66,10 @@ export async function run<S extends object = JSONSchema, O extends ParserOptions
   $refs: $Refs<S, O>,
 ) {
   let plugin: Plugin;
-  let lastError: PluginResult<S, O>;
+  let lastError: PluginResult<S>;
   let index = 0;
 
-  return new Promise<PluginResult<S, O>>((resolve, reject) => {
+  return new Promise<PluginResult<S>>((resolve, reject) => {
     runNextPlugin();
 
     function runNextPlugin() {
@@ -97,7 +96,7 @@ export async function run<S extends object = JSONSchema, O extends ParserOptions
       }
     }
 
-    function callback(err: PluginResult<S, O>["error"], result: PluginResult<S, O>["result"]) {
+    function callback(err: PluginResult<S>["error"], result: PluginResult<S>["result"]) {
       if (err) {
         onError(err);
       } else {
@@ -105,7 +104,7 @@ export async function run<S extends object = JSONSchema, O extends ParserOptions
       }
     }
 
-    function onSuccess(result: PluginResult<S, O>["result"]) {
+    function onSuccess(result: PluginResult<S>["result"]) {
       // console.log('    success');
       resolve({
         plugin,
@@ -113,7 +112,7 @@ export async function run<S extends object = JSONSchema, O extends ParserOptions
       });
     }
 
-    function onError(error: PluginResult<S, O>["error"]) {
+    function onError(error: PluginResult<S>["error"]) {
       // console.log('    %s', err.message || err);
       lastError = {
         plugin,

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/util/url.ts

@@ -26,10 +26,11 @@ export const parse = (u: string | URL) => new URL(u);
  * @returns
  */
 export function resolve(from: string, to: string) {
-  const fromUrl = new URL(convertPathToPosix(from), "resolve://");
+  // we use a non-existent URL to check if its a relative URL
+  const fromUrl = new URL(convertPathToPosix(from), "https://aaa.nonexistanturl.com");
   const resolvedUrl = new URL(convertPathToPosix(to), fromUrl);
   const endSpaces = to.match(/(\s*)$/)?.[1] || "";
-  if (resolvedUrl.protocol === "resolve:") {
+  if (resolvedUrl.hostname === "aaa.nonexistanturl.com") {
     // `from` is a relative URL.
     const { pathname, search, hash } = resolvedUrl;
     return pathname + search + hash + endSpaces;
@@ -43,18 +44,31 @@ export function resolve(from: string, to: string) {
  * @returns
  */
 export function cwd() {
-  if (typeof window !== "undefined") {
-    return location.href;
+  if (typeof window !== "undefined" && window.location && window.location.href) {
+    const href = window.location.href;
+    if (!href || !href.startsWith("http")) {
+      // try parsing as url, and if it fails, return root url /
+      try {
+        new URL(href);
+        return href;
+      } catch {
+        return "/";
+      }
+    }
+    return href;
   }
 
-  const path = process.cwd();
+  if (typeof process !== "undefined" && process.cwd) {
+    const path = process.cwd();
 
-  const lastChar = path.slice(-1);
-  if (lastChar === "/" || lastChar === "\\") {
-    return path;
-  } else {
-    return path + "/";
+    const lastChar = path.slice(-1);
+    if (lastChar === "/" || lastChar === "\\") {
+      return path;
+    } else {
+      return path + "/";
+    }
   }
+  return "/";
 }
 
 /**
@@ -153,7 +167,178 @@ export function isHttp(path: string) {
     return false;
   }
 }
+/**
+ * Determines whether the given url is an unsafe or internal url.
+ *
+ * @param path - The URL or path to check
+ * @returns true if the URL is unsafe/internal, false otherwise
+ */
+export function isUnsafeUrl(path: string): boolean {
+  if (!path || typeof path !== "string") {
+    return true;
+  }
+
+  // Trim whitespace and convert to lowercase for comparison
+  const normalizedPath = path.trim().toLowerCase();
+
+  // Empty or just whitespace
+  if (!normalizedPath) {
+    return true;
+  }
+
+  // JavaScript protocols
+  if (
+    normalizedPath.startsWith("javascript:") ||
+    normalizedPath.startsWith("vbscript:") ||
+    normalizedPath.startsWith("data:")
+  ) {
+    return true;
+  }
+
+  // File protocol
+  if (normalizedPath.startsWith("file:")) {
+    return true;
+  }
+
+  // if we're in the browser, we assume that it is safe
+  if (typeof window !== "undefined" && window.location && window.location.href) {
+    return false;
+  }
+
+  // Local/internal network addresses
+  const localPatterns = [
+    // Localhost variations
+    "localhost",
+    "127.0.0.1",
+    "::1",
+
+    // Private IP ranges (RFC 1918)
+    "10.",
+    "172.16.",
+    "172.17.",
+    "172.18.",
+    "172.19.",
+    "172.20.",
+    "172.21.",
+    "172.22.",
+    "172.23.",
+    "172.24.",
+    "172.25.",
+    "172.26.",
+    "172.27.",
+    "172.28.",
+    "172.29.",
+    "172.30.",
+    "172.31.",
+    "192.168.",
+
+    // Link-local addresses
+    "169.254.",
+
+    // Internal domains
+    ".local",
+    ".internal",
+    ".intranet",
+    ".corp",
+    ".home",
+    ".lan",
+  ];
+
+  try {
+    // Try to parse as URL
+    const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
+
+    const hostname = url.hostname.toLowerCase();
+
+    // Check against local patterns
+    for (const pattern of localPatterns) {
+      if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
+        return true;
+      }
+    }
+
+    // Check for IP addresses in private ranges
+    if (isPrivateIP(hostname)) {
+      return true;
+    }
+
+    // Check for non-standard ports that might indicate internal services
+    const port = url.port;
+    if (port && isInternalPort(parseInt(port))) {
+      return true;
+    }
+  } catch (e) {
+    // If URL parsing fails, check if it's a relative path or contains suspicious patterns
+
+    // Relative paths starting with / are generally safe for same-origin
+    if (normalizedPath.startsWith("/") && !normalizedPath.startsWith("//")) {
+      return false;
+    }
+
+    // Check for localhost patterns in non-URL strings
+    for (const pattern of localPatterns) {
+      if (normalizedPath.includes(pattern)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Helper function to check if an IP address is in a private range
+ */
+function isPrivateIP(ip: string): boolean {
+  const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+  const match = ip.match(ipRegex);
+
+  if (!match) {
+    return false;
+  }
+
+  const [, a, b, c, d] = match.map(Number);
+
+  // Validate IP format
+  if (a > 255 || b > 255 || c > 255 || d > 255) {
+    return false;
+  }
+
+  // Private IP ranges
+  return (
+    a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
+  );
+}
 
+/**
+ * Helper function to check if a port is typically used for internal services
+ */
+function isInternalPort(port: number): boolean {
+  const internalPorts = [
+    22, // SSH
+    23, // Telnet
+    25, // SMTP
+    53, // DNS
+    135, // RPC
+    139, // NetBIOS
+    445, // SMB
+    993, // IMAPS
+    995, // POP3S
+    1433, // SQL Server
+    1521, // Oracle
+    3306, // MySQL
+    3389, // RDP
+    5432, // PostgreSQL
+    5900, // VNC
+    6379, // Redis
+    8080, // Common internal web
+    8443, // Common internal HTTPS
+    9200, // Elasticsearch
+    27017, // MongoDB
+  ];
+
+  return internalPorts.includes(port);
+}
 /**
  * Determines whether the given path is a filesystem path.
  * This includes "file://" URLs.

package/dist/node_modules/@apidevtools/json-schema-ref-parser/package.json

@@ -1,7 +1,19 @@
 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "11.7.2",
+  "version": "14.0.1",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
+  "scripts": {
+    "prepublishOnly": "yarn build",
+    "lint": "eslint lib",
+    "build": "rimraf dist && tsc",
+    "typecheck": "tsc --noEmit",
+    "prettier": "prettier --write \"**/*.+(js|jsx|ts|tsx|har||json|css|md)\"",
+    "test": "vitest --coverage",
+    "test:node": "yarn test",
+    "test:browser": "cross-env BROWSER=\"true\" yarn test",
+    "test:update": "vitest -u",
+    "test:watch": "vitest -w"
+  },
   "keywords": [
     "json",
     "schema",
@@ -34,7 +46,7 @@
       "email": "apis@jonlu.ca"
     }
   ],
-  "homepage": "https://apitools.dev/json-schema-ref-parser/",
+  "homepage": "https://apidevtools.com/json-schema-ref-parser/",
   "repository": {
     "type": "git",
     "url": "https://github.com/APIDevTools/json-schema-ref-parser.git"
@@ -54,45 +66,32 @@
     "dist",
     "cjs"
   ],
-  "scripts": {
-    "prepublishOnly": "yarn build",
-    "lint": "eslint lib",
-    "build": "rimraf dist && tsc",
-    "typecheck": "tsc --noEmit",
-    "prettier": "prettier --write \"**/*.+(js|jsx|ts|tsx|har||json|css|md)\"",
-    "test": "vitest --coverage",
-    "test:node": "yarn test",
-    "test:browser": "cross-env BROWSER=\"true\" yarn test",
-    "test:update": "vitest -u",
-    "test:watch": "vitest -w"
-  },
   "devDependencies": {
-    "@eslint/compat": "^1.1.1",
-    "@eslint/js": "^9.8.0",
-    "@types/eslint": "9.6.0",
+    "@eslint/compat": "^1.3.0",
+    "@eslint/js": "^9.29.0",
+    "@types/eslint": "^9.6.1",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^22",
-    "@typescript-eslint/eslint-plugin": "^8.0.0",
-    "@typescript-eslint/parser": "^8.0.0",
-    "@vitest/coverage-v8": "^2.0.5",
+    "@types/node": "^24",
+    "@typescript-eslint/eslint-plugin": "^8.34.1",
+    "@typescript-eslint/parser": "^8.34.1",
+    "@vitest/coverage-v8": "^3.2.3",
     "cross-env": "^7.0.3",
-    "eslint": "^9.8.0",
-    "eslint-config-prettier": "^9.1.0",
+    "eslint": "^9.29.0",
+    "eslint-config-prettier": "^10.1.5",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-prettier": "^5.2.1",
-    "eslint-plugin-promise": "^7.0.0",
-    "eslint-plugin-unused-imports": "^4.0.1",
-    "globals": "^15.9.0",
-    "jsdom": "^24.1.1",
-    "prettier": "^3.3.3",
+    "eslint-plugin-import": "^2.31.0",
+    "eslint-plugin-prettier": "^5.4.1",
+    "eslint-plugin-promise": "^7.2.1",
+    "eslint-plugin-unused-imports": "^4.1.4",
+    "globals": "^16.2.0",
+    "jsdom": "^26.1.0",
+    "prettier": "^3.5.3",
     "rimraf": "^6.0.1",
-    "typescript": "^5.5.4",
-    "typescript-eslint": "^8.0.0",
-    "vitest": "^2.0.5"
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.34.1",
+    "vitest": "^3.2.3"
   },
   "dependencies": {
-    "@jsdevtools/ono": "^7.1.3",
     "@types/json-schema": "^7.0.15",
     "js-yaml": "^4.1.0"
   },
@@ -107,5 +106,5 @@
       "@semantic-release/github"
     ]
   },
-  "packageManager": "yarn@4.2.2"
+  "packageManager": "yarn@4.9.1"
 }