@nocobase/plugin-mcp-server 2.1.0-alpha.19 → 2.1.0-alpha.20

package/dist/node_modules/@apidevtools/json-schema-ref-parser/dist/lib/util/url.js

@@ -15,23 +15,13 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
     o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -45,7 +35,6 @@ exports.stripQuery = stripQuery;
 exports.getHash = getHash;
 exports.stripHash = stripHash;
 exports.isHttp = isHttp;
-exports.isUnsafeUrl = isUnsafeUrl;
 exports.isFileSystemPath = isFileSystemPath;
 exports.fromFileSystemPath = fromFileSystemPath;
 exports.toFileSystemPath = toFileSystemPath;
@@ -74,11 +63,10 @@ exports.parse = parse;
  * @returns
  */
 function resolve(from, to) {
-    // we use a non-existent URL to check if its a relative URL
-    const fromUrl = new URL((0, convert_path_to_posix_1.default)(from), "https://aaa.nonexistanturl.com");
+    const fromUrl = new URL((0, convert_path_to_posix_1.default)(from), "resolve://");
     const resolvedUrl = new URL((0, convert_path_to_posix_1.default)(to), fromUrl);
     const endSpaces = to.match(/(\s*)$/)?.[1] || "";
-    if (resolvedUrl.hostname === "aaa.nonexistanturl.com") {
+    if (resolvedUrl.protocol === "resolve:") {
         // `from` is a relative URL.
         const { pathname, search, hash } = resolvedUrl;
         return pathname + search + hash + endSpaces;
@@ -91,31 +79,17 @@ function resolve(from, to) {
  * @returns
  */
 function cwd() {
-    if (typeof window !== "undefined" && window.location && window.location.href) {
-        const href = window.location.href;
-        if (!href || !href.startsWith("http")) {
-            // try parsing as url, and if it fails, return root url /
-            try {
-                new URL(href);
-                return href;
-            }
-            catch {
-                return "/";
-            }
-        }
-        return href;
+    if (typeof window !== "undefined") {
+        return location.href;
     }
-    if (typeof process !== "undefined" && process.cwd) {
-        const path = process.cwd();
-        const lastChar = path.slice(-1);
-        if (lastChar === "/" || lastChar === "\\") {
-            return path;
-        }
-        else {
-            return path + "/";
-        }
+    const path = process.cwd();
+    const lastChar = path.slice(-1);
+    if (lastChar === "/" || lastChar === "\\") {
+        return path;
+    }
+    else {
+        return path + "/";
     }
-    return "/";
 }
 /**
  * Returns the protocol of the given URL, or `undefined` if it has no protocol.
@@ -210,152 +184,6 @@ function isHttp(path) {
         return false;
     }
 }
-/**
- * Determines whether the given url is an unsafe or internal url.
- *
- * @param path - The URL or path to check
- * @returns true if the URL is unsafe/internal, false otherwise
- */
-function isUnsafeUrl(path) {
-    if (!path || typeof path !== "string") {
-        return true;
-    }
-    // Trim whitespace and convert to lowercase for comparison
-    const normalizedPath = path.trim().toLowerCase();
-    // Empty or just whitespace
-    if (!normalizedPath) {
-        return true;
-    }
-    // JavaScript protocols
-    if (normalizedPath.startsWith("javascript:") ||
-        normalizedPath.startsWith("vbscript:") ||
-        normalizedPath.startsWith("data:")) {
-        return true;
-    }
-    // File protocol
-    if (normalizedPath.startsWith("file:")) {
-        return true;
-    }
-    // if we're in the browser, we assume that it is safe
-    if (typeof window !== "undefined" && window.location && window.location.href) {
-        return false;
-    }
-    // Local/internal network addresses
-    const localPatterns = [
-        // Localhost variations
-        "localhost",
-        "127.0.0.1",
-        "::1",
-        // Private IP ranges (RFC 1918)
-        "10.",
-        "172.16.",
-        "172.17.",
-        "172.18.",
-        "172.19.",
-        "172.20.",
-        "172.21.",
-        "172.22.",
-        "172.23.",
-        "172.24.",
-        "172.25.",
-        "172.26.",
-        "172.27.",
-        "172.28.",
-        "172.29.",
-        "172.30.",
-        "172.31.",
-        "192.168.",
-        // Link-local addresses
-        "169.254.",
-        // Internal domains
-        ".local",
-        ".internal",
-        ".intranet",
-        ".corp",
-        ".home",
-        ".lan",
-    ];
-    try {
-        // Try to parse as URL
-        const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
-        const hostname = url.hostname.toLowerCase();
-        // Check against local patterns
-        for (const pattern of localPatterns) {
-            if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
-                return true;
-            }
-        }
-        // Check for IP addresses in private ranges
-        if (isPrivateIP(hostname)) {
-            return true;
-        }
-        // Check for non-standard ports that might indicate internal services
-        const port = url.port;
-        if (port && isInternalPort(parseInt(port))) {
-            return true;
-        }
-    }
-    catch (e) {
-        // If URL parsing fails, check if it's a relative path or contains suspicious patterns
-        // Relative paths starting with / are generally safe for same-origin
-        if (normalizedPath.startsWith("/") && !normalizedPath.startsWith("//")) {
-            return false;
-        }
-        // Check for localhost patterns in non-URL strings
-        for (const pattern of localPatterns) {
-            if (normalizedPath.includes(pattern)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-/**
- * Helper function to check if an IP address is in a private range
- */
-function isPrivateIP(ip) {
-    const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const match = ip.match(ipRegex);
-    if (!match) {
-        return false;
-    }
-    const [, a, b, c, d] = match.map(Number);
-    // Validate IP format
-    if (a > 255 || b > 255 || c > 255 || d > 255) {
-        return false;
-    }
-    // Private IP ranges
-    return (a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
-    );
-}
-/**
- * Helper function to check if a port is typically used for internal services
- */
-function isInternalPort(port) {
-    const internalPorts = [
-        22, // SSH
-        23, // Telnet
-        25, // SMTP
-        53, // DNS
-        135, // RPC
-        139, // NetBIOS
-        445, // SMB
-        993, // IMAPS
-        995, // POP3S
-        1433, // SQL Server
-        1521, // Oracle
-        3306, // MySQL
-        3389, // RDP
-        5432, // PostgreSQL
-        5900, // VNC
-        6379, // Redis
-        8080, // Common internal web
-        8443, // Common internal HTTPS
-        9200, // Elasticsearch
-        27017, // MongoDB
-    ];
-    return internalPorts.includes(port);
-}
 /**
  * Determines whether the given path is a filesystem path.
  * This includes "file://" URLs.

package/dist/node_modules/@apidevtools/json-schema-ref-parser/dist/vite.config.js

@@ -14,6 +14,5 @@ exports.default = (0, config_1.defineConfig)({
         passWithNoTests: true,
         reporters: ["verbose"],
         coverage: { reporter: ["lcov", "html", "text"] },
-        snapshotSerializers: ["./test/utils/serializeJson.ts"],
     },
 });

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/bundle.ts

@@ -76,9 +76,9 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
       const keys = Object.keys(obj).sort((a, b) => {
         // Most people will expect references to be bundled into the the "definitions" property,
         // so we always crawl that property first, if it exists.
-        if (a === "definitions" || a === "$defs") {
+        if (a === "definitions") {
           return -1;
-        } else if (b === "definitions" || b === "$defs") {
+        } else if (b === "definitions") {
           return 1;
         } else {
           // Otherwise, crawl the keys based on their length.
@@ -216,14 +216,8 @@ function remap(inventory: InventoryEntry[]) {
     } else {
       // Determine how far each $ref is from the "definitions" property.
       // Most people will expect references to be bundled into the the "definitions" property if possible.
-      const aDefinitionsIndex = Math.max(
-        a.pathFromRoot.lastIndexOf("/definitions"),
-        a.pathFromRoot.lastIndexOf("/$defs"),
-      );
-      const bDefinitionsIndex = Math.max(
-        b.pathFromRoot.lastIndexOf("/definitions"),
-        b.pathFromRoot.lastIndexOf("/$defs"),
-      );
+      const aDefinitionsIndex = a.pathFromRoot.lastIndexOf("/definitions");
+      const bDefinitionsIndex = b.pathFromRoot.lastIndexOf("/definitions");
 
       if (aDefinitionsIndex !== bDefinitionsIndex) {
         // Give higher priority to the $ref that's closer to the "definitions" property

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/dereference.ts

@@ -1,5 +1,6 @@
 import $Ref from "./ref.js";
 import Pointer from "./pointer.js";
+import { ono } from "@jsdevtools/ono";
 import * as url from "./util/url.js";
 import type $Refs from "./refs.js";
 import type { DereferenceOptions, ParserOptions } from "./options.js";
@@ -68,8 +69,11 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     circular: false,
   };
 
-  checkDereferenceTimeout<S, O>(startTime, options);
-
+  if (options && options.timeoutMs) {
+    if (Date.now() - startTime > options.timeoutMs) {
+      throw new TimeoutError(options.timeoutMs);
+    }
+  }
   const derefOptions = (options.dereference || {}) as DereferenceOptions;
   const isExcludedPath = derefOptions.excludedPathMatcher || (() => false);
 
@@ -94,8 +98,6 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
         result.value = dereferenced.value;
       } else {
         for (const key of Object.keys(obj)) {
-          checkDereferenceTimeout<S, O>(startTime, options);
-
           const keyPath = Pointer.join(path, key);
           const keyPathFromRoot = Pointer.join(pathFromRoot, key);
 
@@ -121,31 +123,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
             circular = dereferenced.circular;
             // Avoid pointless mutations; breaks frozen objects to no profit
             if (obj[key] !== dereferenced.value) {
-              // If we have properties we want to preserve from our dereferenced schema then we need
-              // to copy them over to our new object.
-              const preserved: Map<string, unknown> = new Map();
-              if (derefOptions?.preservedProperties) {
-                if (typeof obj[key] === "object" && !Array.isArray(obj[key])) {
-                  derefOptions?.preservedProperties.forEach((prop) => {
-                    if (prop in obj[key]) {
-                      preserved.set(prop, obj[key][prop]);
-                    }
-                  });
-                }
-              }
-
               obj[key] = dereferenced.value;
-
-              // If we have data to preserve and our dereferenced object is still an object then
-              // we need copy back our preserved data into our dereferenced schema.
-              if (derefOptions?.preservedProperties) {
-                if (preserved.size && typeof obj[key] === "object" && !Array.isArray(obj[key])) {
-                  preserved.forEach((value, prop) => {
-                    obj[key][prop] = value;
-                  });
-                }
-              }
-
               derefOptions?.onDereference?.(value.$ref, obj[key], obj, key);
             }
           } else {
@@ -212,53 +190,23 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   const $refPath = url.resolve(shouldResolveOnCwd ? url.cwd() : path, $ref.$ref);
 
   const cache = dereferencedCache.get($refPath);
-
-  if (cache) {
-    // If the object we found is circular we can immediately return it because it would have been
-    // cached with everything we need already and we don't need to re-process anything inside it.
-    //
-    // If the cached object however is _not_ circular and there are additional keys alongside our
-    // `$ref` pointer here we should merge them back in and return that.
-    if (!cache.circular) {
-      const refKeys = Object.keys($ref);
-      if (refKeys.length > 1) {
-        const extraKeys = {};
-        for (const key of refKeys) {
-          if (key !== "$ref" && !(key in cache.value)) {
-            // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
-            extraKeys[key] = $ref[key];
-          }
+  if (cache && !cache.circular) {
+    const refKeys = Object.keys($ref);
+    if (refKeys.length > 1) {
+      const extraKeys = {};
+      for (const key of refKeys) {
+        if (key !== "$ref" && !(key in cache.value)) {
+          // @ts-expect-error TS(7053): Element implicitly has an 'any' type because expre... Remove this comment to see the full error message
+          extraKeys[key] = $ref[key];
         }
-        return {
-          circular: cache.circular,
-          value: Object.assign({}, cache.value, extraKeys),
-        };
       }
-
-      return cache;
+      return {
+        circular: cache.circular,
+        value: Object.assign({}, cache.value, extraKeys),
+      };
     }
 
-    // If both our cached value and our incoming `$ref` are the same then we can return what we
-    // got out of the cache, otherwise we should re-process this value. We need to do this because
-    // the current dereference caching mechanism doesn't take into account that `$ref` are neither
-    // unique or reference the same file.
-    //
-    // For example if `schema.yaml` references `definitions/child.yaml` and
-    // `definitions/parent.yaml` references `child.yaml` then `$ref: 'child.yaml'` may get cached
-    // for `definitions/child.yaml`, resulting in `schema.yaml` being having an invalid reference
-    // to `child.yaml`.
-    //
-    // This check is not perfect and the design of the dereference caching mechanism needs a total
-    // overhaul.
-    if (typeof cache.value === "object" && "$ref" in cache.value && "$ref" in $ref) {
-      if (cache.value.$ref === $ref.$ref) {
-        return cache;
-      } else {
-        // no-op
-      }
-    } else {
-      return cache;
-    }
+    return cache;
   }
 
   const pointer = $refs._resolve($refPath, path, options);
@@ -322,27 +270,9 @@ function dereference$Ref<S extends object = JSONSchema, O extends ParserOptions<
   return dereferencedObject;
 }
 
-/**
- * Check if we've run past our allowed timeout and throw an error if we have.
- *
- * @param startTime - The time when the dereferencing started.
- * @param options
- */
-function checkDereferenceTimeout<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-  startTime: number,
-  options: O,
-): void {
-  if (options && options.timeoutMs) {
-    if (Date.now() - startTime > options.timeoutMs) {
-      throw new TimeoutError(options.timeoutMs);
-    }
-  }
-}
-
 /**
  * Called when a circular reference is found.
- * It sets the {@link $Refs#circular} flag, executes the options.dereference.onCircular callback,
- * and throws an error if options.dereference.circular is false.
+ * It sets the {@link $Refs#circular} flag, and throws an error if options.dereference.circular is false.
  *
  * @param keyPath - The JSON Reference path of the circular reference
  * @param $refs
@@ -351,11 +281,8 @@ function checkDereferenceTimeout<S extends object = JSONSchema, O extends Parser
  */
 function foundCircularReference(keyPath: any, $refs: any, options: any) {
   $refs.circular = true;
-  options?.dereference?.onCircular?.(keyPath);
-
   if (!options.dereference.circular) {
-    const error = new ReferenceError(`Circular $ref pointer found at ${keyPath}`);
-    throw error;
+    throw ono.reference(`Circular $ref pointer found at ${keyPath}`);
   }
   return true;
 }