@poe-platform/safe-js 0.1.720 → 0.1.722

package/dist/safe-js/chunks/{chunk-HYD4K4HN.js → chunk-D3GC5QPZ.js}

@@ -1,3 +1,62 @@
+// packages/tiny-mcp-client/src/http-json-budget.ts
+function assertHttpJsonBudget(text) {
+  let nodes = 0;
+  let allocation = 0;
+  let decodedBytes = 0;
+  const stack = [];
+  const whitespace = (c) => c === " " || c === "	" || c === "\r" || c === "\n";
+  const check = () => {
+    if (nodes > 1e5 || stack.length > 64 || allocation > 8 * 1024 * 1024 || decodedBytes > 4 * 1024 * 1024)
+      throw new Error("MCP HTTP JSON structural budget exceeded");
+  };
+  for (let i = 0; i < text.length; ) {
+    const c = text[i++];
+    if (whitespace(c) || c === "," || c === ":") continue;
+    if (c === "}" || c === "]") {
+      if (stack.pop() !== c) throw new SyntaxError("Malformed MCP HTTP JSON nesting");
+      continue;
+    }
+    nodes++;
+    allocation += 128;
+    if (c === "{" || c === "[") {
+      stack.push(c === "{" ? "}" : "]");
+      check();
+      continue;
+    }
+    check();
+    if (c === '"') {
+      let closed = false;
+      while (i < text.length) {
+        const character = text[i++];
+        if (character === '"') {
+          closed = true;
+          break;
+        }
+        if (character.charCodeAt(0) < 32) throw new SyntaxError("Malformed MCP HTTP JSON string");
+        if (character === "\\") {
+          const escape = text[i++];
+          if (escape === "u") {
+            for (let digit = 0; digit < 4; digit++) {
+              const hex = text[i++];
+              if (hex === void 0 || !"0123456789abcdefABCDEF".includes(hex))
+                throw new SyntaxError("Malformed MCP HTTP JSON escape");
+            }
+          } else if (escape === void 0 || !'"\\/bfnrt'.includes(escape)) {
+            throw new SyntaxError("Malformed MCP HTTP JSON escape");
+          }
+        }
+        decodedBytes += 2;
+        allocation += 2;
+        check();
+      }
+      if (!closed) throw new SyntaxError("Unterminated MCP HTTP JSON string");
+    } else {
+      while (i < text.length && !whitespace(text[i]) && !'{}[],:"'.includes(text[i])) i++;
+    }
+  }
+  if (stack.length !== 0) throw new SyntaxError("Unterminated MCP HTTP JSON container");
+}
+
 // packages/tiny-mcp-client/src/internal.ts
 import { spawn as spawn2 } from "node:child_process";
 import { PassThrough } from "node:stream";
@@ -8144,6 +8203,7 @@ var HttpTransport = class {
       signal
     )).trim();
     if (request !== void 0 && responseBody.length > 0) {
+      assertHttpJsonBudget(responseBody);
       let parsed = parseJsonRpcMessage(responseBody);
       if (parsed.type === "invalid") {
         try {
@@ -8297,6 +8357,7 @@ var HttpTransport = class {
       if (context !== void 0) throw new Error("MCP HTTP response body is empty");
       return;
     }
+    assertHttpJsonBudget(payload);
     if (context !== void 0) {
       this.writeReadableLine(context.validate(payload, false));
       return;
@@ -8319,6 +8380,7 @@ var HttpTransport = class {
         this.rejectLegacyEndpoint = void 0;
         continue;
       }
+      assertHttpJsonBudget(message.data);
       this.writeReadableLine(context?.validate(message.data, true) ?? message.data);
       if (context?.completed) return;
     }
@@ -9756,4 +9818,4 @@ CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for
 the full license text.
 
 */
-//# sourceMappingURL=chunk-HYD4K4HN.js.map
+//# sourceMappingURL=chunk-D3GC5QPZ.js.map