@questpie/mcp 3.28.10 → 3.28.11

package/dist/{create-server-DvumhdI_.mjs → create-server-5Eo4QP3q.mjs}

@@ -128,7 +128,7 @@ const DEFAULT_MCP_CONFIG = {
 	stdio: { trustedMaintenance: false },
 	execution: {}
 };
-function isPlainObject(value) {
+function isPlainObject$1(value) {
 	return !!value && typeof value === "object" && !Array.isArray(value);
 }
 const UNSAFE_CONFIG_KEYS = new Set([
@@ -137,7 +137,7 @@ const UNSAFE_CONFIG_KEYS = new Set([
 	"constructor"
 ]);
 function ownDataEntries(value) {
-	if (!isPlainObject(value)) return [];
+	if (!isPlainObject$1(value)) return [];
 	try {
 		return Object.entries(Object.getOwnPropertyDescriptors(value)).filter(([key, descriptor]) => !UNSAFE_CONFIG_KEYS.has(key) && "value" in descriptor).map(([key, descriptor]) => [key, descriptor.value]);
 	} catch {
@@ -146,14 +146,14 @@ function ownDataEntries(value) {
 }
 function safeCloneConfigValue(value) {
 	if (Array.isArray(value)) return value.map((entry) => safeCloneConfigValue(entry));
-	if (!isPlainObject(value)) return value;
+	if (!isPlainObject$1(value)) return value;
 	const clone = Object.create(null);
 	for (const [key, entry] of ownDataEntries(value)) clone[key] = safeCloneConfigValue(entry);
 	return clone;
 }
 function mergeDeep(base, override) {
 	const out = safeCloneConfigValue(base);
-	for (const [key, value] of ownDataEntries(override)) if (isPlainObject(value) && isPlainObject(out[key])) out[key] = mergeDeep(out[key], value);
+	for (const [key, value] of ownDataEntries(override)) if (isPlainObject$1(value) && isPlainObject$1(out[key])) out[key] = mergeDeep(out[key], value);
 	else if (value !== void 0) out[key] = safeCloneConfigValue(value);
 	return out;
 }
@@ -1073,11 +1073,123 @@ function toJsonSchema(schema) {
 	const compatible = jsonSchemaCompatibleSchema(schema);
 	if (!compatible) return void 0;
 	try {
-		return z.toJSONSchema(compatible, { reused: "ref" });
+		return applyMcpSchemaDiet(z.toJSONSchema(compatible, { reused: "ref" }));
 	} catch {
 		return;
 	}
 }
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const SCHEMA_MAP_KEYS = [
+	"properties",
+	"patternProperties",
+	"dependentSchemas",
+	"$defs",
+	"definitions"
+];
+const NEUTRAL_SCHEMA_LIST_KEYS = [
+	"anyOf",
+	"allOf",
+	"prefixItems"
+];
+const NEUTRAL_SCHEMA_KEYS = [
+	"items",
+	"then",
+	"else",
+	"propertyNames",
+	"contains"
+];
+const NEUTRAL_MAYBE_BOOLEAN_SCHEMA_KEYS = [
+	"additionalProperties",
+	"unevaluatedProperties",
+	"unevaluatedItems",
+	"additionalItems"
+];
+/**
+* Rewrites a draft-07-style tuple (`items: [...]` + `additionalItems`) into
+* its 2020-12 equivalent (`prefixItems: [...]` + trailing `items`) in place.
+*
+* The MCP SDK's own `tools/list` projection (`zod-json-schema-compat.js`,
+* called with no `target`) emits JSON Schema **draft-07**, not 2020-12 — the
+* only place that difference is load-bearing for this codebase's schemas is
+* tuple typing, where draft-07's array-form `items` means something entirely
+* different in 2020-12 (a single "all items must match" schema). Our own
+* `toJsonSchema()` below (full zod's `z.toJSONSchema`) already emits native
+* 2020-12 `prefixItems`, so this is a no-op there. Converting first — for
+* every tuple anywhere in the tree, not just the root — makes the whole
+* document genuinely dialect-correct 2020-12 before `applyMcpSchemaDiet`
+* drops the top-level `$schema` pointer.
+*/
+function normalizeTupleDialect(node) {
+	if (!Array.isArray(node.items) || node.prefixItems !== void 0) return;
+	const tuple = node.items;
+	const additionalItems = node.additionalItems;
+	delete node.items;
+	delete node.additionalItems;
+	node.prefixItems = tuple;
+	if (additionalItems === false) node.items = false;
+	else if (isPlainObject(additionalItems)) node.items = additionalItems;
+}
+/**
+* Strips wire noise the zod v4 / MCP SDK JSON Schema codecs emit on every
+* tool schema, without touching example/default/const/enum payloads (those
+* carry caller data, not schema structure, and must never be walked).
+*
+* - Removes the document-level `$schema` dialect pointer (informational only;
+*   `normalizeTupleDialect` above makes the document genuinely 2020-12-shaped
+*   first, so an absent `$schema` is universally, correctly, read as 2020-12).
+* - Drops `additionalProperties: false`, *except inside a `oneOf`/`not`/`if`
+*   subtree*. Ordinarily this is safe to drop everywhere: the MCP SDK
+*   validates tool arguments against the *original* zod schema at call time
+*   (`McpServer#validateToolInput` in `mcp.js`), never against this projected
+*   JSON Schema, so removing the annotation does not change what a call gets
+*   rejected for. But inside `oneOf`, `additionalProperties: false` can be
+*   the only thing making two branches mutually exclusive (reproduced:
+*   `z.xor` of two `.strict()` objects with disjoint keys — stripping it from
+*   both branches makes a value that should match exactly one branch match
+*   both, which every `oneOf`-aware validator then rejects as ambiguous, even
+*   though the MCP server itself would still accept it). Inside `not`, it can
+*   be the very thing being negated — stripping it *widens* what `not`
+*   excludes, which can turn a previously-schema-valid value into
+*   schema-invalid for any client-side validator. `if` shares the same
+*   "widening changes routing" hazard. `anyOf`/`allOf` don't have this
+*   problem (a widened disjunct can never invalidate an already-valid input),
+*   so only `oneOf`/`not`/`if` propagate the protection flag.
+* - Drops the `pattern` on a `format: "uuid"` node, keeping `format`. The
+*   pattern is the zod-generated uuid regex that always accompanies
+*   `format: "uuid"` in this codebase's schemas (there is no path that sets
+*   `format: "uuid"` other than zod's own `.uuid()`), and — same reasoning as
+*   `additionalProperties` — the MCP SDK never validates against this
+*   projected schema, so the regex is redundant here. `pattern` on any other
+*   node — a node without `format: "uuid"` — is a user-authored constraint
+*   and is left untouched.
+*/
+function walkSchemaNode(node, protectAdditionalProperties = false) {
+	if (!isPlainObject(node)) return;
+	normalizeTupleDialect(node);
+	if (node.format === "uuid" && typeof node.pattern === "string") delete node.pattern;
+	if (!protectAdditionalProperties && node.additionalProperties === false) delete node.additionalProperties;
+	for (const key of SCHEMA_MAP_KEYS) {
+		const map = node[key];
+		if (isPlainObject(map)) for (const value of Object.values(map)) walkSchemaNode(value, protectAdditionalProperties);
+	}
+	for (const key of NEUTRAL_SCHEMA_LIST_KEYS) {
+		const list = node[key];
+		if (Array.isArray(list)) for (const item of list) walkSchemaNode(item, protectAdditionalProperties);
+	}
+	for (const key of NEUTRAL_SCHEMA_KEYS) walkSchemaNode(node[key], protectAdditionalProperties);
+	for (const key of NEUTRAL_MAYBE_BOOLEAN_SCHEMA_KEYS) walkSchemaNode(node[key], protectAdditionalProperties);
+	if (Array.isArray(node.oneOf)) for (const item of node.oneOf) walkSchemaNode(item, true);
+	walkSchemaNode(node.not, true);
+	walkSchemaNode(node.if, true);
+}
+function applyMcpSchemaDiet(schema) {
+	if (!isPlainObject(schema)) return schema;
+	delete schema.$schema;
+	walkSchemaNode(schema);
+	return schema;
+}
 function toToolInputJsonSchema(schema) {
 	const parsed = ToolSchema.shape.inputSchema.safeParse(toJsonSchema(schema));
 	return parsed.success ? parsed.data : {
@@ -2385,6 +2497,46 @@ async function registerRouteTools(server, scope, catalog) {
 
 //#endregion
 //#region src/server/create-server.ts
+function isProductionEnvironment() {
+	return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+/**
+* Reports a schema-diet install failure loudly instead of either crashing
+* every session (a renamed/removed SDK internal would otherwise throw deep
+* inside request handling on the very first `tools/list` call) or failing
+* silently (shipping an undieted catalogue with nobody told why). Always
+* logs; only throws outside production, so a CI/dev run surfaces the break
+* immediately while a live server degrades to the SDK's own undieted
+* `tools/list` response.
+*/
+function reportSchemaDietInstallFailure(message) {
+	const prefixed = `@questpie/mcp: ${message}`;
+	console.error(prefixed);
+	if (!isProductionEnvironment()) throw new Error(prefixed);
+}
+function installSchemaDietListToolsHandler(server) {
+	const handlers = Reflect.get(server.server, "_requestHandlers");
+	if (!(handlers instanceof Map)) {
+		reportSchemaDietInstallFailure("could not install the tools/list schema diet — McpServer#server's internal request-handler map is missing or not a Map (the MCP SDK's internals likely changed shape). Tools will be listed without the diet applied.");
+		return;
+	}
+	const defaultHandler = handlers.get("tools/list");
+	if (!defaultHandler) {
+		reportSchemaDietInstallFailure("could not install the tools/list schema diet — no default tools/list handler was registered even though at least one tool exists. Tools will be listed without the diet applied.");
+		return;
+	}
+	server.server.setRequestHandler(ListToolsRequestSchema, async (request, extra) => {
+		const result = await defaultHandler(request, extra);
+		return {
+			...result,
+			tools: result.tools.map((tool) => ({
+				...tool,
+				inputSchema: applyMcpSchemaDiet(tool.inputSchema),
+				...tool.outputSchema ? { outputSchema: applyMcpSchemaDiet(tool.outputSchema) } : {}
+			}))
+		};
+	});
+}
 async function createServer(app, options, workload) {
 	const release = workload ? createWorkloadMcpRelease(app, options.config) : options.config ? createIsolatedMcpRelease(app, options.config) : getAppMcpRelease(app);
 	const { config, catalog } = release;
@@ -2409,6 +2561,7 @@ async function createServer(app, options, workload) {
 	await registerCustomTools(server, scope, catalog);
 	if (workload) server.server.setRequestHandler(ListToolsRequestSchema, (_request, extra) => listWorkloadTools(workload, release.execution, extra));
 	else if ([...catalog.collections.values()].every((entry) => entry.operations.length === 0) && [...catalog.globals.values()].every((entry) => entry.operations.length === 0) && catalog.routes.size === 0 && catalog.customTools.size === 0) server.server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: [] }));
+	else installSchemaDietListToolsHandler(server);
 	return server;
 }
 function resolveStdioAccessMode(options, trustedMaintenance) {

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { S as scopesFromContext, _ as resolveMcpCatalog, a as customToolWorkloadIdentity, b as requiredScopesForOperation, c as createWorkloadMcpBoundary, f as McpAccessDeniedError, g as toMcpToolError, h as mcpPublicErrorCode, i as customToolDescriptor, l as createRuntimeScope, m as assertBoundedMcpValue, n as createWorkloadMcpServer, o as executeCustomToolCall, p as McpPublicError, r as customToolAllows, s as authorizeWorkload, t as createMcpServer, u as createWorkloadMcpRelease, v as defaultOperationScope, w as mcpTool, x as scopeGateAllows, y as normalizeRequiredScopes } from "./create-server-DvumhdI_.mjs";
-import { n as mcp_default, t as mcpModule } from "./mcp-uf7du4OS.mjs";
+import { S as scopesFromContext, _ as resolveMcpCatalog, a as customToolWorkloadIdentity, b as requiredScopesForOperation, c as createWorkloadMcpBoundary, f as McpAccessDeniedError, g as toMcpToolError, h as mcpPublicErrorCode, i as customToolDescriptor, l as createRuntimeScope, m as assertBoundedMcpValue, n as createWorkloadMcpServer, o as executeCustomToolCall, p as McpPublicError, r as customToolAllows, s as authorizeWorkload, t as createMcpServer, u as createWorkloadMcpRelease, v as defaultOperationScope, w as mcpTool, x as scopeGateAllows, y as normalizeRequiredScopes } from "./create-server-5Eo4QP3q.mjs";
+import { n as mcp_default, t as mcpModule } from "./mcp-i0Kqu_bB.mjs";
 import { t as mcpPlugin } from "./plugin-BZQe1pji.mjs";
-import { t as startStdioServer } from "./stdio-HmbmENQN.mjs";
+import { t as startStdioServer } from "./stdio-37bSPka9.mjs";
 import { randomUUID } from "node:crypto";
 
 //#region src/server/workload-tool-port.ts

package/dist/{mcp-uf7du4OS.mjs → mcp-i0Kqu_bB.mjs}

@@ -1,4 +1,4 @@
-import { C as validateMcpPrincipal, d as getAppMcpRelease, m as assertBoundedMcpValue, t as createMcpServer } from "./create-server-DvumhdI_.mjs";
+import { C as validateMcpPrincipal, d as getAppMcpRelease, m as assertBoundedMcpValue, t as createMcpServer } from "./create-server-5Eo4QP3q.mjs";
 import { t as mcpPlugin } from "./plugin-BZQe1pji.mjs";
 import { route } from "questpie";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";

package/dist/modules/mcp.mjs

@@ -1,3 +1,3 @@
-import { t as mcpModule } from "../mcp-uf7du4OS.mjs";
+import { t as mcpModule } from "../mcp-i0Kqu_bB.mjs";
 
 export { mcpModule };

package/dist/{stdio-HmbmENQN.mjs → stdio-37bSPka9.mjs}

@@ -1,4 +1,4 @@
-import { t as createMcpServer } from "./create-server-DvumhdI_.mjs";
+import { t as createMcpServer } from "./create-server-5Eo4QP3q.mjs";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
 //#region src/server/stdio.ts

package/dist/stdio.mjs

@@ -1,3 +1,3 @@
-import { t as startStdioServer } from "./stdio-HmbmENQN.mjs";
+import { t as startStdioServer } from "./stdio-37bSPka9.mjs";
 
 export { startStdioServer };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@questpie/mcp",
-	"version": "3.28.10",
+	"version": "3.28.11",
 	"description": "Model Context Protocol server for QUESTPIE apps, under the app's own access rules",
 	"repository": {
 		"type": "git",
@@ -70,7 +70,7 @@
 	},
 	"dependencies": {
 		"@modelcontextprotocol/sdk": "^1.29.0",
-		"questpie": "^3.28.10",
+		"questpie": "^3.28.11",
 		"zod": "^4.2.1"
 	},
 	"devDependencies": {
@@ -80,6 +80,6 @@
 		"tsdown": "^0.18.3"
 	},
 	"peerDependencies": {
-		"questpie": "^3.28.10"
+		"questpie": "^3.28.11"
 	}
 }