@red-hat-developer-hub/backstage-plugin-catalog-backend-module-mcp-registry-provider 0.2.0

package/dist/client.cjs.js

@@ -0,0 +1,295 @@
+'use strict';
+
+var util = require('./util.cjs.js');
+
+const MAX_ERROR_BODY_LENGTH = 256;
+const MAX_REDIRECTS = 10;
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+class McpRegistryClientError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpRegistryClientError";
+  }
+}
+function buildServersEndpoint(baseUrl, apiVersion) {
+  return `${util.stripTrailingSlashes(baseUrl)}/${apiVersion}/servers`;
+}
+function parseServersEndpointUrl(baseUrl, apiVersion) {
+  const endpoint = buildServersEndpoint(baseUrl, apiVersion);
+  try {
+    return new URL(endpoint);
+  } catch (err) {
+    throw new McpRegistryClientError(
+      `Invalid MCP Registry endpoint URL "${endpoint}": ${util.formatErrorDetail(
+        err
+      )}`
+    );
+  }
+}
+function buildPageRequestUrl(endpoint, cursor, pageSize, latestVersion) {
+  const url = new URL(endpoint.toString());
+  if (cursor) {
+    url.searchParams.set("cursor", cursor);
+  }
+  if (pageSize !== void 0) {
+    url.searchParams.set("limit", String(pageSize));
+  }
+  if (latestVersion) {
+    url.searchParams.set("version", "latest");
+  }
+  return url;
+}
+function truncateErrorBody(rawBody, maxLength = MAX_ERROR_BODY_LENGTH) {
+  if (rawBody.length <= maxLength) {
+    return rawBody;
+  }
+  return `${rawBody.substring(0, maxLength)}\u2026(truncated)`;
+}
+function isRedirectStatus(status) {
+  return REDIRECT_STATUSES.has(status);
+}
+function resolveRedirectUrl(currentUrl, location) {
+  try {
+    return new URL(location, currentUrl);
+  } catch (err) {
+    throw new McpRegistryClientError(
+      `MCP Registry returned an invalid redirect Location "${location}" from ${currentUrl}: ${util.formatErrorDetail(err)}`
+    );
+  }
+}
+function validateRedirectTarget(targetUrl, hostAllowList) {
+  if (targetUrl.protocol !== "http:" && targetUrl.protocol !== "https:") {
+    throw new McpRegistryClientError(
+      `MCP Registry redirect to disallowed protocol "${targetUrl.protocol}" in "${targetUrl}". Only http and https are permitted.`
+    );
+  }
+  assertRequestHostAllowed(targetUrl, hostAllowList);
+}
+async function fetchRegistryPage(doFetch, url, hostAllowList) {
+  let currentUrl = url;
+  let redirectsFollowed = 0;
+  let response = await fetchOnce(doFetch, currentUrl, hostAllowList);
+  while (isRedirectStatus(response.status)) {
+    if (redirectsFollowed >= MAX_REDIRECTS) {
+      throw new McpRegistryClientError(
+        `MCP Registry exceeded ${MAX_REDIRECTS} redirects starting from ${url}. Last redirect was from ${currentUrl}.`
+      );
+    }
+    const location = response.headers.get("Location");
+    if (!location) {
+      throw new McpRegistryClientError(
+        `MCP Registry returned HTTP ${response.status} without a Location header from ${currentUrl}.`
+      );
+    }
+    const nextUrl = resolveRedirectUrl(currentUrl, location);
+    validateRedirectTarget(nextUrl, hostAllowList);
+    redirectsFollowed += 1;
+    currentUrl = nextUrl;
+    response = await fetchOnce(doFetch, currentUrl, hostAllowList);
+  }
+  const requestUrl = currentUrl.toString();
+  if (!response.ok) {
+    const rawBody = await response.text().catch(() => "(no body)");
+    throw new McpRegistryClientError(
+      `MCP Registry returned HTTP ${response.status} for ${requestUrl}: ${truncateErrorBody(rawBody)}`
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    throw new McpRegistryClientError(
+      `MCP Registry returned unparseable JSON from ${requestUrl}: ${util.formatErrorDetail(
+        err
+      )}`
+    );
+  }
+  if (!body.servers || !Array.isArray(body.servers)) {
+    throw new McpRegistryClientError(
+      `MCP Registry response missing "servers" array from ${requestUrl}`
+    );
+  }
+  return body;
+}
+async function fetchOnce(doFetch, url, hostAllowList) {
+  const requestUrl = url.toString();
+  assertRequestHostAllowed(url, hostAllowList);
+  let response;
+  try {
+    response = await doFetch(requestUrl, { redirect: "manual" });
+  } catch (err) {
+    throw new McpRegistryClientError(
+      `Failed to reach MCP Registry at ${requestUrl}: ${util.formatErrorDetail(
+        err
+      )}`
+    );
+  }
+  assertResponseUrlAllowed(response, hostAllowList, requestUrl);
+  return response;
+}
+function resolveNextCursor(nextCursor, seenCursors, pagesFetched, pageLimit) {
+  if (!nextCursor || nextCursor.length === 0) {
+    return { status: "complete" };
+  }
+  if (seenCursors.has(nextCursor)) {
+    throw new McpRegistryClientError(
+      `MCP Registry returned a repeated cursor "${nextCursor}" during pagination. Aborting sync to prevent infinite loop.`
+    );
+  }
+  if (pagesFetched >= pageLimit) {
+    return { status: "pageLimitReached", resumeCursor: nextCursor };
+  }
+  return { status: "continue", cursor: nextCursor };
+}
+function assertRequestHostAllowed(url, hostAllowList) {
+  if (!hostAllowList) {
+    return;
+  }
+  const hostname = url.hostname.toLowerCase();
+  if (!hostAllowList.includes(hostname)) {
+    throw new McpRegistryClientError(
+      `Request to hostname "${hostname}" blocked: not in the configured hostAllowList [${hostAllowList.join(", ")}].`
+    );
+  }
+}
+function assertResponseUrlAllowed(response, hostAllowList, requestUrl) {
+  if (!hostAllowList) {
+    return;
+  }
+  if (!response.url) {
+    throw new McpRegistryClientError(
+      `MCP Registry response for ${requestUrl} is missing response.url while hostAllowList is configured; refusing to proceed.`
+    );
+  }
+  assertRequestHostAllowed(new URL(response.url), hostAllowList);
+}
+function applyMaxEntriesSoftStop(params) {
+  const {
+    serversIncludingTippedPage,
+    tippedPageSize,
+    priorEntryCount,
+    pageCursor,
+    startCursor,
+    tippedNextCursor
+  } = params;
+  const withoutTip = serversIncludingTippedPage.slice(
+    0,
+    serversIncludingTippedPage.length - tippedPageSize
+  );
+  if (priorEntryCount + withoutTip.length === 0) {
+    return {
+      servers: serversIncludingTippedPage,
+      endCursor: typeof tippedNextCursor === "string" && tippedNextCursor.length > 0 ? tippedNextCursor : void 0
+    };
+  }
+  return {
+    servers: withoutTip,
+    endCursor: pageCursor ?? startCursor
+  };
+}
+function advanceAfterResolvedCursor(next, seenCursors, endCursor) {
+  if (next.status === "complete") {
+    return { action: "complete" };
+  }
+  if (next.status === "pageLimitReached") {
+    seenCursors.add(next.resumeCursor);
+    if (endCursor && next.resumeCursor === endCursor) {
+      return { action: "stopAtEnd" };
+    }
+    return { action: "resume", resumeCursor: next.resumeCursor };
+  }
+  seenCursors.add(next.cursor);
+  if (endCursor && next.cursor === endCursor) {
+    return { action: "stopAtEnd" };
+  }
+  return { action: "continue", cursor: next.cursor };
+}
+function isAtEndCursor(cursor, endCursor) {
+  return endCursor !== void 0 && cursor === endCursor;
+}
+async function fetchRegistryServers(options) {
+  const {
+    baseUrl,
+    apiVersion,
+    pageLimit,
+    pageSize,
+    latestVersion,
+    maxEntries,
+    priorEntryCount = 0,
+    startCursor,
+    endCursor,
+    hostAllowList,
+    fetchApi
+  } = options;
+  const doFetch = fetchApi ?? fetch;
+  const endpoint = parseServersEndpointUrl(baseUrl, apiVersion);
+  const seenCursors = new Set(options.seenCursors);
+  assertRequestHostAllowed(endpoint, hostAllowList);
+  let allServers = [];
+  let cursor = startCursor;
+  let pagesFetched = 0;
+  let resumeCursor;
+  let maxEntriesEndCursor;
+  while (!isAtEndCursor(cursor, endCursor)) {
+    const url = buildPageRequestUrl(endpoint, cursor, pageSize, latestVersion);
+    const body = await fetchRegistryPage(doFetch, url, hostAllowList);
+    allServers.push(...body.servers);
+    pagesFetched += 1;
+    const totalEntries = priorEntryCount + allServers.length;
+    if (maxEntries !== void 0 && totalEntries > maxEntries) {
+      const capped = applyMaxEntriesSoftStop({
+        serversIncludingTippedPage: allServers,
+        tippedPageSize: body.servers.length,
+        priorEntryCount,
+        pageCursor: cursor,
+        startCursor,
+        tippedNextCursor: body.metadata?.nextCursor
+      });
+      allServers = capped.servers;
+      maxEntriesEndCursor = capped.endCursor;
+      break;
+    }
+    const advance = advanceAfterResolvedCursor(
+      resolveNextCursor(
+        body.metadata?.nextCursor,
+        seenCursors,
+        pagesFetched,
+        pageLimit
+      ),
+      seenCursors,
+      endCursor
+    );
+    if (advance.action === "complete" || advance.action === "stopAtEnd") {
+      break;
+    }
+    if (advance.action === "resume") {
+      resumeCursor = advance.resumeCursor;
+      break;
+    }
+    cursor = advance.cursor;
+  }
+  return {
+    servers: allServers,
+    resumeCursor,
+    endCursor: maxEntriesEndCursor,
+    seenCursors
+  };
+}
+
+exports.McpRegistryClientError = McpRegistryClientError;
+exports.advanceAfterResolvedCursor = advanceAfterResolvedCursor;
+exports.applyMaxEntriesSoftStop = applyMaxEntriesSoftStop;
+exports.assertRequestHostAllowed = assertRequestHostAllowed;
+exports.assertResponseUrlAllowed = assertResponseUrlAllowed;
+exports.buildPageRequestUrl = buildPageRequestUrl;
+exports.buildServersEndpoint = buildServersEndpoint;
+exports.fetchRegistryPage = fetchRegistryPage;
+exports.fetchRegistryServers = fetchRegistryServers;
+exports.isAtEndCursor = isAtEndCursor;
+exports.isRedirectStatus = isRedirectStatus;
+exports.parseServersEndpointUrl = parseServersEndpointUrl;
+exports.resolveNextCursor = resolveNextCursor;
+exports.resolveRedirectUrl = resolveRedirectUrl;
+exports.truncateErrorBody = truncateErrorBody;
+exports.validateRedirectTarget = validateRedirectTarget;
+//# sourceMappingURL=client.cjs.js.map

package/dist/client.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.cjs.js","sources":["../src/client.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { McpServerDocument } from '@red-hat-developer-hub/backstage-plugin-catalog-mcp-registry-server-mapping';\nimport { formatErrorDetail, stripTrailingSlashes } from './util';\n\n/** Max characters of an error response body included in client errors. */\nconst MAX_ERROR_BODY_LENGTH = 256;\n\n/** Max redirect hops followed for a single page request. */\nconst MAX_REDIRECTS = 10;\n\n/** HTTP statuses treated as redirects to follow manually. */\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/**\n * A single server entry from the MCP Registry list response.\n */\nexport interface McpRegistryServerEntry {\n  server: McpServerDocument;\n}\n\n/**\n * The MCP Registry servers list response shape.\n */\nexport interface McpRegistryListResponse {\n  servers: McpRegistryServerEntry[];\n  metadata: {\n    count?: number;\n    nextCursor?: string | null;\n  };\n}\n\n/**\n * Error thrown when the registry client encounters a transport or\n * protocol error that should abort the sync run.\n */\nexport class McpRegistryClientError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'McpRegistryClientError';\n  }\n}\n\n/**\n * Build the servers endpoint URL from baseUrl and apiVersion,\n * normalizing slashes so a trailing slash on baseUrl does not\n * produce a double separator.\n */\nexport function buildServersEndpoint(\n  baseUrl: string,\n  apiVersion: string,\n): string {\n  return `${stripTrailingSlashes(baseUrl)}/${apiVersion}/servers`;\n}\n\n/**\n * Options for fetching servers from the MCP Registry.\n */\nexport interface FetchServersOptions {\n  baseUrl: string;\n  apiVersion: string;\n  pageLimit: number;\n  pageSize?: number;\n  /**\n   * When true, each list request includes `?version=latest`. When false\n   * or omitted, the `version` query parameter is left unset.\n   */\n  latestVersion?: boolean;\n  /**\n   * Maximum total entries buffered across the current registry\n   * traversal (including prior resume syncs) before a full mutation.\n   * When exceeded, paging stops gracefully: the tipping page is left\n   * out (unless it is the only page), and `endCursor` is returned so\n   * the provider can commit what was buffered and bound later\n   * traversals.\n   *\n   * Counts `priorEntryCount` plus servers fetched in this call.\n   */\n  maxEntries?: number;\n  /**\n   * Entry count already accumulated earlier in the current multi-sync\n   * traversal. Used with `maxEntries` so the cap spans resume cycles.\n   */\n  priorEntryCount?: number;\n  /**\n   * Cursor to resume from after a prior sync hit `pageLimit`. When\n   * omitted, the first request starts at the beginning of the list.\n   */\n  startCursor?: string;\n  /**\n   * When set (after a prior `maxEntries` soft-stop), a traversal that\n   * starts from the beginning stops when it would advance to this\n   * cursor, instead of waiting for a missing `nextCursor`.\n   */\n  endCursor?: string;\n  /**\n   * Cursors already seen in the current multi-sync traversal. Shared\n   * across resume cycles so repeated-cursor detection spans syncs.\n   * Treated as read-only input; the updated set is returned on\n   * {@link FetchServersResult.seenCursors}.\n   */\n  seenCursors?: ReadonlySet<string>;\n  /**\n   * Optional allowlist of permitted hostnames. When set, every\n   * outbound request URL is validated against this list before\n   * fetching, providing defense-in-depth against SSRF.\n   */\n  hostAllowList?: string[];\n  /** Optional fetch implementation for testing. */\n  fetchApi?: typeof fetch;\n}\n\n/**\n * Result of one `fetchRegistryServers` call (up to `pageLimit` pages).\n *\n * @internal\n */\nexport interface FetchServersResult {\n  /** Servers fetched during this call. */\n  servers: McpRegistryServerEntry[];\n  /**\n   * When set, more pages remain after this call stopped at `pageLimit`.\n   * The next sync should pass this as `startCursor`.\n   */\n  resumeCursor?: string;\n  /**\n   * When set, this call stopped because `maxEntries` was exceeded.\n   * The provider should commit a full mutation of the buffer and\n   * remember this cursor as the end bound for later full traversals.\n   */\n  endCursor?: string;\n  /**\n   * Cursor set after this call, including any newly observed cursors.\n   * Callers should replace their prior set with this value on success.\n   */\n  seenCursors: Set<string>;\n}\n\n/**\n * Outcome of resolving the registry's `nextCursor` for pagination.\n *\n * @internal\n */\nexport type ResolveNextCursorResult =\n  | { status: 'complete' }\n  | { status: 'continue'; cursor: string }\n  | { status: 'pageLimitReached'; resumeCursor: string };\n\n/**\n * Parse the servers list endpoint into a URL.\n *\n * @internal\n */\nexport function parseServersEndpointUrl(\n  baseUrl: string,\n  apiVersion: string,\n): URL {\n  const endpoint = buildServersEndpoint(baseUrl, apiVersion);\n  try {\n    return new URL(endpoint);\n  } catch (err) {\n    throw new McpRegistryClientError(\n      `Invalid MCP Registry endpoint URL \"${endpoint}\": ${formatErrorDetail(\n        err,\n      )}`,\n    );\n  }\n}\n\n/**\n * Build a page request URL with optional cursor, page-size, and\n * latest-version query params.\n *\n * @internal\n */\nexport function buildPageRequestUrl(\n  endpoint: URL,\n  cursor?: string,\n  pageSize?: number,\n  latestVersion?: boolean,\n): URL {\n  const url = new URL(endpoint.toString());\n  if (cursor) {\n    url.searchParams.set('cursor', cursor);\n  }\n  if (pageSize !== undefined) {\n    url.searchParams.set('limit', String(pageSize));\n  }\n  if (latestVersion) {\n    url.searchParams.set('version', 'latest');\n  }\n  return url;\n}\n\n/**\n * Truncate an error response body for safe inclusion in log/error text.\n *\n * @internal\n */\nexport function truncateErrorBody(\n  rawBody: string,\n  maxLength = MAX_ERROR_BODY_LENGTH,\n): string {\n  if (rawBody.length <= maxLength) {\n    return rawBody;\n  }\n  return `${rawBody.substring(0, maxLength)}…(truncated)`;\n}\n\n/**\n * Whether an HTTP status code is a redirect this client follows.\n *\n * @internal\n */\nexport function isRedirectStatus(status: number): boolean {\n  return REDIRECT_STATUSES.has(status);\n}\n\n/**\n * Resolve a redirect `Location` header against the current request URL.\n *\n * @internal\n */\nexport function resolveRedirectUrl(currentUrl: URL, location: string): URL {\n  try {\n    return new URL(location, currentUrl);\n  } catch (err) {\n    throw new McpRegistryClientError(\n      `MCP Registry returned an invalid redirect Location \"${location}\" ` +\n        `from ${currentUrl}: ${formatErrorDetail(err)}`,\n    );\n  }\n}\n\n/**\n * Validate a redirect target before following it.\n *\n * Requires http(s) and, when configured, an allowlisted hostname.\n *\n * @internal\n */\nexport function validateRedirectTarget(\n  targetUrl: URL,\n  hostAllowList?: string[],\n): void {\n  if (targetUrl.protocol !== 'http:' && targetUrl.protocol !== 'https:') {\n    throw new McpRegistryClientError(\n      `MCP Registry redirect to disallowed protocol \"${targetUrl.protocol}\" ` +\n        `in \"${targetUrl}\". Only http and https are permitted.`,\n    );\n  }\n  assertRequestHostAllowed(targetUrl, hostAllowList);\n}\n\n/**\n * Fetch and validate one registry list page.\n *\n * Uses `redirect: 'manual'` and validates each `Location` header\n * against the host allowlist before following, so SSRF via redirect\n * cannot reach a disallowed host.\n *\n * @internal\n */\nexport async function fetchRegistryPage(\n  doFetch: typeof fetch,\n  url: URL,\n  hostAllowList?: string[],\n): Promise<McpRegistryListResponse> {\n  let currentUrl = url;\n  let redirectsFollowed = 0;\n  let response = await fetchOnce(doFetch, currentUrl, hostAllowList);\n\n  while (isRedirectStatus(response.status)) {\n    if (redirectsFollowed >= MAX_REDIRECTS) {\n      throw new McpRegistryClientError(\n        `MCP Registry exceeded ${MAX_REDIRECTS} redirects starting from ` +\n          `${url}. Last redirect was from ${currentUrl}.`,\n      );\n    }\n\n    const location = response.headers.get('Location');\n    if (!location) {\n      throw new McpRegistryClientError(\n        `MCP Registry returned HTTP ${response.status} without a ` +\n          `Location header from ${currentUrl}.`,\n      );\n    }\n\n    const nextUrl = resolveRedirectUrl(currentUrl, location);\n    validateRedirectTarget(nextUrl, hostAllowList);\n    redirectsFollowed += 1;\n    currentUrl = nextUrl;\n    response = await fetchOnce(doFetch, currentUrl, hostAllowList);\n  }\n\n  const requestUrl = currentUrl.toString();\n\n  if (!response.ok) {\n    const rawBody = await response.text().catch(() => '(no body)');\n    throw new McpRegistryClientError(\n      `MCP Registry returned HTTP ${response.status} for ` +\n        `${requestUrl}: ${truncateErrorBody(rawBody)}`,\n    );\n  }\n\n  let body: McpRegistryListResponse;\n  try {\n    body = (await response.json()) as McpRegistryListResponse;\n  } catch (err) {\n    throw new McpRegistryClientError(\n      `MCP Registry returned unparseable JSON from ${requestUrl}: ${formatErrorDetail(\n        err,\n      )}`,\n    );\n  }\n\n  if (!body.servers || !Array.isArray(body.servers)) {\n    throw new McpRegistryClientError(\n      `MCP Registry response missing \"servers\" array from ${requestUrl}`,\n    );\n  }\n\n  return body;\n}\n\n/**\n * Perform one allowlist-checked fetch with `redirect: 'manual'`.\n *\n * @internal\n */\nasync function fetchOnce(\n  doFetch: typeof fetch,\n  url: URL,\n  hostAllowList?: string[],\n): Promise<Response> {\n  const requestUrl = url.toString();\n  assertRequestHostAllowed(url, hostAllowList);\n  let response: Response;\n  try {\n    response = await doFetch(requestUrl, { redirect: 'manual' });\n  } catch (err) {\n    throw new McpRegistryClientError(\n      `Failed to reach MCP Registry at ${requestUrl}: ${formatErrorDetail(\n        err,\n      )}`,\n    );\n  }\n  assertResponseUrlAllowed(response, hostAllowList, requestUrl);\n  return response;\n}\n\n/**\n * Resolve the next pagination cursor for this sync.\n *\n * Returns `complete` when paging is done, `continue` when another page\n * should be fetched in this sync, or `pageLimitReached` when this sync\n * should stop and resume from `resumeCursor` on a later sync.\n * Enforces repeated-cursor detection (still a hard error). Does not\n * mutate `seenCursors`; the caller records new cursors.\n *\n * @internal\n */\nexport function resolveNextCursor(\n  nextCursor: string | null | undefined,\n  seenCursors: ReadonlySet<string>,\n  pagesFetched: number,\n  pageLimit: number,\n): ResolveNextCursorResult {\n  if (!nextCursor || nextCursor.length === 0) {\n    return { status: 'complete' };\n  }\n\n  if (seenCursors.has(nextCursor)) {\n    throw new McpRegistryClientError(\n      `MCP Registry returned a repeated cursor \"${nextCursor}\" ` +\n        `during pagination. Aborting sync to prevent infinite loop.`,\n    );\n  }\n\n  if (pagesFetched >= pageLimit) {\n    return { status: 'pageLimitReached', resumeCursor: nextCursor };\n  }\n\n  return { status: 'continue', cursor: nextCursor };\n}\n\n/**\n * Runtime request guard: assert a URL's hostname is on the configured\n * allow list before issuing (or following) an outbound fetch.\n * Throws McpRegistryClientError when the hostname is not permitted.\n *\n * @internal\n */\nexport function assertRequestHostAllowed(\n  url: URL,\n  hostAllowList: string[] | undefined,\n): void {\n  if (!hostAllowList) {\n    return;\n  }\n  const hostname = url.hostname.toLowerCase();\n  if (!hostAllowList.includes(hostname)) {\n    throw new McpRegistryClientError(\n      `Request to hostname \"${hostname}\" blocked: not in the configured ` +\n        `hostAllowList [${hostAllowList.join(', ')}].`,\n    );\n  }\n}\n\n/**\n * Fail closed when an allowlist is configured but the fetch response\n * does not expose a URL, then validate that URL's hostname.\n *\n * @internal\n */\nexport function assertResponseUrlAllowed(\n  response: Response,\n  hostAllowList: string[] | undefined,\n  requestUrl: string,\n): void {\n  if (!hostAllowList) {\n    return;\n  }\n  if (!response.url) {\n    throw new McpRegistryClientError(\n      `MCP Registry response for ${requestUrl} is missing response.url ` +\n        `while hostAllowList is configured; refusing to proceed.`,\n    );\n  }\n  assertRequestHostAllowed(new URL(response.url), hostAllowList);\n}\n\n/**\n * Soft-stop when a tipped page would push the traversal past `maxEntries`.\n *\n * Drops the tipping page unless it is the only content so far (then keeps\n * it and bounds later traversals at its next cursor).\n *\n * @internal\n */\nexport function applyMaxEntriesSoftStop(params: {\n  serversIncludingTippedPage: McpRegistryServerEntry[];\n  tippedPageSize: number;\n  priorEntryCount: number;\n  pageCursor: string | undefined;\n  startCursor: string | undefined;\n  tippedNextCursor: string | null | undefined;\n}): { servers: McpRegistryServerEntry[]; endCursor: string | undefined } {\n  const {\n    serversIncludingTippedPage,\n    tippedPageSize,\n    priorEntryCount,\n    pageCursor,\n    startCursor,\n    tippedNextCursor,\n  } = params;\n\n  const withoutTip = serversIncludingTippedPage.slice(\n    0,\n    serversIncludingTippedPage.length - tippedPageSize,\n  );\n\n  if (priorEntryCount + withoutTip.length === 0) {\n    // Single page alone exceeds the cap — keep it so a mutation can\n    // still proceed, and bound later traversals at its next cursor.\n    return {\n      servers: serversIncludingTippedPage,\n      endCursor:\n        typeof tippedNextCursor === 'string' && tippedNextCursor.length > 0\n          ? tippedNextCursor\n          : undefined,\n    };\n  }\n\n  // Exclude the tipping page; end at the cursor used to fetch it.\n  return {\n    servers: withoutTip,\n    endCursor: pageCursor ?? startCursor,\n  };\n}\n\n/**\n * Record a resolved next-cursor decision into `seenCursors` and map it\n * to a pagination control action for the fetch loop.\n *\n * @internal\n */\nexport function advanceAfterResolvedCursor(\n  next: ResolveNextCursorResult,\n  seenCursors: Set<string>,\n  endCursor: string | undefined,\n):\n  | { action: 'complete' }\n  | { action: 'stopAtEnd' }\n  | { action: 'resume'; resumeCursor: string }\n  | { action: 'continue'; cursor: string } {\n  if (next.status === 'complete') {\n    return { action: 'complete' };\n  }\n\n  if (next.status === 'pageLimitReached') {\n    seenCursors.add(next.resumeCursor);\n    if (endCursor && next.resumeCursor === endCursor) {\n      return { action: 'stopAtEnd' };\n    }\n    return { action: 'resume', resumeCursor: next.resumeCursor };\n  }\n\n  seenCursors.add(next.cursor);\n  if (endCursor && next.cursor === endCursor) {\n    return { action: 'stopAtEnd' };\n  }\n  return { action: 'continue', cursor: next.cursor };\n}\n\n/**\n * Whether paging should stop because the current cursor matches a\n * previously saved maxEntries end bound.\n *\n * @internal\n */\nexport function isAtEndCursor(\n  cursor: string | undefined,\n  endCursor: string | undefined,\n): boolean {\n  return endCursor !== undefined && cursor === endCursor;\n}\n\n/**\n * Fetch server entries from the MCP Registry using cursor pagination.\n *\n * Fetches at most `pageLimit` pages starting from `startCursor` (or the\n * beginning when unset). When more pages remain after the cap, returns\n * those pages' servers plus a `resumeCursor` for the next sync instead\n * of failing. When `maxEntries` would be exceeded, stops gracefully and\n * returns `endCursor` so the provider can commit the buffer. When\n * `endCursor` is supplied, paging stops upon reaching that cursor\n * instead of requiring a missing `nextCursor`.\n *\n * @throws McpRegistryClientError on transport, protocol, or\n *   repeated-cursor errors.\n */\nexport async function fetchRegistryServers(\n  options: FetchServersOptions,\n): Promise<FetchServersResult> {\n  const {\n    baseUrl,\n    apiVersion,\n    pageLimit,\n    pageSize,\n    latestVersion,\n    maxEntries,\n    priorEntryCount = 0,\n    startCursor,\n    endCursor,\n    hostAllowList,\n    fetchApi,\n  } = options;\n  const doFetch = fetchApi ?? fetch;\n  const endpoint = parseServersEndpointUrl(baseUrl, apiVersion);\n  // Own a local copy so the caller's options set is never mutated.\n  const seenCursors = new Set(options.seenCursors);\n\n  // Defense-in-depth: validate endpoint hostname at runtime even\n  // though config parsing already checked baseUrl against the list.\n  assertRequestHostAllowed(endpoint, hostAllowList);\n\n  let allServers: McpRegistryServerEntry[] = [];\n  let cursor: string | undefined = startCursor;\n  let pagesFetched = 0;\n  let resumeCursor: string | undefined;\n  let maxEntriesEndCursor: string | undefined;\n\n  while (!isAtEndCursor(cursor, endCursor)) {\n    const url = buildPageRequestUrl(endpoint, cursor, pageSize, latestVersion);\n    const body = await fetchRegistryPage(doFetch, url, hostAllowList);\n    allServers.push(...body.servers);\n    pagesFetched += 1;\n\n    const totalEntries = priorEntryCount + allServers.length;\n    if (maxEntries !== undefined && totalEntries > maxEntries) {\n      const capped = applyMaxEntriesSoftStop({\n        serversIncludingTippedPage: allServers,\n        tippedPageSize: body.servers.length,\n        priorEntryCount,\n        pageCursor: cursor,\n        startCursor,\n        tippedNextCursor: body.metadata?.nextCursor,\n      });\n      allServers = capped.servers;\n      maxEntriesEndCursor = capped.endCursor;\n      break;\n    }\n\n    const advance = advanceAfterResolvedCursor(\n      resolveNextCursor(\n        body.metadata?.nextCursor,\n        seenCursors,\n        pagesFetched,\n        pageLimit,\n      ),\n      seenCursors,\n      endCursor,\n    );\n\n    if (advance.action === 'complete' || advance.action === 'stopAtEnd') {\n      break;\n    }\n    if (advance.action === 'resume') {\n      resumeCursor = advance.resumeCursor;\n      break;\n    }\n    cursor = advance.cursor;\n  }\n\n  return {\n    servers: allServers,\n    resumeCursor,\n    endCursor: maxEntriesEndCursor,\n    seenCursors,\n  };\n}\n"],"names":["stripTrailingSlashes","formatErrorDetail"],"mappings":";;;;AAoBA,MAAM,qBAAA,GAAwB,GAAA;AAG9B,MAAM,aAAA,GAAgB,EAAA;AAGtB,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAwBpD,MAAM,+BAA+B,KAAA,CAAM;AAAA,EAChD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,wBAAA;AAAA,EACd;AACF;AAOO,SAAS,oBAAA,CACd,SACA,UAAA,EACQ;AACR,EAAA,OAAO,CAAA,EAAGA,yBAAA,CAAqB,OAAO,CAAC,IAAI,UAAU,CAAA,QAAA,CAAA;AACvD;AAoGO,SAAS,uBAAA,CACd,SACA,UAAA,EACK;AACL,EAAA,MAAM,QAAA,GAAW,oBAAA,CAAqB,OAAA,EAAS,UAAU,CAAA;AACzD,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,IAAI,QAAQ,CAAA;AAAA,EACzB,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,CAAA,mCAAA,EAAsC,QAAQ,CAAA,GAAA,EAAMC,sBAAA;AAAA,QAClD;AAAA,OACD,CAAA;AAAA,KACH;AAAA,EACF;AACF;AAQO,SAAS,mBAAA,CACd,QAAA,EACA,MAAA,EACA,QAAA,EACA,aAAA,EACK;AACL,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA;AACvC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,QAAA,EAAU,MAAM,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,OAAA,EAAS,MAAA,CAAO,QAAQ,CAAC,CAAA;AAAA,EAChD;AACA,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,SAAA,EAAW,QAAQ,CAAA;AAAA,EAC1C;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAA,CACd,OAAA,EACA,SAAA,GAAY,qBAAA,EACJ;AACR,EAAA,IAAI,OAAA,CAAQ,UAAU,SAAA,EAAW;AAC/B,IAAA,OAAO,OAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAA,EAAG,OAAA,CAAQ,SAAA,CAAU,CAAA,EAAG,SAAS,CAAC,CAAA,iBAAA,CAAA;AAC3C;AAOO,SAAS,iBAAiB,MAAA,EAAyB;AACxD,EAAA,OAAO,iBAAA,CAAkB,IAAI,MAAM,CAAA;AACrC;AAOO,SAAS,kBAAA,CAAmB,YAAiB,QAAA,EAAuB;AACzE,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,GAAA,CAAI,QAAA,EAAU,UAAU,CAAA;AAAA,EACrC,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,uDAAuD,QAAQ,CAAA,OAAA,EACrD,UAAU,CAAA,EAAA,EAAKA,sBAAA,CAAkB,GAAG,CAAC,CAAA;AAAA,KACjD;AAAA,EACF;AACF;AASO,SAAS,sBAAA,CACd,WACA,aAAA,EACM;AACN,EAAA,IAAI,SAAA,CAAU,QAAA,KAAa,OAAA,IAAW,SAAA,CAAU,aAAa,QAAA,EAAU;AACrE,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,CAAA,8CAAA,EAAiD,SAAA,CAAU,QAAQ,CAAA,MAAA,EAC1D,SAAS,CAAA,qCAAA;AAAA,KACpB;AAAA,EACF;AACA,EAAA,wBAAA,CAAyB,WAAW,aAAa,CAAA;AACnD;AAWA,eAAsB,iBAAA,CACpB,OAAA,EACA,GAAA,EACA,aAAA,EACkC;AAClC,EAAA,IAAI,UAAA,GAAa,GAAA;AACjB,EAAA,IAAI,iBAAA,GAAoB,CAAA;AACxB,EAAA,IAAI,QAAA,GAAW,MAAM,SAAA,CAAU,OAAA,EAAS,YAAY,aAAa,CAAA;AAEjE,EAAA,OAAO,gBAAA,CAAiB,QAAA,CAAS,MAAM,CAAA,EAAG;AACxC,IAAA,IAAI,qBAAqB,aAAA,EAAe;AACtC,MAAA,MAAM,IAAI,sBAAA;AAAA,QACR,CAAA,sBAAA,EAAyB,aAAa,CAAA,yBAAA,EACjC,GAAG,4BAA4B,UAAU,CAAA,CAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,sBAAA;AAAA,QACR,CAAA,2BAAA,EAA8B,QAAA,CAAS,MAAM,CAAA,gCAAA,EACnB,UAAU,CAAA,CAAA;AAAA,OACtC;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,UAAA,EAAY,QAAQ,CAAA;AACvD,IAAA,sBAAA,CAAuB,SAAS,aAAa,CAAA;AAC7C,IAAA,iBAAA,IAAqB,CAAA;AACrB,IAAA,UAAA,GAAa,OAAA;AACb,IAAA,QAAA,GAAW,MAAM,SAAA,CAAU,OAAA,EAAS,UAAA,EAAY,aAAa,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,UAAA,GAAa,WAAW,QAAA,EAAS;AAEvC,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,UAAU,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,WAAW,CAAA;AAC7D,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,KAAA,EACxC,UAAU,CAAA,EAAA,EAAK,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAAA,KAChD;AAAA,EACF;AAEA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAQ,MAAM,SAAS,IAAA,EAAK;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,CAAA,4CAAA,EAA+C,UAAU,CAAA,EAAA,EAAKA,sBAAA;AAAA,QAC5D;AAAA,OACD,CAAA;AAAA,KACH;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAK,OAAA,IAAW,CAAC,MAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,EAAG;AACjD,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,sDAAsD,UAAU,CAAA;AAAA,KAClE;AAAA,EACF;AAEA,EAAA,OAAO,IAAA;AACT;AAOA,eAAe,SAAA,CACb,OAAA,EACA,GAAA,EACA,aAAA,EACmB;AACnB,EAAA,MAAM,UAAA,GAAa,IAAI,QAAA,EAAS;AAChC,EAAA,wBAAA,CAAyB,KAAK,aAAa,CAAA;AAC3C,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,UAAA,EAAY,EAAE,QAAA,EAAU,UAAU,CAAA;AAAA,EAC7D,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,CAAA,gCAAA,EAAmC,UAAU,CAAA,EAAA,EAAKA,sBAAA;AAAA,QAChD;AAAA,OACD,CAAA;AAAA,KACH;AAAA,EACF;AACA,EAAA,wBAAA,CAAyB,QAAA,EAAU,eAAe,UAAU,CAAA;AAC5D,EAAA,OAAO,QAAA;AACT;AAaO,SAAS,iBAAA,CACd,UAAA,EACA,WAAA,EACA,YAAA,EACA,SAAA,EACyB;AACzB,EAAA,IAAI,CAAC,UAAA,IAAc,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAC1C,IAAA,OAAO,EAAE,QAAQ,UAAA,EAAW;AAAA,EAC9B;AAEA,EAAA,IAAI,WAAA,CAAY,GAAA,CAAI,UAAU,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,4CAA4C,UAAU,CAAA,4DAAA;AAAA,KAExD;AAAA,EACF;AAEA,EAAA,IAAI,gBAAgB,SAAA,EAAW;AAC7B,IAAA,OAAO,EAAE,MAAA,EAAQ,kBAAA,EAAoB,YAAA,EAAc,UAAA,EAAW;AAAA,EAChE;AAEA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,UAAA,EAAW;AAClD;AASO,SAAS,wBAAA,CACd,KACA,aAAA,EACM;AACN,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,WAAA,EAAY;AAC1C,EAAA,IAAI,CAAC,aAAA,CAAc,QAAA,CAAS,QAAQ,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,wBAAwB,QAAQ,CAAA,gDAAA,EACZ,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA;AAAA,KAC9C;AAAA,EACF;AACF;AAQO,SAAS,wBAAA,CACd,QAAA,EACA,aAAA,EACA,UAAA,EACM;AACN,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA;AAAA,EACF;AACA,EAAA,IAAI,CAAC,SAAS,GAAA,EAAK;AACjB,IAAA,MAAM,IAAI,sBAAA;AAAA,MACR,6BAA6B,UAAU,CAAA,gFAAA;AAAA,KAEzC;AAAA,EACF;AACA,EAAA,wBAAA,CAAyB,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,GAAG,aAAa,CAAA;AAC/D;AAUO,SAAS,wBAAwB,MAAA,EAOiC;AACvE,EAAA,MAAM;AAAA,IACJ,0BAAA;AAAA,IACA,cAAA;AAAA,IACA,eAAA;AAAA,IACA,UAAA;AAAA,IACA,WAAA;AAAA,IACA;AAAA,GACF,GAAI,MAAA;AAEJ,EAAA,MAAM,aAAa,0BAAA,CAA2B,KAAA;AAAA,IAC5C,CAAA;AAAA,IACA,2BAA2B,MAAA,GAAS;AAAA,GACtC;AAEA,EAAA,IAAI,eAAA,GAAkB,UAAA,CAAW,MAAA,KAAW,CAAA,EAAG;AAG7C,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,0BAAA;AAAA,MACT,WACE,OAAO,gBAAA,KAAqB,YAAY,gBAAA,CAAiB,MAAA,GAAS,IAC9D,gBAAA,GACA;AAAA,KACR;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,WAAW,UAAA,IAAc;AAAA,GAC3B;AACF;AAQO,SAAS,0BAAA,CACd,IAAA,EACA,WAAA,EACA,SAAA,EAKyC;AACzC,EAAA,IAAI,IAAA,CAAK,WAAW,UAAA,EAAY;AAC9B,IAAA,OAAO,EAAE,QAAQ,UAAA,EAAW;AAAA,EAC9B;AAEA,EAAA,IAAI,IAAA,CAAK,WAAW,kBAAA,EAAoB;AACtC,IAAA,WAAA,CAAY,GAAA,CAAI,KAAK,YAAY,CAAA;AACjC,IAAA,IAAI,SAAA,IAAa,IAAA,CAAK,YAAA,KAAiB,SAAA,EAAW;AAChD,MAAA,OAAO,EAAE,QAAQ,WAAA,EAAY;AAAA,IAC/B;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,YAAA,EAAc,KAAK,YAAA,EAAa;AAAA,EAC7D;AAEA,EAAA,WAAA,CAAY,GAAA,CAAI,KAAK,MAAM,CAAA;AAC3B,EAAA,IAAI,SAAA,IAAa,IAAA,CAAK,MAAA,KAAW,SAAA,EAAW;AAC1C,IAAA,OAAO,EAAE,QAAQ,WAAA,EAAY;AAAA,EAC/B;AACA,EAAA,OAAO,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,KAAK,MAAA,EAAO;AACnD;AAQO,SAAS,aAAA,CACd,QACA,SAAA,EACS;AACT,EAAA,OAAO,SAAA,KAAc,UAAa,MAAA,KAAW,SAAA;AAC/C;AAgBA,eAAsB,qBACpB,OAAA,EAC6B;AAC7B,EAAA,MAAM;AAAA,IACJ,OAAA;AAAA,IACA,UAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,aAAA;AAAA,IACA,UAAA;AAAA,IACA,eAAA,GAAkB,CAAA;AAAA,IAClB,WAAA;AAAA,IACA,SAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AACJ,EAAA,MAAM,UAAU,QAAA,IAAY,KAAA;AAC5B,EAAA,MAAM,QAAA,GAAW,uBAAA,CAAwB,OAAA,EAAS,UAAU,CAAA;AAE5D,EAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,OAAA,CAAQ,WAAW,CAAA;AAI/C,EAAA,wBAAA,CAAyB,UAAU,aAAa,CAAA;AAEhD,EAAA,IAAI,aAAuC,EAAC;AAC5C,EAAA,IAAI,MAAA,GAA6B,WAAA;AACjC,EAAA,IAAI,YAAA,GAAe,CAAA;AACnB,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI,mBAAA;AAEJ,EAAA,OAAO,CAAC,aAAA,CAAc,MAAA,EAAQ,SAAS,CAAA,EAAG;AACxC,IAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,QAAA,EAAU,MAAA,EAAQ,UAAU,aAAa,CAAA;AACzE,IAAA,MAAM,IAAA,GAAO,MAAM,iBAAA,CAAkB,OAAA,EAAS,KAAK,aAAa,CAAA;AAChE,IAAA,UAAA,CAAW,IAAA,CAAK,GAAG,IAAA,CAAK,OAAO,CAAA;AAC/B,IAAA,YAAA,IAAgB,CAAA;AAEhB,IAAA,MAAM,YAAA,GAAe,kBAAkB,UAAA,CAAW,MAAA;AAClD,IAAA,IAAI,UAAA,KAAe,MAAA,IAAa,YAAA,GAAe,UAAA,EAAY;AACzD,MAAA,MAAM,SAAS,uBAAA,CAAwB;AAAA,QACrC,0BAAA,EAA4B,UAAA;AAAA,QAC5B,cAAA,EAAgB,KAAK,OAAA,CAAQ,MAAA;AAAA,QAC7B,eAAA;AAAA,QACA,UAAA,EAAY,MAAA;AAAA,QACZ,WAAA;AAAA,QACA,gBAAA,EAAkB,KAAK,QAAA,EAAU;AAAA,OAClC,CAAA;AACD,MAAA,UAAA,GAAa,MAAA,CAAO,OAAA;AACpB,MAAA,mBAAA,GAAsB,MAAA,CAAO,SAAA;AAC7B,MAAA;AAAA,IACF;AAEA,IAAA,MAAM,OAAA,GAAU,0BAAA;AAAA,MACd,iBAAA;AAAA,QACE,KAAK,QAAA,EAAU,UAAA;AAAA,QACf,WAAA;AAAA,QACA,YAAA;AAAA,QACA;AAAA,OACF;AAAA,MACA,WAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,UAAA,IAAc,OAAA,CAAQ,WAAW,WAAA,EAAa;AACnE,MAAA;AAAA,IACF;AACA,IAAA,IAAI,OAAA,CAAQ,WAAW,QAAA,EAAU;AAC/B,MAAA,YAAA,GAAe,OAAA,CAAQ,YAAA;AACvB,MAAA;AAAA,IACF;AACA,IAAA,MAAA,GAAS,OAAA,CAAQ,MAAA;AAAA,EACnB;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,YAAA;AAAA,IACA,SAAA,EAAW,mBAAA;AAAA,IACX;AAAA,GACF;AACF;;;;;;;;;;;;;;;;;;;"}

package/dist/config.cjs.js

@@ -0,0 +1,231 @@
+'use strict';
+
+var backendPluginApi = require('@backstage/backend-plugin-api');
+
+const DEFAULT_SCHEDULE = {
+  frequency: { minutes: 30 },
+  timeout: { minutes: 3 }
+};
+const DEFAULT_API_VERSION = "v1";
+const DEFAULT_PAGE_LIMIT = 10;
+const DEFAULT_MAX_ENTRIES = 5e3;
+const DEFAULT_REMOTES_ONLY = false;
+const DEFAULT_LATEST_VERSION = false;
+const MCP_REGISTRY_INSTANCE_ID = "mcpRegistry";
+const MCP_REGISTRY_INSTANCE_CONFIG_PATH = `catalog.providers.mcpRegistry.${MCP_REGISTRY_INSTANCE_ID}`;
+const KNOWN_MCP_REGISTRY_KEYS = /* @__PURE__ */ new Set([
+  "baseUrl",
+  "baseName",
+  "apiVersion",
+  "defaultOwner",
+  "defaultLifecycle",
+  "pageLimit",
+  "pageSize",
+  "maxEntries",
+  "remotesOnly",
+  "latestVersion",
+  "hostAllowList",
+  "schedule"
+]);
+function safeGetOptionalString(config, key) {
+  try {
+    return config.getOptionalString(key);
+  } catch {
+    return void 0;
+  }
+}
+function assertSingleRegistryConfig(registryConfig) {
+  const unknownKeys = registryConfig.keys().filter((key) => !KNOWN_MCP_REGISTRY_KEYS.has(key));
+  for (const key of unknownKeys) {
+    let nested;
+    try {
+      nested = registryConfig.getOptionalConfig(key);
+    } catch {
+      continue;
+    }
+    if (nested && nested.keys().length > 0) {
+      const knownKeys = [...KNOWN_MCP_REGISTRY_KEYS].join(", ");
+      throw new Error(
+        `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: found keyed instance "${key}". Configure a single registry object with known keys: ${knownKeys}.`
+      );
+    }
+  }
+}
+function readReservedRegistryInstanceConfig(providersMap, warn) {
+  const keys = providersMap.keys();
+  if (keys.length === 0) {
+    return void 0;
+  }
+  const legacyKeys = keys.filter((key) => KNOWN_MCP_REGISTRY_KEYS.has(key));
+  if (legacyKeys.length > 0) {
+    throw new Error(
+      `Invalid catalog.providers.mcpRegistry configuration: registry options (${legacyKeys.join(", ")}) must be nested under the reserved instance key "${MCP_REGISTRY_INSTANCE_ID}" (e.g. catalog.providers.mcpRegistry.${MCP_REGISTRY_INSTANCE_ID}.baseUrl).`
+    );
+  }
+  const unexpectedKeys = keys.filter((key) => key !== MCP_REGISTRY_INSTANCE_ID);
+  if (unexpectedKeys.length > 0) {
+    warn?.(
+      `catalog.providers.mcpRegistry has additional instance id(s) [${unexpectedKeys.join(
+        ", "
+      )}] which are ignored; multiple MCP Registry providers are not supported yet. Only the reserved "${MCP_REGISTRY_INSTANCE_ID}" instance is used.`
+    );
+  }
+  const registryConfig = providersMap.getOptionalConfig(
+    MCP_REGISTRY_INSTANCE_ID
+  );
+  if (!registryConfig) {
+    return void 0;
+  }
+  return registryConfig;
+}
+function readRequiredHttpBaseUrl(registryConfig) {
+  const baseUrl = safeGetOptionalString(registryConfig, "baseUrl");
+  if (!baseUrl) {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: missing required "baseUrl" field. Set baseUrl to the MCP Registry base URL (e.g., "https://registry.example.com").`
+    );
+  }
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(baseUrl);
+  } catch {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: "baseUrl" is not a valid URL: "${baseUrl}". Set baseUrl to an absolute HTTP(S) URL (e.g., "https://registry.example.com").`
+    );
+  }
+  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: "baseUrl" must use http or https protocol, got "${parsedUrl.protocol}" in "${baseUrl}".`
+    );
+  }
+  return baseUrl;
+}
+function readPageLimit(registryConfig) {
+  const pageLimit = registryConfig.getOptionalNumber("pageLimit") ?? DEFAULT_PAGE_LIMIT;
+  if (pageLimit < 1) {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: "pageLimit" must be at least 1, got ${pageLimit}.`
+    );
+  }
+  return pageLimit;
+}
+function readMaxEntries(registryConfig) {
+  const maxEntries = registryConfig.getOptionalNumber("maxEntries") ?? DEFAULT_MAX_ENTRIES;
+  if (maxEntries < 1) {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: "maxEntries" must be at least 1, got ${maxEntries}.`
+    );
+  }
+  return maxEntries;
+}
+function readOptionalPageSize(registryConfig) {
+  const pageSize = registryConfig.getOptionalNumber("pageSize");
+  if (pageSize !== void 0 && pageSize < 1) {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: "pageSize" must be at least 1, got ${pageSize}.`
+    );
+  }
+  return pageSize;
+}
+function readHostAllowList(registryConfig) {
+  const list = registryConfig.getOptionalStringArray("hostAllowList");
+  if (!list) {
+    return void 0;
+  }
+  return list.map((h) => h.toLowerCase());
+}
+function validateHostAllowList(url, hostAllowList) {
+  const parsed = new URL(url);
+  const hostname = parsed.hostname.toLowerCase();
+  if (!hostAllowList.includes(hostname)) {
+    throw new Error(
+      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: the hostname "${hostname}" from baseUrl "${url}" is not in the configured hostAllowList [${hostAllowList.join(", ")}].`
+    );
+  }
+}
+function readRemotesOnly(registryConfig) {
+  try {
+    return registryConfig.getOptionalBoolean("remotesOnly") ?? DEFAULT_REMOTES_ONLY;
+  } catch {
+    return DEFAULT_REMOTES_ONLY;
+  }
+}
+function readLatestVersion(registryConfig) {
+  try {
+    return registryConfig.getOptionalBoolean("latestVersion") ?? DEFAULT_LATEST_VERSION;
+  } catch {
+    return DEFAULT_LATEST_VERSION;
+  }
+}
+function readProviderSchedule(registryConfig) {
+  const scheduleConfig = registryConfig.getOptionalConfig("schedule");
+  if (!scheduleConfig) {
+    return DEFAULT_SCHEDULE;
+  }
+  return backendPluginApi.readSchedulerServiceTaskScheduleDefinitionFromConfig(scheduleConfig);
+}
+function resolveMcpRegistryProviderConfig(config) {
+  return {
+    ...config,
+    apiVersion: config.apiVersion ?? DEFAULT_API_VERSION,
+    pageLimit: config.pageLimit ?? DEFAULT_PAGE_LIMIT,
+    maxEntries: config.maxEntries ?? DEFAULT_MAX_ENTRIES,
+    remotesOnly: config.remotesOnly ?? DEFAULT_REMOTES_ONLY,
+    latestVersion: config.latestVersion ?? DEFAULT_LATEST_VERSION
+  };
+}
+function readMcpRegistryProviderConfig(rootConfig, warn) {
+  const providersConfig = rootConfig.getOptionalConfig("catalog.providers");
+  if (!providersConfig) {
+    return void 0;
+  }
+  const providersMap = providersConfig.getOptionalConfig("mcpRegistry");
+  if (!providersMap) {
+    return void 0;
+  }
+  const registryConfig = readReservedRegistryInstanceConfig(providersMap, warn);
+  if (!registryConfig) {
+    return void 0;
+  }
+  assertSingleRegistryConfig(registryConfig);
+  const baseUrl = readRequiredHttpBaseUrl(registryConfig);
+  const hostAllowList = readHostAllowList(registryConfig);
+  if (hostAllowList) {
+    validateHostAllowList(baseUrl, hostAllowList);
+  } else {
+    warn?.(
+      `${MCP_REGISTRY_INSTANCE_CONFIG_PATH}.hostAllowList is not configured; outbound registry requests are not restricted by hostname. Set hostAllowList to permitted registry hostnames for defense-in-depth against SSRF.`
+    );
+  }
+  return {
+    baseUrl,
+    baseName: safeGetOptionalString(registryConfig, "baseName"),
+    apiVersion: safeGetOptionalString(registryConfig, "apiVersion") ?? DEFAULT_API_VERSION,
+    defaultOwner: safeGetOptionalString(registryConfig, "defaultOwner"),
+    defaultLifecycle: safeGetOptionalString(registryConfig, "defaultLifecycle"),
+    pageLimit: readPageLimit(registryConfig),
+    pageSize: readOptionalPageSize(registryConfig),
+    maxEntries: readMaxEntries(registryConfig),
+    remotesOnly: readRemotesOnly(registryConfig),
+    latestVersion: readLatestVersion(registryConfig),
+    hostAllowList,
+    schedule: readProviderSchedule(registryConfig)
+  };
+}
+
+exports.MCP_REGISTRY_INSTANCE_ID = MCP_REGISTRY_INSTANCE_ID;
+exports.assertSingleRegistryConfig = assertSingleRegistryConfig;
+exports.readHostAllowList = readHostAllowList;
+exports.readLatestVersion = readLatestVersion;
+exports.readMaxEntries = readMaxEntries;
+exports.readMcpRegistryProviderConfig = readMcpRegistryProviderConfig;
+exports.readOptionalPageSize = readOptionalPageSize;
+exports.readPageLimit = readPageLimit;
+exports.readProviderSchedule = readProviderSchedule;
+exports.readRemotesOnly = readRemotesOnly;
+exports.readRequiredHttpBaseUrl = readRequiredHttpBaseUrl;
+exports.readReservedRegistryInstanceConfig = readReservedRegistryInstanceConfig;
+exports.resolveMcpRegistryProviderConfig = resolveMcpRegistryProviderConfig;
+exports.safeGetOptionalString = safeGetOptionalString;
+exports.validateHostAllowList = validateHostAllowList;
+//# sourceMappingURL=config.cjs.js.map

package/dist/config.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.cjs.js","sources":["../src/config.ts"],"sourcesContent":["/*\n * Copyright Red Hat, Inc.\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport type { Config } from '@backstage/config';\nimport type { SchedulerServiceTaskScheduleDefinition } from '@backstage/backend-plugin-api';\nimport { readSchedulerServiceTaskScheduleDefinitionFromConfig } from '@backstage/backend-plugin-api';\n\n/** Default schedule when `schedule` is omitted. */\nconst DEFAULT_SCHEDULE: SchedulerServiceTaskScheduleDefinition = {\n  frequency: { minutes: 30 },\n  timeout: { minutes: 3 },\n};\n\n/** Default apiVersion when omitted. */\nconst DEFAULT_API_VERSION = 'v1';\n\n/** Default page limit (max pages per sync). */\nconst DEFAULT_PAGE_LIMIT = 10;\n\n/** Default max entries per complete registry traversal (full mutation). */\nconst DEFAULT_MAX_ENTRIES = 5000;\n\n/** Default remotesOnly when omitted. */\nconst DEFAULT_REMOTES_ONLY = false;\n\n/** Default latestVersion when omitted. */\nconst DEFAULT_LATEST_VERSION = false;\n\n/**\n * Reserved instance id under `catalog.providers.mcpRegistry`.\n * This implementation expects only this key; additional ids are rejected\n * until multi-registry support lands.\n */\nexport const MCP_REGISTRY_INSTANCE_ID = 'mcpRegistry';\n\n/** Config path for the reserved registry instance. */\nconst MCP_REGISTRY_INSTANCE_CONFIG_PATH = `catalog.providers.mcpRegistry.${MCP_REGISTRY_INSTANCE_ID}`;\n\n/** Supported single-registry config keys under the reserved instance. */\nconst KNOWN_MCP_REGISTRY_KEYS = new Set([\n  'baseUrl',\n  'baseName',\n  'apiVersion',\n  'defaultOwner',\n  'defaultLifecycle',\n  'pageLimit',\n  'pageSize',\n  'maxEntries',\n  'remotesOnly',\n  'latestVersion',\n  'hostAllowList',\n  'schedule',\n]);\n\n/**\n * Safely read an optional string from config, returning `undefined`\n * when Backstage's ConfigReader throws TypeError for empty-string\n * values from env var substitution like `${VAR:-}`.\n *\n * @internal\n */\nexport function safeGetOptionalString(\n  config: Config,\n  key: string,\n): string | undefined {\n  try {\n    return config.getOptionalString(key);\n  } catch {\n    // ConfigReader throws TypeError for empty-string values\n    // from env var substitution like ${VAR:-}\n    return undefined;\n  }\n}\n\n/**\n * Reject unexpected nested objects under a registry instance config.\n *\n * @internal\n */\nexport function assertSingleRegistryConfig(registryConfig: Config): void {\n  const unknownKeys = registryConfig\n    .keys()\n    .filter(key => !KNOWN_MCP_REGISTRY_KEYS.has(key));\n\n  for (const key of unknownKeys) {\n    let nested;\n    try {\n      nested = registryConfig.getOptionalConfig(key);\n    } catch {\n      // ConfigReader throws TypeError when the value is a scalar\n      // rather than an object — skip this key silently.\n      continue;\n    }\n    if (nested && nested.keys().length > 0) {\n      const knownKeys = [...KNOWN_MCP_REGISTRY_KEYS].join(', ');\n      throw new Error(\n        `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: found ` +\n          `keyed instance \"${key}\". Configure a single registry object ` +\n          `with known keys: ${knownKeys}.`,\n      );\n    }\n  }\n}\n\n/**\n * Optional warning sink used when configuration is accepted with caveats\n * (e.g. ignored extra registry instance ids, or absent `hostAllowList`).\n *\n * @internal\n */\nexport type ConfigWarnFn = (message: string) => void;\n\n/**\n * Resolve the reserved registry instance from the providers map.\n *\n * `catalog.providers.mcpRegistry` is a map of instance ids. This\n * implementation only reads the reserved key {@link MCP_REGISTRY_INSTANCE_ID};\n * additional ids are ignored (with an optional warning).\n *\n * @internal\n */\nexport function readReservedRegistryInstanceConfig(\n  providersMap: Config,\n  warn?: ConfigWarnFn,\n): Config | undefined {\n  const keys = providersMap.keys();\n  if (keys.length === 0) {\n    return undefined;\n  }\n\n  const legacyKeys = keys.filter(key => KNOWN_MCP_REGISTRY_KEYS.has(key));\n  if (legacyKeys.length > 0) {\n    throw new Error(\n      `Invalid catalog.providers.mcpRegistry configuration: registry ` +\n        `options (${legacyKeys.join(', ')}) must be nested under the ` +\n        `reserved instance key \"${MCP_REGISTRY_INSTANCE_ID}\" ` +\n        `(e.g. catalog.providers.mcpRegistry.${MCP_REGISTRY_INSTANCE_ID}.baseUrl).`,\n    );\n  }\n\n  const unexpectedKeys = keys.filter(key => key !== MCP_REGISTRY_INSTANCE_ID);\n  if (unexpectedKeys.length > 0) {\n    warn?.(\n      `catalog.providers.mcpRegistry has additional instance id(s) ` +\n        `[${unexpectedKeys.join(\n          ', ',\n        )}] which are ignored; multiple MCP Registry providers are not ` +\n        `supported yet. Only the reserved \"${MCP_REGISTRY_INSTANCE_ID}\" ` +\n        `instance is used.`,\n    );\n  }\n\n  const registryConfig = providersMap.getOptionalConfig(\n    MCP_REGISTRY_INSTANCE_ID,\n  );\n  if (!registryConfig) {\n    return undefined;\n  }\n\n  return registryConfig;\n}\n\n/**\n * Read and validate the required HTTP(S) `baseUrl`.\n *\n * @internal\n */\nexport function readRequiredHttpBaseUrl(registryConfig: Config): string {\n  const baseUrl = safeGetOptionalString(registryConfig, 'baseUrl');\n  if (!baseUrl) {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: missing ` +\n        `required \"baseUrl\" field. Set baseUrl to the MCP Registry base URL ` +\n        `(e.g., \"https://registry.example.com\").`,\n    );\n  }\n\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(baseUrl);\n  } catch {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: \"baseUrl\" ` +\n        `is not a valid URL: \"${baseUrl}\". Set baseUrl to an absolute ` +\n        `HTTP(S) URL (e.g., \"https://registry.example.com\").`,\n    );\n  }\n\n  if (parsedUrl.protocol !== 'http:' && parsedUrl.protocol !== 'https:') {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: \"baseUrl\" ` +\n        `must use http or https protocol, got \"${parsedUrl.protocol}\" ` +\n        `in \"${baseUrl}\".`,\n    );\n  }\n\n  return baseUrl;\n}\n\n/**\n * Read `pageLimit`, applying the default and rejecting values below 1.\n *\n * @internal\n */\nexport function readPageLimit(registryConfig: Config): number {\n  const pageLimit =\n    registryConfig.getOptionalNumber('pageLimit') ?? DEFAULT_PAGE_LIMIT;\n  if (pageLimit < 1) {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: \"pageLimit\" ` +\n        `must be at least 1, got ${pageLimit}.`,\n    );\n  }\n  return pageLimit;\n}\n\n/**\n * Read `maxEntries`, applying the default and rejecting values below 1.\n * Caps total servers buffered for one complete registry traversal\n * (possibly spanning multiple resume syncs) before a full mutation.\n *\n * @internal\n */\nexport function readMaxEntries(registryConfig: Config): number {\n  const maxEntries =\n    registryConfig.getOptionalNumber('maxEntries') ?? DEFAULT_MAX_ENTRIES;\n  if (maxEntries < 1) {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: \"maxEntries\" ` +\n        `must be at least 1, got ${maxEntries}.`,\n    );\n  }\n  return maxEntries;\n}\n\n/**\n * Read optional `pageSize`, rejecting values below 1 when set.\n *\n * @internal\n */\nexport function readOptionalPageSize(\n  registryConfig: Config,\n): number | undefined {\n  const pageSize = registryConfig.getOptionalNumber('pageSize');\n  if (pageSize !== undefined && pageSize < 1) {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: \"pageSize\" ` +\n        `must be at least 1, got ${pageSize}.`,\n    );\n  }\n  return pageSize;\n}\n\n/**\n * Read optional `hostAllowList`, normalizing entries to lowercase.\n *\n * Returns `undefined` when the key is absent (no filtering).\n * Returns an empty array when configured as `[]` — semantically\n * \"deny all\" (no hostname can pass validation).\n *\n * @internal\n */\nexport function readHostAllowList(\n  registryConfig: Config,\n): string[] | undefined {\n  const list = registryConfig.getOptionalStringArray('hostAllowList');\n  if (!list) {\n    return undefined;\n  }\n  return list.map(h => h.toLowerCase());\n}\n\n/**\n * Validate that a URL's hostname is present in the configured allow list.\n * Throws when the hostname is not in the list.\n *\n * @internal\n */\nexport function validateHostAllowList(\n  url: string,\n  hostAllowList: string[],\n): void {\n  const parsed = new URL(url);\n  const hostname = parsed.hostname.toLowerCase();\n  if (!hostAllowList.includes(hostname)) {\n    throw new Error(\n      `Invalid ${MCP_REGISTRY_INSTANCE_CONFIG_PATH} configuration: the hostname ` +\n        `\"${hostname}\" from baseUrl \"${url}\" is not in the configured ` +\n        `hostAllowList [${hostAllowList.join(', ')}].`,\n    );\n  }\n}\n\n/**\n * Read `remotesOnly`, defaulting to `false`.\n *\n * @internal\n */\nexport function readRemotesOnly(registryConfig: Config): boolean {\n  try {\n    return (\n      registryConfig.getOptionalBoolean('remotesOnly') ?? DEFAULT_REMOTES_ONLY\n    );\n  } catch {\n    // ConfigReader throws TypeError for empty-string env substitution.\n    return DEFAULT_REMOTES_ONLY;\n  }\n}\n\n/**\n * Read `latestVersion`, defaulting to `false`.\n *\n * When true, list requests include `?version=latest`.\n *\n * @internal\n */\nexport function readLatestVersion(registryConfig: Config): boolean {\n  try {\n    return (\n      registryConfig.getOptionalBoolean('latestVersion') ??\n      DEFAULT_LATEST_VERSION\n    );\n  } catch {\n    // ConfigReader throws TypeError for empty-string env substitution.\n    return DEFAULT_LATEST_VERSION;\n  }\n}\n\n/**\n * Read the provider schedule, or the documented default when omitted.\n *\n * @internal\n */\nexport function readProviderSchedule(\n  registryConfig: Config,\n): SchedulerServiceTaskScheduleDefinition {\n  const scheduleConfig = registryConfig.getOptionalConfig('schedule');\n  if (!scheduleConfig) {\n    return DEFAULT_SCHEDULE;\n  }\n  return readSchedulerServiceTaskScheduleDefinitionFromConfig(scheduleConfig);\n}\n\n/**\n * Provider configuration. Fields with documented defaults may be omitted\n * on direct construction; the entity provider and config reader apply the\n * same defaults as app-config parsing.\n *\n * @public\n */\nexport interface McpRegistryProviderConfig {\n  /** Base URL of the MCP Registry (required). */\n  baseUrl: string;\n  /** Optional identity prefix override passed to the mapping transform. */\n  baseName?: string;\n  /** Registry API version slug used in the endpoint path (default `v1`). */\n  apiVersion?: string;\n  /** Default entity owner ref when the mapping does not supply one. */\n  defaultOwner?: string;\n  /** Default entity lifecycle when the mapping does not supply one. */\n  defaultLifecycle?: string;\n  /** Maximum pages fetched per sync (default `10`); excess pages resume next sync. */\n  pageLimit?: number;\n  /** Registry `?limit=` page-size query; omitted from the request when unset. */\n  pageSize?: number;\n  /**\n   * Maximum total entries buffered for one complete registry traversal\n   * before a full mutation (default `5000`). Spans resume syncs when\n   * `pageLimit` pauses mid-traversal. When exceeded, the provider\n   * commits the buffer, saves an end cursor, and later traversals stop\n   * at that cursor until `maxEntries` is patched.\n   */\n  maxEntries?: number;\n  /**\n   * When true, only ingest servers with at least one native remote.\n   * Package-only / placeholder-remote servers are skipped (default `false`).\n   */\n  remotesOnly?: boolean;\n  /**\n   * When true, list requests include `?version=latest` so the registry\n   * returns only the latest version of each server (default `false`).\n   */\n  latestVersion?: boolean;\n  /** Optional allowlist of permitted hostnames for defense-in-depth SSRF protection. */\n  hostAllowList?: string[];\n  /** Schedule for the sync task. */\n  schedule: SchedulerServiceTaskScheduleDefinition;\n}\n\n/**\n * {@link McpRegistryProviderConfig} with defaults applied for fields\n * that are optional on the public interface.\n *\n * @internal\n */\nexport type ResolvedMcpRegistryProviderConfig = McpRegistryProviderConfig & {\n  apiVersion: string;\n  pageLimit: number;\n  maxEntries: number;\n  remotesOnly: boolean;\n  latestVersion: boolean;\n};\n\n/**\n * Apply documented defaults for optional provider config fields.\n *\n * @internal\n */\nexport function resolveMcpRegistryProviderConfig(\n  config: McpRegistryProviderConfig,\n): ResolvedMcpRegistryProviderConfig {\n  return {\n    ...config,\n    apiVersion: config.apiVersion ?? DEFAULT_API_VERSION,\n    pageLimit: config.pageLimit ?? DEFAULT_PAGE_LIMIT,\n    maxEntries: config.maxEntries ?? DEFAULT_MAX_ENTRIES,\n    remotesOnly: config.remotesOnly ?? DEFAULT_REMOTES_ONLY,\n    latestVersion: config.latestVersion ?? DEFAULT_LATEST_VERSION,\n  };\n}\n\n/**\n * Read and validate the MCP Registry provider configuration from\n * `catalog.providers.mcpRegistry.mcpRegistry` (reserved instance id).\n * Returns `undefined` when the providers map or reserved instance is\n * absent (inert module).\n *\n * Additional instance ids under `catalog.providers.mcpRegistry` are\n * ignored; pass `warn` to surface that multiple registries are not\n * supported yet. When `hostAllowList` is omitted, `warn` is also used\n * to recommend configuring hostname restrictions.\n *\n * @throws When a legacy flat `catalog.providers.mcpRegistry` object is\n *   used, or when `baseUrl` is missing on the reserved instance.\n */\nexport function readMcpRegistryProviderConfig(\n  rootConfig: Config,\n  warn?: ConfigWarnFn,\n): ResolvedMcpRegistryProviderConfig | undefined {\n  const providersConfig = rootConfig.getOptionalConfig('catalog.providers');\n  if (!providersConfig) {\n    return undefined;\n  }\n\n  const providersMap = providersConfig.getOptionalConfig('mcpRegistry');\n  if (!providersMap) {\n    return undefined;\n  }\n\n  const registryConfig = readReservedRegistryInstanceConfig(providersMap, warn);\n  if (!registryConfig) {\n    return undefined;\n  }\n\n  assertSingleRegistryConfig(registryConfig);\n\n  const baseUrl = readRequiredHttpBaseUrl(registryConfig);\n  const hostAllowList = readHostAllowList(registryConfig);\n\n  if (hostAllowList) {\n    validateHostAllowList(baseUrl, hostAllowList);\n  } else {\n    warn?.(\n      `${MCP_REGISTRY_INSTANCE_CONFIG_PATH}.hostAllowList is not configured; ` +\n        `outbound registry requests are not restricted by hostname. Set ` +\n        `hostAllowList to permitted registry hostnames for defense-in-depth ` +\n        `against SSRF.`,\n    );\n  }\n\n  return {\n    baseUrl,\n    baseName: safeGetOptionalString(registryConfig, 'baseName'),\n    apiVersion:\n      safeGetOptionalString(registryConfig, 'apiVersion') ??\n      DEFAULT_API_VERSION,\n    defaultOwner: safeGetOptionalString(registryConfig, 'defaultOwner'),\n    defaultLifecycle: safeGetOptionalString(registryConfig, 'defaultLifecycle'),\n    pageLimit: readPageLimit(registryConfig),\n    pageSize: readOptionalPageSize(registryConfig),\n    maxEntries: readMaxEntries(registryConfig),\n    remotesOnly: readRemotesOnly(registryConfig),\n    latestVersion: readLatestVersion(registryConfig),\n    hostAllowList,\n    schedule: readProviderSchedule(registryConfig),\n  };\n}\n"],"names":["readSchedulerServiceTaskScheduleDefinitionFromConfig"],"mappings":";;;;AAqBA,MAAM,gBAAA,GAA2D;AAAA,EAC/D,SAAA,EAAW,EAAE,OAAA,EAAS,EAAA,EAAG;AAAA,EACzB,OAAA,EAAS,EAAE,OAAA,EAAS,CAAA;AACtB,CAAA;AAGA,MAAM,mBAAA,GAAsB,IAAA;AAG5B,MAAM,kBAAA,GAAqB,EAAA;AAG3B,MAAM,mBAAA,GAAsB,GAAA;AAG5B,MAAM,oBAAA,GAAuB,KAAA;AAG7B,MAAM,sBAAA,GAAyB,KAAA;AAOxB,MAAM,wBAAA,GAA2B;AAGxC,MAAM,iCAAA,GAAoC,iCAAiC,wBAAwB,CAAA,CAAA;AAGnG,MAAM,uBAAA,uBAA8B,GAAA,CAAI;AAAA,EACtC,SAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA,eAAA;AAAA,EACA,eAAA;AAAA,EACA;AACF,CAAC,CAAA;AASM,SAAS,qBAAA,CACd,QACA,GAAA,EACoB;AACpB,EAAA,IAAI;AACF,IAAA,OAAO,MAAA,CAAO,kBAAkB,GAAG,CAAA;AAAA,EACrC,CAAA,CAAA,MAAQ;AAGN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAOO,SAAS,2BAA2B,cAAA,EAA8B;AACvE,EAAA,MAAM,WAAA,GAAc,cAAA,CACjB,IAAA,EAAK,CACL,MAAA,CAAO,SAAO,CAAC,uBAAA,CAAwB,GAAA,CAAI,GAAG,CAAC,CAAA;AAElD,EAAA,KAAA,MAAW,OAAO,WAAA,EAAa;AAC7B,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,cAAA,CAAe,kBAAkB,GAAG,CAAA;AAAA,IAC/C,CAAA,CAAA,MAAQ;AAGN,MAAA;AAAA,IACF;AACA,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,IAAA,EAAK,CAAE,SAAS,CAAA,EAAG;AACtC,MAAA,MAAM,YAAY,CAAC,GAAG,uBAAuB,CAAA,CAAE,KAAK,IAAI,CAAA;AACxD,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,sCAAA,EACvB,GAAG,0DACF,SAAS,CAAA,CAAA;AAAA,OACjC;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,kCAAA,CACd,cACA,IAAA,EACoB;AACpB,EAAA,MAAM,IAAA,GAAO,aAAa,IAAA,EAAK;AAC/B,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,aAAa,IAAA,CAAK,MAAA,CAAO,SAAO,uBAAA,CAAwB,GAAA,CAAI,GAAG,CAAC,CAAA;AACtE,EAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uEAAA,EACc,WAAW,IAAA,CAAK,IAAI,CAAC,CAAA,kDAAA,EACP,wBAAwB,yCACX,wBAAwB,CAAA,UAAA;AAAA,KACnE;AAAA,EACF;AAEA,EAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,CAAA,GAAA,KAAO,QAAQ,wBAAwB,CAAA;AAC1E,EAAA,IAAI,cAAA,CAAe,SAAS,CAAA,EAAG;AAC7B,IAAA,IAAA;AAAA,MACE,gEACM,cAAA,CAAe,IAAA;AAAA,QACjB;AAAA,OACD,kGACoC,wBAAwB,CAAA,mBAAA;AAAA,KAEjE;AAAA,EACF;AAEA,EAAA,MAAM,iBAAiB,YAAA,CAAa,iBAAA;AAAA,IAClC;AAAA,GACF;AACA,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,OAAO,cAAA;AACT;AAOO,SAAS,wBAAwB,cAAA,EAAgC;AACtE,EAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,cAAA,EAAgB,SAAS,CAAA;AAC/D,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,WAAW,iCAAiC,CAAA,kIAAA;AAAA,KAG9C;AAAA,EACF;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,SAAA,GAAY,IAAI,IAAI,OAAO,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,+CAAA,EAClB,OAAO,CAAA,iFAAA;AAAA,KAEnC;AAAA,EACF;AAEA,EAAA,IAAI,SAAA,CAAU,QAAA,KAAa,OAAA,IAAW,SAAA,CAAU,aAAa,QAAA,EAAU;AACrE,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,WAAW,iCAAiC,CAAA,gEAAA,EACD,SAAA,CAAU,QAAQ,SACpD,OAAO,CAAA,EAAA;AAAA,KAClB;AAAA,EACF;AAEA,EAAA,OAAO,OAAA;AACT;AAOO,SAAS,cAAc,cAAA,EAAgC;AAC5D,EAAA,MAAM,SAAA,GACJ,cAAA,CAAe,iBAAA,CAAkB,WAAW,CAAA,IAAK,kBAAA;AACnD,EAAA,IAAI,YAAY,CAAA,EAAG;AACjB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,oDAAA,EACf,SAAS,CAAA,CAAA;AAAA,KACxC;AAAA,EACF;AACA,EAAA,OAAO,SAAA;AACT;AASO,SAAS,eAAe,cAAA,EAAgC;AAC7D,EAAA,MAAM,UAAA,GACJ,cAAA,CAAe,iBAAA,CAAkB,YAAY,CAAA,IAAK,mBAAA;AACpD,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,qDAAA,EACf,UAAU,CAAA,CAAA;AAAA,KACzC;AAAA,EACF;AACA,EAAA,OAAO,UAAA;AACT;AAOO,SAAS,qBACd,cAAA,EACoB;AACpB,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,iBAAA,CAAkB,UAAU,CAAA;AAC5D,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,GAAW,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,mDAAA,EACf,QAAQ,CAAA,CAAA;AAAA,KACvC;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAWO,SAAS,kBACd,cAAA,EACsB;AACtB,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,sBAAA,CAAuB,eAAe,CAAA;AAClE,EAAA,IAAI,CAAC,IAAA,EAAM;AACT,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,aAAa,CAAA;AACtC;AAQO,SAAS,qBAAA,CACd,KACA,aAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,CAAS,WAAA,EAAY;AAC7C,EAAA,IAAI,CAAC,aAAA,CAAc,QAAA,CAAS,QAAQ,CAAA,EAAG;AACrC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,QAAA,EAAW,iCAAiC,CAAA,8BAAA,EACtC,QAAQ,CAAA,gBAAA,EAAmB,GAAG,CAAA,0CAAA,EAChB,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA;AAAA,KAC9C;AAAA,EACF;AACF;AAOO,SAAS,gBAAgB,cAAA,EAAiC;AAC/D,EAAA,IAAI;AACF,IAAA,OACE,cAAA,CAAe,kBAAA,CAAmB,aAAa,CAAA,IAAK,oBAAA;AAAA,EAExD,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,oBAAA;AAAA,EACT;AACF;AASO,SAAS,kBAAkB,cAAA,EAAiC;AACjE,EAAA,IAAI;AACF,IAAA,OACE,cAAA,CAAe,kBAAA,CAAmB,eAAe,CAAA,IACjD,sBAAA;AAAA,EAEJ,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,sBAAA;AAAA,EACT;AACF;AAOO,SAAS,qBACd,cAAA,EACwC;AACxC,EAAA,MAAM,cAAA,GAAiB,cAAA,CAAe,iBAAA,CAAkB,UAAU,CAAA;AAClE,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,gBAAA;AAAA,EACT;AACA,EAAA,OAAOA,sEAAqD,cAAc,CAAA;AAC5E;AAmEO,SAAS,iCACd,MAAA,EACmC;AACnC,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,UAAA,EAAY,OAAO,UAAA,IAAc,mBAAA;AAAA,IACjC,SAAA,EAAW,OAAO,SAAA,IAAa,kBAAA;AAAA,IAC/B,UAAA,EAAY,OAAO,UAAA,IAAc,mBAAA;AAAA,IACjC,WAAA,EAAa,OAAO,WAAA,IAAe,oBAAA;AAAA,IACnC,aAAA,EAAe,OAAO,aAAA,IAAiB;AAAA,GACzC;AACF;AAgBO,SAAS,6BAAA,CACd,YACA,IAAA,EAC+C;AAC/C,EAAA,MAAM,eAAA,GAAkB,UAAA,CAAW,iBAAA,CAAkB,mBAAmB,CAAA;AACxE,EAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,YAAA,GAAe,eAAA,CAAgB,iBAAA,CAAkB,aAAa,CAAA;AACpE,EAAA,IAAI,CAAC,YAAA,EAAc;AACjB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,MAAM,cAAA,GAAiB,kCAAA,CAAmC,YAAA,EAAc,IAAI,CAAA;AAC5E,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,0BAAA,CAA2B,cAAc,CAAA;AAEzC,EAAA,MAAM,OAAA,GAAU,wBAAwB,cAAc,CAAA;AACtD,EAAA,MAAM,aAAA,GAAgB,kBAAkB,cAAc,CAAA;AAEtD,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,qBAAA,CAAsB,SAAS,aAAa,CAAA;AAAA,EAC9C,CAAA,MAAO;AACL,IAAA,IAAA;AAAA,MACE,GAAG,iCAAiC,CAAA,iLAAA;AAAA,KAItC;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,QAAA,EAAU,qBAAA,CAAsB,cAAA,EAAgB,UAAU,CAAA;AAAA,IAC1D,UAAA,EACE,qBAAA,CAAsB,cAAA,EAAgB,YAAY,CAAA,IAClD,mBAAA;AAAA,IACF,YAAA,EAAc,qBAAA,CAAsB,cAAA,EAAgB,cAAc,CAAA;AAAA,IAClE,gBAAA,EAAkB,qBAAA,CAAsB,cAAA,EAAgB,kBAAkB,CAAA;AAAA,IAC1E,SAAA,EAAW,cAAc,cAAc,CAAA;AAAA,IACvC,QAAA,EAAU,qBAAqB,cAAc,CAAA;AAAA,IAC7C,UAAA,EAAY,eAAe,cAAc,CAAA;AAAA,IACzC,WAAA,EAAa,gBAAgB,cAAc,CAAA;AAAA,IAC3C,aAAA,EAAe,kBAAkB,cAAc,CAAA;AAAA,IAC/C,aAAA;AAAA,IACA,QAAA,EAAU,qBAAqB,cAAc;AAAA,GAC/C;AACF;;;;;;;;;;;;;;;;;;"}

package/dist/index.cjs.js

@@ -0,0 +1,12 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var module$1 = require('./module.cjs.js');
+var McpRegistryEntityProvider = require('./McpRegistryEntityProvider.cjs.js');
+
+
+
+exports.default = module$1.catalogModuleMcpRegistryProvider;
+exports.McpRegistryEntityProvider = McpRegistryEntityProvider.McpRegistryEntityProvider;
+//# sourceMappingURL=index.cjs.js.map

package/dist/index.cjs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;"}