@steuerboard/mcp 0.3.3 → 0.4.0

package/src/lib/base64.ts

@@ -29,9 +29,9 @@ export function stringFromBase64(b64str: string): string {
 }
 
 export const zodOutbound = z
-  .instanceof(Uint8Array)
+  .custom<Uint8Array>((x) => x instanceof Uint8Array)
   .or(z.string().transform(stringToBytes));
 
 export const zodInbound = z
-  .instanceof(Uint8Array)
+  .custom<Uint8Array>((x) => x instanceof Uint8Array)
   .or(z.string().transform(bytesFromBase64));

package/src/lib/config.ts

@@ -62,8 +62,8 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "0.1.0",
-  sdkVersion: "0.3.3",
-  genVersion: "2.721.3",
+  sdkVersion: "0.4.0",
+  genVersion: "2.917.0",
   userAgent:
-    "speakeasy-sdk/mcp-typescript 0.3.3 2.721.3 0.1.0 @steuerboard/mcp",
+    "speakeasy-sdk/mcp-typescript 0.4.0 2.917.0 0.1.0 @steuerboard/mcp",
 } as const;

package/src/lib/encodings.ts

@@ -3,7 +3,7 @@
  */
 
 import { bytesToBase64 } from "./base64.js";
-import { isPlainObject } from "./is-plain-object.js";
+import { isPlainObject } from "./primitives.js";
 
 export class EncodingError extends Error {
   constructor(message: string) {
@@ -102,8 +102,9 @@ export function encodeLabel(
       });
       encValue = mapped?.join("").slice(1);
     } else {
-      const k =
-        options?.explode && isPlainObject(value) ? `${encodeString(pk)}=` : "";
+      const k = options?.explode && isPlainObject(value)
+        ? `${encodeString(pk)}=`
+        : "";
       encValue = `${k}${encodeValue(pv)}`;
     }
 
@@ -365,6 +366,12 @@ function serializeValue(value: unknown): string {
   } else if (value instanceof Uint8Array) {
     return bytesToBase64(value);
   } else if (typeof value === "object") {
+    if (
+      "toJSON" in value
+      && typeof value.toJSON === "function"
+    ) {
+      return String(value.toJSON());
+    }
     return JSON.stringify(value, jsonReplacer);
   }
 
@@ -374,6 +381,8 @@ function serializeValue(value: unknown): string {
 function jsonReplacer(_: string, value: unknown): unknown {
   if (value instanceof Uint8Array) {
     return bytesToBase64(value);
+  } else if (typeof value === "bigint") {
+    return value.toString();
   } else {
     return value;
   }
@@ -440,7 +449,7 @@ type BulkQueryEncoder = (
 ) => string;
 
 export function queryEncoder(f: QueryEncoder): BulkQueryEncoder {
-  const bulkEncode = function (
+  const bulkEncode = function(
     values: Record<string, unknown>,
     options?: QueryEncoderOptions,
   ): string {
@@ -465,6 +474,23 @@ export const encodeSpaceDelimitedQuery = queryEncoder(encodeSpaceDelimited);
 export const encodePipeDelimitedQuery = queryEncoder(encodePipeDelimited);
 export const encodeDeepObjectQuery = queryEncoder(encodeDeepObject);
 
+function isBlobLike(val: unknown): val is Blob {
+  if (val instanceof Blob) {
+    return true;
+  }
+
+  if (typeof val !== "object" || val == null || !(Symbol.toStringTag in val)) {
+    return false;
+  }
+
+  const tag = val[Symbol.toStringTag];
+  if (tag !== "Blob" && tag !== "File") {
+    return false;
+  }
+
+  return "stream" in val && typeof val.stream === "function";
+}
+
 export function appendForm(
   fd: FormData,
   key: string,
@@ -473,11 +499,22 @@ export function appendForm(
 ): void {
   if (value == null) {
     return;
-  } else if (value instanceof Blob && fileName) {
-    fd.append(key, value, fileName);
-  } else if (value instanceof Blob) {
-    fd.append(key, value);
+  } else if (isBlobLike(value)) {
+    if (fileName) {
+      fd.append(key, value as Blob, fileName);
+    } else {
+      fd.append(key, value as Blob);
+    }
   } else {
     fd.append(key, String(value));
   }
 }
+
+export async function normalizeBlob(
+  value: Pick<Blob, "arrayBuffer" | "type">,
+): Promise<Blob> {
+  if (value instanceof Blob) {
+    return value;
+  }
+  return new Blob([await value.arrayBuffer()], { type: value.type });
+}

package/src/lib/env.ts

@@ -2,8 +2,6 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 
-import { dlv } from "./dlv.js";
-
 import * as z from "zod";
 
 export interface Env {
@@ -12,7 +10,7 @@ export interface Env {
   STEUERBOARD_DEBUG?: boolean | undefined;
 }
 
-export const envSchema: z.ZodType<Env, z.ZodTypeDef, unknown> = z.object({
+export const envSchema: z.ZodType<Env> = z.object({
   STEUERBOARD_BEARER_AUTH: z.string().optional(),
 
   STEUERBOARD_DEBUG: z.coerce.boolean().optional(),
@@ -27,8 +25,13 @@ export function env(): Env {
     return envMemo;
   }
 
+  const globals = globalThis as {
+    process?: { env?: Record<string, string | undefined> };
+    Deno?: { env?: { toObject?: () => Record<string, string | undefined> } };
+  };
+
   envMemo = envSchema.parse(
-    dlv(globalThis, "process.env") ?? dlv(globalThis, "Deno.env") ?? {},
+    globals.process?.env ?? globals.Deno?.env?.toObject?.() ?? {},
   );
   return envMemo;
 }

package/src/lib/files.ts

@@ -80,3 +80,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}

package/src/lib/http.ts

@@ -45,8 +45,10 @@ export class HTTPClient {
   private requestHooks: BeforeRequestHook[] = [];
   private requestErrorHooks: RequestErrorHook[] = [];
   private responseHooks: ResponseHook[] = [];
+  private options: HTTPClientOptions;
 
-  constructor(private options: HTTPClientOptions = {}) {
+  constructor(options: HTTPClientOptions = {}) {
+    this.options = options;
     this.fetcher = options.fetcher || DEFAULT_FETCHER;
   }
 

package/src/lib/matchers.ts

@@ -6,7 +6,7 @@ import { APIError } from "../models/errors/apierror.js";
 import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
 import { Result } from "../types/fp.js";
 import { matchResponse, matchStatusCode, StatusCodePredicate } from "./http.js";
-import { isPlainObject } from "./is-plain-object.js";
+import { isPlainObject } from "./primitives.js";
 import { safeParse } from "./schemas.js";
 
 export type Encoding =
@@ -299,9 +299,13 @@ export function match<T, E>(
       );
       return [result.ok ? { ok: false, error: result.value } : result, raw];
     } else {
+      const valueToParse = resultKey && isPlainObject(data) && resultKey in data
+        ? data[resultKey as keyof typeof data]
+        : data;
+
       return [
         safeParse(
-          data,
+          valueToParse,
           (v: unknown) => matcher.schema.parse(v),
           "Response validation failed",
         ),

package/src/lib/primitives.ts

@@ -111,3 +111,19 @@ export function invariant(
     throw new InvariantError(message);
   }
 }
+
+export function isPlainObject(
+  value: unknown,
+): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object") return false;
+  if (Object.prototype.toString.call(value) !== "[object Object]") return false;
+  const proto = Object.getPrototypeOf(value);
+  if (proto === null || proto === Object.prototype) return true;
+  // cross-realm plain objects (vm contexts, iframes) inherit from a
+  // different realm's Object.prototype, which itself has a null prototype
+  try {
+    return Object.getPrototypeOf(proto) === null;
+  } catch {
+    return false;
+  }
+}

package/src/lib/retries.ts

@@ -194,6 +194,14 @@ async function retryBackoff(
 }
 
 function retryIntervalFromResponse(res: Response): number {
+  const retryAfterMsVal = res.headers.get("retry-after-ms");
+  if (retryAfterMsVal) {
+    const parsedMs = Number(retryAfterMsVal);
+    if (Number.isFinite(parsedMs) && parsedMs >= 0) {
+      return parsedMs;
+    }
+  }
+
   const retryVal = res.headers.get("retry-after") || "";
   if (!retryVal) {
     return 0;

package/src/lib/schemas.ts

@@ -2,34 +2,22 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 
-import {
-  output,
-  ZodEffects,
-  ZodError,
-  ZodObject,
-  ZodRawShape,
-  ZodTypeAny,
-} from "zod";
+import * as z from "zod";
 import { SDKValidationError } from "../models/errors/sdkvalidationerror.js";
 import { ERR, OK, Result } from "../types/fp.js";
 
 export function collectExtraKeys<
-  Shape extends ZodRawShape,
-  Catchall extends ZodTypeAny,
+  Shape extends z.ZodRawShape,
+  Catchall extends z.ZodType,
   K extends string,
+  Optional extends boolean,
 >(
-  obj: ZodObject<Shape, "strip", Catchall>,
+  obj: z.ZodObject<Shape, z.core.$catchall<Catchall>>,
   extrasKey: K,
-  optional: boolean,
-): ZodEffects<
-  typeof obj,
-  & output<ZodObject<Shape, "strict">>
-  & {
-    [k in K]: Record<string, output<Catchall>>;
-  }
-> {
-  return obj.transform((val) => {
-    const extras: Record<string, output<Catchall>> = {};
+  optional: Optional,
+) {
+  return obj.transform((val: any) => {
+    const extras: Record<string, z.output<Catchall>> = {};
     const { shape } = obj;
     for (const [key] of Object.entries(val)) {
       if (key in shape) {
@@ -66,7 +54,7 @@ export function parse<Inp, Out>(
   try {
     return fn(rawValue);
   } catch (err) {
-    if (err instanceof ZodError) {
+    if (err instanceof z.ZodError) {
       throw new SDKValidationError(errorMessage, err, rawValue);
     }
     throw err;

package/src/lib/sdks.ts

@@ -310,9 +310,9 @@ export class ClientSDK {
   }
 }
 
-const jsonLikeContentTypeRE = /(application|text)\/.*?\+*json.*/;
+const jsonLikeContentTypeRE = /^(application|text)\/([^+]+\+)*json.*/;
 const jsonlLikeContentTypeRE =
-  /(application|text)\/(.*?\+*\bjsonl\b.*|.*?\+*\bx-ndjson\b.*)/;
+  /^(application|text)\/([^+]+\+)*(jsonl|x-ndjson)\b.*/;
 async function logRequest(logger: Logger | undefined, req: Request) {
   if (!logger) {
     return;
@@ -383,8 +383,6 @@ async function logResponse(
       break;
     case matchContentType(res, "application/jsonl")
       || jsonlLikeContentTypeRE.test(ct):
-      logger.log(await res.clone().text());
-      break;
     case matchContentType(res, "text/event-stream"):
       logger.log(`<${contentType}>`);
       break;

package/src/lib/security.ts

@@ -13,17 +13,22 @@ type OAuth2PasswordFlow = {
   tokenURL: string;
 };
 
-export enum SecurityErrorCode {
-  Incomplete = "incomplete",
-  UnrecognisedSecurityType = "unrecognized_security_type",
-}
+export const SecurityErrorCode = {
+  Incomplete: "incomplete",
+  UnrecognisedSecurityType: "unrecognized_security_type",
+} as const;
+export type SecurityErrorCode =
+  (typeof SecurityErrorCode)[keyof typeof SecurityErrorCode];
 
 export class SecurityError extends Error {
+  public code: SecurityErrorCode;
+
   constructor(
-    public code: SecurityErrorCode,
+    code: SecurityErrorCode,
     message: string,
   ) {
     super(message);
+    this.code = code;
     this.name = "SecurityError";
   }
 
@@ -84,7 +89,10 @@ type SecurityInputOAuth2 = {
 type SecurityInputOAuth2ClientCredentials = {
   type: "oauth2:client_credentials";
   value:
-    | { clientID?: string | undefined; clientSecret?: string | undefined }
+    | {
+      clientID?: string | undefined;
+      clientSecret?: string | undefined;
+    }
     | null
     | string
     | undefined;
@@ -237,16 +245,28 @@ function applyBearer(
 }
 export function resolveGlobalSecurity(
   security: Partial<Security> | null | undefined,
+  allowedFields?: number[],
 ): SecurityState | null {
-  return resolveSecurity(
+  let inputs: SecurityInput[][] = [
     [
       {
         fieldName: "Authorization",
         type: "http:bearer",
-        value: security?.bearerAuth ?? env().STEUERBOARD_BEARER_AUTH,
+        value: security?.bearerAuth || env().STEUERBOARD_BEARER_AUTH,
       },
     ],
-  );
+  ];
+
+  if (allowedFields) {
+    inputs = allowedFields.map((i) => {
+      if (i < 0 || i >= inputs.length) {
+        throw new RangeError(`invalid allowedFields index ${i}`);
+      }
+      return inputs[i]!;
+    });
+  }
+
+  return resolveSecurity(...inputs);
 }
 
 export async function extractSecurity<

package/src/mcp-server/cli/serve/command.ts

@@ -0,0 +1,108 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { buildCommand } from "@stricli/core";
+import { numberParser } from "@stricli/core";
+import * as z from "zod";
+import { consoleLoggerLevels } from "../../console-logger.js";
+
+export const serveCommand = buildCommand({
+  loader: async () => {
+    const { main } = await import("./impl.js");
+    return main;
+  },
+  parameters: {
+    flags: {
+      port: {
+        kind: "parsed",
+        brief: "The port to listen on for Streamable HTTP connections",
+        default: "2718",
+        parse: (val: string) =>
+          z.coerce.number().int().gte(0).lt(65536).parse(val),
+      },
+      "disable-static-auth": {
+        kind: "boolean",
+        brief:
+          "Disable static authentication, allowing credentials to be passed via request headers only",
+        default: false,
+      },
+      tool: {
+        kind: "parsed",
+        brief: "Specify tools to mount on the server",
+        optional: true,
+        variadic: true,
+        parse: (value) => {
+          return z.string().parse(value);
+        },
+      },
+      mode: {
+        kind: "enum",
+        brief:
+          "Server mode (dynamic: expose list_tools, describe_tool_input, and execute_tool instead of individual tools)",
+        values: ["dynamic"],
+        optional: true,
+      },
+      "tool-annotations": {
+        kind: "parsed",
+        brief:
+          "Filter tools by annotations (comma-separated: readOnly, destructive, idempotent, openWorld). Listed = required true, unlisted = required false.",
+        optional: true,
+        parse: (value) => value.split(",").map(s => s.trim()),
+      },
+      "bearer-auth": {
+        kind: "parsed",
+        brief: "Sets the bearerAuth auth field for the API",
+        optional: true,
+        parse: (value) => {
+          return z.string().parse(value);
+        },
+      },
+      "server-url": {
+        kind: "parsed",
+        brief: "Overrides the default server URL used by the SDK",
+        optional: true,
+        parse: (value) => new URL(value).toString(),
+      },
+      "server-index": {
+        kind: "parsed",
+        brief: "Selects a predefined server used by the SDK",
+        optional: true,
+        parse: numberParser,
+      },
+      "log-level": {
+        kind: "enum",
+        brief: "The log level to use for the server",
+        default: "info",
+        values: consoleLoggerLevels,
+      },
+      env: {
+        kind: "parsed",
+        brief: "Environment variables made available to the server",
+        optional: true,
+        variadic: true,
+        parse: (val: string) => {
+          const sepIdx = val.indexOf("=");
+          if (sepIdx === -1) {
+            throw new Error("Invalid environment variable format");
+          }
+
+          const key = val.slice(0, sepIdx);
+          const value = val.slice(sepIdx + 1);
+
+          return [
+            z.string().nonempty({
+              message: "Environment variable key must be a non-empty string",
+            }).parse(key),
+            z.string().nonempty({
+              message: "Environment variable value must be a non-empty string",
+            }).parse(value),
+          ] satisfies [string, string];
+        },
+      },
+    },
+  },
+  docs: {
+    brief: "Run the MCP server with Streamable HTTP transport",
+  },
+});

package/src/mcp-server/cli/serve/impl.ts

@@ -0,0 +1,112 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import express from "express";
+import { LocalContext } from "../../cli.js";
+import {
+  ConsoleLoggerLevel,
+  createConsoleLogger,
+} from "../../console-logger.js";
+import { MCPServerFlags } from "../../flags.js";
+import { createMCPServer } from "../../server.js";
+import { buildAnnotationFilter } from "../../tools.js";
+import { buildSDK } from "../../tools.js";
+
+import { landingPageExpress } from "../../../landing-page.js";
+
+interface ServeCommandFlags extends MCPServerFlags {
+  readonly port: number;
+  readonly "disable-static-auth": boolean;
+  readonly "log-level": ConsoleLoggerLevel;
+  readonly env?: [string, string][];
+}
+
+export async function main(this: LocalContext, flags: ServeCommandFlags) {
+  flags.env?.forEach(([key, value]) => {
+    process.env[key] = value;
+  });
+
+  await startStreamableHTTP(flags);
+}
+
+async function startStreamableHTTP(cliFlags: ServeCommandFlags) {
+  const logger = createConsoleLogger(cliFlags["log-level"]);
+  const app = express();
+
+  // Enable CORS for cross-origin requests
+  app.use((req, res, next) => {
+    res.header("Access-Control-Allow-Origin", "*");
+    res.header("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+    res.header("Access-Control-Allow-Headers", "*");
+    if (req.method === "OPTIONS") {
+      res.sendStatus(204);
+      return;
+    }
+    next();
+  });
+
+  app.use(express.json());
+
+  app.post("/mcp", async (req, res) => {
+    const headers = new Headers();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (Array.isArray(value)) {
+        for (const v of value) headers.append(key, v);
+      } else if (value !== undefined) {
+        headers.set(key, value);
+      }
+    }
+
+    const transport = new StreamableHTTPServerTransport({});
+
+    const { server: mcpServer } = createMCPServer({
+      logger,
+      allowedTools: cliFlags.tool,
+      dynamic: cliFlags.mode === "dynamic",
+      annotationFilter: buildAnnotationFilter(cliFlags["tool-annotations"]),
+      serverURL: cliFlags["server-url"],
+      getSDK: () =>
+        buildSDK(headers, cliFlags, cliFlags["disable-static-auth"], logger),
+      serverIdx: cliFlags["server-index"],
+    });
+
+    mcpServer.server.onerror = (error) => {
+      logger.error("MCP protocol error", {
+        error: error instanceof Error ? error.message : String(error),
+        stack: error instanceof Error ? error.stack : undefined,
+      });
+    };
+
+    await mcpServer.connect(transport as Transport);
+    await transport.handleRequest(req, res, req.body);
+  });
+
+  app.get("/", landingPageExpress);
+
+  const httpServer = app.listen(cliFlags.port, "0.0.0.0", () => {
+    const ha = httpServer.address();
+    const host = typeof ha === "string" ? ha : `${ha?.address}:${ha?.port}`;
+    logger.info("MCP Streamable HTTP server started", { host });
+  });
+
+  const shutdown = () => {
+    logger.info("Shutting down HTTP server");
+
+    const timer = setTimeout(() => {
+      logger.info("Forcing shutdown");
+      process.exit(1);
+    }, 5000);
+
+    httpServer.close(() => {
+      clearTimeout(timer);
+      logger.info("Graceful shutdown complete");
+      process.exit(0);
+    });
+  };
+
+  process.on("SIGTERM", shutdown);
+  process.on("SIGINT", shutdown);
+}

package/src/mcp-server/cli/start/command.ts

@@ -36,6 +36,20 @@ export const startCommand = buildCommand({
           return z.string().parse(value);
         },
       },
+      mode: {
+        kind: "enum",
+        brief:
+          "Server mode (dynamic: expose list_tools, describe_tool_input, and execute_tool instead of individual tools)",
+        values: ["dynamic"],
+        optional: true,
+      },
+      "tool-annotations": {
+        kind: "parsed",
+        brief:
+          "Filter tools by annotations (comma-separated: readOnly, destructive, idempotent, openWorld). Listed = required true, unlisted = required false.",
+        optional: true,
+        parse: (value) => value.split(",").map(s => s.trim()),
+      },
       "bearer-auth": {
         kind: "parsed",
         brief: "Sets the bearerAuth auth field for the API",