@transloadit/mcp-server 0.4.1 → 0.5.0

package/dist/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACH,CAAA;AAEtE,8FAA8F;AAC9F,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,KAAG,OAOxC,CAAA"}

package/dist/json.js

@@ -0,0 +1,14 @@
+/** A plain object; arrays are rejected because callers read named fields. */
+export const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** Parses JSON text, returning `undefined` for empty or invalid input instead of throwing. */
+export const parseJson = (text) => {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+//# sourceMappingURL=json.js.map

package/dist/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA"}

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAanD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,EAAE,SAAS,MAAM,EAAE,KAAG,MAchE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,KAAG,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAG7F,CAAA;AAED,eAAO,MAAM,SAAS,QAAO,SAAuB,CAAA"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAmBnD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,EAAE,SAAS,MAAM,EAAE,KAAG,MAchE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,KAAG,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAG7F,CAAA;AAED,eAAO,MAAM,SAAS,QAAO,SAAuB,CAAA"}

package/dist/logger.js

@@ -1,7 +1,10 @@
 import { SevLogger } from '@transloadit/sev-logger';
 const baseLogger = new SevLogger({ breadcrumbs: ['mcp-server'] });
 const redactString = (value, secrets) => {
-    let output = value.replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]');
+    let output = value
+        .replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]')
+        // The hosted upstream secret travels as a header; scrub it even when it was not listed.
+        .replace(/Transloadit-Mcp-Upstream(["']?\s*[:=]\s*["']?)[^\s"',}]+/gi, 'Transloadit-Mcp-Upstream$1[redacted]');
     for (const secret of secrets) {
         if (!secret)
             continue;

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAEjE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAU,EAAE;IAChE,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAA;IACpE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,OAAiB,EAAU,EAAE;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,UAAU;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAkC,EAAgC,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,UAAU,CAAA"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAEjE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAU,EAAE;IAChE,IAAI,MAAM,GAAG,KAAK;SACf,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QAClD,wFAAwF;SACvF,OAAO,CACN,4DAA4D,EAC5D,sCAAsC,CACvC,CAAA;IACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,OAAiB,EAAU,EAAE;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,UAAU;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAkC,EAAgC,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,UAAU,CAAA"}

package/dist/options.d.ts

@@ -0,0 +1,10 @@
+/** Validates what every server instance relies on, however it is constructed. */
+export declare const assertServerOptions: (options: {
+    resourceMetadataUrl?: string;
+    upstreamSecret?: string;
+    maxUrlDownloadBytes?: unknown;
+    urlDownloadTimeoutMs?: unknown;
+}) => void;
+/** Validates the HTTP request body limit. */
+export declare const assertRequestBodyLimit: (value: unknown) => void;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAWA,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,GAAI,SAAS;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B,KAAG,IAUH,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,IAEvD,CAAA"}

package/dist/options.js

@@ -0,0 +1,26 @@
+/**
+ * Limits also arrive from JSON config files, where a value such as `"1MB"` would silently disable
+ * a numeric comparison, so each one must be a positive integer.
+ */
+const assertPositiveInteger = (value, name, unit) => {
+    if (value === undefined)
+        return;
+    if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive integer number of ${unit}.`);
+    }
+};
+/** Validates what every server instance relies on, however it is constructed. */
+export const assertServerOptions = (options) => {
+    // API2 only accepts relayed `aud=mcp` tokens from the hosted service, so without the secret
+    // every authenticated call fails; refusing to start surfaces that in the deploy's health check.
+    if (options.resourceMetadataUrl && !options.upstreamSecret) {
+        throw new Error('TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted mode) requires TRANSLOADIT_MCP_UPSTREAM_SECRET: API2 only accepts relayed MCP tokens from the hosted service.');
+    }
+    assertPositiveInteger(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes', 'bytes');
+    assertPositiveInteger(options.urlDownloadTimeoutMs, 'urlDownloadTimeoutMs', 'milliseconds');
+};
+/** Validates the HTTP request body limit. */
+export const assertRequestBodyLimit = (value) => {
+    assertPositiveInteger(value, 'maxRequestBodyBytes', 'bytes');
+};
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY,EAAQ,EAAE;IACjF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,IAAI,GAAG,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAKnC,EAAQ,EAAE;IACT,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,6JAA6J,CAC9J,CAAA;IACH,CAAC;IACD,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;IAClF,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAQ,EAAE;IAC7D,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC,CAAA"}

package/dist/request-transport.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+type RequestTransportOptions = {
+    resourceMetadataUrl?: string;
+    allowedHosts?: string[];
+    enableDnsRebindingProtection?: boolean;
+    maxRequestBodyBytes?: number;
+};
+/** A per-request MCP transport plus the function that serves the HTTP request through it. */
+export type RequestTransport = {
+    transport: Transport;
+    handle: (req: IncomingMessage, res: ServerResponse, parsedBody: unknown) => Promise<void>;
+};
+/**
+ * Creates the stateless transport for one HTTP request. Origins are checked before this point by
+ * `applyCorsHeaders`, which understands `*.` and `:*` wildcards; the SDK compares origins
+ * literally, so it only receives the Host allowlist.
+ */
+export declare const createRequestTransport: (options: RequestTransportOptions) => RequestTransport;
+export {};
+//# sourceMappingURL=request-transport.d.ts.map

package/dist/request-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-transport.d.ts","sourceRoot":"","sources":["../src/request-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AAY9E,KAAK,uBAAuB,GAAG;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,6FAA6F;AAC7F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAA;IACpB,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1F,CAAA;AAqGD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,uBAAuB,KAAG,gBA4BzE,CAAA"}

package/dist/request-transport.js

@@ -0,0 +1,129 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+import { readBodyWithinLimit, resolveMaxRequestBodyBytes, sendBodyTooLarge, } from "./http-helpers.js";
+import { isRecord, parseJson } from "./json.js";
+/**
+ * Finds the challenge a tool attached after API2 rejected the forwarded token. Tool results are
+ * the only place that knows, because API2 checks the token when a tool calls it.
+ */
+const findUpstreamChallenge = (body) => {
+    const parsed = parseJson(body);
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    for (const message of messages) {
+        if (!isRecord(message) || !isRecord(message.result))
+            continue;
+        const { result } = message;
+        if (result.isError !== true || !isRecord(result._meta))
+            continue;
+        const challenges = result._meta['mcp/www_authenticate'];
+        const header = Array.isArray(challenges)
+            ? challenges.find((challenge) => typeof challenge === 'string')
+            : undefined;
+        if (typeof header !== 'string')
+            continue;
+        if (header.includes('error="invalid_token"'))
+            return { status: 401, header };
+        if (header.includes('error="insufficient_scope"'))
+            return { status: 403, header };
+    }
+    return undefined;
+};
+const toWebRequest = (req) => {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        for (const entry of Array.isArray(value) ? value : [value])
+            headers.append(name, entry);
+    }
+    // The body always arrives pre-parsed, so headers and a fixed base URL are all it needs.
+    return new Request(new URL(req.url ?? '/', 'http://localhost'), { method: req.method, headers });
+};
+const sendParseError = (res) => {
+    res.statusCode = 400;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        error: { code: -32700, message: 'Parse error: Invalid JSON' },
+        id: null,
+    }));
+};
+/**
+ * Returns the JSON-RPC message, reading it within the body limit when no parser consumed the
+ * stream yet (an Express app without `express.json()`). `undefined` means a response was sent.
+ */
+const readMessage = async (req, res, parsedBody, maxBytes) => {
+    if (parsedBody !== undefined || req.method !== 'POST' || req.readableEnded) {
+        return { message: parsedBody };
+    }
+    const rawBody = await readBodyWithinLimit(req, maxBytes);
+    if (rawBody === undefined) {
+        sendBodyTooLarge(res, maxBytes);
+        return undefined;
+    }
+    const message = parseJson(rawBody);
+    if (message === undefined) {
+        sendParseError(res);
+        return undefined;
+    }
+    return { message };
+};
+/**
+ * Serves a hosted request through the SDK's web-standard transport in JSON mode, so the status is
+ * decided after the tool ran: MCP OAuth clients refresh only on HTTP 401 and re-scope only on
+ * HTTP 403 `insufficient_scope`, and a tool result over HTTP 200 would keep them retrying a
+ * rejected token.
+ */
+const relayHostedRequest = async (transport, req, res, message) => {
+    const response = await transport.handleRequest(toWebRequest(req), { parsedBody: message });
+    const body = await response.text();
+    // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
+    // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
+    // items still carry the challenge in `_meta["mcp/www_authenticate"]`.
+    const challenge = !Array.isArray(message) && response.headers.get('content-type')?.includes('application/json')
+        ? findUpstreamChallenge(body)
+        : undefined;
+    res.statusCode = challenge?.status ?? response.status;
+    for (const [name, value] of response.headers)
+        res.setHeader(name, value);
+    if (challenge)
+        res.setHeader('WWW-Authenticate', challenge.header);
+    res.end(body);
+};
+/**
+ * Creates the stateless transport for one HTTP request. Origins are checked before this point by
+ * `applyCorsHeaders`, which understands `*.` and `:*` wildcards; the SDK compares origins
+ * literally, so it only receives the Host allowlist.
+ */
+export const createRequestTransport = (options) => {
+    const shared = {
+        sessionIdGenerator: undefined,
+        allowedHosts: options.allowedHosts,
+        enableDnsRebindingProtection: options.enableDnsRebindingProtection,
+    };
+    const maxBytes = resolveMaxRequestBodyBytes(options);
+    if (!options.resourceMetadataUrl) {
+        const transport = new StreamableHTTPServerTransport(shared);
+        return {
+            transport,
+            handle: async (req, res, parsedBody) => {
+                const read = await readMessage(req, res, parsedBody, maxBytes);
+                if (read)
+                    await transport.handleRequest(req, res, read.message);
+            },
+        };
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        ...shared,
+        enableJsonResponse: true,
+    });
+    return {
+        transport,
+        handle: async (req, res, parsedBody) => {
+            const read = await readMessage(req, res, parsedBody, maxBytes);
+            if (read)
+                await relayHostedRequest(transport, req, res, read.message);
+        },
+    };
+};
+//# sourceMappingURL=request-transport.js.map

package/dist/request-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-transport.js","sourceRoot":"","sources":["../src/request-transport.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AAExH,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAiB/C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE;IAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAQ;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,SAAQ;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC;YAC/D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAQ;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAW,EAAE;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzF,CAAC;IACD,wFAAwF;IACxF,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAClG,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAmB,EAAQ,EAAE;IACnD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE;QAC7D,EAAE,EAAE,IAAI;KACT,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,GAAoB,EACpB,GAAmB,EACnB,UAAmB,EACnB,QAAgB,EAC2B,EAAE;IAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,SAAmD,EACnD,GAAoB,EACpB,GAAmB,EACnB,OAAgB,EACD,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,8FAA8F;IAC9F,gGAAgG;IAChG,sEAAsE;IACtE,MAAM,SAAS,GACb,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC;QAC3F,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,SAAS,CAAA;IACf,GAAG,CAAC,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAA;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO;QAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxE,IAAI,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAgC,EAAoB,EAAE;IAC3F,MAAM,MAAM,GAAG;QACb,kBAAkB,EAAE,SAAS;QAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,4BAA4B,EAAE,OAAO,CAAC,4BAA4B;KACnE,CAAA;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAA;QAC3D,OAAO;YACL,SAAS;YACT,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,IAAI;oBAAE,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YACjE,CAAC;SACF,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,GAAG,MAAM;QACT,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAA;IACF,OAAO;QACL,SAAS;QACT,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;YAC9D,IAAI,IAAI;gBAAE,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/server-card.d.ts

@@ -1,10 +1,22 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolName, ToolSecurityScheme } from './tool-metadata.ts';
 export declare const serverCardPath = "/.well-known/mcp/server-card.json";
 type JsonSchemaObject = Record<string, unknown>;
-type ServerCardToolDefinition = {
-    name: string;
+type ServerCardToolInput = {
+    name: ToolName;
+    inputSchema: JsonSchemaObject;
+};
+type ServerCardToolDefinition = ServerCardToolInput & {
     title: string;
     description: string;
-    inputSchema: JsonSchemaObject;
+    annotations: ToolAnnotations;
+    securitySchemes: ToolSecurityScheme[];
+};
+type ServerCardAuthentication = {
+    required: boolean;
+    schemes: string[];
+    /** RFC 9728 protected-resource metadata that names the OAuth authorization server. */
+    resourceMetadataUrl?: string;
 };
 type ServerCard = {
     $schema: string;
@@ -22,20 +34,21 @@ type ServerCard = {
         type: string;
         endpoint: string;
     };
-    authentication?: {
-        required: boolean;
-        schemes: string[];
-    };
+    authentication?: ServerCardAuthentication;
     capabilities: {
         tools: {
             listChanged: boolean;
         };
+        resources: {
+            listChanged: boolean;
+        };
     };
     tools: ['dynamic'] | ServerCardToolDefinition[];
 };
 export declare const buildServerCard: (endpoint: string, options?: {
     authKey?: string;
     authSecret?: string;
+    resourceMetadataUrl?: string;
 }) => ServerCard;
 export {};
 //# sourceMappingURL=server-card.d.ts.map

package/dist/server-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-card.d.ts","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc,sCAAsC,CAAA;AAEjE,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACzD,YAAY,EAAE;QAAE,KAAK,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;IACjD,KAAK,EAAE,CAAC,SAAS,CAAC,GAAG,wBAAwB,EAAE,CAAA;CAChD,CAAA;AA4HD,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,UAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,KACtD,UA6BF,CAAA"}
+{"version":3,"file":"server-card.d.ts","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AAEzE,OAAO,KAAK,EAAgB,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAOpF,eAAO,MAAM,cAAc,sCAAsC,CAAA;AAEjE,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,QAAQ,CAAA;IACd,WAAW,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,KAAK,wBAAwB,GAAG,mBAAmB,GAAG;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,eAAe,CAAA;IAC5B,eAAe,EAAE,kBAAkB,EAAE,CAAA;CACtC,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,sFAAsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,YAAY,EAAE;QAAE,KAAK,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;IACtF,KAAK,EAAE,CAAC,SAAS,CAAC,GAAG,wBAAwB,EAAE,CAAA;CAChD,CAAA;AA8ID,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,UAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,KACpF,UAkCF,CAAA"}

package/dist/server-card.js

@@ -1,11 +1,10 @@
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 import packageJson from '../package.json' with { type: 'json' };
+import { resolveSecuritySchemes, resolveToolAuthMode, toolMetadata } from "./tool-metadata.js";
 export const serverCardPath = '/.well-known/mcp/server-card.json';
-const tools = [
+const toolInputs = [
     {
         name: 'transloadit_lint_assembly_instructions',
-        title: 'Lint Assembly Instructions',
-        description: 'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -19,8 +18,6 @@ const tools = [
     },
     {
         name: 'transloadit_create_assembly',
-        title: 'Create or resume an Assembly',
-        description: 'Create or resume an Assembly, optionally uploading files and waiting for completion.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -30,6 +27,20 @@ const tools = [
                     type: 'array',
                     items: { type: 'object' },
                 },
+                attachments: {
+                    type: 'array',
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['download_url', 'file_id'],
+                        properties: {
+                            download_url: { type: 'string' },
+                            file_id: { type: 'string' },
+                            mime_type: { type: 'string' },
+                            file_name: { type: 'string' },
+                        },
+                    },
+                },
                 fields: { type: 'object' },
                 wait_for_completion: { type: 'boolean' },
                 wait_timeout_ms: { type: 'number' },
@@ -43,8 +54,6 @@ const tools = [
     },
     {
         name: 'transloadit_get_assembly_status',
-        title: 'Get Assembly Status',
-        description: 'Fetch the latest Assembly status by URL or ID.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -56,8 +65,6 @@ const tools = [
     },
     {
         name: 'transloadit_wait_for_assembly',
-        title: 'Wait For Assembly Completion',
-        description: 'Polls until the Assembly completes or timeout is reached.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -71,8 +78,6 @@ const tools = [
     },
     {
         name: 'transloadit_list_robots',
-        title: 'List Robots',
-        description: 'Returns a filtered list of robots with short summaries.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -86,8 +91,6 @@ const tools = [
     },
     {
         name: 'transloadit_get_robot_help',
-        title: 'Get Robot Help',
-        description: 'Returns a robot summary and parameter details.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -99,8 +102,6 @@ const tools = [
     },
     {
         name: 'transloadit_list_templates',
-        title: 'List Templates',
-        description: 'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -118,9 +119,31 @@ const tools = [
             },
         },
     },
+    {
+        name: 'transloadit_get_profile',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {},
+        },
+    },
 ];
+/** Tool definitions with the security schemes this deployment mode can honor. */
+const buildTools = (mode) => toolInputs.map((tool) => {
+    const metadata = toolMetadata[tool.name];
+    return {
+        ...tool,
+        title: metadata.title,
+        description: metadata.description,
+        annotations: metadata.annotations,
+        securitySchemes: resolveSecuritySchemes(metadata, mode),
+    };
+});
 export const buildServerCard = (endpoint, options = {}) => {
     const hasCredentials = Boolean(options.authKey && options.authSecret);
+    const tools = buildTools(resolveToolAuthMode(options));
+    // Hosted deployments hand out tokens through OAuth; self-hosted ones accept a static bearer.
+    const schemes = options.resourceMetadataUrl ? ['oauth2', 'bearer'] : ['bearer'];
     return {
         $schema: 'https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json',
         version: '1.0',
@@ -139,10 +162,12 @@ export const buildServerCard = (endpoint, options = {}) => {
         },
         authentication: {
             required: !hasCredentials,
-            schemes: ['bearer'],
+            schemes,
+            ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),
         },
         capabilities: {
             tools: { listChanged: false },
+            resources: { listChanged: false },
         },
         tools,
     };

package/dist/server-card.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-card.js","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAE5E,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG,mCAAmC,CAAA;AAyBjE,MAAM,KAAK,GAA+B;IACxC;QACE,IAAI,EAAE,wCAAwC;QAC9C,KAAK,EAAE,4BAA4B;QACnC,WAAW,EACT,qFAAqF;QACvF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;gBAClF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,EAAE;gBACrE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,2CAA2C,EAAE;aAC5F;SACF;KACF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,sFAAsF;QACxF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;gBAClF,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACxC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACnC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACtC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACrC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;gBAC1E,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC;SACF;KACF;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,KAAK,EAAE,qBAAqB;QAC5B,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;SACF;KACF;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,8BAA8B;QACrC,WAAW,EAAE,2DAA2D;QACxE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACrC;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,yDAAyD;QACtE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;SACF;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,gBAAgB;QACvB,WAAW,EAAE,gDAAgD;QAC7D,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC1D;SACF;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,wHAAwH;QAC1H,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;gBACrE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAChD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;iBACjE;gBACD,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aACrC;SACF;KACF;CACF,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,UAAqD,EAAE,EAC3C,EAAE;IACd,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;IAErE,OAAO;QACL,OAAO,EAAE,wEAAwE;QACjF,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,uBAAuB;QACxC,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,WAAW,CAAC,OAAO;SAC7B;QACD,WAAW,EACT,kHAAkH;QACpH,gBAAgB,EAAE,+CAA+C;QACjE,OAAO,EAAE,qCAAqC;QAC9C,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,QAAQ;SACT;QACD,cAAc,EAAE;YACd,QAAQ,EAAE,CAAC,cAAc;YACzB,OAAO,EAAE,CAAC,QAAQ,CAAC;SACpB;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;SAC9B;QACD,KAAK;KACN,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"server-card.js","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAE5E,OAAO,WAAW,MAAM,iBAAiB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AAC/D,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAE9F,MAAM,CAAC,MAAM,cAAc,GAAG,mCAAmC,CAAA;AAqCjE,MAAM,UAAU,GAA0B;IACxC;QACE,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;gBAClF,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,2BAA2B,EAAE;gBACrE,YAAY,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,2CAA2C,EAAE;aAC5F;SACF;KACF;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE;gBAClF,KAAK,EAAE;oBACL,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC1B;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE;wBACL,IAAI,EAAE,QAAQ;wBACd,oBAAoB,EAAE,KAAK;wBAC3B,QAAQ,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC;wBACrC,UAAU,EAAE;4BACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BAChC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BAC3B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;4BAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;yBAC9B;qBACF;iBACF;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBACxC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACnC,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACtC,iBAAiB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACrC,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE;gBAC1E,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACpC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACjC;SACF;KACF;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAChC;SACF;KACF;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAChC,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC/B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aACrC;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC1B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC3B;SACF;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;aAC1D;SACF;KACF;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE;gBACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBACxB,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;gBAC7B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE;gBACrE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE;gBAChD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;gBACtD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,oBAAoB,CAAC;iBACjE;gBACD,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;aACrC;SACF;KACF;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,oBAAoB,EAAE,KAAK;YAC3B,UAAU,EAAE,EAAE;SACf;KACF;CACF,CAAA;AAED,iFAAiF;AACjF,MAAM,UAAU,GAAG,CAAC,IAAkB,EAA8B,EAAE,CACpE,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;IACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,eAAe,EAAE,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC;KACxD,CAAA;AACH,CAAC,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAC7B,QAAgB,EAChB,UAAmF,EAAE,EACzE,EAAE;IACd,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAA;IACtD,6FAA6F;IAC7F,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;IAE/E,OAAO;QACL,OAAO,EAAE,wEAAwE;QACjF,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,uBAAuB;QACxC,UAAU,EAAE;YACV,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,wBAAwB;YAC/B,OAAO,EAAE,WAAW,CAAC,OAAO;SAC7B;QACD,WAAW,EACT,kHAAkH;QACpH,gBAAgB,EAAE,+CAA+C;QACjE,OAAO,EAAE,qCAAqC;QAC9C,SAAS,EAAE;YACT,IAAI,EAAE,iBAAiB;YACvB,QAAQ;SACT;QACD,cAAc,EAAE;YACd,QAAQ,EAAE,CAAC,cAAc;YACzB,OAAO;YACP,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;YAC7B,SAAS,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE;SAClC;QACD,KAAK;KACN,CAAA;AACH,CAAC,CAAA"}

package/dist/server.d.ts

@@ -1,13 +1,48 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { z } from 'zod';
 export type TransloaditMcpServerOptions = {
     authKey?: string;
     authSecret?: string;
     mcpToken?: string;
+    /**
+     * Protected-resource metadata URL of the hosted deployment. When set, auth failures carry an
+     * RFC 6750 challenge that points OAuth clients at API2 (`TRANSLOADIT_MCP_RESOURCE_METADATA_URL`).
+     */
+    resourceMetadataUrl?: string;
+    /**
+     * Shared secret that identifies the Transloadit-hosted MCP service to API2, which only accepts
+     * relayed `aud=mcp` bearer tokens from that service (`TRANSLOADIT_MCP_UPSTREAM_SECRET`). It is
+     * sent as `Transloadit-Mcp-Upstream` next to a forwarded bearer token and never with key/secret.
+     */
+    upstreamSecret?: string;
+    /**
+     * HMAC algorithm for key/secret signatures (`TRANSLOADIT_SIGNATURE_ALGORITHM`). Must match the
+     * Auth Key's `signature_algo`; Console keys that may sign Smart CDN URLs require `sha256`.
+     * Defaults to the SDK's `sha384`, which ordinary API keys use.
+     */
+    signatureAlgorithm?: McpSignatureAlgorithm;
+    /** Origins the result widget may load previews from (`TRANSLOADIT_MCP_RESULT_DOMAINS`). */
+    resultDomains?: string[];
+    /** Most bytes the URL inputs of one call may download together; defaults to 1 GiB. */
+    maxUrlDownloadBytes?: number;
+    /** Longest one URL input download may take, redirects included; defaults to 10 minutes. */
+    urlDownloadTimeoutMs?: number;
+    /** Console origin used for widget deep links; defaults to the public website. */
+    consoleUrl?: string;
     endpoint?: string;
     serverName?: string;
     serverVersion?: string;
     clientName?: string;
     clientSuffix?: string;
 };
+/** Signature algorithms API2 accepts for Auth Key signatures. */
+export declare const signatureAlgorithmSchema: z.ZodEnum<{
+    sha1: "sha1";
+    sha256: "sha256";
+    sha384: "sha384";
+}>;
+export type McpSignatureAlgorithm = z.infer<typeof signatureAlgorithmSchema>;
+/** Header that carries `upstreamSecret` on API2 calls made with a forwarded bearer token. */
+export declare const upstreamSecretHeader = "Transloadit-Mcp-Upstream";
 export declare const createTransloaditMcpServer: (options?: TransloaditMcpServerOptions) => McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAgBnE,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AA0mBD,eAAO,MAAM,0BAA0B,GACrC,UAAS,2BAAgC,KACxC,SAugBF,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAWnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAevB,MAAM,MAAM,2BAA2B,GAAG;IACxC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,qBAAqB,CAAA;IAC1C,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,sFAAsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,2FAA2F;IAC3F,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAID,iEAAiE;AACjE,eAAO,MAAM,wBAAwB;;;;EAAuC,CAAA;AAE5E,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE5E,6FAA6F;AAC7F,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAg7B9D,eAAO,MAAM,0BAA0B,GACrC,UAAS,2BAAgC,KACxC,SAwoBF,CAAA"}