@transloadit/mcp-server 0.4.2 → 0.5.1

package/dist/express.js

@@ -1,19 +1,26 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { isBasicAuthorized } from "./http-helpers.js";
+import { applyCorsHeaders, assertHttpOptions, corsAllowHeaders, isBasicAuthorized, rejectMissingBearerToken, resolveAllowedOrigins, } from "./http-helpers.js";
 import { getMetrics, getMetricsContentType } from "./metrics.js";
+import { createRequestTransport } from "./request-transport.js";
 import { createTransloaditMcpServer } from "./server.js";
 import { buildServerCard, serverCardPath } from "./server-card.js";
 export function createTransloaditMcpExpressRouter(options = {}) {
+    assertHttpOptions(options);
     const router = express.Router();
     const routePath = options.path ?? '/mcp';
     const metricsPath = options.metricsPath === false ? undefined : (options.metricsPath ?? '/metrics');
     const metricsAuth = options.metricsAuth;
-    const serverCardJson = JSON.stringify(buildServerCard(routePath, { authKey: options.authKey, authSecret: options.authSecret }));
+    // Explicit `allowedOrigins` or hosted mode add an Origin policy here; embedders own CORS otherwise.
+    const allowedOrigins = resolveAllowedOrigins(options);
+    const serverCardJson = JSON.stringify(buildServerCard(routePath, {
+        authKey: options.authKey,
+        authSecret: options.authSecret,
+        resourceMetadataUrl: options.resourceMetadataUrl,
+    }));
     const sendServerCard = (res, includeBody) => {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID');
+        res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders);
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
         res.setHeader('Cache-Control', 'public, max-age=3600');
         res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -26,7 +33,7 @@ export function createTransloaditMcpExpressRouter(options = {}) {
     router.options(serverCardPath, (_req, res) => {
         res.setHeader('Access-Control-Allow-Origin', '*');
         res.setHeader('Access-Control-Allow-Methods', 'GET,HEAD,OPTIONS');
-        res.setHeader('Access-Control-Allow-Headers', 'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID');
+        res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders);
         res.status(204).end();
     });
     router.get(serverCardPath, (_req, res) => {
@@ -36,6 +43,17 @@ export function createTransloaditMcpExpressRouter(options = {}) {
         sendServerCard(res, false);
     });
     router.all(routePath, async (req, res) => {
+        if (allowedOrigins) {
+            if (!applyCorsHeaders(req, res, allowedOrigins))
+                return;
+            if (req.method === 'OPTIONS') {
+                res.status(204).end();
+                return;
+            }
+        }
+        // Any unauthenticated hosted method gets the OAuth challenge, so GET-probing clients find API2.
+        if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl))
+            return;
         if (req.method !== 'POST') {
             res.status(405).json({
                 jsonrpc: '2.0',
@@ -44,19 +62,14 @@ export function createTransloaditMcpExpressRouter(options = {}) {
             });
             return;
         }
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            allowedOrigins: options.allowedOrigins,
-            allowedHosts: options.allowedHosts,
-            enableDnsRebindingProtection: options.enableDnsRebindingProtection,
-        });
+        const { transport, handle } = createRequestTransport(options);
         const server = createTransloaditMcpServer(options);
         res.on('close', () => {
             void transport.close();
             void server.close();
         });
         await server.connect(transport);
-        await transport.handleRequest(req, res, req.body);
+        await handle(req, res, req.body);
     });
     if (metricsPath) {
         router.get(metricsPath, async (req, res) => {

package/dist/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,OAAO,MAAM,SAAS,CAAA;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMlE,MAAM,UAAU,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAA;IACxC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,CAAA;IACjF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IAEvC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CACnC,eAAe,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CACzF,CAAA;IAED,MAAM,cAAc,GAAG,CAAC,GAAqB,EAAE,WAAoB,EAAE,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,yDAAyD,CAC1D,CAAA;QACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAA;QACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;QAClD,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IACvB,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,yDAAyD,CAC1D,CAAA;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvD,EAAE,EAAE,IAAI;aACT,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,4BAA4B,EAAE,OAAO,CAAC,4BAA4B;SACnE,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;QAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE/B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;gBAC3F,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../src/express.ts"],"names":[],"mappings":"AAEA,OAAO,OAAO,MAAM,SAAS,CAAA;AAE7B,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAMlE,MAAM,UAAU,iCAAiC,CAAC,UAAwC,EAAE;IAC1F,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAA;IAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAAA;IACxC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,CAAA;IACjF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IACvC,oGAAoG;IACpG,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAErD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CACnC,eAAe,CAAC,SAAS,EAAE;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CACH,CAAA;IAED,MAAM,cAAc,GAAG,CAAC,GAAqB,EAAE,WAAoB,EAAE,EAAE;QACrE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,gBAAgB,CAAC,CAAA;QAC/D,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAA;QACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;QAClD,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IACvB,CAAC,CAAA;IAED,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC3C,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;QACjD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,gBAAgB,CAAC,CAAA;QAC/D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACvC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACxC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IAC5B,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAqB,EAAE,EAAE;QAC1E,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC;gBAAE,OAAM;YACvD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;gBACrB,OAAM;YACR,CAAC;QACH,CAAC;QAED,gGAAgG;QAChG,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC;YAAE,OAAM;QAE3E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvD,EAAE,EAAE,IAAI;aACT,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;QAClD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE/B,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;gBAC3F,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBAC1F,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QACvB,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/http-helpers.d.ts

@@ -11,5 +11,95 @@ export declare const isBasicAuthorized: (req: IncomingMessage, expected: {
     username: string;
     password: string;
 }) => boolean;
+/**
+ * Browser origins the hosted endpoint accepts when no explicit `allowedOrigins` are configured:
+ * the ChatGPT and Claude web apps, Transloadit sites, devdock and loopback. Requests without an
+ * `Origin` header (CLIs, servers) are never subject to this list.
+ */
+export declare const hostedAllowedOrigins: string[];
+/**
+ * Matches an `Origin` header against an allowlist entry. Entries are exact origins or patterns
+ * with a `*.` subdomain wildcard and/or a `:*` any-port suffix.
+ */
+export declare const matchesOriginPattern: (origin: string, pattern: string) => boolean;
+export declare const isOriginAllowed: (origin: string, allowedOrigins: string[]) => boolean;
+/** Explicit `allowedOrigins` win; hosted mode falls back to the ChatGPT/Claude/Transloadit list. */
+export declare const resolveAllowedOrigins: (options: {
+    allowedOrigins?: string[];
+    resourceMetadataUrl?: string;
+}) => string[] | undefined;
 export declare const applyCorsHeaders: (req: IncomingMessage, res: ServerResponse, allowedOrigins?: string[]) => boolean;
+/**
+ * Request headers browser MCP clients send (Streamable HTTP adds `Mcp-Protocol-Version` after
+ * initialization); preflights that omit one block the client entirely.
+ */
+export declare const corsAllowHeaders = "Authorization,Content-Type,Mcp-Protocol-Version,Mcp-Session-Id,Last-Event-ID";
+/** Response headers browser clients must read: the session id and the OAuth challenge. */
+export declare const corsExposeHeaders = "Mcp-Session-Id,WWW-Authenticate";
+/** Human-readable status served on bare GETs and kept in the hosted 401 body. */
+export declare const serverInfo: {
+    name: string;
+    status: string;
+    docs: string;
+};
+/**
+ * Bare GETs without the SSE Accept header are not valid MCP requests (Streamable HTTP requires
+ * `Accept: text/event-stream` for GET). Answer with a friendly status so directory health probes
+ * (Glama, uptime monitors) see a 200 instead of the SDK's opaque 406. Returns `true` when sent.
+ */
+export declare const sendServerInfoForBareGet: (req: IncomingMessage, res: ServerResponse) => boolean;
+/**
+ * `WWW-Authenticate` value (RFC 6750) that points OAuth clients at the protected-resource
+ * metadata and, for rejected requests, names the error so hosts show their linking UI.
+ */
+export declare const buildBearerChallenge: (options: {
+    resourceMetadataUrl?: string;
+    error?: {
+        code: string;
+        description: string;
+    };
+    /** Scopes the client should request again (RFC 6750 `scope`, used to re-scope on 403). */
+    scopes?: string[];
+}) => string;
+/**
+ * Request body limits the README documents. Hosted requests only carry JSON-RPC and small base64
+ * payloads, and pass the bearer gate before API2 has checked the token, so they get the smaller one.
+ */
+export declare const resolveMaxRequestBodyBytes: (options: {
+    maxRequestBodyBytes?: number;
+    resourceMetadataUrl?: string;
+}) => number;
+/**
+ * Reads a request body up to `maxBytes`. Returns `undefined` once it is larger; the rest is drained
+ * without being kept, so an oversized body cannot exhaust memory.
+ */
+export declare const readBodyWithinLimit: (req: IncomingMessage, maxBytes: number) => Promise<string | undefined>;
+export declare const sendBodyTooLarge: (res: ServerResponse, maxBytes: number) => void;
+/**
+ * Refuses HTTP options that would fail silently later. The static-token check runs first and
+ * would reject every OAuth token with a bare `Bearer` challenge, so hosted OAuth could never start.
+ */
+export declare const assertHttpOptions: (options: {
+    mcpToken?: string;
+    resourceMetadataUrl?: string;
+    upstreamSecret?: string;
+    maxRequestBodyBytes?: unknown;
+    maxUrlDownloadBytes?: unknown;
+    urlDownloadTimeoutMs?: unknown;
+    resultDomains?: string[];
+    widgetDomain?: string;
+}) => void;
+/**
+ * Self-hosted policy: the request must carry the static `TRANSLOADIT_MCP_TOKEN`. Returns `true`
+ * when the 401 was already sent.
+ */
+export declare const rejectMissingMcpToken: (req: IncomingMessage, res: ServerResponse, mcpToken: string | undefined) => boolean;
+/**
+ * Hosted policy: a bearer token only has to be present, because API2 verifies it on every
+ * forwarded call. Without one, any request (bare GET probes included, since clients such as Codex
+ * discover the authorization server from an unauthenticated GET) gets a 401 that points OAuth
+ * clients at the protected-resource metadata. The body keeps the friendly server status for
+ * humans. Returns `true` when the 401 was already sent.
+ */
+export declare const rejectMissingBearerToken: (req: IncomingMessage, res: ServerResponse, resourceMetadataUrl: string | undefined) => boolean;
 //# sourceMappingURL=http-helpers.d.ts.map

package/dist/http-helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-helpers.d.ts","sourceRoot":"","sources":["../src/http-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAIhE,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAMzE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MACqB,CAAA;AAElE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAKxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,GAAG,SAAS,KACzB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAgB3C,CAAA;AASD,eAAO,MAAM,YAAY,GAAI,KAAK,eAAe,EAAE,OAAO,MAAM,KAAG,OAIlE,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,KAAK,eAAe,EACpB,UAAU;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/C,OAOF,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,iBAAiB,MAAM,EAAE,KACxB,OA0BF,CAAA"}
+{"version":3,"file":"http-helpers.d.ts","sourceRoot":"","sources":["../src/http-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAMhE,eAAO,MAAM,aAAa,GAAI,KAAK,MAAM,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAMzE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,MACqB,CAAA;AAElE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAKxE,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,GAAG,SAAS,KACzB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAgB3C,CAAA;AASD,eAAO,MAAM,YAAY,GAAI,KAAK,eAAe,EAAE,OAAO,MAAM,KAAG,OAIlE,CAAA;AAED,eAAO,MAAM,iBAAiB,GAC5B,KAAK,eAAe,EACpB,UAAU;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,KAC/C,OAOF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,UAehC,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,EAAE,SAAS,MAAM,KAAG,OAoBtE,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,EAAE,gBAAgB,MAAM,EAAE,KAAG,OACF,CAAA;AAEzE,oGAAoG;AACpG,eAAO,MAAM,qBAAqB,GAAI,SAAS;IAC7C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,KAAG,MAAM,EAAE,GAAG,SAGd,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC3B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,iBAAiB,MAAM,EAAE,KACxB,OAuBF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,iFACmD,CAAA;AAEhF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,oCAAoC,CAAA;AAElE,iFAAiF;AACjF,eAAO,MAAM,UAAU;;;;CAItB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,KAAK,eAAe,EAAE,KAAK,cAAc,KAAG,OAOpF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS;IAC5C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB,KAAG,MAeH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,GAAI,SAAS;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,KAAG,MAA6F,CAAA;AAEjG;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAC9B,KAAK,eAAe,EACpB,UAAU,MAAM,KACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAoBzB,CAAA;AAEJ,eAAO,MAAM,gBAAgB,GAAI,KAAK,cAAc,EAAE,UAAU,MAAM,KAAG,IAWxE,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,SAAS;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,KAAG,IASH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,GAChC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,UAAU,MAAM,GAAG,SAAS,KAC3B,OAMF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,qBAAqB,MAAM,GAAG,SAAS,KACtC,OAcF,CAAA"}

package/dist/http-helpers.js

@@ -1,4 +1,5 @@
 import { timingSafeEqual } from 'node:crypto';
+import { assertRequestBodyLimit, assertServerOptions } from "./options.js";
 export const parsePathname = (url, fallback) => {
     try {
         return new URL(url ?? fallback, 'http://localhost').pathname;
@@ -57,13 +58,73 @@ export const isBasicAuthorized = (req, expected) => {
     return (timingSafeEqualString(provided.username, expected.username) &&
         timingSafeEqualString(provided.password, expected.password));
 };
+/**
+ * Browser origins the hosted endpoint accepts when no explicit `allowedOrigins` are configured:
+ * the ChatGPT and Claude web apps, Transloadit sites, devdock and loopback. Requests without an
+ * `Origin` header (CLIs, servers) are never subject to this list.
+ */
+export const hostedAllowedOrigins = [
+    'https://chatgpt.com',
+    'https://chat.openai.com',
+    'https://claude.ai',
+    'https://claude.com',
+    'https://transloadit.com',
+    'https://*.transloadit.com',
+    'https://transloadit.dev:*',
+    'https://*.transloadit.dev:*',
+    'http://localhost:*',
+    'https://localhost:*',
+    'http://127.0.0.1:*',
+    'https://127.0.0.1:*',
+    'http://[::1]:*',
+    'https://[::1]:*',
+];
+const originPatternRegex = /^(?<protocol>https?):\/\/(?<host>\*\.)?(?<hostname>\[[^\]]+\]|[^:/]+)(?::(?<port>\*|\d+))?$/;
+/**
+ * Matches an `Origin` header against an allowlist entry. Entries are exact origins or patterns
+ * with a `*.` subdomain wildcard and/or a `:*` any-port suffix.
+ */
+export const matchesOriginPattern = (origin, pattern) => {
+    if (origin === pattern)
+        return true;
+    const match = originPatternRegex.exec(pattern);
+    if (!match?.groups)
+        return false;
+    let url;
+    try {
+        url = new URL(origin);
+    }
+    catch {
+        return false;
+    }
+    const { protocol, host, hostname, port } = match.groups;
+    if (url.protocol !== `${protocol}:`)
+        return false;
+    const originHost = url.hostname.replaceAll(/^\[|\]$/g, '');
+    const patternHost = (hostname ?? '').replaceAll(/^\[|\]$/g, '');
+    const hostMatches = host
+        ? originHost.endsWith(`.${patternHost}`) && originHost.length > patternHost.length + 1
+        : originHost === patternHost;
+    if (!hostMatches)
+        return false;
+    if (port === '*')
+        return true;
+    return url.port === (port ?? '');
+};
+export const isOriginAllowed = (origin, allowedOrigins) => allowedOrigins.some((pattern) => matchesOriginPattern(origin, pattern));
+/** Explicit `allowedOrigins` win; hosted mode falls back to the ChatGPT/Claude/Transloadit list. */
+export const resolveAllowedOrigins = (options) => {
+    if (options.allowedOrigins && options.allowedOrigins.length > 0)
+        return options.allowedOrigins;
+    return options.resourceMetadataUrl ? hostedAllowedOrigins : undefined;
+};
 export const applyCorsHeaders = (req, res, allowedOrigins) => {
     const origin = req.headers.origin;
     if (!origin) {
         return true;
     }
     if (allowedOrigins && allowedOrigins.length > 0) {
-        if (!allowedOrigins.includes(origin)) {
+        if (!isOriginAllowed(origin, allowedOrigins)) {
             res.statusCode = 403;
             res.end('Forbidden');
             return false;
@@ -75,8 +136,137 @@ export const applyCorsHeaders = (req, res, allowedOrigins) => {
         res.setHeader('Access-Control-Allow-Origin', '*');
     }
     res.setHeader('Access-Control-Allow-Methods', 'GET,POST,DELETE,OPTIONS');
-    res.setHeader('Access-Control-Allow-Headers', 'Authorization,Content-Type,Mcp-Session-Id,Last-Event-ID');
-    res.setHeader('Access-Control-Expose-Headers', 'Mcp-Session-Id');
+    res.setHeader('Access-Control-Allow-Headers', corsAllowHeaders);
+    res.setHeader('Access-Control-Expose-Headers', corsExposeHeaders);
+    return true;
+};
+/**
+ * Request headers browser MCP clients send (Streamable HTTP adds `Mcp-Protocol-Version` after
+ * initialization); preflights that omit one block the client entirely.
+ */
+export const corsAllowHeaders = 'Authorization,Content-Type,Mcp-Protocol-Version,Mcp-Session-Id,Last-Event-ID';
+/** Response headers browser clients must read: the session id and the OAuth challenge. */
+export const corsExposeHeaders = 'Mcp-Session-Id,WWW-Authenticate';
+/** Human-readable status served on bare GETs and kept in the hosted 401 body. */
+export const serverInfo = {
+    name: 'Transloadit MCP Server',
+    status: 'ok',
+    docs: 'https://transloadit.com/docs/sdks/mcp-server/',
+};
+/**
+ * Bare GETs without the SSE Accept header are not valid MCP requests (Streamable HTTP requires
+ * `Accept: text/event-stream` for GET). Answer with a friendly status so directory health probes
+ * (Glama, uptime monitors) see a 200 instead of the SDK's opaque 406. Returns `true` when sent.
+ */
+export const sendServerInfoForBareGet = (req, res) => {
+    const accept = req.headers.accept ?? '';
+    if (req.method !== 'GET' || accept.includes('text/event-stream'))
+        return false;
+    res.statusCode = 200;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify(serverInfo));
+    return true;
+};
+/**
+ * `WWW-Authenticate` value (RFC 6750) that points OAuth clients at the protected-resource
+ * metadata and, for rejected requests, names the error so hosts show their linking UI.
+ */
+export const buildBearerChallenge = (options) => {
+    const parts = [];
+    if (options.resourceMetadataUrl) {
+        parts.push(`resource_metadata="${options.resourceMetadataUrl}"`);
+    }
+    if (options.error) {
+        parts.push(`error="${options.error.code}"`, `error_description="${options.error.description.replaceAll('"', "'")}"`);
+    }
+    if (options.scopes && options.scopes.length > 0) {
+        parts.push(`scope="${options.scopes.join(' ')}"`);
+    }
+    return parts.length > 0 ? `Bearer ${parts.join(', ')}` : 'Bearer';
+};
+/**
+ * Request body limits the README documents. Hosted requests only carry JSON-RPC and small base64
+ * payloads, and pass the bearer gate before API2 has checked the token, so they get the smaller one.
+ */
+export const resolveMaxRequestBodyBytes = (options) => options.maxRequestBodyBytes ?? (options.resourceMetadataUrl ? 1 : 10) * 1024 * 1024;
+/**
+ * Reads a request body up to `maxBytes`. Returns `undefined` once it is larger; the rest is drained
+ * without being kept, so an oversized body cannot exhaust memory.
+ */
+export const readBodyWithinLimit = (req, maxBytes) => new Promise((resolve, reject) => {
+    const chunks = [];
+    let size = 0;
+    let tooLarge = false;
+    req.on('data', (chunk) => {
+        if (tooLarge)
+            return;
+        size += chunk.length;
+        if (size > maxBytes) {
+            tooLarge = true;
+            chunks.length = 0;
+            resolve(undefined);
+            return;
+        }
+        chunks.push(chunk);
+    });
+    req.on('end', () => {
+        if (!tooLarge)
+            resolve(Buffer.concat(chunks).toString('utf8'));
+    });
+    req.on('error', reject);
+});
+export const sendBodyTooLarge = (res, maxBytes) => {
+    res.statusCode = 413;
+    res.setHeader('Connection', 'close');
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        error: { code: -32000, message: `Request body exceeds ${maxBytes} bytes.` },
+        id: null,
+    }));
+};
+/**
+ * Refuses HTTP options that would fail silently later. The static-token check runs first and
+ * would reject every OAuth token with a bare `Bearer` challenge, so hosted OAuth could never start.
+ */
+export const assertHttpOptions = (options) => {
+    if (options.mcpToken && options.resourceMetadataUrl) {
+        throw new Error('Configure either TRANSLOADIT_MCP_TOKEN (self-hosted) or TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted OAuth), not both.');
+    }
+    assertRequestBodyLimit(options.maxRequestBodyBytes);
+    // Also checked per server instance; repeated here so a bad config fails at startup.
+    assertServerOptions(options);
+};
+/**
+ * Self-hosted policy: the request must carry the static `TRANSLOADIT_MCP_TOKEN`. Returns `true`
+ * when the 401 was already sent.
+ */
+export const rejectMissingMcpToken = (req, res, mcpToken) => {
+    if (!mcpToken || isAuthorized(req, mcpToken))
+        return false;
+    res.statusCode = 401;
+    res.setHeader('WWW-Authenticate', 'Bearer');
+    res.end('Unauthorized');
+    return true;
+};
+/**
+ * Hosted policy: a bearer token only has to be present, because API2 verifies it on every
+ * forwarded call. Without one, any request (bare GET probes included, since clients such as Codex
+ * discover the authorization server from an unauthenticated GET) gets a 401 that points OAuth
+ * clients at the protected-resource metadata. The body keeps the friendly server status for
+ * humans. Returns `true` when the 401 was already sent.
+ */
+export const rejectMissingBearerToken = (req, res, resourceMetadataUrl) => {
+    if (!resourceMetadataUrl || extractBearerToken(req.headers.authorization))
+        return false;
+    res.statusCode = 401;
+    res.setHeader('WWW-Authenticate', buildBearerChallenge({ resourceMetadataUrl }));
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+        ...serverInfo,
+        error: 'unauthorized',
+        error_description: 'This endpoint requires an OAuth bearer token. Discover the authorization server through the resource_metadata URL in the WWW-Authenticate header.',
+    }));
     return true;
 };
 //# sourceMappingURL=http-helpers.js.map

package/dist/http-helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-helpers.js","sourceRoot":"","sources":["../src/http-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAuB,EAAE,QAAgB,EAAU,EAAE;IACjF,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CACpD,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAElE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA0B,EAAsB,EAAE;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAA0B,EAC0B,EAAE;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,cAAc,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,KAAa,EAAW,EAAE;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAoB,EACpB,QAAgD,EACvC,EAAE;IACX,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CACL,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC5D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAAoB,EACpB,GAAmB,EACnB,cAAyB,EAChB,EAAE;IACX,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;QACpD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAA;IACxE,GAAG,CAAC,SAAS,CACX,8BAA8B,EAC9B,yDAAyD,CAC1D,CAAA;IACD,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,gBAAgB,CAAC,CAAA;IAEhE,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}
+{"version":3,"file":"http-helpers.js","sourceRoot":"","sources":["../src/http-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAE1E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAuB,EAAE,QAAgB,EAAU,EAAE;IACjF,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,kBAAkB,CAAC,CAAC,QAAQ,CAAA;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAA;IACjB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CACpD,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAElE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAA0B,EAAsB,EAAE;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IACrD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAA0B,EAC0B,EAAE;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC7D,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC3C,IAAI,cAAc,KAAK,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAA;QAClD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAA;QAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACnD,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAE,KAAa,EAAW,EAAE;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,qBAAqB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,GAAoB,EACpB,QAAgD,EACvC,EAAE;IACX,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC5D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CACL,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC;QAC3D,qBAAqB,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAC5D,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,qBAAqB;IACrB,yBAAyB;IACzB,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,2BAA2B;IAC3B,2BAA2B;IAC3B,6BAA6B;IAC7B,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,gBAAgB;IAChB,iBAAiB;CAClB,CAAA;AAED,MAAM,kBAAkB,GACtB,6FAA6F,CAAA;AAE/F;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,OAAe,EAAW,EAAE;IAC/E,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,EAAE,MAAM;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAA;IACvD,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,QAAQ,GAAG;QAAE,OAAO,KAAK,CAAA;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1D,MAAM,WAAW,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC/D,MAAM,WAAW,GAAG,IAAI;QACtB,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;QACtF,CAAC,CAAC,UAAU,KAAK,WAAW,CAAA;IAC9B,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAC9B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC7B,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,cAAwB,EAAW,EAAE,CACnF,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;AAEzE,oGAAoG;AACpG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAGrC,EAAwB,EAAE;IACzB,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,cAAc,CAAA;IAC9F,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,GAAoB,EACpB,GAAmB,EACnB,cAAyB,EAChB,EAAE;IACX,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAO,KAAK,CAAA;QACd,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAA;QACpD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACjC,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,yBAAyB,CAAC,CAAA;IACxE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,gBAAgB,CAAC,CAAA;IAC/D,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,iBAAiB,CAAC,CAAA;IAEjE,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,8EAA8E,CAAA;AAEhF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,iCAAiC,CAAA;AAElE,iFAAiF;AACjF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,wBAAwB;IAC9B,MAAM,EAAE,IAAI;IACZ,IAAI,EAAE,+CAA+C;CACtD,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAoB,EAAE,GAAmB,EAAW,EAAE;IAC7F,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACjD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IACnC,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAKpC,EAAU,EAAE;IACX,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,mBAAmB,GAAG,CAAC,CAAA;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACR,UAAU,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,EAC/B,sBAAsB,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CACxE,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AACnE,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAG1C,EAAU,EAAE,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjG;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,GAAoB,EACpB,QAAgB,EACa,EAAE,CAC/B,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAC/B,IAAI,QAAQ;YAAE,OAAM;QACpB,IAAI,IAAI,KAAK,CAAC,MAAM,CAAA;QACpB,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;YACpB,QAAQ,GAAG,IAAI,CAAA;YACf,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;YACjB,OAAO,CAAC,SAAS,CAAC,CAAA;YAClB,OAAM;QACR,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACjB,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzB,CAAC,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAmB,EAAE,QAAgB,EAAQ,EAAE;IAC9E,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACpC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,wBAAwB,QAAQ,SAAS,EAAE;QAC3E,EAAE,EAAE,IAAI;KACT,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OASjC,EAAQ,EAAE;IACT,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,yHAAyH,CAC1H,CAAA;IACH,CAAC;IACD,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;IACnD,oFAAoF;IACpF,mBAAmB,CAAC,OAAO,CAAC,CAAA;AAC9B,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,GAAoB,EACpB,GAAmB,EACnB,QAA4B,EACnB,EAAE;IACX,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;IAC3C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACvB,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,GAAoB,EACpB,GAAmB,EACnB,mBAAuC,EAC9B,EAAE;IACX,IAAI,CAAC,mBAAmB,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IACvF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAA;IAChF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,UAAU;QACb,KAAK,EAAE,cAAc;QACrB,iBAAiB,EACf,mJAAmJ;KACtJ,CAAC,CACH,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/dist/http-request-handler.d.ts

@@ -8,6 +8,7 @@ type PathPolicy = {
 type RequestHandlerOptions = {
     allowedOrigins?: string[];
     mcpToken?: string;
+    resourceMetadataUrl?: string;
     path: PathPolicy;
     logger?: SevLogger;
     redactSecrets?: Array<string | undefined>;

package/dist/http-request-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-request-handler.d.ts","sourceRoot":"","sources":["../src/http-request-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AACvG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAKxD,KAAK,UAAU,GAAG;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED,KAAK,qBAAqB,GAAG;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1C,CAAA;AAED,eAAO,MAAM,uBAAuB,GAClC,WAAW,6BAA6B,EACxC,SAAS,qBAAqB,MAOhB,KAAK,eAAe,EAAE,KAAK,cAAc,kBAoDxD,CAAA"}
+{"version":3,"file":"http-request-handler.d.ts","sourceRoot":"","sources":["../src/http-request-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AACvG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAcxD,KAAK,UAAU,GAAG;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB,CAAA;AAED,KAAK,qBAAqB,GAAG;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1C,CAAA;AAED,eAAO,MAAM,uBAAuB,GAClC,WAAW,6BAA6B,EACxC,SAAS,qBAAqB,MAShB,KAAK,eAAe,EAAE,KAAK,cAAc,kBAuCxD,CAAA"}

package/dist/http-request-handler.js

@@ -1,10 +1,12 @@
-import { applyCorsHeaders, isAuthorized, normalizePath, parsePathname } from "./http-helpers.js";
+import { applyCorsHeaders, assertHttpOptions, normalizePath, parsePathname, rejectMissingBearerToken, rejectMissingMcpToken, resolveAllowedOrigins, sendServerInfoForBareGet, } from "./http-helpers.js";
 import { buildRedactor, getLogger } from "./logger.js";
 export const createMcpRequestHandler = (transport, options) => {
+    assertHttpOptions(options);
     const expectedPath = normalizePath(options.path.expectedPath);
     const allowRoot = options.path.allowRoot ?? false;
     const logger = options.logger ?? getLogger().nest('http');
     const redact = buildRedactor(options.redactSecrets ?? []);
+    const allowedOrigins = resolveAllowedOrigins(options);
     return async (req, res) => {
         const pathname = normalizePath(parsePathname(req.url, expectedPath));
         if (pathname !== expectedPath && (!allowRoot || pathname !== '/')) {
@@ -12,7 +14,7 @@ export const createMcpRequestHandler = (transport, options) => {
             res.end('Not Found');
             return;
         }
-        if (!applyCorsHeaders(req, res, options.allowedOrigins)) {
+        if (!applyCorsHeaders(req, res, allowedOrigins)) {
             return;
         }
         if (req.method === 'OPTIONS') {
@@ -20,25 +22,13 @@ export const createMcpRequestHandler = (transport, options) => {
             res.end();
             return;
         }
-        if (options.mcpToken && !isAuthorized(req, options.mcpToken)) {
-            res.statusCode = 401;
-            res.setHeader('WWW-Authenticate', 'Bearer');
-            res.end('Unauthorized');
+        if (rejectMissingMcpToken(req, res, options.mcpToken)) {
             return;
         }
-        // Bare GETs without the SSE Accept header are not valid MCP requests (the
-        // Streamable HTTP spec requires Accept: text/event-stream for GET).  Return
-        // a friendly JSON status so directory health-probes (Glama, uptime monitors)
-        // see a 200 instead of the SDK's opaque 406.
-        const accept = req.headers.accept ?? '';
-        if (req.method === 'GET' && !accept.includes('text/event-stream')) {
-            res.statusCode = 200;
-            res.setHeader('Content-Type', 'application/json');
-            res.end(JSON.stringify({
-                name: 'Transloadit MCP Server',
-                status: 'ok',
-                docs: 'https://transloadit.com/docs/sdks/mcp-server/',
-            }));
+        if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+            return;
+        }
+        if (sendServerInfoForBareGet(req, res)) {
             return;
         }
         try {

package/dist/http-request-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-request-handler.js","sourceRoot":"","sources":["../src/http-request-handler.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAChG,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAetD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAAwC,EACxC,OAA8B,EAC9B,EAAE;IACF,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IAEzD,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YACvB,OAAM;QACR,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,6EAA6E;QAC7E,6CAA6C;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,+CAA+C;aACtD,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAI,GAA0B,CAAC,IAAI,CAAA;YACnD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YACrF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"http-request-handler.js","sourceRoot":"","sources":["../src/http-request-handler.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAgBtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,SAAwC,EACxC,OAA8B,EAC9B,EAAE;IACF,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAErD,OAAO,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QACpE,IAAI,QAAQ,KAAK,YAAY,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YAChD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAM;QACR,CAAC;QAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpE,OAAM;QACR,CAAC;QAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,UAAU,GAAI,GAA0B,CAAC,IAAI,CAAA;YACnD,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;YACrF,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;QAClC,CAAC;IACH,CAAC,CAAA;AACH,CAAC,CAAA"}

package/dist/http.d.ts

@@ -12,6 +12,8 @@ export type TransloaditMcpHttpOptions = TransloaditMcpServerOptions & {
         username: string;
         password: string;
     };
+    /** Largest accepted request body; defaults to 1 MiB hosted and 10 MiB self-hosted. */
+    maxRequestBodyBytes?: number;
     sessionIdGenerator?: (() => string) | undefined;
     logger?: SevLogger;
 };

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAExD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAe9D,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,GAAG;IACpE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IAC5B,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAEpD,kBAAkB,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAA;IAC/C,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,CAAC,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG;IACpB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAyBD,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,yBAA8B,GACtC,yBAAyB,CA6J3B"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAGxD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAA;AAsB9D,MAAM,MAAM,yBAAyB,GAAG,2BAA2B,GAAG;IACpE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;IAC5B,WAAW,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,sFAAsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAE5B,kBAAkB,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAA;IAC/C,MAAM,CAAC,EAAE,SAAS,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG,CAAC,CACvC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG;IACpB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B,CAAA;AAID,wBAAgB,+BAA+B,CAC7C,OAAO,GAAE,yBAA8B,GACtC,yBAAyB,CAwJ3B"}