@transloadit/mcp-server 0.4.2 → 0.5.1

package/dist/http.js

@@ -1,36 +1,22 @@
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { applyCorsHeaders, isAuthorized, isBasicAuthorized, normalizePath, parsePathname, } from "./http-helpers.js";
+import { applyCorsHeaders, assertHttpOptions, isBasicAuthorized, normalizePath, parsePathname, readBodyWithinLimit, rejectMissingBearerToken, rejectMissingMcpToken, resolveAllowedOrigins, resolveMaxRequestBodyBytes, sendBodyTooLarge, sendServerInfoForBareGet, } from "./http-helpers.js";
+import { parseJson } from "./json.js";
 import { getMetrics, getMetricsContentType } from "./metrics.js";
+import { createRequestTransport } from "./request-transport.js";
 import { createTransloaditMcpServer } from "./server.js";
 import { buildServerCard, serverCardPath } from "./server-card.js";
 const defaultPath = '/mcp';
-/** Read the full request body and JSON-parse it before handing it to the MCP transport. */
-function readJsonBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on('data', (chunk) => chunks.push(chunk));
-        req.on('end', () => {
-            const raw = Buffer.concat(chunks).toString('utf8');
-            if (!raw) {
-                resolve(undefined);
-                return;
-            }
-            try {
-                resolve(JSON.parse(raw));
-            }
-            catch {
-                resolve(undefined);
-            }
-        });
-        req.on('error', reject);
-    });
-}
 export function createTransloaditMcpHttpHandler(options = {}) {
     const activeRequests = new Set();
+    assertHttpOptions(options);
     const expectedPath = options.path ?? defaultPath;
     const metricsPath = options.metricsPath === false ? undefined : normalizePath(options.metricsPath ?? '/metrics');
     const metricsAuth = options.metricsAuth;
-    const serverCardJson = JSON.stringify(buildServerCard(expectedPath, { authKey: options.authKey, authSecret: options.authSecret }));
+    const allowedOrigins = resolveAllowedOrigins(options);
+    const serverCardJson = JSON.stringify(buildServerCard(expectedPath, {
+        authKey: options.authKey,
+        authSecret: options.authSecret,
+        resourceMetadataUrl: options.resourceMetadataUrl,
+    }));
     const handler = (async (req, res) => {
         const pathname = normalizePath(parsePathname(req.url, expectedPath));
         if (pathname === serverCardPath) {
@@ -81,7 +67,7 @@ export function createTransloaditMcpHttpHandler(options = {}) {
             res.end('Not Found');
             return;
         }
-        if (!applyCorsHeaders(req, res, options.allowedOrigins)) {
+        if (!applyCorsHeaders(req, res, allowedOrigins)) {
             return;
         }
         if (req.method === 'OPTIONS') {
@@ -89,24 +75,13 @@ export function createTransloaditMcpHttpHandler(options = {}) {
             res.end();
             return;
         }
-        if (options.mcpToken && !isAuthorized(req, options.mcpToken)) {
-            res.statusCode = 401;
-            res.setHeader('WWW-Authenticate', 'Bearer');
-            res.end('Unauthorized');
+        if (rejectMissingMcpToken(req, res, options.mcpToken)) {
             return;
         }
-        // Bare GETs without the SSE Accept header are not valid MCP requests (the
-        // Streamable HTTP spec requires Accept: text/event-stream for GET).  Return
-        // a friendly JSON status so directory health-probes see a 200 instead of 406.
-        const accept = req.headers.accept ?? '';
-        if (req.method === 'GET' && !accept.includes('text/event-stream')) {
-            res.statusCode = 200;
-            res.setHeader('Content-Type', 'application/json');
-            res.end(JSON.stringify({
-                name: 'Transloadit MCP Server',
-                status: 'ok',
-                docs: 'https://transloadit.com/docs/sdks/mcp-server/',
-            }));
+        if (rejectMissingBearerToken(req, res, options.resourceMetadataUrl)) {
+            return;
+        }
+        if (sendServerInfoForBareGet(req, res)) {
             return;
         }
         if (req.method !== 'POST') {
@@ -119,13 +94,14 @@ export function createTransloaditMcpHttpHandler(options = {}) {
             }));
             return;
         }
-        const parsedBody = await readJsonBody(req);
-        const transport = new StreamableHTTPServerTransport({
-            sessionIdGenerator: undefined,
-            allowedOrigins: options.allowedOrigins,
-            allowedHosts: options.allowedHosts,
-            enableDnsRebindingProtection: options.enableDnsRebindingProtection,
-        });
+        const maxBytes = resolveMaxRequestBodyBytes(options);
+        const rawBody = await readBodyWithinLimit(req, maxBytes);
+        if (rawBody === undefined) {
+            sendBodyTooLarge(res, maxBytes);
+            return;
+        }
+        const parsedBody = parseJson(rawBody);
+        const { transport, handle } = createRequestTransport(options);
         const server = createTransloaditMcpServer(options);
         const activeRequest = { transport, server };
         activeRequests.add(activeRequest);
@@ -137,7 +113,7 @@ export function createTransloaditMcpHttpHandler(options = {}) {
         res.on('close', cleanupActiveRequest);
         await server.connect(transport);
         try {
-            await transport.handleRequest(req, res, parsedBody);
+            await handle(req, res, parsedBody);
         }
         catch {
             if (!res.headersSent) {

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAsBlE,MAAM,WAAW,GAAG,MAAM,CAAA;AAE1B,2FAA2F;AAC3F,SAAS,YAAY,CAAC,GAAoB;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAa,EAAE,CAAA;QAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;QACrD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,CAAC,SAAS,CAAC,CAAA;gBAClB,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,SAAS,CAAC,CAAA;YACpB,CAAC;QACH,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,UAAqC,EAAE;IAEvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAG1B,CAAA;IACJ,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IAChD,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,CAAA;IAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IAEvC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CACnC,eAAe,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAC5F,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QAEpE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxD,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;YACjE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC7B,OAAM;YACR,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;YAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAA;YACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QAED,IAAI,WAAW,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC5C,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC7B,OAAM;YACR,CAAC;YAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC3B,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;YACxD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAA;YAC3C,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;YACvB,OAAM;QACR,CAAC;QAED,0EAA0E;QAC1E,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,+CAA+C;aACtD,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,4BAA4B,EAAE,OAAO,CAAC,4BAA4B;SACnE,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC3C,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,oBAAoB,GAAG,GAAG,EAAE;YAChC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACpC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;QACrC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE/B,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACtC,CAAC;IACH,CAAC,CAA8B,CAAA;IAE/B,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YACjD,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACpC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;YAC3C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,CACH,CAAA;IACH,CAAC,CAAA;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAwBlE,MAAM,WAAW,GAAG,MAAM,CAAA;AAE1B,MAAM,UAAU,+BAA+B,CAC7C,UAAqC,EAAE;IAEvC,MAAM,cAAc,GAAG,IAAI,GAAG,EAG1B,CAAA;IACJ,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IAChD,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,CAAA;IAC9F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;IACvC,MAAM,cAAc,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAErD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CACnC,eAAe,CAAC,YAAY,EAAE;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CACH,CAAA;IAED,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,MAAM,QAAQ,GAAG,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAA;QAEpE,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAChC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxD,OAAM;YACR,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,kBAAkB,CAAC,CAAA;YACjE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC7B,OAAM;YACR,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAA;YAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAA;YACtD,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAA;YAClD,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QAED,IAAI,WAAW,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC5C,IAAI,WAAW,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;gBACvB,OAAM;YACR,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;gBAC7B,OAAM;YACR,CAAC;YAED,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,CAAA;YAC3B,OAAM;QACR,CAAC;QAED,IAAI,QAAQ,KAAK,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;YAChD,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,GAAG,EAAE,CAAA;YACT,OAAM;QACR,CAAC;QAED,IAAI,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,OAAM;QACR,CAAC;QAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACpE,OAAM;QACR,CAAC;QAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACvC,OAAM;QACR,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;YACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;YACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;gBACb,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE;gBACvD,EAAE,EAAE,IAAI;aACT,CAAC,CACH,CAAA;YACD,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;QACpD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;YAC/B,OAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC7D,MAAM,MAAM,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;QAC3C,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,oBAAoB,GAAG,GAAG,EAAE;YAChC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACpC,KAAK,SAAS,CAAC,KAAK,EAAE,CAAA;YACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAA;QACrC,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAE/B,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;QACtC,CAAC;IACH,CAAC,CAA8B,CAAA;IAE/B,OAAO,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE;QACzB,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;YACjD,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;YACpC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,aAAa,CAAA;YAC3C,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;QACxD,CAAC,CAAC,CACH,CAAA;IACH,CAAC,CAAA;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/json.d.ts

@@ -0,0 +1,5 @@
+/** A plain object; arrays are rejected because callers read named fields. */
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+/** Parses JSON text, returning `undefined` for empty or invalid input instead of throwing. */
+export declare const parseJson: (text: string) => unknown;
+//# sourceMappingURL=json.d.ts.map

package/dist/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACH,CAAA;AAEtE,8FAA8F;AAC9F,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,KAAG,OAOxC,CAAA"}

package/dist/json.js

@@ -0,0 +1,14 @@
+/** A plain object; arrays are rejected because callers read named fields. */
+export const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+/** Parses JSON text, returning `undefined` for empty or invalid input instead of throwing. */
+export const parseJson = (text) => {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+//# sourceMappingURL=json.js.map

package/dist/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../src/json.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEtE,8FAA8F;AAC9F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE;IACjD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA"}

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAanD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,EAAE,SAAS,MAAM,EAAE,KAAG,MAchE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,KAAG,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAG7F,CAAA;AAED,eAAO,MAAM,SAAS,QAAO,SAAuB,CAAA"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAmBnD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,EAAE,SAAS,MAAM,EAAE,KAAG,MAchE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,SAAS,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,KAAG,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAG7F,CAAA;AAED,eAAO,MAAM,SAAS,QAAO,SAAuB,CAAA"}

package/dist/logger.js

@@ -1,7 +1,10 @@
 import { SevLogger } from '@transloadit/sev-logger';
 const baseLogger = new SevLogger({ breadcrumbs: ['mcp-server'] });
 const redactString = (value, secrets) => {
-    let output = value.replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]');
+    let output = value
+        .replace(/Bearer\s+[^\s]+/gi, 'Bearer [redacted]')
+        // The hosted upstream secret travels as a header; scrub it even when it was not listed.
+        .replace(/Transloadit-Mcp-Upstream(["']?\s*[:=]\s*["']?)[^\s"',}]+/gi, 'Transloadit-Mcp-Upstream$1[redacted]');
     for (const secret of secrets) {
         if (!secret)
             continue;

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAEjE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAU,EAAE;IAChE,IAAI,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAA;IACpE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,OAAiB,EAAU,EAAE;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,UAAU;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAkC,EAAgC,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,UAAU,CAAA"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAEnD,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAA;AAEjE,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,OAAiB,EAAU,EAAE;IAChE,IAAI,MAAM,GAAG,KAAK;SACf,OAAO,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;QAClD,wFAAwF;SACvF,OAAO,CACN,4DAA4D,EAC5D,sCAAsC,CACvC,CAAA;IACH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAE,OAAiB,EAAU,EAAE;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAClE,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1E,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;IACjD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,UAAU;YAAE,OAAO,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAkC,EAAgC,EAAE;IAChG,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAChF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;AACnD,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,GAAc,EAAE,CAAC,UAAU,CAAA"}

package/dist/options.d.ts

@@ -0,0 +1,12 @@
+/** Validates what every server instance relies on, however it is constructed. */
+export declare const assertServerOptions: (options: {
+    resourceMetadataUrl?: string;
+    upstreamSecret?: string;
+    maxUrlDownloadBytes?: unknown;
+    urlDownloadTimeoutMs?: unknown;
+    resultDomains?: string[];
+    widgetDomain?: string;
+}) => void;
+/** Validates the HTTP request body limit. */
+export declare const assertRequestBodyLimit: (value: unknown) => void;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAaA,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,GAAI,SAAS;IAC3C,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,KAAG,IAiBH,CAAA;AAED,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,IAEvD,CAAA"}

package/dist/options.js

@@ -0,0 +1,34 @@
+import { parseWidgetOrigin } from "./ui/assembly-result-widget.js";
+/**
+ * Limits also arrive from JSON config files, where a value such as `"1MB"` would silently disable
+ * a numeric comparison, so each one must be a positive integer.
+ */
+const assertPositiveInteger = (value, name, unit) => {
+    if (value === undefined)
+        return;
+    if (typeof value !== 'number' || !Number.isInteger(value) || value <= 0) {
+        throw new Error(`${name} must be a positive integer number of ${unit}.`);
+    }
+};
+/** Validates what every server instance relies on, however it is constructed. */
+export const assertServerOptions = (options) => {
+    // API2 only accepts relayed `aud=mcp` tokens from the hosted service, so without the secret
+    // every authenticated call fails; refusing to start surfaces that in the deploy's health check.
+    if (options.resourceMetadataUrl && !options.upstreamSecret) {
+        throw new Error('TRANSLOADIT_MCP_RESOURCE_METADATA_URL (hosted mode) requires TRANSLOADIT_MCP_UPSTREAM_SECRET: API2 only accepts relayed MCP tokens from the hosted service.');
+    }
+    assertPositiveInteger(options.maxUrlDownloadBytes, 'maxUrlDownloadBytes', 'bytes');
+    assertPositiveInteger(options.urlDownloadTimeoutMs, 'urlDownloadTimeoutMs', 'milliseconds');
+    // A malformed origin would only surface as blank previews in the host, so it fails startup.
+    for (const domain of options.resultDomains ?? []) {
+        parseWidgetOrigin(domain, 'resultDomains');
+    }
+    if (options.widgetDomain) {
+        parseWidgetOrigin(options.widgetDomain, 'widgetDomain');
+    }
+};
+/** Validates the HTTP request body limit. */
+export const assertRequestBodyLimit = (value) => {
+    assertPositiveInteger(value, 'maxRequestBodyBytes', 'bytes');
+};
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAElE;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,KAAc,EAAE,IAAY,EAAE,IAAY,EAAQ,EAAE;IACjF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAM;IAC/B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,yCAAyC,IAAI,GAAG,CAAC,CAAA;IAC1E,CAAC;AACH,CAAC,CAAA;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAOnC,EAAQ,EAAE;IACT,4FAA4F;IAC5F,gGAAgG;IAChG,IAAI,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,6JAA6J,CAC9J,CAAA;IACH,CAAC;IACD,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;IAClF,qBAAqB,CAAC,OAAO,CAAC,oBAAoB,EAAE,sBAAsB,EAAE,cAAc,CAAC,CAAA;IAC3F,4FAA4F;IAC5F,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QACjD,iBAAiB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;IAC5C,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,iBAAiB,CAAC,OAAO,CAAC,YAAY,EAAE,cAAc,CAAC,CAAA;IACzD,CAAC;AACH,CAAC,CAAA;AAED,6CAA6C;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAQ,EAAE;IAC7D,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAA;AAC9D,CAAC,CAAA"}

package/dist/request-transport.d.ts

@@ -0,0 +1,21 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { Transport } from '@modelcontextprotocol/sdk/shared/transport.js';
+type RequestTransportOptions = {
+    resourceMetadataUrl?: string;
+    allowedHosts?: string[];
+    enableDnsRebindingProtection?: boolean;
+    maxRequestBodyBytes?: number;
+};
+/** A per-request MCP transport plus the function that serves the HTTP request through it. */
+export type RequestTransport = {
+    transport: Transport;
+    handle: (req: IncomingMessage, res: ServerResponse, parsedBody: unknown) => Promise<void>;
+};
+/**
+ * Creates the stateless transport for one HTTP request. Origins are checked before this point by
+ * `applyCorsHeaders`, which understands `*.` and `:*` wildcards; the SDK compares origins
+ * literally, so it only receives the Host allowlist.
+ */
+export declare const createRequestTransport: (options: RequestTransportOptions) => RequestTransport;
+export {};
+//# sourceMappingURL=request-transport.d.ts.map

package/dist/request-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-transport.d.ts","sourceRoot":"","sources":["../src/request-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAA;AAY9E,KAAK,uBAAuB,GAAG;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,4BAA4B,CAAC,EAAE,OAAO,CAAA;IACtC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,6FAA6F;AAC7F,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAA;IACpB,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1F,CAAA;AAqGD;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,uBAAuB,KAAG,gBA4BzE,CAAA"}

package/dist/request-transport.js

@@ -0,0 +1,129 @@
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js';
+import { readBodyWithinLimit, resolveMaxRequestBodyBytes, sendBodyTooLarge, } from "./http-helpers.js";
+import { isRecord, parseJson } from "./json.js";
+/**
+ * Finds the challenge a tool attached after API2 rejected the forwarded token. Tool results are
+ * the only place that knows, because API2 checks the token when a tool calls it.
+ */
+const findUpstreamChallenge = (body) => {
+    const parsed = parseJson(body);
+    const messages = Array.isArray(parsed) ? parsed : [parsed];
+    for (const message of messages) {
+        if (!isRecord(message) || !isRecord(message.result))
+            continue;
+        const { result } = message;
+        if (result.isError !== true || !isRecord(result._meta))
+            continue;
+        const challenges = result._meta['mcp/www_authenticate'];
+        const header = Array.isArray(challenges)
+            ? challenges.find((challenge) => typeof challenge === 'string')
+            : undefined;
+        if (typeof header !== 'string')
+            continue;
+        if (header.includes('error="invalid_token"'))
+            return { status: 401, header };
+        if (header.includes('error="insufficient_scope"'))
+            return { status: 403, header };
+    }
+    return undefined;
+};
+const toWebRequest = (req) => {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        if (value === undefined)
+            continue;
+        for (const entry of Array.isArray(value) ? value : [value])
+            headers.append(name, entry);
+    }
+    // The body always arrives pre-parsed, so headers and a fixed base URL are all it needs.
+    return new Request(new URL(req.url ?? '/', 'http://localhost'), { method: req.method, headers });
+};
+const sendParseError = (res) => {
+    res.statusCode = 400;
+    res.setHeader('Content-Type', 'application/json');
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        error: { code: -32700, message: 'Parse error: Invalid JSON' },
+        id: null,
+    }));
+};
+/**
+ * Returns the JSON-RPC message, reading it within the body limit when no parser consumed the
+ * stream yet (an Express app without `express.json()`). `undefined` means a response was sent.
+ */
+const readMessage = async (req, res, parsedBody, maxBytes) => {
+    if (parsedBody !== undefined || req.method !== 'POST' || req.readableEnded) {
+        return { message: parsedBody };
+    }
+    const rawBody = await readBodyWithinLimit(req, maxBytes);
+    if (rawBody === undefined) {
+        sendBodyTooLarge(res, maxBytes);
+        return undefined;
+    }
+    const message = parseJson(rawBody);
+    if (message === undefined) {
+        sendParseError(res);
+        return undefined;
+    }
+    return { message };
+};
+/**
+ * Serves a hosted request through the SDK's web-standard transport in JSON mode, so the status is
+ * decided after the tool ran: MCP OAuth clients refresh only on HTTP 401 and re-scope only on
+ * HTTP 403 `insufficient_scope`, and a tool result over HTTP 200 would keep them retrying a
+ * rejected token.
+ */
+const relayHostedRequest = async (transport, req, res, message) => {
+    const response = await transport.handleRequest(toWebRequest(req), { parsedBody: message });
+    const body = await response.text();
+    // A client retries the whole HTTP request after re-authorizing, so a batch keeps its 200: the
+    // other calls may have succeeded (an Assembly created twice would be charged twice). Its failed
+    // items still carry the challenge in `_meta["mcp/www_authenticate"]`.
+    const challenge = !Array.isArray(message) && response.headers.get('content-type')?.includes('application/json')
+        ? findUpstreamChallenge(body)
+        : undefined;
+    res.statusCode = challenge?.status ?? response.status;
+    for (const [name, value] of response.headers)
+        res.setHeader(name, value);
+    if (challenge)
+        res.setHeader('WWW-Authenticate', challenge.header);
+    res.end(body);
+};
+/**
+ * Creates the stateless transport for one HTTP request. Origins are checked before this point by
+ * `applyCorsHeaders`, which understands `*.` and `:*` wildcards; the SDK compares origins
+ * literally, so it only receives the Host allowlist.
+ */
+export const createRequestTransport = (options) => {
+    const shared = {
+        sessionIdGenerator: undefined,
+        allowedHosts: options.allowedHosts,
+        enableDnsRebindingProtection: options.enableDnsRebindingProtection,
+    };
+    const maxBytes = resolveMaxRequestBodyBytes(options);
+    if (!options.resourceMetadataUrl) {
+        const transport = new StreamableHTTPServerTransport(shared);
+        return {
+            transport,
+            handle: async (req, res, parsedBody) => {
+                const read = await readMessage(req, res, parsedBody, maxBytes);
+                if (read)
+                    await transport.handleRequest(req, res, read.message);
+            },
+        };
+    }
+    const transport = new WebStandardStreamableHTTPServerTransport({
+        ...shared,
+        enableJsonResponse: true,
+    });
+    return {
+        transport,
+        handle: async (req, res, parsedBody) => {
+            const read = await readMessage(req, res, parsedBody, maxBytes);
+            if (read)
+                await relayHostedRequest(transport, req, res, read.message);
+        },
+    };
+};
+//# sourceMappingURL=request-transport.js.map

package/dist/request-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-transport.js","sourceRoot":"","sources":["../src/request-transport.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,wCAAwC,EAAE,MAAM,+DAA+D,CAAA;AAExH,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAiB/C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAiC,EAAE;IAC5E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAQ;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;QAC1B,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,SAAQ;QAChE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC;YAC/D,CAAC,CAAC,SAAS,CAAA;QACb,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAQ;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;QAC5E,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAoB,EAAW,EAAE;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzF,CAAC;IACD,wFAAwF;IACxF,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;AAClG,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,GAAmB,EAAQ,EAAE;IACnD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;IACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;IACjD,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE;QAC7D,EAAE,EAAE,IAAI;KACT,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,GAAoB,EACpB,GAAmB,EACnB,UAAmB,EACnB,QAAgB,EAC2B,EAAE;IAC7C,IAAI,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACxD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAC/B,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,GAAG,CAAC,CAAA;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAC9B,SAAmD,EACnD,GAAoB,EACpB,GAAmB,EACnB,OAAgB,EACD,EAAE;IACjB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;IAC1F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,8FAA8F;IAC9F,gGAAgG;IAChG,sEAAsE;IACtE,MAAM,SAAS,GACb,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC;QAC3F,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAC7B,CAAC,CAAC,SAAS,CAAA;IACf,GAAG,CAAC,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAA;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO;QAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACxE,IAAI,SAAS;QAAE,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;IAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AACf,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAgC,EAAoB,EAAE;IAC3F,MAAM,MAAM,GAAG;QACb,kBAAkB,EAAE,SAAS;QAC7B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,4BAA4B,EAAE,OAAO,CAAC,4BAA4B;KACnE,CAAA;IACD,MAAM,QAAQ,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IACpD,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,MAAM,CAAC,CAAA;QAC3D,OAAO;YACL,SAAS;YACT,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;gBACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;gBAC9D,IAAI,IAAI;oBAAE,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;YACjE,CAAC;SACF,CAAA;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,wCAAwC,CAAC;QAC7D,GAAG,MAAM;QACT,kBAAkB,EAAE,IAAI;KACzB,CAAC,CAAA;IACF,OAAO;QACL,SAAS;QACT,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;YAC9D,IAAI,IAAI;gBAAE,MAAM,kBAAkB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/server-card.d.ts

@@ -1,10 +1,22 @@
+import type { ToolAnnotations } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolName, ToolSecurityScheme } from './tool-metadata.ts';
 export declare const serverCardPath = "/.well-known/mcp/server-card.json";
 type JsonSchemaObject = Record<string, unknown>;
-type ServerCardToolDefinition = {
-    name: string;
+type ServerCardToolInput = {
+    name: ToolName;
+    inputSchema: JsonSchemaObject;
+};
+type ServerCardToolDefinition = ServerCardToolInput & {
     title: string;
     description: string;
-    inputSchema: JsonSchemaObject;
+    annotations: ToolAnnotations;
+    securitySchemes: ToolSecurityScheme[];
+};
+type ServerCardAuthentication = {
+    required: boolean;
+    schemes: string[];
+    /** RFC 9728 protected-resource metadata that names the OAuth authorization server. */
+    resourceMetadataUrl?: string;
 };
 type ServerCard = {
     $schema: string;
@@ -22,20 +34,21 @@ type ServerCard = {
         type: string;
         endpoint: string;
     };
-    authentication?: {
-        required: boolean;
-        schemes: string[];
-    };
+    authentication?: ServerCardAuthentication;
     capabilities: {
         tools: {
             listChanged: boolean;
         };
+        resources: {
+            listChanged: boolean;
+        };
     };
     tools: ['dynamic'] | ServerCardToolDefinition[];
 };
 export declare const buildServerCard: (endpoint: string, options?: {
     authKey?: string;
     authSecret?: string;
+    resourceMetadataUrl?: string;
 }) => ServerCard;
 export {};
 //# sourceMappingURL=server-card.d.ts.map

package/dist/server-card.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-card.d.ts","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc,sCAAsC,CAAA;AAEjE,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,KAAK,wBAAwB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;IACzD,YAAY,EAAE;QAAE,KAAK,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;IACjD,KAAK,EAAE,CAAC,SAAS,CAAC,GAAG,wBAAwB,EAAE,CAAA;CAChD,CAAA;AA4HD,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,UAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,KACtD,UA6BF,CAAA"}
+{"version":3,"file":"server-card.d.ts","sourceRoot":"","sources":["../src/server-card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AAEzE,OAAO,KAAK,EAAgB,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAOpF,eAAO,MAAM,cAAc,sCAAsC,CAAA;AAEjE,KAAK,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE/C,KAAK,mBAAmB,GAAG;IACzB,IAAI,EAAE,QAAQ,CAAA;IACd,WAAW,EAAE,gBAAgB,CAAA;CAC9B,CAAA;AAED,KAAK,wBAAwB,GAAG,mBAAmB,GAAG;IACpD,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,eAAe,CAAA;IAC5B,eAAe,EAAE,kBAAkB,EAAE,CAAA;CACtC,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,EAAE,OAAO,CAAA;IACjB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,sFAAsF;IACtF,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B,CAAA;AAED,KAAK,UAAU,GAAG;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5D,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC7C,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC,YAAY,EAAE;QAAE,KAAK,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,SAAS,EAAE;YAAE,WAAW,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,CAAA;IACtF,KAAK,EAAE,CAAC,SAAS,CAAC,GAAG,wBAAwB,EAAE,CAAA;CAChD,CAAA;AA8ID,eAAO,MAAM,eAAe,GAC1B,UAAU,MAAM,EAChB,UAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAO,KACpF,UAkCF,CAAA"}

package/dist/server-card.js

@@ -1,11 +1,10 @@
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 import packageJson from '../package.json' with { type: 'json' };
+import { resolveSecuritySchemes, resolveToolAuthMode, toolMetadata } from "./tool-metadata.js";
 export const serverCardPath = '/.well-known/mcp/server-card.json';
-const tools = [
+const toolInputs = [
     {
         name: 'transloadit_lint_assembly_instructions',
-        title: 'Lint Assembly Instructions',
-        description: 'Lint Assembly Instructions without creating an Assembly. Returns structured issues.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -19,8 +18,6 @@ const tools = [
     },
     {
         name: 'transloadit_create_assembly',
-        title: 'Create or resume an Assembly',
-        description: 'Create or resume an Assembly, optionally uploading files and waiting for completion.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -30,6 +27,20 @@ const tools = [
                     type: 'array',
                     items: { type: 'object' },
                 },
+                attachments: {
+                    type: 'array',
+                    items: {
+                        type: 'object',
+                        additionalProperties: false,
+                        required: ['download_url', 'file_id'],
+                        properties: {
+                            download_url: { type: 'string' },
+                            file_id: { type: 'string' },
+                            mime_type: { type: 'string' },
+                            file_name: { type: 'string' },
+                        },
+                    },
+                },
                 fields: { type: 'object' },
                 wait_for_completion: { type: 'boolean' },
                 wait_timeout_ms: { type: 'number' },
@@ -43,8 +54,6 @@ const tools = [
     },
     {
         name: 'transloadit_get_assembly_status',
-        title: 'Get Assembly Status',
-        description: 'Fetch the latest Assembly status by URL or ID.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -56,8 +65,6 @@ const tools = [
     },
     {
         name: 'transloadit_wait_for_assembly',
-        title: 'Wait For Assembly Completion',
-        description: 'Polls until the Assembly completes or timeout is reached.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -71,8 +78,6 @@ const tools = [
     },
     {
         name: 'transloadit_list_robots',
-        title: 'List Robots',
-        description: 'Returns a filtered list of robots with short summaries.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -86,8 +91,6 @@ const tools = [
     },
     {
         name: 'transloadit_get_robot_help',
-        title: 'Get Robot Help',
-        description: 'Returns a robot summary and parameter details.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -99,8 +102,6 @@ const tools = [
     },
     {
         name: 'transloadit_list_templates',
-        title: 'List Templates',
-        description: 'List Assembly Templates (owned and/or builtin). Tip: pass include_builtin: "exclusively-latest" to list builtins only.',
         inputSchema: {
             type: 'object',
             additionalProperties: false,
@@ -118,9 +119,31 @@ const tools = [
             },
         },
     },
+    {
+        name: 'transloadit_get_profile',
+        inputSchema: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {},
+        },
+    },
 ];
+/** Tool definitions with the security schemes this deployment mode can honor. */
+const buildTools = (mode) => toolInputs.map((tool) => {
+    const metadata = toolMetadata[tool.name];
+    return {
+        ...tool,
+        title: metadata.title,
+        description: metadata.description,
+        annotations: metadata.annotations,
+        securitySchemes: resolveSecuritySchemes(metadata, mode),
+    };
+});
 export const buildServerCard = (endpoint, options = {}) => {
     const hasCredentials = Boolean(options.authKey && options.authSecret);
+    const tools = buildTools(resolveToolAuthMode(options));
+    // Hosted deployments hand out tokens through OAuth; self-hosted ones accept a static bearer.
+    const schemes = options.resourceMetadataUrl ? ['oauth2', 'bearer'] : ['bearer'];
     return {
         $schema: 'https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json',
         version: '1.0',
@@ -139,10 +162,12 @@ export const buildServerCard = (endpoint, options = {}) => {
         },
         authentication: {
             required: !hasCredentials,
-            schemes: ['bearer'],
+            schemes,
+            ...(options.resourceMetadataUrl ? { resourceMetadataUrl: options.resourceMetadataUrl } : {}),
         },
         capabilities: {
             tools: { listChanged: false },
+            resources: { listChanged: false },
         },
         tools,
     };