@zuplo/cli 7.9.4 → 7.9.6

package/node_modules/@modelcontextprotocol/server/dist/{mcp-TfXCpFsH.cjs → mcp-BumlNux0.cjs}

@@ -1,5 +1,5 @@
 const require_chunk = require('./chunk-Bnu9O96Y.cjs');
-const require_src = require('./src-BtQ5YSyq.cjs');
+const require_src = require('./src-BhnGYybN.cjs');
 let _modelcontextprotocol_server__shims = require("@modelcontextprotocol/server/_shims");
 let _modelcontextprotocol_core_internal = require("@modelcontextprotocol/core/internal");
 
@@ -355,7 +355,7 @@ var StdioListenRouter = class {
 	_serverCapabilities;
 	/**
 	* The serving instance's identity, stamped onto the graceful-close
-	* results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+	* results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
 	* `ResultMetaObject`). Handed over together with the capabilities.
 	*/
 	_serverInfo;
@@ -482,6 +482,15 @@ function notificationToServerEvent(method, uri) {
 
 //#endregion
 //#region src/server/middleware/bearerAuth.ts
+function comparableResource(value) {
+	const text = String(value);
+	const hash = text.indexOf("#");
+	return (hash === -1 ? text : text.slice(0, hash)).replace(/\/$/, "");
+}
+function sameResource(reported, expected) {
+	if (!reported) return false;
+	return comparableResource(reported) === comparableResource(expected);
+}
 function headerQuotedValue(value) {
 	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
 }
@@ -505,7 +514,8 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 * the verified {@link AuthInfo}.
 *
 * The runtime-neutral core of Bearer authentication: it parses the header,
-* runs the verifier, enforces `requiredScopes`, and rejects tokens without an
+* runs the verifier, compares the token's resource with `expectedResource`,
+* enforces `requiredScopes`, and rejects tokens without an
 * expiration or past it. On any failure it throws an {@link OAuthError} —
 * pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
 * answer, or use {@link requireBearerAuth} to get both steps as one call.
@@ -514,11 +524,12 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 * `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
 */
 async function verifyBearerToken(authorizationHeader, options) {
-	const { verifier, requiredScopes = [] } = options;
+	const { verifier, requiredScopes = [], expectedResource } = options;
 	if (!authorizationHeader) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Missing Authorization header");
 	const [type, token] = authorizationHeader.split(" ");
 	if (type?.toLowerCase() !== "bearer" || !token) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
 	const authInfo = await verifier.verifyAccessToken(token);
+	if (expectedResource !== void 0 && !sameResource(authInfo.resource, expectedResource)) throw new require_src.OAuthError(require_src.OAuthErrorCode.InvalidToken, "Token was not issued for this resource");
 	if (requiredScopes.length > 0) {
 		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new require_src.OAuthError(require_src.OAuthErrorCode.InsufficientScope, "Insufficient scope");
 	}
@@ -586,11 +597,12 @@ function bearerAuthChallengeResponse(error, options) {
 * ```
 */
 function requireBearerAuth(options) {
-	const { verifier, requiredScopes = [], resourceMetadataUrl } = options;
+	const { verifier, requiredScopes = [], resourceMetadataUrl, expectedResource } = options;
 	const resolved = {
 		verifier,
 		requiredScopes,
-		resourceMetadataUrl
+		resourceMetadataUrl,
+		expectedResource
 	};
 	return async (request) => {
 		const [authorizationHeader] = (request.headers.get("authorization") ?? "").split(",");
@@ -972,7 +984,7 @@ function installModernOnlyHandlers(server, servedModernVersions) {
 * Package-internal: the instance's implementation identity, for the serving
 * entries to stamp onto entry-built results (the `subscriptions/listen`
 * graceful-close result — built outside the encode seam, but the spec's
-* `SubscriptionsListenResultMeta` extends `ResultMetaObject`, so it carries
+* `SubscriptionsListenResultMetaObject` extends `ResultMetaObject`, so it carries
 * the serverInfo SHOULD like every other result). Not public API.
 */
 function serverIdentityOf(server) {
@@ -1043,6 +1055,11 @@ var Server = class extends require_src.Protocol {
 		if (require_src.modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
 		if (this._capabilities.logging) this._registerLoggingHandler();
 	}
+	/** Attaches to the given transport; rejects while this instance is connected to another one. */
+	async connect(transport) {
+		if (this.transport !== void 0) throw new require_src.SdkError(require_src.SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		await super.connect(transport);
+	}
 	/**
 	* Registers the built-in `logging/setLevel` request handler.
 	*
@@ -1604,6 +1621,30 @@ function discoverAdvertisedCapabilities(capabilities) {
 
 //#endregion
 //#region src/server/mcp.ts
+function toolInputElementCount(value, max) {
+	let count = 0;
+	const stack = [value];
+	while (stack.length > 0) {
+		const node = stack.pop();
+		if (node === null || typeof node !== "object") continue;
+		if (Array.isArray(node)) for (const child of node) {
+			if (++count > max) return count;
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+		else for (const key in node) {
+			if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
+			if (++count > max) return count;
+			const child = node[key];
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+	}
+	return count;
+}
+function resolveMaxToolInputElements(value) {
+	if (value === void 0 || value === Infinity) return void 0;
+	if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+	return value;
+}
 /**
 * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
 * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -1622,16 +1663,12 @@ var McpServer = class {
 	* The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
 	*/
 	server;
+	_maxToolInputElements;
 	_registeredResources = {};
 	_registeredResourceTemplates = {};
 	_registeredTools = {};
 	_registeredPrompts = {};
-	/**
-	* Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-	* registration-time scan and the pre-dispatch validation step share one
-	* conversion instead of paying it twice per request under the
-	* per-request-factory `createMcpHandler` model.
-	*/
+	/** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
 	_toolInputSchemaJson = {};
 	/**
 	* The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -1656,6 +1693,7 @@ var McpServer = class {
 	}
 	constructor(serverInfo, options) {
 		this.server = new Server(serverInfo, options);
+		this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
 		if (options?.capabilities?.tools) this.setToolRequestHandlers();
 		if (options?.capabilities?.resources) this.setResourceRequestHandlers();
 		if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -1727,7 +1765,7 @@ var McpServer = class {
 				name,
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema ? require_src.standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+				inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
 				annotations: tool.annotations,
 				icons: tool.icons,
 				execution: tool.execution,
@@ -1772,6 +1810,7 @@ var McpServer = class {
 	* Validates tool input arguments against the tool's input schema.
 	*/
 	async validateToolInput(tool, args, toolName) {
+		if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new require_src.ProtocolError(require_src.ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
 		if (!tool.inputSchema) return;
 		const parseResult = await require_src.validateStandardSchema(tool.inputSchema, args ?? {});
 		if (!parseResult.success) throw new require_src.ProtocolError(require_src.ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -2045,19 +2084,19 @@ var McpServer = class {
 	}
 	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		require_src.validateAndWarnToolName(name);
-		if (inputSchema !== void 0) try {
-			const json = require_src.standardSchemaToJsonSchema(inputSchema, "input");
-			this._toolInputSchemaJson[name] = json;
-			const scan = require_src.scanXMcpHeaderDeclarations(json);
-			if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-		} catch {}
 		let currentHandler = handler;
+		let outputSchemaJson;
 		const registeredTool = {
 			title,
 			description,
 			inputSchema,
 			outputSchema,
-			outputSchemaJson: convertOutputSchemaJson(outputSchema),
+			get outputSchemaJson() {
+				return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+			},
+			set outputSchemaJson(value) {
+				outputSchemaJson = value;
+			},
 			annotations,
 			icons,
 			execution,
@@ -2218,6 +2257,13 @@ const EMPTY_OBJECT_JSON_SCHEMA = {
 	type: "object",
 	properties: {}
 };
+/** Converts a tool's `inputSchema` for `tools/list` and warns on an invalid SEP-2243 `x-mcp-header` declaration. */
+function convertListedInputSchema(name, inputSchema) {
+	const json = require_src.standardSchemaToJsonSchema(inputSchema, "input");
+	const scan = require_src.scanXMcpHeaderDeclarations(json);
+	if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+	return json;
+}
 /**
 * Convert a registered `outputSchema` to JSON Schema, memoised on {@link RegisteredTool.outputSchemaJson}
 * so `tools/call` passes the SAME advertised schema to the wire codec's `projectCallToolResult` that
@@ -2240,7 +2286,7 @@ function createPromptHandler(name, argsSchema, callback) {
 	if (argsSchema) {
 		const typedCallback = callback;
 		return async (args, ctx) => {
-			const parseResult = await require_src.validateStandardSchema(argsSchema, args);
+			const parseResult = await require_src.validateStandardSchema(argsSchema, args ?? {});
 			if (!parseResult.success) throw new require_src.ProtocolError(require_src.ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
 			return typedCallback(parseResult.data, ctx);
 		};
@@ -2428,4 +2474,4 @@ Object.defineProperty(exports, 'verifyBearerToken', {
     return verifyBearerToken;
   }
 });
-//# sourceMappingURL=mcp-TfXCpFsH.cjs.map
+//# sourceMappingURL=mcp-BumlNux0.cjs.map