@zuplo/cli 7.9.4 → 7.9.6

package/node_modules/@modelcontextprotocol/server/dist/{mcp-DYuW2ZSs.mjs → mcp-DIH4cS6P.mjs}

@@ -1,4 +1,4 @@
-import { A as promptArgumentsFromStandardSchema, At as LATEST_PROTOCOL_VERSION, B as scanXMcpHeaderDeclarations, C as REQUEST_STATE_ONLY_LEG_PACING_MS, Ct as CLIENT_CAPABILITIES_META_KEY, E as sleep, H as assertCompleteRequestPrompt, Ht as requiredClientCapabilitiesForInputRequest, It as SERVER_INFO_META_KEY, Kt as SdkError, Lt as SUBSCRIPTION_ID_META_KEY, M as validateStandardSchema, N as parseSchema, T as linkedRoundAbort, U as assertCompleteRequestResourceTemplate, Vt as missingClientCapabilities, Xt as OAuthErrorCode, Yt as OAuthError, _ as mergeCapabilities, _t as normalizeContentlessToolResult, a as UriTemplate, b as withRequestStateValue, bt as legacyProtocolVersions, ct as codecForVersion, dt as ResourceNotFoundError, g as Protocol, gt as attachCacheHintFallback, ht as assertValidCacheHint, j as standardSchemaToJsonSchema, jt as LOG_LEVEL_META_KEY, lt as MissingRequiredClientCapabilityError, mt as ProtocolErrorCode, nt as LoggingLevelSchema, q as isInputRequiredResult, qt as SdkErrorCode, r as normalizeRawShapeSchema, s as validateAndWarnToolName, st as MODERN_WIRE_REVISION, ut as ProtocolError, v as requestStateAccessor, w as inputRequiredRoundsExceededMessage, xt as modernProtocolVersions, yt as isModernProtocolVersion } from "./src-BHSMhZ_W.mjs";
+import { A as promptArgumentsFromStandardSchema, At as LATEST_PROTOCOL_VERSION, B as scanXMcpHeaderDeclarations, C as REQUEST_STATE_ONLY_LEG_PACING_MS, Ct as CLIENT_CAPABILITIES_META_KEY, E as sleep, H as assertCompleteRequestPrompt, Ht as requiredClientCapabilitiesForInputRequest, It as SERVER_INFO_META_KEY, Kt as SdkError, Lt as SUBSCRIPTION_ID_META_KEY, M as validateStandardSchema, N as parseSchema, T as linkedRoundAbort, U as assertCompleteRequestResourceTemplate, Vt as missingClientCapabilities, Xt as OAuthErrorCode, Yt as OAuthError, _ as mergeCapabilities, _t as normalizeContentlessToolResult, a as UriTemplate, b as withRequestStateValue, bt as legacyProtocolVersions, ct as codecForVersion, dt as ResourceNotFoundError, g as Protocol, gt as attachCacheHintFallback, ht as assertValidCacheHint, j as standardSchemaToJsonSchema, jt as LOG_LEVEL_META_KEY, lt as MissingRequiredClientCapabilityError, mt as ProtocolErrorCode, nt as LoggingLevelSchema, q as isInputRequiredResult, qt as SdkErrorCode, r as normalizeRawShapeSchema, s as validateAndWarnToolName, st as MODERN_WIRE_REVISION, ut as ProtocolError, v as requestStateAccessor, w as inputRequiredRoundsExceededMessage, xt as modernProtocolVersions, yt as isModernProtocolVersion } from "./src-Cqbh3MYc.mjs";
 import { DefaultJsonSchemaValidator } from "@modelcontextprotocol/server/_shims";
 
 //#region src/server/completable.ts
@@ -353,7 +353,7 @@ var StdioListenRouter = class {
 	_serverCapabilities;
 	/**
 	* The serving instance's identity, stamped onto the graceful-close
-	* results' `_meta` (the spec's `SubscriptionsListenResultMeta` extends
+	* results' `_meta` (the spec's `SubscriptionsListenResultMetaObject` extends
 	* `ResultMetaObject`). Handed over together with the capabilities.
 	*/
 	_serverInfo;
@@ -480,6 +480,15 @@ function notificationToServerEvent(method, uri) {
 
 //#endregion
 //#region src/server/middleware/bearerAuth.ts
+function comparableResource(value) {
+	const text = String(value);
+	const hash = text.indexOf("#");
+	return (hash === -1 ? text : text.slice(0, hash)).replace(/\/$/, "");
+}
+function sameResource(reported, expected) {
+	if (!reported) return false;
+	return comparableResource(reported) === comparableResource(expected);
+}
 function headerQuotedValue(value) {
 	return value.replaceAll(/[\\"]/g, String.raw`\$&`).replaceAll(/[^\u0020-\u007E]/g, " ");
 }
@@ -503,7 +512,8 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 * the verified {@link AuthInfo}.
 *
 * The runtime-neutral core of Bearer authentication: it parses the header,
-* runs the verifier, enforces `requiredScopes`, and rejects tokens without an
+* runs the verifier, compares the token's resource with `expectedResource`,
+* enforces `requiredScopes`, and rejects tokens without an
 * expiration or past it. On any failure it throws an {@link OAuthError} —
 * pass that to {@link bearerAuthChallengeResponse} for the matching HTTP
 * answer, or use {@link requireBearerAuth} to get both steps as one call.
@@ -512,11 +522,12 @@ function buildWwwAuthenticateHeader(errorCode, description, requiredScopes, reso
 * `@modelcontextprotocol/express` feeds it `req.headers.authorization`.
 */
 async function verifyBearerToken(authorizationHeader, options) {
-	const { verifier, requiredScopes = [] } = options;
+	const { verifier, requiredScopes = [], expectedResource } = options;
 	if (!authorizationHeader) throw new OAuthError(OAuthErrorCode.InvalidToken, "Missing Authorization header");
 	const [type, token] = authorizationHeader.split(" ");
 	if (type?.toLowerCase() !== "bearer" || !token) throw new OAuthError(OAuthErrorCode.InvalidToken, "Invalid Authorization header format, expected 'Bearer TOKEN'");
 	const authInfo = await verifier.verifyAccessToken(token);
+	if (expectedResource !== void 0 && !sameResource(authInfo.resource, expectedResource)) throw new OAuthError(OAuthErrorCode.InvalidToken, "Token was not issued for this resource");
 	if (requiredScopes.length > 0) {
 		if (!requiredScopes.every((scope) => authInfo.scopes.includes(scope))) throw new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope");
 	}
@@ -584,11 +595,12 @@ function bearerAuthChallengeResponse(error, options) {
 * ```
 */
 function requireBearerAuth(options) {
-	const { verifier, requiredScopes = [], resourceMetadataUrl } = options;
+	const { verifier, requiredScopes = [], resourceMetadataUrl, expectedResource } = options;
 	const resolved = {
 		verifier,
 		requiredScopes,
-		resourceMetadataUrl
+		resourceMetadataUrl,
+		expectedResource
 	};
 	return async (request) => {
 		const [authorizationHeader] = (request.headers.get("authorization") ?? "").split(",");
@@ -970,7 +982,7 @@ function installModernOnlyHandlers(server, servedModernVersions) {
 * Package-internal: the instance's implementation identity, for the serving
 * entries to stamp onto entry-built results (the `subscriptions/listen`
 * graceful-close result — built outside the encode seam, but the spec's
-* `SubscriptionsListenResultMeta` extends `ResultMetaObject`, so it carries
+* `SubscriptionsListenResultMetaObject` extends `ResultMetaObject`, so it carries
 * the serverInfo SHOULD like every other result). Not public API.
 */
 function serverIdentityOf(server) {
@@ -1041,6 +1053,11 @@ var Server = class extends Protocol {
 		if (modernProtocolVersions(this._supportedProtocolVersions).length > 0) this.setRequestHandler("server/discover", () => this._ondiscover());
 		if (this._capabilities.logging) this._registerLoggingHandler();
 	}
+	/** Attaches to the given transport; rejects while this instance is connected to another one. */
+	async connect(transport) {
+		if (this.transport !== void 0) throw new SdkError(SdkErrorCode.AlreadyConnected, "Use a separate Server instance per connection: this instance is already connected to a transport. To connect it to a new transport, call close() first.");
+		await super.connect(transport);
+	}
 	/**
 	* Registers the built-in `logging/setLevel` request handler.
 	*
@@ -1602,6 +1619,30 @@ function discoverAdvertisedCapabilities(capabilities) {
 
 //#endregion
 //#region src/server/mcp.ts
+function toolInputElementCount(value, max) {
+	let count = 0;
+	const stack = [value];
+	while (stack.length > 0) {
+		const node = stack.pop();
+		if (node === null || typeof node !== "object") continue;
+		if (Array.isArray(node)) for (const child of node) {
+			if (++count > max) return count;
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+		else for (const key in node) {
+			if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
+			if (++count > max) return count;
+			const child = node[key];
+			if (child !== null && typeof child === "object") stack.push(child);
+		}
+	}
+	return count;
+}
+function resolveMaxToolInputElements(value) {
+	if (value === void 0 || value === Infinity) return void 0;
+	if (typeof value !== "number" || Number.isNaN(value) || value < 1) throw new RangeError(`maxToolInputElements must be a number of at least 1, or Infinity, got ${String(value)}`);
+	return value;
+}
 /**
 * High-level MCP server that provides a simpler API for working with resources, tools, and prompts.
 * For advanced usage (like sending notifications or setting custom request handlers), use the underlying
@@ -1620,16 +1661,12 @@ var McpServer = class {
 	* The underlying {@linkcode Server} instance, useful for advanced operations like sending notifications.
 	*/
 	server;
+	_maxToolInputElements;
 	_registeredResources = {};
 	_registeredResourceTemplates = {};
 	_registeredTools = {};
 	_registeredPrompts = {};
-	/**
-	* Per-tool JSON-converted `inputSchema`, memoized so the SEP-2243
-	* registration-time scan and the pre-dispatch validation step share one
-	* conversion instead of paying it twice per request under the
-	* per-request-factory `createMcpHandler` model.
-	*/
+	/** Per-tool JSON-converted `inputSchema`, filled on first use by `toolInputSchemaJson()`. */
 	_toolInputSchemaJson = {};
 	/**
 	* The JSON-serialized `inputSchema` of a registered tool, or `undefined`
@@ -1654,6 +1691,7 @@ var McpServer = class {
 	}
 	constructor(serverInfo, options) {
 		this.server = new Server(serverInfo, options);
+		this._maxToolInputElements = resolveMaxToolInputElements(options?.maxToolInputElements);
 		if (options?.capabilities?.tools) this.setToolRequestHandlers();
 		if (options?.capabilities?.resources) this.setResourceRequestHandlers();
 		if (options?.capabilities?.prompts) this.setPromptRequestHandlers();
@@ -1725,7 +1763,7 @@ var McpServer = class {
 				name,
 				title: tool.title,
 				description: tool.description,
-				inputSchema: tool.inputSchema ? standardSchemaToJsonSchema(tool.inputSchema, "input") : EMPTY_OBJECT_JSON_SCHEMA,
+				inputSchema: tool.inputSchema ? convertListedInputSchema(name, tool.inputSchema) : EMPTY_OBJECT_JSON_SCHEMA,
 				annotations: tool.annotations,
 				icons: tool.icons,
 				execution: tool.execution,
@@ -1770,6 +1808,7 @@ var McpServer = class {
 	* Validates tool input arguments against the tool's input schema.
 	*/
 	async validateToolInput(tool, args, toolName) {
+		if (this._maxToolInputElements !== void 0 && toolInputElementCount(args, this._maxToolInputElements) > this._maxToolInputElements) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for tool ${toolName}: arguments contain more than the maximum of ${this._maxToolInputElements} elements`);
 		if (!tool.inputSchema) return;
 		const parseResult = await validateStandardSchema(tool.inputSchema, args ?? {});
 		if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Input validation error: Invalid arguments for tool ${toolName}: ${parseResult.error}`);
@@ -2043,19 +2082,19 @@ var McpServer = class {
 	}
 	_createRegisteredTool(name, title, description, inputSchema, outputSchema, annotations, icons, execution, scopeChallenge, _meta, handler) {
 		validateAndWarnToolName(name);
-		if (inputSchema !== void 0) try {
-			const json = standardSchemaToJsonSchema(inputSchema, "input");
-			this._toolInputSchemaJson[name] = json;
-			const scan = scanXMcpHeaderDeclarations(json);
-			if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
-		} catch {}
 		let currentHandler = handler;
+		let outputSchemaJson;
 		const registeredTool = {
 			title,
 			description,
 			inputSchema,
 			outputSchema,
-			outputSchemaJson: convertOutputSchemaJson(outputSchema),
+			get outputSchemaJson() {
+				return outputSchemaJson ??= convertOutputSchemaJson(registeredTool.outputSchema);
+			},
+			set outputSchemaJson(value) {
+				outputSchemaJson = value;
+			},
 			annotations,
 			icons,
 			execution,
@@ -2216,6 +2255,13 @@ const EMPTY_OBJECT_JSON_SCHEMA = {
 	type: "object",
 	properties: {}
 };
+/** Converts a tool's `inputSchema` for `tools/list` and warns on an invalid SEP-2243 `x-mcp-header` declaration. */
+function convertListedInputSchema(name, inputSchema) {
+	const json = standardSchemaToJsonSchema(inputSchema, "input");
+	const scan = scanXMcpHeaderDeclarations(json);
+	if (!scan.valid) console.warn(`[mcp-sdk] tool '${name}' carries an invalid x-mcp-header declaration and will be excluded by conforming Streamable HTTP clients: ${scan.reason}`);
+	return json;
+}
 /**
 * Convert a registered `outputSchema` to JSON Schema, memoised on {@link RegisteredTool.outputSchemaJson}
 * so `tools/call` passes the SAME advertised schema to the wire codec's `projectCallToolResult` that
@@ -2238,7 +2284,7 @@ function createPromptHandler(name, argsSchema, callback) {
 	if (argsSchema) {
 		const typedCallback = callback;
 		return async (args, ctx) => {
-			const parseResult = await validateStandardSchema(argsSchema, args);
+			const parseResult = await validateStandardSchema(argsSchema, args ?? {});
 			if (!parseResult.success) throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Invalid arguments for prompt ${name}: ${parseResult.error}`);
 			return typedCallback(parseResult.data, ctx);
 		};
@@ -2277,4 +2323,4 @@ function unwrapOptionalSchema(schema) {
 
 //#endregion
 export { armSseKeepAlive as C, DEFAULT_SSE_KEEP_ALIVE_MS as S, isCompletable as T, DEFAULT_MAX_SUBSCRIPTIONS as _, seedClientIdentityFromEnvelope as a, InMemoryServerEventBus as b, findScopeChallenge as c, buildOAuthProtectedResourceMetadata as d, getOAuthProtectedResourceMetadataUrl as f, verifyBearerToken as g, requireBearerAuth as h, installModernOnlyHandlers as i, requireScopes as l, bearerAuthChallengeResponse as m, ResourceTemplate as n, serverIdentityOf as o, oauthMetadataResponse as p, Server as r, createScopeChallengeResponse as s, McpServer as t, scopeChallengeResourceMetadataUrl as u, StdioListenRouter as v, completable as w, createServerNotifier as x, createListenRouter as y };
-//# sourceMappingURL=mcp-DYuW2ZSs.mjs.map
+//# sourceMappingURL=mcp-DIH4cS6P.mjs.map