deadbyte-mcp 0.15.48 → 0.15.50

package/node_modules/@modelcontextprotocol/server/dist/index.cjs

@@ -1,6 +1,6 @@
 const require_chunk = require('./chunk-Bnu9O96Y.cjs');
-const require_mcp = require('./mcp-DUcCQSTW.cjs');
-const require_src = require('./src-CgFsfg3E.cjs');
+const require_mcp = require('./mcp-BumlNux0.cjs');
+const require_src = require('./src-BhnGYybN.cjs');
 let _modelcontextprotocol_server__shims = require("@modelcontextprotocol/server/_shims");
 let _modelcontextprotocol_core_internal = require("@modelcontextprotocol/core/internal");
 
@@ -341,6 +341,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * @example Hono.js
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_hono"
 * app.all('/mcp', async c => {
+*     // Stateless example: create a server and a transport per request.
+*     const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*     const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*     await server.connect(transport);
 *     return transport.handleRequest(c.req.raw);
 * });
 * ```
@@ -349,6 +353,10 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 * ```ts source="./streamableHttp.examples.ts#WebStandardStreamableHTTPServerTransport_workers"
 * const worker = {
 *     async fetch(request: Request): Promise<Response> {
+*         // Stateless example: create a server and a transport per request.
+*         const server = new McpServer({ name: 'my-server', version: '1.0.0' });
+*         const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+*         await server.connect(transport);
 *         return transport.handleRequest(request);
 *     }
 * };
@@ -357,6 +365,7 @@ async function readRequestBody(request, maxBytes = DEFAULT_MAX_REQUEST_BODY_SIZE
 var WebStandardStreamableHTTPServerTransport = class {
 	sessionIdGenerator;
 	_started = false;
+	_hasHandledRequest = false;
 	_closed = false;
 	_streamMapping = /* @__PURE__ */ new Map();
 	_requestToStreamMapping = /* @__PURE__ */ new Map();
@@ -478,6 +487,8 @@ var WebStandardStreamableHTTPServerTransport = class {
 	*/
 	async handleRequest(req, options) {
 		if (this._closed) return this.createJsonErrorResponse(404, -32001, "Session not found");
+		if (!this.sessionIdGenerator && this._hasHandledRequest) throw new Error("Stateless transport cannot be reused across requests. Create a new transport per request.");
+		this._hasHandledRequest = true;
 		const validationError = this.validateRequestHeaders(req);
 		if (validationError) return validationError;
 		switch (req.method) {
@@ -1029,6 +1040,10 @@ function toError(value) {
 function internalServerErrorResponse(id = null) {
 	return jsonRpcErrorResponse(500, -32603, "Internal server error", void 0, id);
 }
+/** Throws when the factory returned an instance that is still connected to another exchange. */
+function assertNotServing(server) {
+	if (server.transport !== void 0) throw new Error("The factory returned an instance that is still serving another request. Return a new instance for each request.");
+}
 /**
 * The entry's default legacy serving (`legacy: 'stateless'`): per-request
 * stateless serving of 2025-era traffic using the same factory as the modern
@@ -1367,6 +1382,7 @@ function createMcpHandler(factory, options = {}) {
 			requestInfo: request
 		});
 		const server = product instanceof require_mcp.McpServer ? product.server : product;
+		assertNotServing(server);
 		if (route.messageKind === "request" && route.message.method === "subscriptions/listen") {
 			const capabilities = server.getCapabilities();
 			const serverInfo = require_mcp.serverIdentityOf(server);
@@ -1400,6 +1416,7 @@ function createMcpHandler(factory, options = {}) {
 			reportError(toError(error));
 			return internalServerErrorResponse(route.message.id);
 		}
+		assertNotServing(server);
 		require_src.setNegotiatedProtocolVersion(server, claimedRevision);
 		require_mcp.installModernOnlyHandlers(server, require_src.SUPPORTED_MODERN_PROTOCOL_VERSIONS);
 		if (meta !== void 0) require_mcp.seedClientIdentityFromEnvelope(server, {
@@ -1408,10 +1425,12 @@ function createMcpHandler(factory, options = {}) {
 		});
 		const previousOnClose = server.onclose;
 		inflight.add(server);
-		server.onclose = () => {
+		const onExchangeClose = () => {
 			inflight.delete(server);
+			if (server.onclose === onExchangeClose) server.onclose = previousOnClose;
 			previousOnClose?.();
 		};
+		server.onclose = onExchangeClose;
 		try {
 			const response = await invoke(product, route.message, {
 				classification: route.classification,
@@ -1569,14 +1588,22 @@ function hostHeaderValidationResponse(req, allowedHostnames) {
 *   and only browser-originated requests carry the header this check defends against.
 * - Allowlist items are hostnames only (no scheme, no port), the same convention as
 *   `validateHostHeader`. For IPv6, include brackets (e.g. `[::1]`).
+* - A browser extension's origin carries its extension ID as the hostname; list the
+*   ID to allow one extension. An allowlist item of the form `<scheme>://*`
+*   (lowercase, e.g. `moz-extension://*`) allows every origin of that scheme, which
+*   Firefox needs because its extension IDs differ on every install.
+*   `http://*` and `https://*` are not honoured: list websites by hostname.
 * - Any present value that cannot be parsed as an origin URL — including the literal
 *   `null` origin browsers send for opaque contexts — is rejected (deny on failure).
 */
 function validateOriginHeader(originHeader, allowedOriginHostnames) {
 	if (originHeader === null || originHeader === void 0 || originHeader === "") return { ok: true };
 	let hostname;
+	let scheme;
 	try {
-		hostname = new URL(originHeader).hostname;
+		const url = new URL(originHeader);
+		hostname = url.hostname;
+		scheme = url.protocol;
 	} catch {
 		return {
 			ok: false,
@@ -1591,7 +1618,7 @@ function validateOriginHeader(originHeader, allowedOriginHostnames) {
 		message: `Invalid Origin header: ${originHeader}`,
 		originHeader
 	};
-	if (!allowedOriginHostnames.includes(hostname)) return {
+	if (!(scheme !== "http:" && scheme !== "https:" && allowedOriginHostnames.includes(`${scheme}//*`)) && !allowedOriginHostnames.includes(hostname)) return {
 		ok: false,
 		errorCode: "invalid_origin",
 		message: `Invalid Origin: ${hostname}`,