fastmcp 4.23.7 → 4.23.8

package/dist/{chunk-MPFPOZ2H.cjs → chunk-T2F3RYH2.cjs}

@@ -1,9 +1,15 @@
 "use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }// src/strictInputSchema.ts
 var _zod2 = require('zod');
+function objectRootSchema(schema) {
+  return schema.type === void 0 ? { ...schema, type: "object" } : schema;
+}
 function strictInputSchema(schema, nested = false) {
-  const { additionalProperties, properties } = schema;
+  const { additionalProperties, anyOf, oneOf, properties } = schema;
+  if (!nested && !properties && (anyOf || oneOf)) {
+    return objectRootSchema(schema);
+  }
   const keepsAdditionalProperties = Object.keys(_nullishCoalesce(properties, () => ( {}))).length === 0 && (typeof additionalProperties === "object" || additionalProperties === true || nested && additionalProperties === void 0 && !properties);
-  return {
+  const strict = {
     ...schema,
     ...keepsAdditionalProperties ? {} : { additionalProperties: false },
     ...properties && {
@@ -15,6 +21,7 @@ function strictInputSchema(schema, nested = false) {
       )
     }
   };
+  return nested ? strict : objectRootSchema(strict);
 }
 function zodInputSchema(schema, target) {
   return _zod2.z.toJSONSchema(schema, {
@@ -32,5 +39,6 @@ function zodInputSchema(schema, target) {
 
 
 
-exports.strictInputSchema = strictInputSchema; exports.zodInputSchema = zodInputSchema;
-//# sourceMappingURL=chunk-MPFPOZ2H.cjs.map
+
+exports.objectRootSchema = objectRootSchema; exports.strictInputSchema = strictInputSchema; exports.zodInputSchema = zodInputSchema;
+//# sourceMappingURL=chunk-T2F3RYH2.cjs.map

package/dist/chunk-T2F3RYH2.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["/home/runner/work/fastmcp/fastmcp/dist/chunk-T2F3RYH2.cjs","../src/strictInputSchema.ts"],"names":[],"mappings":"AAAA;ACEA,2BAAkB;AAUX,SAAS,gBAAA,CAAiB,MAAA,EAAgC;AAC/D,EAAA,OAAO,MAAA,CAAO,KAAA,IAAS,KAAA,EAAA,EAAY,EAAE,GAAG,MAAA,EAAQ,IAAA,EAAM,SAAS,EAAA,EAAI,MAAA;AACrE;AA2BO,SAAS,iBAAA,CACd,MAAA,EACA,OAAA,EAAS,KAAA,EACG;AACZ,EAAA,MAAM,EAAE,oBAAA,EAAsB,KAAA,EAAO,KAAA,EAAO,WAAW,EAAA,EAAI,MAAA;AAE3D,EAAA,GAAA,CAAI,CAAC,OAAA,GAAU,CAAC,WAAA,GAAA,CAAe,MAAA,GAAS,KAAA,CAAA,EAAQ;AAC9C,IAAA,OAAO,gBAAA,CAAiB,MAAM,CAAA;AAAA,EAChC;AAEA,EAAA,MAAM,0BAAA,EACJ,MAAA,CAAO,IAAA,kBAAK,UAAA,UAAc,CAAC,GAAC,CAAA,CAAE,OAAA,IAAW,EAAA,GAAA,CACxC,OAAO,qBAAA,IAAyB,SAAA,GAC/B,qBAAA,IAAyB,KAAA,GACxB,OAAA,GAAU,qBAAA,IAAyB,KAAA,EAAA,GAAa,CAAC,UAAA,CAAA;AAEtD,EAAA,MAAM,OAAA,EAAS;AAAA,IACb,GAAG,MAAA;AAAA,IACH,GAAI,0BAAA,EAA4B,CAAC,EAAA,EAAI,EAAE,oBAAA,EAAsB,MAAM,CAAA;AAAA,IACnE,GAAI,WAAA,GAAc;AAAA,MAChB,UAAA,EAAY,MAAA,CAAO,WAAA;AAAA,QACjB,MAAA,CAAO,OAAA,CAAQ,UAAU,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,KAAK,CAAA,EAAA,GAAM;AAAA,UAC/C,GAAA;AAAA,UACA,OAAO,MAAA,IAAU,SAAA,GAAY,KAAA,CAAM,KAAA,IAAS,SAAA,EACxC,iBAAA,CAAkB,KAAA,EAAO,IAAI,EAAA,EAC7B;AAAA,QACN,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO,OAAA,EAAS,OAAA,EAAS,gBAAA,CAAiB,MAAM,CAAA;AAClD;AAWO,SAAS,cAAA,CACd,MAAA,EACA,MAAA,EACY;AACZ,EAAA,OAAO,OAAA,CAAE,YAAA,CAAa,MAAA,EAAQ;AAAA,IAC5B,EAAA,EAAI,OAAA;AAAA,IACJ,QAAA,EAAU,CAAC,EAAE,UAAA,EAAY,UAAU,CAAA,EAAA,GAAM;AACvC,MAAA,MAAM,IAAA,EAAM,SAAA,CAAU,IAAA,CAAK,GAAA;AAC3B,MAAA,GAAA,CACE,GAAA,CAAI,KAAA,IAAS,SAAA,GACb,CAAC,GAAA,CAAI,SAAA,GACL,UAAA,CAAW,qBAAA,IAAyB,KAAA,CAAA,EACpC;AACA,QAAA,UAAA,CAAW,qBAAA,EAAuB,KAAA;AAAA,MACpC;AAAA,IACF,CAAA;AAAA,IACA;AAAA,EACF,CAAC,CAAA;AACH;ADjEA;AACA;AACE;AACA;AACA;AACF,oIAAC","file":"/home/runner/work/fastmcp/fastmcp/dist/chunk-T2F3RYH2.cjs","sourcesContent":[null,"import type { JsonSchema } from \"xsschema\";\n\nimport { z } from \"zod\";\n\n/**\n * Gives a tool's input or output schema the `type: \"object\"` MCP requires at\n * its root, unless it states a type of its own. A union of objects converts to\n * a bare `anyOf` or `oneOf`, and the SDK client rejects a whole `tools/list`\n * that contains one, so a single such tool would hide every other. Arguments\n * and structured content are always objects, so this only rules out values a\n * tool can never be sent or return.\n */\nexport function objectRootSchema(schema: JsonSchema): JsonSchema {\n  return schema.type === undefined ? { ...schema, type: \"object\" } : schema;\n}\n\n/**\n * Closes tool input objects to undeclared keys, like xsschema's\n * `strictJsonSchema`, except for objects made only of additional properties.\n * Closing one of those advertises an object that accepts nothing but `{}`,\n * while the tool's own validation still takes any key, so it keeps whatever\n * `additionalProperties` it declared — or none:\n *\n * - a dictionary, whose `additionalProperties` is a schema (`z.record()`, an\n *   OpenAPI map), keeps its value schema;\n * - a free-form object, which declares `additionalProperties: true`, or, as an\n *   argument, is a bare `{ type: \"object\" }` (OpenAPI's usual spelling), stays\n *   open.\n *\n * An object that declares an empty `properties`, or a bare one at the top of\n * the input, is still closed: that is how a schema says \"no keys\" —\n * `z.object({})`, or a tool without arguments. A union at the top, though —\n * `anyOf` or `oneOf` with no `properties` of its own — is left as it is: its\n * branches declare its keys, and how strict they are, so closing the root\n * would reject every one of them.\n *\n * The root is given an object type (see `objectRootSchema`).\n *\n * Shared by both runtimes, so a tool's advertised input schema does not depend\n * on whether it is served by `FastMCP` or `EdgeFastMCP`.\n */\nexport function strictInputSchema(\n  schema: JsonSchema,\n  nested = false,\n): JsonSchema {\n  const { additionalProperties, anyOf, oneOf, properties } = schema;\n\n  if (!nested && !properties && (anyOf || oneOf)) {\n    return objectRootSchema(schema);\n  }\n\n  const keepsAdditionalProperties =\n    Object.keys(properties ?? {}).length === 0 &&\n    (typeof additionalProperties === \"object\" ||\n      additionalProperties === true ||\n      (nested && additionalProperties === undefined && !properties));\n\n  const strict = {\n    ...schema,\n    ...(keepsAdditionalProperties ? {} : { additionalProperties: false }),\n    ...(properties && {\n      properties: Object.fromEntries(\n        Object.entries(properties).map(([key, value]) => [\n          key,\n          typeof value === \"object\" && value.type === \"object\"\n            ? strictInputSchema(value, true)\n            : value,\n        ]),\n      ),\n    }),\n  };\n\n  return nested ? strict : objectRootSchema(strict);\n}\n\n/**\n * Converts Zod 4 tool parameters by what a call may send (`io: \"input\"`), so a\n * transformed field advertises the type it parses and a defaulted one is\n * optional. Input-side conversion leaves a plain `z.object()` open, since it\n * strips undeclared keys rather than rejecting them; this closes it, as\n * output-side conversion did, at any depth — including inside arrays, unions\n * and record values, which `strictInputSchema` does not reach. Explicit\n * catchalls (`z.looseObject()`, `.catchall()`) keep what they declare.\n */\nexport function zodInputSchema(\n  schema: z.ZodType,\n  target?: \"draft-7\",\n): JsonSchema {\n  return z.toJSONSchema(schema, {\n    io: \"input\",\n    override: ({ jsonSchema, zodSchema }) => {\n      const def = zodSchema._zod.def;\n      if (\n        def.type === \"object\" &&\n        !def.catchall &&\n        jsonSchema.additionalProperties === undefined\n      ) {\n        jsonSchema.additionalProperties = false;\n      }\n    },\n    target,\n  }) as JsonSchema;\n}\n"]}

package/dist/{chunk-CA2EPNZF.js → chunk-UY253ACS.js}

@@ -395,14 +395,18 @@ function expandIPv6(host) {
   return groups.every((g) => !Number.isNaN(g)) ? groups : null;
 }
 function isPrivateOrLoopbackHost(hostname) {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
-  if (host === "localhost" || host === "0.0.0.0") {
+  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+  if (host === "localhost" || host.endsWith(".localhost")) {
     return true;
   }
   if (host.includes(":")) {
     return isPrivateOrLoopbackIPv6(host);
   }
-  return host === "127.0.0.1" || /^169\.254\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+  return /^0\./.test(host) || // 0.0.0.0/8, "this network"
+  /^127\./.test(host) || // 127.0.0.0/8, all of it loopback
+  // 100.64.0.0/10, shared (CGNAT) space — Alibaba Cloud's metadata
+  // endpoint is 100.100.100.200.
+  /^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(host) || /^169\.254\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
 }
 function isPrivateOrLoopbackIPv6(host) {
   const groups = expandIPv6(host);
@@ -3142,4 +3146,4 @@ export {
   DiskStore,
   JWKSVerifier
 };
-//# sourceMappingURL=chunk-CA2EPNZF.js.map
+//# sourceMappingURL=chunk-UY253ACS.js.map