mcp-use 2.0.0-beta.2 → 2.0.0-beta.5

package/dist/index.js

@@ -1,3 +1,10 @@
+import {
+  hasExplicitAssetsBase,
+  originFromAssetsBase,
+  resolveAssetsBase,
+  resolveServerOrigin,
+  synthesizeViewDocument
+} from "./chunk-VV2P4ZFZ.js";
 import {
   authInfoFromRequest,
   composeFetch,
@@ -228,6 +235,22 @@ var DEFAULT_INSPECTOR_ASSETS_URL = `https://cdn.jsdelivr.net/npm/@mcp-use/inspec
 function inspectorStylesUrl(assetsUrl) {
   return assetsUrl.replace(/\.js(?=$|[?#])/, ".css");
 }
+function isDefaultJsdelivrInspectorUrl(url) {
+  return url.startsWith("https://cdn.jsdelivr.net/npm/@mcp-use/inspector@");
+}
+function withInspectorCacheBust(assetsUrl) {
+  if (!isDefaultJsdelivrInspectorUrl(assetsUrl)) return assetsUrl;
+  const sep = assetsUrl.includes("?") ? "&" : "?";
+  return `${assetsUrl}${sep}cb=${crypto.randomUUID()}`;
+}
+function matchesInspectorShellPath(pathname, basePath) {
+  const prefix = `${basePath}/inspector`;
+  if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) {
+    return false;
+  }
+  const suffix = pathname.slice(prefix.length);
+  return suffix !== "/api" && !suffix.startsWith("/api/");
+}
 function escapeHtml(value) {
   return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&#39;");
 }
@@ -238,7 +261,8 @@ function renderInspectorShell(options) {
   const { serverName, basePath, assetsUrl, manufactChatUrl } = options;
   const serializedBasePath = serializeForInlineScript(basePath);
   const serializedManufactChatUrl = manufactChatUrl ? serializeForInlineScript(manufactChatUrl) : null;
-  const bundleUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
+  const rawUrl = assetsUrl ?? DEFAULT_INSPECTOR_ASSETS_URL;
+  const bundleUrl = withInspectorCacheBust(rawUrl);
   const scriptSrc = escapeHtml(bundleUrl);
   const stylesHref = escapeHtml(inspectorStylesUrl(bundleUrl));
   return `<!doctype html>
@@ -304,22 +328,21 @@ function createInspectorHandler(inspector, options) {
   const { assetsUrl: configAssetsUrl, manufactChatUrl: configManufactChatUrl } = inspector ?? {};
   const assetsUrl = configAssetsUrl ?? process.env["MCP_USE_INSPECTOR_ASSETS_URL"] ?? void 0;
   const manufactChatUrl = configManufactChatUrl ?? process.env["MANUFACT_CHAT_URL"] ?? void 0;
-  const html = renderInspectorShell({
+  const shellOptions = {
     serverName: options.serverName,
     basePath: options.basePath,
     assetsUrl,
     manufactChatUrl
-  });
-  const path = `${options.basePath}/inspector`;
-  const slashPath = `${path}/`;
+  };
   return async (request) => {
     if (request.method !== "GET" && request.method !== "HEAD") {
       return new Response("Method Not Allowed", { status: 405 });
     }
     const pathname = new URL(request.url).pathname;
-    if (pathname !== path && pathname !== slashPath) {
+    if (!matchesInspectorShellPath(pathname, options.basePath)) {
       return new Response("Not Found", { status: 404 });
     }
+    const html = renderInspectorShell(shellOptions);
     return new Response(request.method === "HEAD" ? null : html, {
       status: 200,
       headers: { "content-type": "text/html; charset=utf-8" }
@@ -709,9 +732,6 @@ function createMcpMount(factory, options = {}) {
   };
   return { handler, fetch };
 }
-function mountMcp(factory, options = {}) {
-  return createMcpMount(factory, options);
-}
 
 // src/tools.ts
 function resolveToolInputSchema(definition) {
@@ -721,112 +741,140 @@ function resolveToolInputSchema(definition) {
 // src/views/register.ts
 var registerViews = /* @__PURE__ */ Symbol("mcp-use/registerViews");
 
-// src/views/document.ts
-function resolveAssetUrl(assetPath, origin) {
-  if (!assetPath.startsWith("/")) {
-    throw new Error(
-      `View manifest asset path must be origin-absolute (start with "/"); got ${JSON.stringify(assetPath)}`
-    );
+// src/views/csp-env.ts
+var CATEGORY_ENV = {
+  connectDomains: "CSP_CONNECT_DOMAINS",
+  resourceDomains: "CSP_RESOURCE_DOMAINS",
+  frameDomains: "CSP_FRAME_DOMAINS",
+  baseUriDomains: "CSP_BASE_URI_DOMAINS"
+};
+function parseDomainList(raw) {
+  if (raw === void 0 || raw.trim() === "") {
+    return [];
   }
-  return `${origin}${assetPath}`;
-}
-function resolvePublicBase(origin, basePath) {
-  return `${origin}${basePath}/_mcp-use/public/`;
+  return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 }
-function escapeInlineScript(code) {
-  return code.replaceAll(/<\/script/gi, "<\\/script").replaceAll("<!--", "\\x3C!--");
-}
-function escapeInlineStyle(css) {
-  return css.replaceAll(/<\/style/gi, "<\\/style");
+function readEnvDomains(name) {
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  const raw = process.env[name];
+  if (raw === void 0 || raw.trim() === "") {
+    return void 0;
+  }
+  return parseDomainList(raw);
 }
-function escapeHtml2(value) {
-  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+function readCspUrlsShortcut() {
+  return readEnvDomains("CSP_URLS") ?? [];
 }
-function synthesizeViewDocument(entry, origin, basePath) {
-  const viewConfig = {
-    publicBase: resolvePublicBase(origin, basePath)
-  };
-  const configScript = `<script>globalThis.__mcpUseViewConfig=${JSON.stringify(viewConfig)};</script>`;
-  if (entry.kind === "inline") {
-    const styleTag = entry.css.length > 0 ? `<style>${escapeInlineStyle(entry.css)}</style>` : "";
-    const moduleScript = `<script type="module">${escapeInlineScript(entry.js)}</script>`;
-    return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-${configScript}
-${styleTag}
-</head>
-<body>
-<div id="root"></div>
-${moduleScript}
-</body>
-</html>`;
-  }
-  const cssLinks = entry.css.map(
-    (path) => `<link rel="stylesheet" href="${escapeHtml2(resolveAssetUrl(path, origin))}">`
-  ).join("\n");
-  const scriptTags = (entry.scripts ?? []).map(
-    (path) => `<script type="module" src="${escapeHtml2(resolveAssetUrl(path, origin))}"></script>`
-  ).join("\n");
-  const entryUrl = resolveAssetUrl(entry.entry, origin);
-  return `<!doctype html>
-<html>
-<head>
-<meta charset="utf-8">
-${configScript}
-${cssLinks}
-</head>
-<body>
-<div id="root"></div>
-${scriptTags}
-<script type="module" src="${escapeHtml2(entryUrl)}"></script>
-</body>
-</html>`;
+function readEnvDomainsForCategory(category) {
+  const perCategory = readEnvDomains(CATEGORY_ENV[category]);
+  if (perCategory !== void 0) {
+    return perCategory;
+  }
+  return readCspUrlsShortcut();
 }
-
-// src/views/origin.ts
-function resolveRequestOrigin(request) {
-  const forwarded = request.headers.get("forwarded");
-  if (forwarded !== null) {
-    const fromForwarded = parseForwardedHeader(forwarded);
-    if (fromForwarded !== void 0) {
-      return fromForwarded;
+function mergeDomainLists(...segments) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const segment of segments) {
+    for (const domain of segment) {
+      if (!seen.has(domain)) {
+        seen.add(domain);
+        out.push(domain);
+      }
     }
   }
-  const proto = request.headers.get("x-forwarded-proto");
-  const host = request.headers.get("x-forwarded-host");
-  if (proto !== null && host !== null) {
-    const firstHost = host.split(",")[0]?.trim();
-    const firstProto = proto.split(",")[0]?.trim();
-    if (firstHost !== void 0 && firstProto !== void 0 && firstHost !== "") {
-      return `${firstProto}://${firstHost}`;
-    }
+  return out;
+}
+function toWebSocketOrigin(serverOrigin) {
+  if (serverOrigin.startsWith("https://")) {
+    return `wss://${serverOrigin.slice("https://".length)}`;
+  }
+  if (serverOrigin.startsWith("http://")) {
+    return `ws://${serverOrigin.slice("http://".length)}`;
   }
-  return new URL(request.url).origin;
+  return serverOrigin;
 }
-function parseForwardedHeader(header) {
-  for (const part of header.split(",")) {
-    const params = /* @__PURE__ */ new Map();
-    for (const token of part.split(";")) {
-      const [key, ...rest] = token.trim().split("=");
-      if (key === void 0 || rest.length === 0) {
-        continue;
-      }
-      params.set(key.toLowerCase(), rest.join("=").replace(/^"|"$/g, ""));
-    }
-    const proto = params.get("proto");
-    const host = params.get("host");
-    if (proto !== void 0 && host !== void 0) {
-      return `${proto}://${host}`;
+function buildMergedResourceCsp(authorFacts, options) {
+  const author = authorFacts?.csp;
+  const mcpConnectAuto = [];
+  if (options.serverOrigin !== "") {
+    mcpConnectAuto.push(options.serverOrigin);
+    if (options.hmrWs === true) {
+      mcpConnectAuto.push(toWebSocketOrigin(options.serverOrigin));
     }
   }
-  return void 0;
+  const mcpResourceAuto = [];
+  const resourceOrigin = options.explicitAssetsBase ? options.assetsOrigin : options.serverOrigin;
+  if (resourceOrigin !== "") {
+    mcpResourceAuto.push(resourceOrigin);
+  }
+  const connectDomains = mergeDomainLists(
+    author?.connectDomains ?? [],
+    readEnvDomainsForCategory("connectDomains"),
+    mcpConnectAuto
+  );
+  const resourceDomains = mergeDomainLists(
+    author?.resourceDomains ?? [],
+    readEnvDomainsForCategory("resourceDomains"),
+    mcpResourceAuto
+  );
+  const frameDomains = mergeDomainLists(
+    author?.frameDomains ?? [],
+    readEnvDomainsForCategory("frameDomains")
+  );
+  const baseUriDomains = mergeDomainLists(
+    author?.baseUriDomains ?? [],
+    readEnvDomainsForCategory("baseUriDomains")
+  );
+  return {
+    ...author,
+    connectDomains,
+    resourceDomains,
+    frameDomains,
+    baseUriDomains
+  };
 }
 
 // src/views/routes.ts
 var PUBLIC_BUILD_DIR = ".mcp-use/build/views/public";
 var PUBLIC_DEV_DIR = "public";
+var VIEW_ASSETS_BUILD_ROOT = ".mcp-use/build/views";
+function createViewAssetsHandler(basePath, views, options) {
+  if (views.size === 0) {
+    return void 0;
+  }
+  const assetsPrefix = `${basePath}/_mcp-use/views`;
+  const projectRoot = options?.projectRoot ?? process.cwd();
+  return async (request) => {
+    if (request.method !== "GET" && request.method !== "HEAD") {
+      return new Response("Method Not Allowed", { status: 405 });
+    }
+    if (!matchesPathPrefix(request, assetsPrefix)) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const pathname = pathnameOf(request);
+    const remainder = pathname.slice(assetsPrefix.length + 1);
+    const slash = remainder.indexOf("/");
+    if (slash <= 0 || slash === remainder.length - 1) {
+      return new Response("Not Found", { status: 404 });
+    }
+    const viewName = remainder.slice(0, slash);
+    const subpath = remainder.slice(slash + 1);
+    const entry = views.get(viewName);
+    if (entry === void 0 || entry.kind !== "external") {
+      return new Response("Not Found", { status: 404 });
+    }
+    const [{ join }, { resolvePublicFilePath, servePublicFile }] = await Promise.all([import("path"), import("./public-route-7IK5D7V7.js")]);
+    const viewRoot = join(projectRoot, VIEW_ASSETS_BUILD_ROOT, viewName);
+    const diskPath = await resolvePublicFilePath(viewRoot, subpath);
+    if (diskPath === null) {
+      return new Response("Not Found", { status: 404 });
+    }
+    return await servePublicFile(diskPath);
+  };
+}
 function createViewPublicHandler(basePath, views, options) {
   if (views.size === 0) {
     return void 0;
@@ -880,36 +928,20 @@ function buildToolResultUiMeta(viewName) {
     [UI_RESOURCE_URI_META_KEY]: resourceUri
   };
 }
-function toWebSocketOrigin(servingOrigin) {
-  if (servingOrigin.startsWith("https://")) {
-    return `wss://${servingOrigin.slice("https://".length)}`;
-  }
-  if (servingOrigin.startsWith("http://")) {
-    return `ws://${servingOrigin.slice("http://".length)}`;
-  }
-  return servingOrigin;
-}
-function buildResourceUiMeta(authorFacts, servingOrigin, options) {
-  const authorResourceDomains = authorFacts?.csp?.resourceDomains ?? [];
-  const resourceDomains = [
-    ...authorResourceDomains,
-    ...servingOrigin !== "" ? [servingOrigin] : []
-  ];
-  const authorConnectDomains = authorFacts?.csp?.connectDomains ?? [];
-  const connectDomains = [...authorConnectDomains];
-  if (options?.hmrWs === true && servingOrigin !== "") {
-    const wsOrigin = toWebSocketOrigin(servingOrigin);
-    if (!connectDomains.includes(wsOrigin)) {
-      connectDomains.push(wsOrigin);
-    }
-  }
-  const ui = {
-    csp: {
-      ...authorFacts?.csp,
-      connectDomains,
-      resourceDomains
-    }
+function resolveCspOptions(options) {
+  const request = options?.request;
+  const serverOrigin = options?.serverOrigin ?? (request !== void 0 ? resolveServerOrigin(request) : "");
+  const assetsBase = options?.assetsBase ?? (request !== void 0 ? resolveAssetsBase(request) : serverOrigin);
+  return {
+    serverOrigin,
+    assetsOrigin: originFromAssetsBase(assetsBase),
+    explicitAssetsBase: hasExplicitAssetsBase(),
+    ...options?.hmrWs === true ? { hmrWs: true } : {}
   };
+}
+function buildResourceUiMeta(authorFacts, options) {
+  const csp = buildMergedResourceCsp(authorFacts, resolveCspOptions(options));
+  const ui = { csp };
   if (authorFacts?.permissions !== void 0) {
     ui["permissions"] = authorFacts.permissions;
   }
@@ -921,13 +953,13 @@ function buildResourceUiMeta(authorFacts, servingOrigin, options) {
   }
   return { [UI_META_KEY]: ui };
 }
-function viewResourceConfig(_viewName, _entry, authorFacts, servingOrigin, options) {
+function viewResourceConfig(_viewName, _entry, authorFacts, options) {
   return {
     mimeType: UI_MIME_TYPE,
     ...authorFacts?.description !== void 0 && {
       description: authorFacts.description
     },
-    _meta: buildResourceUiMeta(authorFacts, servingOrigin, options)
+    _meta: buildResourceUiMeta(authorFacts, options)
   };
 }
 
@@ -1423,6 +1455,21 @@ var MCPServer = class _MCPServer {
           handler: viewHandler
         });
       }
+      if (!this.#viewsDevMode) {
+        const viewAssetsHandler = createViewAssetsHandler(
+          basePath,
+          this.#views,
+          { projectRoot: this.#viewsProjectRoot }
+        );
+        if (viewAssetsHandler !== void 0) {
+          routes.push({
+            match: (request) => request.method === "GET" || request.method === "HEAD" ? new URL(request.url).pathname.startsWith(
+              `${basePath}/_mcp-use/views/`
+            ) : false,
+            handler: viewAssetsHandler
+          });
+        }
+      }
       const inspectorHandler = createInspectorHandler(this.#config.inspector, {
         serverName: this.#config.name,
         basePath
@@ -1434,7 +1481,7 @@ var MCPServer = class _MCPServer {
               return false;
             }
             const pathname = new URL(request.url).pathname;
-            return pathname === `${basePath}/inspector` || pathname === `${basePath}/inspector/`;
+            return matchesInspectorShellPath(pathname, basePath);
           },
           handler: inspectorHandler
         });
@@ -1530,7 +1577,7 @@ var MCPServer = class _MCPServer {
       }
     );
     const request = ctx.requestInfo;
-    const servingOrigin = request !== void 0 ? resolveRequestOrigin(request) : "";
+    const viewMetaOptions = request !== void 0 ? { request, hmrWs: this.#viewsDevMode } : { hmrWs: this.#viewsDevMode };
     const basePath = this.#basePath();
     for (const entry of this.#tools.values()) {
       this.#registerTool(server, entry);
@@ -1549,7 +1596,7 @@ var MCPServer = class _MCPServer {
         server,
         viewName,
         viewEntry,
-        servingOrigin,
+        viewMetaOptions,
         basePath
       );
     }
@@ -1602,18 +1649,16 @@ var MCPServer = class _MCPServer {
       });
     }
   }
-  #registerViewResource(server, viewName, entry, servingOrigin, basePath) {
+  #registerViewResource(server, viewName, entry, metaOptions, basePath) {
     const uri = viewResourceUri(viewName);
     const authorFacts = this.#viewResourceFacts(
       this.#viewBindings.get(viewName)?.config
     );
-    const hmrWs = this.#viewsDevMode;
     const resourceConfig = viewResourceConfig(
       viewName,
       entry,
       authorFacts,
-      servingOrigin,
-      { hmrWs }
+      metaOptions
     );
     server.registerResource(
       viewName,
@@ -1621,15 +1666,24 @@ var MCPServer = class _MCPServer {
       resourceConfig,
       async (readUri, ctx) => {
         const req = ctx.http?.req;
-        const origin = req !== void 0 ? resolveRequestOrigin(req) : servingOrigin;
-        const html = synthesizeViewDocument(entry, origin, basePath);
+        const readOptions = req !== void 0 ? {
+          request: req,
+          ...metaOptions.hmrWs === true ? { hmrWs: true } : {}
+        } : metaOptions.hmrWs === true ? { hmrWs: true } : {};
+        const assetsBase = req !== void 0 ? resolveAssetsBase(req) : metaOptions.request !== void 0 ? resolveAssetsBase(metaOptions.request) : "";
+        const html = synthesizeViewDocument(
+          entry,
+          assetsBase,
+          basePath,
+          viewName
+        );
         return {
           contents: [
             {
               uri: readUri.href,
               mimeType: resourceConfig.mimeType,
               text: html,
-              _meta: buildResourceUiMeta(authorFacts, origin, { hmrWs })
+              _meta: buildResourceUiMeta(authorFacts, readOptions)
             }
           ]
         };
@@ -1767,7 +1821,6 @@ export {
   jsonBodyMiddleware,
   matchesPath,
   matchesPathPrefix,
-  mountMcp,
   originValidationMiddleware,
   pathnameOf,
   registerViews,