panoma 0.1.9 → 0.9.0

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/providers/proxyProvider.d.ts

@@ -1,49 +0,0 @@
-import { Response } from 'express';
-import { OAuthRegisteredClientsStore } from '../clients.js';
-import { OAuthClientInformationFull, OAuthTokenRevocationRequest, OAuthTokens } from '../../../shared/auth.js';
-import { AuthInfo } from '../types.js';
-import { AuthorizationParams, OAuthServerProvider } from '../provider.js';
-import { FetchLike } from '../../../shared/transport.js';
-export type ProxyEndpoints = {
-    authorizationUrl: string;
-    tokenUrl: string;
-    revocationUrl?: string;
-    registrationUrl?: string;
-};
-export type ProxyOptions = {
-    /**
-     * Individual endpoint URLs for proxying specific OAuth operations
-     */
-    endpoints: ProxyEndpoints;
-    /**
-     * Function to verify access tokens and return auth info
-     */
-    verifyAccessToken: (token: string) => Promise<AuthInfo>;
-    /**
-     * Function to fetch client information from the upstream server
-     */
-    getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
-    /**
-     * Custom fetch implementation used for all network requests.
-     */
-    fetch?: FetchLike;
-};
-/**
- * Implements an OAuth server that proxies requests to another OAuth server.
- */
-export declare class ProxyOAuthServerProvider implements OAuthServerProvider {
-    protected readonly _endpoints: ProxyEndpoints;
-    protected readonly _verifyAccessToken: (token: string) => Promise<AuthInfo>;
-    protected readonly _getClient: (clientId: string) => Promise<OAuthClientInformationFull | undefined>;
-    protected readonly _fetch?: FetchLike;
-    skipLocalPkceValidation: boolean;
-    revokeToken?: (client: OAuthClientInformationFull, request: OAuthTokenRevocationRequest) => Promise<void>;
-    constructor(options: ProxyOptions);
-    get clientsStore(): OAuthRegisteredClientsStore;
-    authorize(client: OAuthClientInformationFull, params: AuthorizationParams, res: Response): Promise<void>;
-    challengeForAuthorizationCode(_client: OAuthClientInformationFull, _authorizationCode: string): Promise<string>;
-    exchangeAuthorizationCode(client: OAuthClientInformationFull, authorizationCode: string, codeVerifier?: string, redirectUri?: string, resource?: URL): Promise<OAuthTokens>;
-    exchangeRefreshToken(client: OAuthClientInformationFull, refreshToken: string, scopes?: string[], resource?: URL): Promise<OAuthTokens>;
-    verifyAccessToken(token: string): Promise<AuthInfo>;
-}
-//# sourceMappingURL=proxyProvider.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/providers/proxyProvider.js

@@ -1,159 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ProxyOAuthServerProvider = void 0;
-const auth_js_1 = require("../../../shared/auth.js");
-const errors_js_1 = require("../errors.js");
-/**
- * Implements an OAuth server that proxies requests to another OAuth server.
- */
-class ProxyOAuthServerProvider {
-    constructor(options) {
-        this.skipLocalPkceValidation = true;
-        this._endpoints = options.endpoints;
-        this._verifyAccessToken = options.verifyAccessToken;
-        this._getClient = options.getClient;
-        this._fetch = options.fetch;
-        if (options.endpoints?.revocationUrl) {
-            this.revokeToken = async (client, request) => {
-                const revocationUrl = this._endpoints.revocationUrl;
-                if (!revocationUrl) {
-                    throw new Error('No revocation endpoint configured');
-                }
-                const params = new URLSearchParams();
-                params.set('token', request.token);
-                params.set('client_id', client.client_id);
-                if (client.client_secret) {
-                    params.set('client_secret', client.client_secret);
-                }
-                if (request.token_type_hint) {
-                    params.set('token_type_hint', request.token_type_hint);
-                }
-                const response = await (this._fetch ?? fetch)(revocationUrl, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/x-www-form-urlencoded'
-                    },
-                    body: params.toString()
-                });
-                await response.body?.cancel();
-                if (!response.ok) {
-                    throw new errors_js_1.ServerError(`Token revocation failed: ${response.status}`);
-                }
-            };
-        }
-    }
-    get clientsStore() {
-        const registrationUrl = this._endpoints.registrationUrl;
-        return {
-            getClient: this._getClient,
-            ...(registrationUrl && {
-                registerClient: async (client) => {
-                    const response = await (this._fetch ?? fetch)(registrationUrl, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json'
-                        },
-                        body: JSON.stringify(client)
-                    });
-                    if (!response.ok) {
-                        await response.body?.cancel();
-                        throw new errors_js_1.ServerError(`Client registration failed: ${response.status}`);
-                    }
-                    const data = await response.json();
-                    return auth_js_1.OAuthClientInformationFullSchema.parse(data);
-                }
-            })
-        };
-    }
-    async authorize(client, params, res) {
-        // Start with required OAuth parameters
-        const targetUrl = new URL(this._endpoints.authorizationUrl);
-        const searchParams = new URLSearchParams({
-            client_id: client.client_id,
-            response_type: 'code',
-            redirect_uri: params.redirectUri,
-            code_challenge: params.codeChallenge,
-            code_challenge_method: 'S256'
-        });
-        // Add optional standard OAuth parameters
-        if (params.state)
-            searchParams.set('state', params.state);
-        if (params.scopes?.length)
-            searchParams.set('scope', params.scopes.join(' '));
-        if (params.resource)
-            searchParams.set('resource', params.resource.href);
-        targetUrl.search = searchParams.toString();
-        res.redirect(targetUrl.toString());
-    }
-    async challengeForAuthorizationCode(_client, _authorizationCode) {
-        // In a proxy setup, we don't store the code challenge ourselves
-        // Instead, we proxy the token request and let the upstream server validate it
-        return '';
-    }
-    async exchangeAuthorizationCode(client, authorizationCode, codeVerifier, redirectUri, resource) {
-        const params = new URLSearchParams({
-            grant_type: 'authorization_code',
-            client_id: client.client_id,
-            code: authorizationCode
-        });
-        if (client.client_secret) {
-            params.append('client_secret', client.client_secret);
-        }
-        if (codeVerifier) {
-            params.append('code_verifier', codeVerifier);
-        }
-        if (redirectUri) {
-            params.append('redirect_uri', redirectUri);
-        }
-        if (resource) {
-            params.append('resource', resource.href);
-        }
-        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded'
-            },
-            body: params.toString()
-        });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new errors_js_1.ServerError(`Token exchange failed: ${response.status}`);
-        }
-        const data = await response.json();
-        return auth_js_1.OAuthTokensSchema.parse(data);
-    }
-    async exchangeRefreshToken(client, refreshToken, scopes, resource) {
-        const params = new URLSearchParams({
-            grant_type: 'refresh_token',
-            client_id: client.client_id,
-            refresh_token: refreshToken
-        });
-        if (client.client_secret) {
-            params.set('client_secret', client.client_secret);
-        }
-        if (scopes?.length) {
-            params.set('scope', scopes.join(' '));
-        }
-        if (resource) {
-            params.set('resource', resource.href);
-        }
-        const response = await (this._fetch ?? fetch)(this._endpoints.tokenUrl, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded'
-            },
-            body: params.toString()
-        });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new errors_js_1.ServerError(`Token refresh failed: ${response.status}`);
-        }
-        const data = await response.json();
-        return auth_js_1.OAuthTokensSchema.parse(data);
-    }
-    async verifyAccessToken(token) {
-        return this._verifyAccessToken(token);
-    }
-}
-exports.ProxyOAuthServerProvider = ProxyOAuthServerProvider;
-//# sourceMappingURL=proxyProvider.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.d.ts

@@ -1,101 +0,0 @@
-import express, { RequestHandler } from 'express';
-import { ClientRegistrationHandlerOptions } from './handlers/register.js';
-import { TokenHandlerOptions } from './handlers/token.js';
-import { AuthorizationHandlerOptions } from './handlers/authorize.js';
-import { RevocationHandlerOptions } from './handlers/revoke.js';
-import { OAuthServerProvider } from './provider.js';
-import { OAuthMetadata } from '../../shared/auth.js';
-export type AuthRouterOptions = {
-    /**
-     * A provider implementing the actual authorization logic for this router.
-     */
-    provider: OAuthServerProvider;
-    /**
-     * The authorization server's issuer identifier, which is a URL that uses the "https" scheme and has no query or fragment components.
-     */
-    issuerUrl: URL;
-    /**
-     * The base URL of the authorization server to use for the metadata endpoints.
-     *
-     * If not provided, the issuer URL will be used as the base URL.
-     */
-    baseUrl?: URL;
-    /**
-     * An optional URL of a page containing human-readable information that developers might want or need to know when using the authorization server.
-     */
-    serviceDocumentationUrl?: URL;
-    /**
-     * An optional list of scopes supported by this authorization server
-     */
-    scopesSupported?: string[];
-    /**
-     * The resource name to be displayed in protected resource metadata
-     */
-    resourceName?: string;
-    /**
-     * The URL of the protected resource (RS) whose metadata we advertise.
-     * If not provided, falls back to `baseUrl` and then to `issuerUrl` (AS=RS).
-     */
-    resourceServerUrl?: URL;
-    authorizationOptions?: Omit<AuthorizationHandlerOptions, 'provider'>;
-    clientRegistrationOptions?: Omit<ClientRegistrationHandlerOptions, 'clientsStore'>;
-    revocationOptions?: Omit<RevocationHandlerOptions, 'provider'>;
-    tokenOptions?: Omit<TokenHandlerOptions, 'provider'>;
-};
-export declare const createOAuthMetadata: (options: {
-    provider: OAuthServerProvider;
-    issuerUrl: URL;
-    baseUrl?: URL;
-    serviceDocumentationUrl?: URL;
-    scopesSupported?: string[];
-}) => OAuthMetadata;
-/**
- * Installs standard MCP authorization server endpoints, including dynamic client registration and token revocation (if supported).
- * Also advertises standard authorization server metadata, for easier discovery of supported configurations by clients.
- * Note: if your MCP server is only a resource server and not an authorization server, use mcpAuthMetadataRouter instead.
- *
- * By default, rate limiting is applied to all endpoints to prevent abuse.
- *
- * This router MUST be installed at the application root, like so:
- *
- *  const app = express();
- *  app.use(mcpAuthRouter(...));
- */
-export declare function mcpAuthRouter(options: AuthRouterOptions): RequestHandler;
-export type AuthMetadataOptions = {
-    /**
-     * OAuth Metadata as would be returned from the authorization server
-     * this MCP server relies on
-     */
-    oauthMetadata: OAuthMetadata;
-    /**
-     * The url of the MCP server, for use in protected resource metadata
-     */
-    resourceServerUrl: URL;
-    /**
-     * The url for documentation for the MCP server
-     */
-    serviceDocumentationUrl?: URL;
-    /**
-     * An optional list of scopes supported by this MCP server
-     */
-    scopesSupported?: string[];
-    /**
-     * An optional resource name to display in resource metadata
-     */
-    resourceName?: string;
-};
-export declare function mcpAuthMetadataRouter(options: AuthMetadataOptions): express.Router;
-/**
- * Helper function to construct the OAuth 2.0 Protected Resource Metadata URL
- * from a given server URL. This replaces the path with the standard metadata endpoint.
- *
- * @param serverUrl - The base URL of the protected resource server
- * @returns The URL for the OAuth protected resource metadata endpoint
- *
- * @example
- * getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
- * // Returns: 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
- */
-export declare function getOAuthProtectedResourceMetadataUrl(serverUrl: URL): string;
-//# sourceMappingURL=router.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/router.js

@@ -1,128 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createOAuthMetadata = void 0;
-exports.mcpAuthRouter = mcpAuthRouter;
-exports.mcpAuthMetadataRouter = mcpAuthMetadataRouter;
-exports.getOAuthProtectedResourceMetadataUrl = getOAuthProtectedResourceMetadataUrl;
-const express_1 = __importDefault(require("express"));
-const register_js_1 = require("./handlers/register.js");
-const token_js_1 = require("./handlers/token.js");
-const authorize_js_1 = require("./handlers/authorize.js");
-const revoke_js_1 = require("./handlers/revoke.js");
-const metadata_js_1 = require("./handlers/metadata.js");
-// Check for dev mode flag that allows HTTP issuer URLs (for development/testing only)
-const allowInsecureIssuerUrl = process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === 'true' || process.env.MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL === '1';
-if (allowInsecureIssuerUrl) {
-    // eslint-disable-next-line no-console
-    console.warn('MCP_DANGEROUSLY_ALLOW_INSECURE_ISSUER_URL is enabled - HTTP issuer URLs are allowed. Do not use in production.');
-}
-const checkIssuerUrl = (issuer) => {
-    // Technically RFC 8414 does not permit a localhost HTTPS exemption, but this will be necessary for ease of testing
-    if (issuer.protocol !== 'https:' && issuer.hostname !== 'localhost' && issuer.hostname !== '127.0.0.1' && !allowInsecureIssuerUrl) {
-        throw new Error('Issuer URL must be HTTPS');
-    }
-    if (issuer.hash) {
-        throw new Error(`Issuer URL must not have a fragment: ${issuer}`);
-    }
-    if (issuer.search) {
-        throw new Error(`Issuer URL must not have a query string: ${issuer}`);
-    }
-};
-const createOAuthMetadata = (options) => {
-    const issuer = options.issuerUrl;
-    const baseUrl = options.baseUrl;
-    checkIssuerUrl(issuer);
-    const authorization_endpoint = '/authorize';
-    const token_endpoint = '/token';
-    const registration_endpoint = options.provider.clientsStore.registerClient ? '/register' : undefined;
-    const revocation_endpoint = options.provider.revokeToken ? '/revoke' : undefined;
-    const metadata = {
-        issuer: issuer.href,
-        service_documentation: options.serviceDocumentationUrl?.href,
-        authorization_endpoint: new URL(authorization_endpoint, baseUrl || issuer).href,
-        response_types_supported: ['code'],
-        code_challenge_methods_supported: ['S256'],
-        token_endpoint: new URL(token_endpoint, baseUrl || issuer).href,
-        token_endpoint_auth_methods_supported: ['client_secret_post', 'none'],
-        grant_types_supported: ['authorization_code', 'refresh_token'],
-        scopes_supported: options.scopesSupported,
-        revocation_endpoint: revocation_endpoint ? new URL(revocation_endpoint, baseUrl || issuer).href : undefined,
-        revocation_endpoint_auth_methods_supported: revocation_endpoint ? ['client_secret_post'] : undefined,
-        registration_endpoint: registration_endpoint ? new URL(registration_endpoint, baseUrl || issuer).href : undefined
-    };
-    return metadata;
-};
-exports.createOAuthMetadata = createOAuthMetadata;
-/**
- * Installs standard MCP authorization server endpoints, including dynamic client registration and token revocation (if supported).
- * Also advertises standard authorization server metadata, for easier discovery of supported configurations by clients.
- * Note: if your MCP server is only a resource server and not an authorization server, use mcpAuthMetadataRouter instead.
- *
- * By default, rate limiting is applied to all endpoints to prevent abuse.
- *
- * This router MUST be installed at the application root, like so:
- *
- *  const app = express();
- *  app.use(mcpAuthRouter(...));
- */
-function mcpAuthRouter(options) {
-    const oauthMetadata = (0, exports.createOAuthMetadata)(options);
-    const router = express_1.default.Router();
-    router.use(new URL(oauthMetadata.authorization_endpoint).pathname, (0, authorize_js_1.authorizationHandler)({ provider: options.provider, ...options.authorizationOptions }));
-    router.use(new URL(oauthMetadata.token_endpoint).pathname, (0, token_js_1.tokenHandler)({ provider: options.provider, ...options.tokenOptions }));
-    router.use(mcpAuthMetadataRouter({
-        oauthMetadata,
-        // Prefer explicit RS; otherwise fall back to AS baseUrl, then to issuer (back-compat)
-        resourceServerUrl: options.resourceServerUrl ?? options.baseUrl ?? new URL(oauthMetadata.issuer),
-        serviceDocumentationUrl: options.serviceDocumentationUrl,
-        scopesSupported: options.scopesSupported,
-        resourceName: options.resourceName
-    }));
-    if (oauthMetadata.registration_endpoint) {
-        router.use(new URL(oauthMetadata.registration_endpoint).pathname, (0, register_js_1.clientRegistrationHandler)({
-            clientsStore: options.provider.clientsStore,
-            ...options.clientRegistrationOptions
-        }));
-    }
-    if (oauthMetadata.revocation_endpoint) {
-        router.use(new URL(oauthMetadata.revocation_endpoint).pathname, (0, revoke_js_1.revocationHandler)({ provider: options.provider, ...options.revocationOptions }));
-    }
-    return router;
-}
-function mcpAuthMetadataRouter(options) {
-    checkIssuerUrl(new URL(options.oauthMetadata.issuer));
-    const router = express_1.default.Router();
-    const protectedResourceMetadata = {
-        resource: options.resourceServerUrl.href,
-        authorization_servers: [options.oauthMetadata.issuer],
-        scopes_supported: options.scopesSupported,
-        resource_name: options.resourceName,
-        resource_documentation: options.serviceDocumentationUrl?.href
-    };
-    // Serve PRM at the path-specific URL per RFC 9728
-    const rsPath = new URL(options.resourceServerUrl.href).pathname;
-    router.use(`/.well-known/oauth-protected-resource${rsPath === '/' ? '' : rsPath}`, (0, metadata_js_1.metadataHandler)(protectedResourceMetadata));
-    // Always add this for OAuth Authorization Server metadata per RFC 8414
-    router.use('/.well-known/oauth-authorization-server', (0, metadata_js_1.metadataHandler)(options.oauthMetadata));
-    return router;
-}
-/**
- * Helper function to construct the OAuth 2.0 Protected Resource Metadata URL
- * from a given server URL. This replaces the path with the standard metadata endpoint.
- *
- * @param serverUrl - The base URL of the protected resource server
- * @returns The URL for the OAuth protected resource metadata endpoint
- *
- * @example
- * getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp'))
- * // Returns: 'https://api.example.com/.well-known/oauth-protected-resource/mcp'
- */
-function getOAuthProtectedResourceMetadataUrl(serverUrl) {
-    const u = new URL(serverUrl.href);
-    const rsPath = u.pathname && u.pathname !== '/' ? u.pathname : '';
-    return new URL(`/.well-known/oauth-protected-resource${rsPath}`, u).href;
-}
-//# sourceMappingURL=router.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.d.ts

@@ -1,32 +0,0 @@
-/**
- * Information about a validated access token, provided to request handlers.
- */
-export interface AuthInfo {
-    /**
-     * The access token.
-     */
-    token: string;
-    /**
-     * The client ID associated with this token.
-     */
-    clientId: string;
-    /**
-     * Scopes associated with this token.
-     */
-    scopes: string[];
-    /**
-     * When the token expires (in seconds since epoch).
-     */
-    expiresAt?: number;
-    /**
-     * The RFC 8707 resource server identifier for which this token is valid.
-     * If set, this MUST match the MCP server's resource identifier (minus hash fragment).
-     */
-    resource?: URL;
-    /**
-     * Additional data associated with the token.
-     * This field should be used for any additional data that needs to be attached to the auth info.
-     */
-    extra?: Record<string, unknown>;
-}
-//# sourceMappingURL=types.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/auth/types.js

@@ -1,3 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.d.ts

@@ -1,38 +0,0 @@
-import { AnySchema, SchemaInput } from './zod-compat.js';
-export declare const COMPLETABLE_SYMBOL: unique symbol;
-export type CompleteCallback<T extends AnySchema = AnySchema> = (value: SchemaInput<T>, context?: {
-    arguments?: Record<string, string>;
-}) => SchemaInput<T>[] | Promise<SchemaInput<T>[]>;
-export type CompletableMeta<T extends AnySchema = AnySchema> = {
-    complete: CompleteCallback<T>;
-};
-export type CompletableSchema<T extends AnySchema> = T & {
-    [COMPLETABLE_SYMBOL]: CompletableMeta<T>;
-};
-/**
- * Wraps a Zod type to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
- * Works with both Zod v3 and v4 schemas.
- */
-export declare function completable<T extends AnySchema>(schema: T, complete: CompleteCallback<T>): CompletableSchema<T>;
-/**
- * Checks if a schema is completable (has completion metadata).
- */
-export declare function isCompletable(schema: unknown): schema is CompletableSchema<AnySchema>;
-/**
- * Gets the completer callback from a completable schema, if it exists.
- */
-export declare function getCompleter<T extends AnySchema>(schema: T): CompleteCallback<T> | undefined;
-/**
- * Unwraps a completable schema to get the underlying schema.
- * For backward compatibility with code that called `.unwrap()`.
- */
-export declare function unwrapCompletable<T extends AnySchema>(schema: CompletableSchema<T>): T;
-export declare enum McpZodTypeKind {
-    Completable = "McpCompletable"
-}
-export interface CompletableDef<T extends AnySchema = AnySchema> {
-    type: T;
-    complete: CompleteCallback<T>;
-    typeName: McpZodTypeKind.Completable;
-}
-//# sourceMappingURL=completable.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/completable.js

@@ -1,48 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.McpZodTypeKind = exports.COMPLETABLE_SYMBOL = void 0;
-exports.completable = completable;
-exports.isCompletable = isCompletable;
-exports.getCompleter = getCompleter;
-exports.unwrapCompletable = unwrapCompletable;
-exports.COMPLETABLE_SYMBOL = Symbol.for('mcp.completable');
-/**
- * Wraps a Zod type to provide autocompletion capabilities. Useful for, e.g., prompt arguments in MCP.
- * Works with both Zod v3 and v4 schemas.
- */
-function completable(schema, complete) {
-    Object.defineProperty(schema, exports.COMPLETABLE_SYMBOL, {
-        value: { complete },
-        enumerable: false,
-        writable: false,
-        configurable: false
-    });
-    return schema;
-}
-/**
- * Checks if a schema is completable (has completion metadata).
- */
-function isCompletable(schema) {
-    return !!schema && typeof schema === 'object' && exports.COMPLETABLE_SYMBOL in schema;
-}
-/**
- * Gets the completer callback from a completable schema, if it exists.
- */
-function getCompleter(schema) {
-    const meta = schema[exports.COMPLETABLE_SYMBOL];
-    return meta?.complete;
-}
-/**
- * Unwraps a completable schema to get the underlying schema.
- * For backward compatibility with code that called `.unwrap()`.
- */
-function unwrapCompletable(schema) {
-    return schema;
-}
-// Legacy exports for backward compatibility
-// These types are deprecated but kept for existing code
-var McpZodTypeKind;
-(function (McpZodTypeKind) {
-    McpZodTypeKind["Completable"] = "McpCompletable";
-})(McpZodTypeKind || (exports.McpZodTypeKind = McpZodTypeKind = {}));
-//# sourceMappingURL=completable.js.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.d.ts

@@ -1,45 +0,0 @@
-import { Express } from 'express';
-/**
- * Options for creating an MCP Express application.
- */
-export interface CreateMcpExpressAppOptions {
-    /**
-     * The hostname to bind to. Defaults to '127.0.0.1'.
-     * When set to '127.0.0.1', 'localhost', or '::1', DNS rebinding protection is automatically enabled.
-     */
-    host?: string;
-    /**
-     * List of allowed hostnames for DNS rebinding protection.
-     * If provided, host header validation will be applied using this list.
-     * For IPv6, provide addresses with brackets (e.g., '[::1]').
-     *
-     * This is useful when binding to '0.0.0.0' or '::' but still wanting
-     * to restrict which hostnames are allowed.
-     */
-    allowedHosts?: string[];
-}
-/**
- * Creates an Express application pre-configured for MCP servers.
- *
- * When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
- * DNS rebinding protection middleware is automatically applied to protect against
- * DNS rebinding attacks on localhost servers.
- *
- * @param options - Configuration options
- * @returns A configured Express application
- *
- * @example
- * ```typescript
- * // Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
- * const app = createMcpExpressApp();
- *
- * // Custom host - DNS rebinding protection only applied for localhost hosts
- * const app = createMcpExpressApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
- * const app = createMcpExpressApp({ host: 'localhost' }); // DNS rebinding protection enabled
- *
- * // Custom allowed hosts for non-localhost binding
- * const app = createMcpExpressApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
- * ```
- */
-export declare function createMcpExpressApp(options?: CreateMcpExpressAppOptions): Express;
-//# sourceMappingURL=express.d.ts.map

package/app/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/express.js

@@ -1,56 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createMcpExpressApp = createMcpExpressApp;
-const express_1 = __importDefault(require("express"));
-const hostHeaderValidation_js_1 = require("./middleware/hostHeaderValidation.js");
-/**
- * Creates an Express application pre-configured for MCP servers.
- *
- * When the host is '127.0.0.1', 'localhost', or '::1' (the default is '127.0.0.1'),
- * DNS rebinding protection middleware is automatically applied to protect against
- * DNS rebinding attacks on localhost servers.
- *
- * @param options - Configuration options
- * @returns A configured Express application
- *
- * @example
- * ```typescript
- * // Basic usage - defaults to 127.0.0.1 with DNS rebinding protection
- * const app = createMcpExpressApp();
- *
- * // Custom host - DNS rebinding protection only applied for localhost hosts
- * const app = createMcpExpressApp({ host: '0.0.0.0' }); // No automatic DNS rebinding protection
- * const app = createMcpExpressApp({ host: 'localhost' }); // DNS rebinding protection enabled
- *
- * // Custom allowed hosts for non-localhost binding
- * const app = createMcpExpressApp({ host: '0.0.0.0', allowedHosts: ['myapp.local', 'localhost'] });
- * ```
- */
-function createMcpExpressApp(options = {}) {
-    const { host = '127.0.0.1', allowedHosts } = options;
-    const app = (0, express_1.default)();
-    app.use(express_1.default.json());
-    // If allowedHosts is explicitly provided, use that for validation
-    if (allowedHosts) {
-        app.use((0, hostHeaderValidation_js_1.hostHeaderValidation)(allowedHosts));
-    }
-    else {
-        // Apply DNS rebinding protection automatically for localhost hosts
-        const localhostHosts = ['127.0.0.1', 'localhost', '::1'];
-        if (localhostHosts.includes(host)) {
-            app.use((0, hostHeaderValidation_js_1.localhostHostValidation)());
-        }
-        else if (host === '0.0.0.0' || host === '::') {
-            // Warn when binding to all interfaces without DNS rebinding protection
-            // eslint-disable-next-line no-console
-            console.warn(`Warning: Server is binding to ${host} without DNS rebinding protection. ` +
-                'Consider using the allowedHosts option to restrict allowed hosts, ' +
-                'or use authentication to protect your server.');
-        }
-    }
-    return app;
-}
-//# sourceMappingURL=express.js.map