tiny-stdio-mcp-server 0.1.7 → 0.1.9

package/dist/content/audio.d.ts

@@ -1,3 +1,4 @@
+import { type FromUrlOptions } from "./remote.js";
 export interface AudioContent {
     type: "audio";
     data: string;
@@ -7,7 +8,7 @@ export declare class Audio {
     private readonly base64Data;
     private readonly mimeType;
     private constructor();
-    static fromUrl(url: string): Promise<Audio>;
+    static fromUrl(url: string, options?: FromUrlOptions): Promise<Audio>;
     static fromBytes(data: Uint8Array, format?: string): Audio;
     static fromBase64(base64: string, mimeType: string): Audio;
     toContentBlock(): AudioContent;

package/dist/content/audio.js

@@ -1,4 +1,5 @@
 import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
+import { readRemoteBytes } from "./remote.js";
 const SUPPORTED_AUDIO_MIMES = new Set([
     "audio/mpeg",
     "audio/wav",
@@ -19,13 +20,12 @@ export class Audio {
         this.base64Data = base64Data;
         this.mimeType = mimeType;
     }
-    static async fromUrl(url) {
+    static async fromUrl(url, options) {
         const response = await fetch(url);
         if (!response.ok) {
             throw new Error(`Failed to fetch audio from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
-        const arrayBuffer = await response.arrayBuffer();
-        const data = new Uint8Array(arrayBuffer);
+        const data = await readRemoteBytes(response, "audio", url, options);
         const detected = fileTypeFromBuffer(data);
         let mimeType;
         if (detected && SUPPORTED_AUDIO_MIMES.has(detected.mime)) {

package/dist/content/file.d.ts

@@ -1,3 +1,4 @@
+import { type FromUrlOptions } from "./remote.js";
 export interface TextResourceContents {
     uri: string;
     mimeType: string;
@@ -19,7 +20,7 @@ export declare class File {
     private readonly name?;
     private readonly charset;
     private constructor();
-    static fromUrl(url: string): Promise<File>;
+    static fromUrl(url: string, options?: FromUrlOptions): Promise<File>;
     static fromBytes(data: Uint8Array, mimeType: string): File;
     static fromText(text: string, mimeType?: string): File;
     static fromBase64(base64: string, mimeType: string): File;

package/dist/content/file.js

@@ -1,4 +1,5 @@
 import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
+import { readRemoteBytes } from "./remote.js";
 function isTextMimeType(mimeType) {
     const normalizedMimeType = mimeType.toLowerCase();
     return (normalizedMimeType.startsWith("text/") ||
@@ -22,13 +23,12 @@ export class File {
         this.name = name;
         this.charset = charset;
     }
-    static async fromUrl(url) {
+    static async fromUrl(url, options) {
         const response = await fetch(url);
         if (!response.ok) {
             throw new Error(`Failed to fetch file from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
-        const arrayBuffer = await response.arrayBuffer();
-        const data = new Uint8Array(arrayBuffer);
+        const data = await readRemoteBytes(response, "file", url, options);
         const detected = fileTypeFromBuffer(data);
         let mimeType;
         if (detected) {

package/dist/content/image.d.ts

@@ -1,3 +1,4 @@
+import { type FromUrlOptions } from "./remote.js";
 export interface ImageContent {
     type: "image";
     data: string;
@@ -7,7 +8,7 @@ export declare class Image {
     private readonly base64Data;
     private readonly mimeType;
     private constructor();
-    static fromUrl(url: string): Promise<Image>;
+    static fromUrl(url: string, options?: FromUrlOptions): Promise<Image>;
     static fromBytes(data: Uint8Array, format?: string): Image;
     static fromBase64(base64: string, mimeType: string): Image;
     toContentBlock(): ImageContent;

package/dist/content/image.js

@@ -1,4 +1,5 @@
 import { assertBase64, fileTypeFromBuffer, parseContentType, safeRemoteLabel } from "./mime.js";
+import { readRemoteBytes } from "./remote.js";
 const SUPPORTED_IMAGE_MIMES = new Set([
     "image/png",
     "image/jpeg",
@@ -12,13 +13,12 @@ export class Image {
         this.base64Data = base64Data;
         this.mimeType = mimeType;
     }
-    static async fromUrl(url) {
+    static async fromUrl(url, options) {
         const response = await fetch(url);
         if (!response.ok) {
             throw new Error(`Failed to fetch image from ${safeRemoteLabel(url)}: ${response.status} ${response.statusText}`);
         }
-        const arrayBuffer = await response.arrayBuffer();
-        const data = new Uint8Array(arrayBuffer);
+        const data = await readRemoteBytes(response, "image", url, options);
         const detected = fileTypeFromBuffer(data);
         let mimeType;
         if (detected && SUPPORTED_IMAGE_MIMES.has(detected.mime)) {

package/dist/content/index.d.ts

@@ -1,4 +1,6 @@
 export { fileTypeFromBuffer, type FileTypeResult } from "./mime.js";
+export { DEFAULT_FROM_URL_MAX_BYTES } from "./remote.js";
+export type { FromUrlOptions } from "./remote.js";
 export { Image, type ImageContent } from "./image.js";
 export { Audio, type AudioContent } from "./audio.js";
 export { File, type EmbeddedResource, type TextResourceContents, type BlobResourceContents, } from "./file.js";

package/dist/content/index.js

@@ -1,5 +1,6 @@
 // MIME detection
 export { fileTypeFromBuffer } from "./mime.js";
+export { DEFAULT_FROM_URL_MAX_BYTES } from "./remote.js";
 // Content helpers
 export { Image } from "./image.js";
 export { Audio } from "./audio.js";

package/dist/content/remote.d.ts

@@ -0,0 +1,5 @@
+export declare const DEFAULT_FROM_URL_MAX_BYTES: number;
+export interface FromUrlOptions {
+    maxBytes?: number;
+}
+export declare function readRemoteBytes(response: Response, kind: string, url: string, options?: FromUrlOptions): Promise<Uint8Array>;

package/dist/content/remote.js

@@ -0,0 +1,69 @@
+import { safeRemoteLabel } from "./mime.js";
+export const DEFAULT_FROM_URL_MAX_BYTES = 5 * 1024 * 1024;
+function resolveMaxBytes(options) {
+    const maxBytes = options?.maxBytes ?? DEFAULT_FROM_URL_MAX_BYTES;
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+        throw new Error("maxBytes must be a positive integer");
+    }
+    return maxBytes;
+}
+function createSizeError(kind, url, maxBytes) {
+    return new Error(`Remote ${kind} from ${safeRemoteLabel(url)} exceeds maximum size of ${maxBytes} bytes`);
+}
+function readContentLength(response) {
+    const rawContentLength = response.headers.get("content-length");
+    if (typeof rawContentLength !== "string") {
+        return undefined;
+    }
+    const contentLength = Number(rawContentLength.trim());
+    if (!Number.isSafeInteger(contentLength) || contentLength < 0) {
+        return undefined;
+    }
+    return contentLength;
+}
+function combineChunks(chunks, totalBytes) {
+    const combined = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+        combined.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return combined;
+}
+async function readStreamBytes(body, kind, url, maxBytes) {
+    const reader = body.getReader();
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done) {
+                return combineChunks(chunks, totalBytes);
+            }
+            totalBytes += value.byteLength;
+            if (totalBytes > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                throw createSizeError(kind, url, maxBytes);
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+export async function readRemoteBytes(response, kind, url, options) {
+    const maxBytes = resolveMaxBytes(options);
+    const contentLength = readContentLength(response);
+    if (contentLength !== undefined && contentLength > maxBytes) {
+        throw createSizeError(kind, url, maxBytes);
+    }
+    if (response.body) {
+        return readStreamBytes(response.body, kind, url, maxBytes);
+    }
+    const arrayBuffer = await response.arrayBuffer();
+    if (arrayBuffer.byteLength > maxBytes) {
+        throw createSizeError(kind, url, maxBytes);
+    }
+    return new Uint8Array(arrayBuffer);
+}

package/dist/index.d.ts

@@ -2,8 +2,8 @@ export { createServer } from "./server.js";
 export type { MessageHandler, MessageSession, Server } from "./server.js";
 export { defineSchema } from "./schema.js";
 export type { TypedSchema } from "./schema.js";
-export { Image, Audio, File, toContentBlocks, fileTypeFromBuffer, } from "./content/index.js";
-export type { ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, } from "./content/index.js";
+export { Image, Audio, File, toContentBlocks, fileTypeFromBuffer, DEFAULT_FROM_URL_MAX_BYTES, } from "./content/index.js";
+export type { ImageContent, AudioContent, EmbeddedResource, TextResourceContents, BlobResourceContents, ContentBlock, TextContent, FileTypeResult, FromUrlOptions, } from "./content/index.js";
 export type { ToolReturn } from "./content/index.js";
 export type { ServerOptions, ToolHandler, ToolDefinition, Tool, ToolAnnotations, ToolExecution, Icon, ContentAnnotations, ResourceLink, CallToolResult, PromptContentItem, PromptArgument, Prompt, PromptMessage, GetPromptResult, PromptHandler, PromptDefinition, Resource, ResourceTemplate, ResourceContents, ReadResourceResult, ResourceHandler, ResourceDefinition, ResourceTemplateDefinition, HandleResult, ContentItem, JSONSchema, JSONSchemaProperty, Transport, SDKTransport, JSONRPCRequest, JSONRPCResponse, JSONRPCError, JSONRPCMessage, JSONRPCNotification, InitializeResult, } from "./types.js";
 export { JSON_RPC_ERROR_CODES, ToolError } from "./types.js";

package/dist/index.js

@@ -3,5 +3,5 @@ export { createServer } from "./server.js";
 // Schema
 export { defineSchema } from "./schema.js";
 // Content helpers
-export { Image, Audio, File, toContentBlocks, fileTypeFromBuffer, } from "./content/index.js";
+export { Image, Audio, File, toContentBlocks, fileTypeFromBuffer, DEFAULT_FROM_URL_MAX_BYTES, } from "./content/index.js";
 export { JSON_RPC_ERROR_CODES, ToolError } from "./types.js";

package/dist/schema.d.ts

@@ -4,6 +4,7 @@ interface SchemaPropertyDef {
     type: SchemaPropertyType;
     description?: string;
     optional?: boolean;
+    [keyword: string]: unknown;
 }
 type SchemaDefinition = Record<string, SchemaPropertyDef>;
 type InferType<T extends SchemaPropertyType> = T extends "string" ? string : T extends "number" ? number : T extends "boolean" ? boolean : T extends "object" ? Record<string, unknown> : T extends "array" ? unknown[] : never;

package/dist/schema.js

@@ -2,14 +2,17 @@ export function defineSchema(definition) {
     const properties = {};
     const required = [];
     for (const [key, prop] of Object.entries(definition)) {
+        const jsonSchemaProperty = {};
+        for (const [propertyKey, propertyValue] of Object.entries(prop)) {
+            if (propertyKey !== "optional") {
+                jsonSchemaProperty[propertyKey] = propertyValue;
+            }
+        }
         Object.defineProperty(properties, key, {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: {
-                type: prop.type,
-                ...(prop.description !== undefined && { description: prop.description }),
-            },
+            value: jsonSchemaProperty,
         });
         if (!prop.optional) {
             required.push(key);

package/dist/server.js

@@ -320,6 +320,7 @@ export function createServer(options) {
     };
     const server = {
         tool(name, description, inputSchema, handler, outputSchema) {
+            assertNonEmptyName(name, "Tool name required");
             if (outputSchema !== undefined) {
                 assertSupportedOutputSchema(outputSchema);
             }
@@ -333,6 +334,7 @@ export function createServer(options) {
             return server;
         },
         registerTool(definition, handler) {
+            assertNonEmptyName(definition.name, "Tool name required");
             if (definition.outputSchema !== undefined) {
                 assertSupportedOutputSchema(definition.outputSchema);
             }
@@ -343,6 +345,7 @@ export function createServer(options) {
             return server;
         },
         prompt(definition, handler) {
+            assertNonEmptyName(definition.name, "Prompt name required");
             prompts.set(definition.name, { ...definition, handler });
             return server;
         },
@@ -354,7 +357,7 @@ export function createServer(options) {
             return server;
         },
         resourceTemplate(definition, handler) {
-            uriTemplateParser.parse(definition.uriTemplate);
+            assertReadableUriTemplate(definition.uriTemplate);
             new UriTemplate(definition.uriTemplate);
             resourceTemplates.set(definition.uriTemplate, { ...definition, handler });
             return server;
@@ -536,6 +539,20 @@ function isValidUri(uri) {
         return false;
     }
 }
+function assertNonEmptyName(name, message) {
+    if (name.length === 0) {
+        throw new Error(message);
+    }
+}
+function assertReadableUriTemplate(uriTemplate) {
+    const parsed = uriTemplateParser.parse(uriTemplate);
+    const expanded = parsed.expand(new Proxy({}, {
+        get: (_target, property) => typeof property === "string" ? "value" : undefined,
+    }));
+    if (typeof expanded !== "string" || !isValidUri(expanded)) {
+        throw new Error(`Invalid resource URI template: ${uriTemplate}`);
+    }
+}
 function toStringArguments(value) {
     if (value === undefined) {
         return {};
@@ -588,9 +605,13 @@ function normalizeToolResult(handlerResult, outputSchema) {
         throw new Error("Invalid tool result");
     }
     if (outputSchema === undefined) {
-        return isCallToolResult(handlerResult)
+        const result = isCallToolResult(handlerResult)
             ? handlerResult
             : { content: toContentBlocks(handlerResult) };
+        if (!isCallToolResult(result)) {
+            throw new Error("Invalid tool result");
+        }
+        return result;
     }
     const structuredContent = isCallToolResult(handlerResult)
         ? handlerResult.structuredContent
@@ -695,7 +716,8 @@ function isGetPromptResult(value) {
     if (typeof value !== "object" || value === null || !hasOwnProperty(value, "messages")) {
         return false;
     }
-    return Array.isArray(value.messages)
+    return (!hasOwnProperty(value, "description") || value.description === undefined || typeof value.description === "string")
+        && Array.isArray(value.messages)
         && value.messages.every((message) => typeof message === "object"
             && message !== null
             && hasOwnProperty(message, "role")
@@ -708,13 +730,7 @@ function isReadResourceResult(value) {
         return false;
     }
     return Array.isArray(value.contents)
-        && value.contents.every((content) => typeof content === "object"
-            && content !== null
-            && hasOwnProperty(content, "uri")
-            && typeof content.uri === "string"
-            && isValidUri(content.uri)
-            && ((hasOwnProperty(content, "text") && typeof content.text === "string")
-                || (hasOwnProperty(content, "blob") && typeof content.blob === "string" && isBase64(content.blob))));
+        && value.contents.every(isResourceContents);
 }
 function hasContentArray(value) {
     return typeof value === "object" && value !== null && hasOwnProperty(value, "content")
@@ -725,6 +741,9 @@ function isContentItem(value) {
         return false;
     }
     const block = value;
+    if (!hasValidContentAnnotations(block)) {
+        return false;
+    }
     if (block.type === "text") {
         return hasOwnProperty(block, "text") && typeof block.text === "string";
     }
@@ -738,8 +757,13 @@ function isContentItem(value) {
     if (block.type === "resource_link") {
         return hasOwnProperty(block, "uri")
             && typeof block.uri === "string"
+            && isValidUri(block.uri)
             && hasOwnProperty(block, "name")
-            && typeof block.name === "string";
+            && typeof block.name === "string"
+            && (!hasOwnProperty(block, "title") || block.title === undefined || typeof block.title === "string")
+            && (!hasOwnProperty(block, "description") || block.description === undefined || typeof block.description === "string")
+            && (!hasOwnProperty(block, "mimeType") || block.mimeType === undefined || typeof block.mimeType === "string")
+            && (!hasOwnProperty(block, "size") || block.size === undefined || typeof block.size === "number");
     }
     if (block.type !== "resource"
         || !hasOwnProperty(block, "resource")
@@ -747,12 +771,33 @@ function isContentItem(value) {
         || block.resource === null) {
         return false;
     }
-    const resource = block.resource;
-    return hasOwnProperty(resource, "uri")
-        && typeof resource.uri === "string"
-        && (!hasOwnProperty(resource, "mimeType") || typeof resource.mimeType === "string")
-        && ((hasOwnProperty(resource, "text") && typeof resource.text === "string")
-            || (hasOwnProperty(resource, "blob") && typeof resource.blob === "string" && isBase64(resource.blob)));
+    return isResourceContents(block.resource);
+}
+function isResourceContents(value) {
+    if (typeof value !== "object"
+        || value === null
+        || !hasOwnProperty(value, "uri")
+        || typeof value.uri !== "string"
+        || !isValidUri(value.uri)) {
+        return false;
+    }
+    if (hasOwnProperty(value, "mimeType") && value.mimeType !== undefined && typeof value.mimeType !== "string") {
+        return false;
+    }
+    return (hasOwnProperty(value, "text") && typeof value.text === "string")
+        || (hasOwnProperty(value, "blob") && typeof value.blob === "string" && isBase64(value.blob));
+}
+function hasValidContentAnnotations(value) {
+    if (!hasOwnProperty(value, "annotations") || value.annotations === undefined) {
+        return true;
+    }
+    if (!isJsonObject(value.annotations)) {
+        return false;
+    }
+    const { audience, priority, lastModified } = value.annotations;
+    return (audience === undefined || (Array.isArray(audience) && audience.every((item) => item === "user" || item === "assistant")))
+        && (priority === undefined || typeof priority === "number")
+        && (lastModified === undefined || typeof lastModified === "string");
 }
 function isBase64(value) {
     if (value.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-stdio-mcp-server",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "bugs": {
     "url": "https://github.com/poe-platform/poe-code/issues"
   },