toolcraft 0.0.416 → 0.0.417

package/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.89",
+      "version": "0.1.90",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.416",
+      "version": "0.0.417",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.416",
+      "version": "0.0.417",
       "license": "MIT"
     },
     {

package/dist/composition.json

@@ -98,7 +98,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.89",
+      "version": "0.1.90",
       "license": "MIT"
     },
     {
@@ -113,7 +113,7 @@
     },
     {
       "name": "toolcraft",
-      "version": "0.0.416",
+      "version": "0.0.417",
       "license": "MIT"
     },
     {
@@ -123,7 +123,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.416",
+      "version": "0.0.417",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/dist/composition.json

@@ -18,7 +18,7 @@
     },
     {
       "name": "tiny-http-mcp-server",
-      "version": "0.1.89",
+      "version": "0.1.90",
       "license": "MIT"
     },
     {

package/node_modules/tiny-http-mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tiny-http-mcp-server",
-  "version": "0.1.89",
+  "version": "0.1.90",
   "description": "Minimal MCP server over HTTP built on tiny-stdio-mcp-server",
   "type": "module",
   "main": "dist/index.js",

package/node_modules/tiny-mcp-client/README.md

@@ -73,6 +73,12 @@ before OAuth callbacks run. Invalid headers fail without reflecting their values
 Use `snapshotHttpTransportHeaders(headers)` to apply the same ownership and safe
 validation when preparing a registry before constructing transports.
 `maxResponseBytes` bounds a complete JSON body or each SSE event (default 16 MiB).
+Before deserialization, HTTP JSON-RPC messages also have fixed per-message limits:
+100,000 nodes (including keys), 64 container levels, 4 MiB of decoded UTF-16
+strings, and an 8 MiB allocation estimate (128 bytes per node plus string storage).
+The first limit reached rejects the reply. These conservative admission limits
+protect Worker hosts from compact object amplification; they are not exact heap
+measurements. Increasing the byte limit does not increase the structural limits.
 Receive streams may carry many bounded events and keepalive comments; the limit
 does not cap their lifetime bytes. Use request deadlines and cancellation to
 bound pending operations.

package/node_modules/tiny-mcp-client/dist/index.js

@@ -65,6 +65,65 @@ var init_inMemory = __esm({
   }
 });
 
+// src/http-json-budget.ts
+function assertHttpJsonBudget(text) {
+  let nodes = 0;
+  let allocation = 0;
+  let decodedBytes = 0;
+  const stack = [];
+  const whitespace = (c) => c === " " || c === "	" || c === "\r" || c === "\n";
+  const check = () => {
+    if (nodes > 1e5 || stack.length > 64 || allocation > 8 * 1024 * 1024 || decodedBytes > 4 * 1024 * 1024)
+      throw new Error("MCP HTTP JSON structural budget exceeded");
+  };
+  for (let i = 0; i < text.length; ) {
+    const c = text[i++];
+    if (whitespace(c) || c === "," || c === ":") continue;
+    if (c === "}" || c === "]") {
+      if (stack.pop() !== c) throw new SyntaxError("Malformed MCP HTTP JSON nesting");
+      continue;
+    }
+    nodes++;
+    allocation += 128;
+    if (c === "{" || c === "[") {
+      stack.push(c === "{" ? "}" : "]");
+      check();
+      continue;
+    }
+    check();
+    if (c === '"') {
+      let closed = false;
+      while (i < text.length) {
+        const character = text[i++];
+        if (character === '"') {
+          closed = true;
+          break;
+        }
+        if (character.charCodeAt(0) < 32) throw new SyntaxError("Malformed MCP HTTP JSON string");
+        if (character === "\\") {
+          const escape = text[i++];
+          if (escape === "u") {
+            for (let digit = 0; digit < 4; digit++) {
+              const hex = text[i++];
+              if (hex === void 0 || !"0123456789abcdefABCDEF".includes(hex))
+                throw new SyntaxError("Malformed MCP HTTP JSON escape");
+            }
+          } else if (escape === void 0 || !'"\\/bfnrt'.includes(escape)) {
+            throw new SyntaxError("Malformed MCP HTTP JSON escape");
+          }
+        }
+        decodedBytes += 2;
+        allocation += 2;
+        check();
+      }
+      if (!closed) throw new SyntaxError("Unterminated MCP HTTP JSON string");
+    } else {
+      while (i < text.length && !whitespace(text[i]) && !'{}[],:"'.includes(text[i])) i++;
+    }
+  }
+  if (stack.length !== 0) throw new SyntaxError("Unterminated MCP HTTP JSON container");
+}
+
 // src/internal.ts
 import { spawn as spawn2 } from "node:child_process";
 import { PassThrough } from "node:stream";
@@ -8208,6 +8267,7 @@ var HttpTransport = class {
       signal
     )).trim();
     if (request !== void 0 && responseBody.length > 0) {
+      assertHttpJsonBudget(responseBody);
       let parsed = parseJsonRpcMessage(responseBody);
       if (parsed.type === "invalid") {
         try {
@@ -8361,6 +8421,7 @@ var HttpTransport = class {
       if (context !== void 0) throw new Error("MCP HTTP response body is empty");
       return;
     }
+    assertHttpJsonBudget(payload);
     if (context !== void 0) {
       this.writeReadableLine(context.validate(payload, false));
       return;
@@ -8383,6 +8444,7 @@ var HttpTransport = class {
         this.rejectLegacyEndpoint = void 0;
         continue;
       }
+      assertHttpJsonBudget(message.data);
       this.writeReadableLine(context?.validate(message.data, true) ?? message.data);
       if (context?.completed) return;
     }

package/node_modules/tiny-stdio-mcp-server/dist/composition.json

@@ -8,7 +8,7 @@
     },
     {
       "name": "toolcraft-schema",
-      "version": "0.0.416",
+      "version": "0.0.417",
       "license": "MIT"
     }
   ]

package/node_modules/toolcraft-schema/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft-schema",
-  "version": "0.0.416",
+  "version": "0.0.417",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolcraft",
-  "version": "0.0.416",
+  "version": "0.0.417",
   "license": "MIT",
   "type": "module",
   "main": "dist/index.js",
@@ -162,7 +162,7 @@
     "yaml"
   ],
   "optionalDependencies": {
-    "toolcraft-schema": "0.0.416",
+    "toolcraft-schema": "0.0.417",
     "toolcraft-design": "*",
     "@poe-code/frontmatter": "*",
     "@poe-code/agent-mcp-config": "*",