Skip to content

3ngram 1.2.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Aug 22:26
v1.2.3
2414a84
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

3ngram v1.2.3

Patch release: OAuth Client ID Metadata Document (CIMD) client resolution never
worked in a deployed build. If you authorize an MCP client that identifies
itself by a metadata-document URL rather than dynamic registration, this is the
release that makes it work.

Changes

  • Every CIMD client resolution failed under a real ESM runtime.
    packages/core/src/auth/client-metadata.ts imported ipaddr.js as a
    namespace (import * as ipaddr). That package is CommonJS with
    module.exports = ipaddr and no exports map, so Node's ESM interop — which
    relies on cjs-module-lexer finding statically scannable assignments —
    synthesizes no usable named exports. Every member of the namespace was
    undefined at runtime, so the first call, ipaddr.isValid(...) in
    resolveHostnameDefault, threw a TypeError.

    resolvePublicTarget catches any resolver throw and relabels it
    dns_failure, so every CIMD resolution failed — for hostnames and IP
    literals alike, with no network I/O — and surfaced to the client as a bare
    400 invalid_client attributed to DNS. The import is now a default import.

    This was invisible to the test suite: Vitest pre-bundles CommonJS
    dependencies through Vite's own interop and synthesizes the named exports, so
    the module shape under test was never the shape the deployment loaded.

  • New guard: scripts/check-cjs-namespace-imports.mjs. Imports every
    namespace-imported bare specifier through real Node ESM resolution and fails
    when a member the source uses is absent from the namespace. Detection is by
    member use rather than export count (ipaddr.js's namespace is not empty —
    the lexer emits a literal module.exports key, so counting exports is a false
    pass) and covers destructuring as well as property access. Not yet wired into
    CI; run it with node scripts/check-cjs-namespace-imports.mjs.

Upgrading

No configuration or migration changes. Deployments using CIMD clients should
retry authorization after upgrading. Deployments using only dynamic client
registration (RFC 7591) are unaffected — that path never went through the
broken resolver.

Library versions

@3ngram/core 0.8.1. @3ngram/db 0.7.0, @3ngram/schema 0.6.0,
@3ngram/config 0.2.3 — unchanged.

Immutable container reference

ghcr.io/b3dmar/3ngram@sha256:8cafe579c19150411c7a14e70163756aae6f08efc1b0b55274bc68ffb0ddadbb

Assets 2
Loading