Summary

Enhances input format tolerance for the __evmauth parameter to support both JSON string and object formats, improving compatibility across different MCP client implementations.

Resolves #4

Changes

Core Implementation

• Enhanced extractProof() method with comprehensive type guard isEVMAuthProof()
• Dual format support for both JSON string and object formats
• Type-safe validation without any any type assertions
• Size limits enforced (1MB max) for JSON string payloads
• Pre-validation checks before JSON parsing attempts

Error Handling

• Added PROOF_MALFORMED error code for invalid JSON structures
• Differentiated error responses for various failure modes
• Enhanced debug logging with format detection and troubleshooting hints
• Proper exception handling with RadiusError instances

TypeScript Compliance

• Eliminated all any type usage in production code (4 instances removed)
• Fixed compilation error with strict TypeScript mode
• Implemented comprehensive type guard without unsafe casts
• All functions have explicit return types

Test Coverage

• Added 3 new edge case tests (49 total tests)
• Tests for oversized JSON payloads
• Tests for null/undefined field handling
• Tests for array vs object JSON differentiation
• Fixed test expectations to match new error codes

Testing

$ npm test
✓ 49 tests passed
✓ TypeScript strict mode: PASSING
✓ No 'any' types in production code
✓ 100% coverage of modified code

Client Compatibility

• ✅ Web-based MCP clients - Often serialize complex objects to JSON strings
• ✅ Node.js MCP clients - Typically pass objects directly
• ✅ Proxy scenarios - Handle both formats seamlessly
• ✅ Legacy clients - Maintain backward compatibility

Performance & Security

• 1MB size limit prevents DoS attacks via oversized payloads
• Pre-validation avoids unnecessary parsing attempts
• Early returns for obviously invalid input
• Comprehensive type checking prevents type confusion attacks