add safe decodeURIComponent helper; add changeset entry

Author: mgyarmathy

.changeset/fix-uri-template-query-params.md

@@ -0,0 +1,6 @@
+---
+'@modelcontextprotocol/core': patch
+---
+
+Fix `UriTemplate.match()` to correctly handle optional, out-of-order, and URL-encoded query parameters. Previously, query parameters had to appear in the exact order specified in the template and omitted parameters would cause match failures. Omitted query parameters are now
+absent from the result (rather than set to `''`), so callers can use `vars.param ?? defaultValue`.

src/shared/uriTemplate.ts

@@ -7,6 +7,14 @@ const MAX_VARIABLE_LENGTH = 1000000; // 1MB
 const MAX_TEMPLATE_EXPRESSIONS = 10000;
 const MAX_REGEX_LENGTH = 1000000; // 1MB
 
+function safeDecode(s: string): string {
+    try {
+        return decodeURIComponent(s);
+    } catch {
+        return s;
+    }
+}
+
 export class UriTemplate {
     /**
      * Returns true if the given string contains any URI template expressions.
@@ -295,8 +303,8 @@ export class UriTemplate {
                 for (const pair of queryPart.split('&')) {
                     const equalIndex = pair.indexOf('=');
                     if (equalIndex !== -1) {
-                        const key = decodeURIComponent(pair.slice(0, equalIndex));
-                        const value = decodeURIComponent(pair.slice(equalIndex + 1));
+                        const key = safeDecode(pair.slice(0, equalIndex));
+                        const value = safeDecode(pair.slice(equalIndex + 1));
                         queryParams.set(key, value);
                     }
                 }

test/shared/uriTemplate.test.ts

@@ -232,7 +232,7 @@ describe('UriTemplate', () => {
                 version: 'v1',
                 resource: 'users',
                 apiKey: 'testkey',
-                q: 'user',
+                q: 'user'
             });
             expect(template.variableNames).toEqual(['version', 'resource', 'apiKey', 'q', 'p', 'sort']);
         });