@abide/abide 0.28.0

package/src/lib/server/prompts/types/Prompt.ts

@@ -0,0 +1,13 @@
+/*
+An MCP prompt declared by a markdown file under `src/mcp/prompts/`. The
+resolver plugin parses the file's frontmatter + body and generates a call
+to definePrompt, stamping in the `name` from the file path; `render(args)`
+interpolates the body's `{{name}}` placeholders into the single user
+message returned by `prompts/get`. Prompts are MCP-only — there is no
+client-side counterpart, so the shape carries no ClientFlags.
+*/
+export type Prompt = {
+    readonly name: string
+    readonly description: string | undefined
+    render(args: Record<string, string>): string
+}

package/src/lib/server/prompts/types/PromptOptions.ts

@@ -0,0 +1,12 @@
+/*
+Options definePrompt receives for one markdown prompt. The resolver plugin
+generates this object from the file: `description` + `jsonSchema` come from
+the frontmatter (the schema built from the `arguments` list), and `render`
+closes over the parsed body. All of this is server-only — prompts are never
+imported by client code.
+*/
+export type PromptOptions = {
+    description?: string
+    jsonSchema?: Record<string, unknown>
+    render: (args: Record<string, string>) => string
+}

package/src/lib/server/prompts/types/PromptRegistryEntry.ts

@@ -0,0 +1,13 @@
+import type { Prompt } from './Prompt.ts'
+
+/*
+Per-prompt registry record. The MCP dispatcher enumerates this to build
+`prompts/list` (description + arguments from the JSON Schema) and to
+dispatch `prompts/get` (render the body with the caller's arguments).
+jsonSchema stays off the public Prompt shape so the render closure isn't
+burdened with metadata it never reads.
+*/
+export type PromptRegistryEntry = {
+    prompt: Prompt
+    jsonSchema: Record<string, unknown> | undefined
+}

package/src/lib/server/prompts/types/PromptRoutes.ts

@@ -0,0 +1,10 @@
+import type { Prompt } from './Prompt.ts'
+
+/*
+Manifest of prompt-name → module loader. Produced by the resolver plugin
+from each `.md` under src/mcp/prompts/. Each markdown file is transformed
+into a module that registers one Prompt (its `.name` stamped in by the
+generated definePrompt call) on import. The registry loader imports every
+module once so the MCP dispatcher can enumerate the full prompt surface.
+*/
+export type PromptRoutes = Record<string, () => Promise<Record<string, Prompt>>>

package/src/lib/server/reachable.ts

@@ -0,0 +1,45 @@
+import { parseBoundedEnvInt } from '../shared/parseBoundedEnvInt.ts'
+import { createReachable } from './runtime/createReachable.ts'
+
+/*
+Server-only outbound reachability for an external host. `await reachable(host)`
+HEADs the host's origin: the first call awaits a real probe (faithful — a down
+host costs the full timeout, an up host one handshake) and starts a background
+poll that re-probes every TTL, so every later call resolves instantly off the
+warm value, fresh within one TTL. A down host going down is caught within
+~failureLimit polls; recovery flips it back automatically.
+
+  if (!(await reachable('api.example.com'))) return error(503)
+
+A bare host defaults to https; pass an explicit http://… for a non-TLS host.
+Answers "can I connect to this host," NOT "is my endpoint healthy": any
+completed HTTP response (even 4xx/5xx, even a 405 to HEAD) counts as reachable;
+only a connection failure or timeout reads as unreachable. There is no ambient
+server-side connectivity signal, so this is the honest way to fail a doomed
+outbound call fast — see online() for the inbound/client-reported counterpart.
+
+ABIDE_REACHABLE_TTL (poll cadence / freshness, ms) and ABIDE_REACHABLE_TIMEOUT
+(per-HEAD bound, ms) tune the defaults; the timeout is deliberately generous so
+a healthy-but-distant host over a slow link is not mis-read as down.
+*/
+const TTL_MS = parseBoundedEnvInt(process.env.ABIDE_REACHABLE_TTL, 1_000, 600_000) ?? 30_000
+const TIMEOUT_MS = parseBoundedEnvInt(process.env.ABIDE_REACHABLE_TIMEOUT, 100, 60_000) ?? 3_000
+/* Stop polling a host nobody has read in a few TTLs; the next read restarts it cold. */
+const IDLE_MS = TTL_MS * 3
+
+/* Status-agnostic HEAD: a completed response proves connectivity; reject/timeout does not. */
+async function probeOrigin(origin: string): Promise<boolean> {
+    try {
+        await fetch(origin, { method: 'HEAD', signal: AbortSignal.timeout(TIMEOUT_MS) })
+        return true
+    } catch {
+        return false
+    }
+}
+
+// @readme observability
+export const reachable = createReachable({
+    probe: probeOrigin,
+    intervalMs: TTL_MS,
+    idleMs: IDLE_MS,
+}).reachable

package/src/lib/server/redirect.ts

@@ -0,0 +1,43 @@
+/*
+Redirect Response with abide-friendly ergonomics — accepts relative
+URLs (the platform's `Response.redirect` throws on them), defaults to
+302, and matches the helper-style call site of `json`/`error` for
+visual consistency inside a handler.
+
+  return redirect('/login')              // 302 to /login
+  return redirect('/articles/1', 301)    // permanent
+  return redirect(externalUrl, 307)      // preserve method (POST stays POST)
+
+Status guidance:
+- 301 — moved permanently (cacheable; browsers may swap method to GET)
+- 302 — found / temporary (default; browsers may swap method to GET)
+- 303 — "after a POST, GET this" (forces GET on the follow-up)
+- 307 — temporary, preserve method
+- 308 — permanent, preserve method
+
+A final `ResponseInit` adds headers (e.g. a `Set-Cookie` on the redirect);
+the positional `status` always wins over any `init.status`.
+*/
+import { NO_STORE } from '../shared/CACHE_CONTROL_VALUES.ts'
+import type { TypedResponse } from './rpc/types/TypedResponse.ts'
+import { withResponseDefaults } from './runtime/withResponseDefaults.ts'
+
+type RedirectStatus = 301 | 302 | 303 | 307 | 308
+
+/*
+Return type is `TypedResponse<never>` for the same reason `error()` is —
+the wire response is a 3xx with no body the caller resolves to, so it
+must not pollute the inferred `Return` of a route that conditionally
+redirects vs returns json.
+*/
+// @readme response
+export function redirect(
+    url: string,
+    status: RedirectStatus = 302,
+    init?: ResponseInit,
+): TypedResponse<never> {
+    return new Response(
+        null,
+        withResponseDefaults(init, { Location: url, 'Cache-Control': NO_STORE }, status),
+    ) as TypedResponse<never>
+}

package/src/lib/server/request.ts

@@ -0,0 +1,19 @@
+import { requestContext } from './runtime/requestContext.ts'
+
+/*
+Returns the inbound Request for the current SSR/RPC pass. Implemented as an
+AsyncLocalStorage lookup over the per-request store the server installs at
+the fetch boundary. Throws if called outside a request scope (e.g. from
+top-level module code or from app.ts init) — silent undefined would mask
+the misuse.
+*/
+// @readme request-scope
+export function request(): Request {
+    const store = requestContext.getStore()
+    if (!store) {
+        throw new Error(
+            '[abide] request() called outside a request scope — it only resolves while an SSR render or rpc handler is in flight',
+        )
+    }
+    return store.req
+}

package/src/lib/server/rpc/defineVerb.ts

@@ -0,0 +1,210 @@
+import { abideLog } from '../../shared/abideLog.ts'
+import { buildRpcRequest } from '../../shared/buildRpcRequest.ts'
+import { createRemoteFunction } from '../../shared/createRemoteFunction.ts'
+import { forwardHeaders } from '../../shared/forwardHeaders.ts'
+import { isReadOnlyMethod } from '../../shared/isReadOnlyMethod.ts'
+import { resolveClientFlags } from '../../shared/resolveClientFlags.ts'
+import type { ClientFlags } from '../../shared/types/ClientFlags.ts'
+import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
+import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
+import type { StandardSchemaV1 } from '../../shared/types/StandardSchemaV1.ts'
+import { json } from '../json.ts'
+import { requestContext } from '../runtime/requestContext.ts'
+import { parseArgs } from './parseArgs.ts'
+import { registerVerb } from './registerVerb.ts'
+import { runWithVerbTimeout } from './runWithVerbTimeout.ts'
+import type { RemoteHandler } from './types/RemoteHandler.ts'
+
+/*
+Stash for the per-request AbortController a timed verb composes into the
+inbound signal — read back in invoke's deadline callback to fire it. Lives on
+the scope's Request (one verb per .fetch — network or in-process dispatch) so
+an SSR pass's many in-process cache reads, which call invoke() directly and
+never reach parseArgsForFetch, can't cross-cancel.
+*/
+const VERB_TIMEOUT_ABORT = Symbol('abideVerbTimeoutAbort')
+
+/* Verb dispatch + validation spans, opt-in via DEBUG=abide:rpc. Reveals an
+   in-process RPC→RPC call (same request scope, same trace) as a nested span. */
+const rpcLog = abideLog.channel('abide:rpc')
+
+/*
+Builds a RemoteFunction from an HTTP verb + RPC URL + handler. The bundler
+rewrites every `export const VERB = handler(fn)` inside an `$rpc/**` module
+so the verb (from the export name) and the URL (from the file path under
+`src/server/rpc/`, with `/rpc/` prefix) are threaded into defineVerb.
+
+The plain call (`fn(args)`) resolves to the Content-Type-decoded body;
+non-2xx responses throw HttpError. `.raw(args)` returns the underlying
+Response for callers that need status/headers/body streaming.
+`.fetch(req)` is the dispatch hook the framework's router uses to
+invoke the handler from an incoming HTTP request (with args parsed off
+the Request via parseArgs).
+
+Every raw invocation records the synthesized Request against the returned
+promise so cache() can stash it on the entry without re-building.
+*/
+// @readme plumbing
+export function defineVerb<Args, Return>(
+    method: HttpVerb,
+    url: string,
+    handler: RemoteHandler<Args, Return>,
+    opts?: {
+        inputSchema?: StandardSchemaV1
+        outputSchema?: StandardSchemaV1
+        filesSchema?: StandardSchemaV1
+        clients?: Partial<ClientFlags>
+        crossOrigin?: boolean
+        /* Per-verb cap on actual received body bytes (413 past it); omitted = Bun's server-wide maxRequestBodySize. */
+        maxBodySize?: number
+        /* Per-verb handler deadline (ms): a 504 once exceeded, on every surface (SSR/MCP/CLI/network). */
+        timeout?: number
+    },
+): RemoteFunction<Args, Return> {
+    const timeout = opts?.timeout
+    const inputSchema = opts?.inputSchema
+    const outputSchema = opts?.outputSchema
+    const filesSchema = opts?.filesSchema
+    /*
+    An input schema makes the handler safe to advertise to non-browser
+    surfaces. CLI flips on for any verb with one (a human/script invokes it
+    deliberately). MCP only auto-exposes read-only verbs (GET/HEAD) — a
+    model shouldn't be able to mutate/delete just because the handler
+    carries a schema, so mutating verbs require an explicit clients.mcp.
+    Explicit `clients` always wins.
+    */
+    const hasSchema = inputSchema !== undefined
+    const clients = resolveClientFlags(opts?.clients, {
+        mcp: hasSchema && isReadOnlyMethod(method),
+        cli: hasSchema,
+    })
+
+    function buildRequest(args: Args | undefined): Request {
+        const store = requestContext.getStore()
+        const baseUrl = store ? store.url.href : 'http://localhost/'
+        const headers = store ? forwardHeaders(store.req.headers) : new Headers()
+        return buildRpcRequest({ method, url, args, baseUrl, headers })
+    }
+
+    /*
+    Handler bodies may throw synchronously (e.g. an `assert(...)` at the
+    top of the function). The `async function` wrapper coerces both sync
+    throws and returned non-promises into the Promise<Response> shape
+    callers expect, so an SSR caller's `await` always sees the rejection
+    through the cache layer's snapshot boundary instead of the error
+    escaping the request scope.
+    */
+    async function runHandler(args: Args | undefined): Promise<Response> {
+        return rpcLog.trace(
+            `rpc ${method} ${url}`,
+            () => handler(args as Args) as unknown as Response,
+        )
+    }
+
+    /*
+    Validates the parsed args against inputSchema (text fields), then — when the
+    verb declares filesSchema — validates the File parts parseArgs split onto
+    the request store and merges them into the args bag the handler receives.
+    Either schema's issues become a 422. Files stay out of inputSchema so its
+    JSON-Schema projection (OpenAPI/MCP/CLI) never has to model a binary.
+    */
+    async function validateThenHandle(args: Args | undefined): Promise<Response> {
+        let value: unknown = args
+        if (inputSchema) {
+            const result = await rpcLog.trace(`validate ${url}`, () =>
+                inputSchema['~standard'].validate(value),
+            )
+            if (result.issues) {
+                return json({ issues: result.issues }, { status: 422 })
+            }
+            value = result.value
+        }
+        if (filesSchema) {
+            const files = requestContext.getStore()?.files ?? {}
+            const result = await filesSchema['~standard'].validate(files)
+            if (result.issues) {
+                return json({ issues: result.issues }, { status: 422 })
+            }
+            value = { ...(value as object), ...(result.value as object) }
+        }
+        return runHandler(value as Args)
+    }
+
+    /*
+    `getRequest` is unused on the server path — handlers receive parsed
+    `args` directly and reach the inbound Request via `request()`.
+    createRemoteFunction passes a thunk so the client side can lazily
+    synthesize its Request without forcing the server to allocate one per
+    SSR call.
+    */
+    /* Abort the controller parseArgsForFetch stashed on store.req; a no-op when none was stashed (SSR cache reads). */
+    function abortVerbTimeout(): void {
+        const req = requestContext.getStore()?.req as
+            | (Request & { [VERB_TIMEOUT_ABORT]?: AbortController })
+            | undefined
+        req?.[VERB_TIMEOUT_ABORT]?.abort(new DOMException('handler timeout', 'TimeoutError'))
+    }
+
+    function invoke(args: Args | undefined): Promise<Response> {
+        const work = inputSchema || filesSchema ? validateThenHandle(args) : runHandler(args)
+        if (timeout === undefined) {
+            return work
+        }
+        /*
+        On the deadline, fire the controller parseArgsForFetch composed into
+        request().signal (absent on the SSR cache-read path, so a sibling
+        verb's outbound fetch is never cancelled) — then 504.
+        */
+        return runWithVerbTimeout(work, timeout, abortVerbTimeout)
+    }
+
+    const remote = createRemoteFunction<Args, Return>({
+        method,
+        url,
+        clients,
+        crossOrigin: opts?.crossOrigin,
+        buildRequest,
+        invoke,
+        parseArgsForFetch: async (request) => {
+            const args = await parseArgs(method, request, opts?.maxBodySize)
+            /*
+            Compose this verb's deadline into request().signal so a handler's
+            fetch(ext, { signal: request().signal }) is cancelled when the
+            timeout fires — not just abandoned. Applied after parseArgs onto the
+            scope's *final* request: a maxBodySize verb swaps store.req for a
+            buffered copy (readBodyWithinLimit) and an app.handle hook may
+            rewrite it, so composing onto the inbound `request` would leave
+            request() — and abortVerbTimeout, which reads store.req — pointed at
+            an un-cancellable signal. Only the signal is shadowed; the body
+            stays readable. The store always exists here (network + in-process
+            dispatch both run inside runWithRequestScope); SSR cache reads call
+            invoke() directly, never this path, so a sibling verb is never
+            cross-cancelled.
+            */
+            if (timeout !== undefined) {
+                const req = requestContext.getStore()?.req
+                if (req) {
+                    const controller = new AbortController()
+                    const composed = AbortSignal.any([req.signal, controller.signal])
+                    Object.defineProperty(req, 'signal', { value: composed, configurable: true })
+                    Object.defineProperty(req, VERB_TIMEOUT_ABORT, {
+                        value: controller,
+                        configurable: true,
+                    })
+                }
+            }
+            return args as Args | undefined
+        },
+    })
+    registerVerb({
+        remote: remote as RemoteFunction<unknown, unknown>,
+        inputSchema,
+        outputSchema,
+        filesSchema,
+        clients,
+        timeout,
+        maxBodySize: opts?.maxBodySize,
+        crossOrigin: opts?.crossOrigin,
+    })
+    return remote
+}

package/src/lib/server/rpc/dispatchVerbInProcess.ts

@@ -0,0 +1,46 @@
+import { buildRpcRequest } from '../../shared/buildRpcRequest.ts'
+import type { RemoteFunction } from '../../shared/types/RemoteFunction.ts'
+import type { AppModule } from '../AppModule.ts'
+import { runWithRequestScope } from '../runtime/runWithRequestScope.ts'
+
+/*
+Runs a verb in-process: synthesizes the rpc Request from the remote's own
+method + url and pipes it through remote.fetch — the same handler/validation/
+error path the HTTP router uses, no network hop. The single in-process
+dispatch every consumer surface (the CLI client, the MCP tool dispatcher, and
+the test client) routes through, so they can't drift on how a verb is invoked.
+Takes the RemoteFunction directly — invocation never reads the registry
+entry's schemas/clients (validation is closed over inside the remote), so the
+entry is not a dependency here. `baseUrl` gives the synthetic Request its
+origin (handlers reading request.url see the caller's host); `headers` carries
+forwarded auth/identity context.
+
+Runs inside the runWithRequestScope seam createServer crosses for real
+requests, so a handler sees an identical scope to a live HTTP request: a fresh
+per-request cache, the cookie jar with Set-Cookie flush, request()/server()
+resolution, and the app's handleError (or the 500 fallback) on a throw. The
+synthesized Request is shared between the scope store and the handler fetch so
+request() returns the same Request parseArgs read from.
+*/
+export function dispatchVerbInProcess({
+    remote,
+    args,
+    baseUrl,
+    headers,
+    app,
+}: {
+    remote: RemoteFunction<unknown, unknown>
+    args: unknown
+    baseUrl: string
+    headers?: Headers
+    app?: AppModule
+}): Promise<Response> {
+    const request = buildRpcRequest({
+        method: remote.method,
+        url: remote.url,
+        args,
+        baseUrl,
+        headers,
+    })
+    return runWithRequestScope(request, { app, logRequests: false }, () => remote.fetch(request))
+}

package/src/lib/server/rpc/findVerbByCommandName.ts

@@ -0,0 +1,18 @@
+import { commandNameForUrl } from '../../shared/commandNameForUrl.ts'
+import type { VerbRegistryEntry } from './types/VerbRegistryEntry.ts'
+import { verbRegistry } from './verbRegistry.ts'
+
+/*
+Finds the registered verb whose URL maps to a given command name (folder
+segments joined with `-`, per commandNameForUrl). The CLI client proxy and
+the MCP tool dispatcher both key off this name, so the scan lives here once
+rather than being re-implemented — and reused — at each call site.
+*/
+export function findVerbByCommandName(name: string): VerbRegistryEntry | undefined {
+    for (const entry of verbRegistry.values()) {
+        if (commandNameForUrl(entry.remote.url) === name) {
+            return entry
+        }
+    }
+    return undefined
+}

package/src/lib/server/rpc/parseArgs.ts

@@ -0,0 +1,127 @@
+import { carriesBodyArgs } from '../../shared/carriesBodyArgs.ts'
+import { HttpError } from '../../shared/HttpError.ts'
+import type { HttpVerb } from '../../shared/types/HttpVerb.ts'
+import { error } from '../error.ts'
+import { requestContext } from '../runtime/requestContext.ts'
+import { readBodyWithinLimit } from './readBodyWithinLimit.ts'
+
+/*
+Splits a parsed FormData into the text fields that become args and the File
+parts that don't. Repeated text keys collapse into an array (an HTML form posts
+multiple same-named inputs); File parts group by field name and stash on the
+request store for files() to read — they never enter args, so the input schema
+keeps validating a plain object with no binary in it.
+*/
+function splitFormData(form: FormData): Record<string, unknown> {
+    const fileMap: Record<string, File[]> = {}
+    const fields: Record<string, unknown> = {}
+    for (const [key, value] of form) {
+        if (value instanceof File) {
+            fileMap[key] ??= []
+            fileMap[key].push(value)
+            continue
+        }
+        const existing = fields[key]
+        if (!(key in fields)) {
+            fields[key] = value
+        } else if (Array.isArray(existing)) {
+            existing.push(value)
+        } else {
+            fields[key] = [existing, value]
+        }
+    }
+    const store = requestContext.getStore()
+    if (store && Object.keys(fileMap).length > 0) {
+        store.files = fileMap
+    }
+    return fields
+}
+
+/*
+Parses + merges every source of args available for a verb-defined handler:
+- body (json or form-encoded, ignored for GET/DELETE/HEAD)
+- url query string
+
+When both are present and the body is a plain object, the merge layers the
+body on top of the query so the typed body wins on collision — the query
+supplies defaults a body field can override, and a URL param can't silently
+shadow a validated body value. A non-object body (array, primitive, null)
+skips the merge entirely and is returned as-is — there's no key on the body
+to layer the query into, and the framework's args type is a single bag rather
+than a `{body, query}` envelope. Returns undefined when no source contributes
+any key.
+
+`maxBodySize` (per-verb, opt-in) bounds the body's actual received bytes
+before any parse — see readBodyWithinLimit. Omitted = no abide-level check;
+Bun.serve's server-wide maxRequestBodySize is the ceiling.
+*/
+export async function parseArgs(
+    method: HttpVerb,
+    request: Request,
+    maxBodySize?: number,
+): Promise<unknown> {
+    /*
+    Skip the URL parse entirely when the raw request URL has no query —
+    typical POST/PUT/PATCH calls land here with a flat rpc URL and no
+    `?…`, so the `new URL(...)` constructor cost (which dwarfs the
+    indexOf check) is wasted work.
+    */
+    const queryStart = request.url.indexOf('?')
+    const hasQuery = queryStart !== -1
+    const url = hasQuery ? new URL(request.url) : undefined
+
+    let body: unknown
+    if (carriesBodyArgs(method)) {
+        let bounded = request
+        if (maxBodySize !== undefined) {
+            bounded = await readBodyWithinLimit(request, maxBodySize)
+            /*
+            The size check drained the original body, so point the scope's
+            request at the readable copy — a handler with a content-type this
+            parse skips (raw uploads) reads the body via request() itself, and
+            it must see the bytes, not 'Body already used'.
+            */
+            const store = requestContext.getStore()
+            if (store) {
+                store.req = bounded
+            }
+        }
+        const contentType = (bounded.headers.get('content-type') ?? '').toLowerCase()
+        try {
+            if (contentType.includes('application/json')) {
+                const text = await bounded.text()
+                if (text !== '') {
+                    body = JSON.parse(text)
+                }
+            } else if (
+                contentType.includes('application/x-www-form-urlencoded') ||
+                contentType.includes('multipart/form-data')
+            ) {
+                body = splitFormData(await bounded.formData())
+            }
+        } catch {
+            /* A malformed body is the client's fault — surface a 400, not the 500 a
+               raw JSON.parse/formData throw would bubble to. createRemoteFunction.fetch
+               unwraps the HttpError's response onto the wire (as it does for the 413). */
+            throw new HttpError(error(400, 'Malformed request body'))
+        }
+    }
+
+    if (body !== undefined && (typeof body !== 'object' || body === null || Array.isArray(body))) {
+        return body
+    }
+
+    if (!url) {
+        if (body === undefined) {
+            return undefined
+        }
+        return body
+    }
+
+    const bodyObject = (body ?? {}) as Record<string, unknown>
+    const merged = { ...Object.fromEntries(url.searchParams), ...bodyObject }
+    if (Object.keys(merged).length === 0) {
+        return undefined
+    }
+    return merged
+}

package/src/lib/server/rpc/readBodyWithinLimit.ts

@@ -0,0 +1,44 @@
+import { HttpError } from '../../shared/HttpError.ts'
+import { error } from '../error.ts'
+
+/*
+Enforces a verb's maxBodySize on the actual received bytes, not the
+Content-Length header (absent on chunked bodies, trivially spoofed). A
+declared Content-Length over the limit rejects before reading anything;
+otherwise the body streams into a buffer that throws 413 the moment the
+limit is crossed — aborting the read, so the remaining bytes are never
+consumed. Returns a reassembled Request carrying the buffered body and the
+original headers, so the parse path's .text()/.formData() work unchanged.
+Only called when the verb declares maxBodySize; the default ceiling is
+Bun.serve's server-wide maxRequestBodySize, which Bun enforces natively.
+*/
+export async function readBodyWithinLimit(request: Request, maxBytes: number): Promise<Request> {
+    const tooLarge = () =>
+        new HttpError(error(413, `request body exceeds maxBodySize (${maxBytes} bytes)`))
+    const declared = Number(request.headers.get('content-length') ?? Number.NaN)
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw tooLarge()
+    }
+    if (!request.body) {
+        return request
+    }
+    const chunks: Uint8Array[] = []
+    let total = 0
+    for await (const chunk of request.body) {
+        total += chunk.byteLength
+        if (total > maxBytes) {
+            throw tooLarge()
+        }
+        chunks.push(chunk)
+    }
+    const buffered = new Uint8Array(total)
+    chunks.reduce((offset, chunk) => {
+        buffered.set(chunk, offset)
+        return offset + chunk.byteLength
+    }, 0)
+    return new Request(request.url, {
+        method: request.method,
+        headers: request.headers,
+        body: buffered,
+    })
+}

package/src/lib/server/rpc/registerVerb.ts

@@ -0,0 +1,6 @@
+import type { VerbRegistryEntry } from './types/VerbRegistryEntry.ts'
+import { verbRegistry } from './verbRegistry.ts'
+
+export function registerVerb(entry: VerbRegistryEntry): void {
+    verbRegistry.set(entry.remote.url, entry)
+}

package/src/lib/server/rpc/runWithVerbTimeout.ts

@@ -0,0 +1,49 @@
+import { error } from '../error.ts'
+
+/*
+Bounds a verb handler's execution: races the in-flight `work` against `ms`.
+On the deadline it resolves a 504 — so the caller (an SSR cache read, an
+MCP/CLI invocation, or the network response) is unblocked in time with an
+honest status — and calls `onTimeout` to cancel any
+cooperating outbound work (the network path composes the verb's deadline into
+request().signal; see defineVerb).
+
+`work` keeps running after the deadline — JS can't cancel a running async
+function, only stop awaiting it — so its eventual settlement is swallowed to
+avoid an unhandled rejection, and a late-resolved streaming Response has its
+body cancelled to release the underlying source. A handler that wants its own
+outbound I/O torn down should pass request().signal to it.
+*/
+export function runWithVerbTimeout(
+    work: Promise<Response>,
+    ms: number,
+    onTimeout: () => void,
+): Promise<Response> {
+    let timer: ReturnType<typeof setTimeout> | undefined
+    let timedOut = false
+    const deadline = new Promise<Response>((resolve) => {
+        timer = setTimeout(() => {
+            timedOut = true
+            onTimeout()
+            resolve(error(504, 'handler timeout'))
+        }, ms)
+    })
+    return (async () => {
+        try {
+            return await Promise.race([work, deadline])
+        } finally {
+            clearTimeout(timer)
+            if (timedOut) {
+                // The race already returned a 504. Swallow a late rejection, and
+                // cancel a late-resolved streaming Response's body so its source
+                // (DB cursor, file handle) is released rather than leaked.
+                void work.then(
+                    (late) => {
+                        void late.body?.cancel()
+                    },
+                    () => {},
+                )
+            }
+        }
+    })()
+}