@mastra/mcp 2.5.0-alpha.2 → 2.5.0

package/dist/shared/events/webhook.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Generate a Standard Webhooks symmetric secret: `whsec_` + base64 of 32 CSPRNG bytes.
+ *
+ * @experimental SEP-3415 is a draft; this API may change.
+ */
+export declare function generateWebhookSecret(): string;
+/** @experimental SEP-3415 is a draft; this API may change. */
+export interface SignWebhookOptions {
+    /** One secret, or several to dual-sign during a rotation grace window. */
+    secret: string | readonly string[];
+    /** The `webhook-id` value. */
+    id: string;
+    /** The `webhook-timestamp` value, in Unix seconds. */
+    timestamp: number;
+    /** The raw request body, exactly as it will be sent. */
+    body: string | Uint8Array;
+}
+/**
+ * Compute the `webhook-signature` header value: `v1,<base64 HMAC-SHA256>` over
+ * `${id}.${timestamp}.` + raw body. Several secrets yield space-separated signatures.
+ *
+ * @throws {Error} when a secret is not a valid `whsec_` secret.
+ * @experimental SEP-3415 is a draft; this API may change.
+ */
+export declare function signWebhook({ secret, id, timestamp, body }: SignWebhookOptions): string;
+/** @experimental SEP-3415 is a draft; this API may change. */
+export type WebhookVerifyFailure = 'missing_headers' | 'invalid_timestamp' | 'stale_timestamp' | 'invalid_signature';
+/** @experimental SEP-3415 is a draft; this API may change. */
+export type WebhookVerifyResult = {
+    ok: true;
+    id: string;
+    timestamp: number;
+    /** The `X-MCP-Subscription-Id` header, when present. */
+    subscriptionId?: string;
+    /** The secret whose signature matched. */
+    secret: string;
+} | {
+    ok: false;
+    reason: WebhookVerifyFailure;
+};
+/** @experimental SEP-3415 is a draft; this API may change. */
+export type WebhookHeaders = Headers | Record<string, string | string[] | undefined>;
+/** @experimental SEP-3415 is a draft; this API may change. */
+export interface VerifyWebhookOptions {
+    /** The expected secret, or every candidate secret (for example those not yet associated with an `id`). */
+    secret: string | readonly string[];
+    headers: WebhookHeaders;
+    /** The raw request body bytes exactly as received, never a re-serialized object. */
+    body: string | Uint8Array;
+    /** Maximum allowed clock skew, in seconds, in either direction. Defaults to 300. */
+    toleranceSec?: number;
+}
+/**
+ * Verify a Standard Webhooks delivery. Never throws on malformed input; returns a typed failure instead.
+ * Signatures are compared in constant time, and any `v1,` signature matching any secret is accepted.
+ *
+ * @experimental SEP-3415 is a draft; this API may change.
+ */
+export declare function verifyWebhook({ secret, headers, body, toleranceSec, }: VerifyWebhookOptions): WebhookVerifyResult;
+//# sourceMappingURL=webhook.d.ts.map

package/dist/shared/events/webhook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook.d.ts","sourceRoot":"","sources":["../../../src/shared/events/webhook.ts"],"names":[],"mappings":"AAaA;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,8DAA8D;AAC9D,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnC,8BAA8B;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B;AAUD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,kBAAkB,GAAG,MAAM,CAavF;AAED,8DAA8D;AAC9D,MAAM,MAAM,oBAAoB,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,mBAAmB,CAAC;AAErH,8DAA8D;AAC9D,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEhD,8DAA8D;AAC9D,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;AAErF,8DAA8D;AAC9D,MAAM,WAAW,oBAAoB;IACnC,0GAA0G;IAC1G,MAAM,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACnC,OAAO,EAAE,cAAc,CAAC;IACxB,oFAAoF;IACpF,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;IAC1B,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAcD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,EAC5B,MAAM,EACN,OAAO,EACP,IAAI,EACJ,YAAoC,GACrC,EAAE,oBAAoB,GAAG,mBAAmB,CAyC5C"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mastra/mcp",
-  "version": "2.5.0-alpha.2",
+  "version": "2.5.0",
   "description": "",
   "type": "module",
   "main": "dist/index.js",
@@ -34,7 +34,7 @@
     "fast-deep-equal": "^3.1.3"
   },
   "peerDependencies": {
-    "@mastra/core": ">=1.76.0-0 <2.0.0-0",
+    "@mastra/core": ">=1.79.0-0 <2.0.0-0",
     "zod": "^4.2.0"
   },
   "devDependencies": {
@@ -53,14 +53,14 @@
     "vitest": "4.1.11",
     "zod": "^4.6.7",
     "zod-to-json-schema": "^3.25.1",
-    "@internal/lint": "0.0.144",
-    "@internal/ai-sdk-v5": "0.0.91",
-    "@internal/llm-recorder": "0.0.80",
-    "@internal/types-builder": "0.0.119",
-    "@internal/test-utils": "0.0.80",
-    "@mastra/schema-compat": "1.3.16-alpha.0",
-    "@mastra/core": "1.79.0-alpha.11",
-    "@mastra/observability": "1.21.0-alpha.2"
+    "@internal/lint": "0.0.145",
+    "@internal/ai-sdk-v5": "0.0.92",
+    "@internal/llm-recorder": "0.0.81",
+    "@internal/test-utils": "0.0.81",
+    "@mastra/core": "1.79.0",
+    "@internal/types-builder": "0.0.120",
+    "@mastra/schema-compat": "1.3.16",
+    "@mastra/observability": "1.21.0"
   },
   "homepage": "https://mastra.ai",
   "repository": {