@ractive-ch/tab-mcp 0.3.1 → 0.4.0

package/README.md

@@ -10,7 +10,7 @@ and gets an MCP address. The user adds that address to an AI app and pairs it by
 a code from the page on the relay's sign-in page. The relay then forwards the AI app's
 requests to the page. It knows nothing about the tools themselves.
 
-**Status: 0.3.1.** Until 1.0, a new minor version can still change settings and the API.
+**Status: 0.4.0.** Until 1.0, a new minor version can still change settings and the API.
 The relay speaks MCP revision 2026-07-28 only and accepts AI apps that register through
 OAuth Client ID Metadata Documents; see [compatibility](https://github.com/ractive/tab-mcp/blob/main/docs/compatibility.md)
 for which apps work.
@@ -32,7 +32,7 @@ Or with Docker (linux/amd64 and linux/arm64):
 docker run -d -p 127.0.0.1:8080:8080 -v tab-mcp-data:/data \
   -e TAB_MCP_PUBLIC_URL=https://relay.example.com \
   -e TAB_MCP_ALLOWED_ORIGINS=https://app.example.com \
-  ractive/tab-mcp:0.3.1
+  ractive/tab-mcp:0.4.0
 ```
 
 The image is also on `ghcr.io/ractive/tab-mcp`. Put the relay behind a reverse proxy

package/exchange.d.ts

@@ -16,19 +16,28 @@ export declare const RelayErrorCode: {
     readonly badResponse: -31007;
     readonly storeUnavailable: -31008;
     readonly signedOut: -31009;
+    readonly restarting: -31010;
 };
 export type CancelReason = "client_closed" | "timeout" | "error";
 /**
  * What to do when the page goes away mid-request (DEC-074): send the request
  * to the page again once it is back (only while nothing was sent to the AI
- * app), or answer with this JSON-RPC message at HTTP 200 (`undefined` for a
- * notification: then 503).
+ * app), answer with this JSON-RPC message at HTTP 200, or fail with this
+ * error (no body and no error: 503, `-31003`).
  */
 export type PageGoneReply = {
     retry: true;
 } | {
     retry: false;
     body?: string;
+} | {
+    retry: false;
+    error: {
+        status: number;
+        code: number;
+        message: string;
+        headers: Record<string, string>;
+    };
 };
 export interface ExchangeOptions {
     id: string;
@@ -89,5 +98,5 @@ export declare class Exchange {
      * nothing was sent, else a JSON-RPC error event if the stream is at an
      * event boundary.
      */
-    fail(status: number, code: number, message: string, cancelTab: boolean): void;
+    fail(status: number, code: number, message: string, cancelTab: boolean, headers?: Record<string, string>): void;
 }

package/identity.d.ts

@@ -20,7 +20,8 @@ export declare function identityKey(issuer: string, subject: string): string;
 /** Verifies tab assertions (DEC-076) and remembers used `jti`s. */
 export declare class TabAssertionVerifier {
     #private;
-    constructor(oidc: OidcConfig, keys?: KeySource);
+    /** `maxSeen` replaces `MAX_SEEN_JTI` (tests only). */
+    constructor(oidc: OidcConfig, keys?: KeySource, maxSeen?: number);
     /**
      * Check an assertion for an MCP address; returns the binding key. Throws
      * `JwtError` with a short reason for the log.