mcp-trellis 0.2.1 → 1.0.0

package/dist/body.js

@@ -0,0 +1,145 @@
+/**
+ * Request-body size limits. Nothing upstream caps body size on its own —
+ * `request.json()` / `request.text()` and a raw `http.createServer` stream
+ * both buffer the whole body in memory first, so an uncapped read is a
+ * straightforward memory-exhaustion DoS.
+ */
+export class BodyTooLargeError extends Error {
+    maxBytes;
+    constructor(maxBytes) {
+        super(`request body exceeds ${maxBytes} bytes`);
+        this.maxBytes = maxBytes;
+        this.name = "BodyTooLargeError";
+    }
+}
+/** Default cap for `/mcp` — JSON-RPC payloads, generally small but tool args can be text-heavy. */
+export const DEFAULT_MCP_BODY_LIMIT = 1_048_576; // 1 MiB
+/** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */
+export const DEFAULT_OAUTH_BODY_LIMIT = 65_536; // 64 KiB
+const declaredContentLength = (headers) => {
+    const header = headers.get("content-length");
+    if (!header)
+        return null;
+    const declared = Number(header);
+    return Number.isFinite(declared) ? declared : null;
+};
+const concatBytes = (chunks, total) => {
+    const combined = new Uint8Array(total);
+    chunks.reduce((offset, chunk) => {
+        combined.set(chunk, offset);
+        return offset + chunk.byteLength;
+    }, 0);
+    return combined;
+};
+const toBytes = (chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+/**
+ * Reads a Web `Request` body as text, rejecting early on an honest
+ * oversized `Content-Length`, then aborting mid-stream — before the whole
+ * body is buffered — if a chunked body (no `Content-Length`) exceeds
+ * `maxBytes`. Falls back to `request.text()` when `request.body` is null
+ * (some runtimes don't expose a streaming body), still enforcing the cap.
+ */
+export const readBoundedText = async (request, maxBytes) => {
+    const declared = declaredContentLength(request.headers);
+    if (declared !== null && declared > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    const reader = request.body?.getReader();
+    if (!reader) {
+        const text = await request.text();
+        if (new TextEncoder().encode(text).byteLength > maxBytes) {
+            throw new BodyTooLargeError(maxBytes);
+        }
+        return text;
+    }
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            // ponytail: one oversized chunk can briefly allocate maxBytes + highWaterMark
+            // (~64 KiB on Node) before reject — fine for 1 MiB / 64 KiB caps.
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new BodyTooLargeError(maxBytes);
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    return new TextDecoder().decode(concatBytes(chunks, total));
+};
+export const isNodeReadable = (value) => typeof value?.on === "function" &&
+    typeof value?.pause === "function" &&
+    typeof value?.removeListener === "function";
+const readFromEvents = (stream, maxBytes) => new Promise((resolve, reject) => {
+    const collected = [];
+    let total = 0;
+    let settled = false;
+    const onData = (chunk) => {
+        const bytes = toBytes(chunk);
+        total += bytes.byteLength;
+        if (total > maxBytes) {
+            fail(new BodyTooLargeError(maxBytes));
+            return;
+        }
+        collected.push(bytes);
+    };
+    const onEnd = () => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        resolve(concatBytes(collected, total));
+    };
+    const onError = (err) => {
+        fail(err);
+    };
+    const cleanup = () => {
+        stream.removeListener("data", onData);
+        stream.removeListener("end", onEnd);
+        stream.removeListener("error", onError);
+    };
+    const fail = (err) => {
+        if (settled)
+            return;
+        settled = true;
+        stream.pause();
+        cleanup();
+        reject(err);
+    };
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", onError);
+});
+const readFromAsyncIterable = async (chunks, maxBytes) => {
+    const collected = [];
+    let total = 0;
+    for await (const chunk of chunks) {
+        const bytes = toBytes(chunk);
+        total += bytes.byteLength;
+        if (total > maxBytes)
+            throw new BodyTooLargeError(maxBytes);
+        collected.push(bytes);
+    }
+    return concatBytes(collected, total);
+};
+/**
+ * Same contract as `readBoundedText` for a raw Node request stream.
+ * Does **not** destroy the socket — that races a 413 response into EPIPE.
+ * On overflow the event path pauses and drops listeners; the caller writes
+ * 413 then tears down after flush.
+ */
+export const readBoundedNodeBody = async (source, maxBytes, options = {}) => {
+    const declared = options.contentLength ? Number(options.contentLength) : NaN;
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    if (isNodeReadable(source))
+        return readFromEvents(source, maxBytes);
+    return readFromAsyncIterable(source, maxBytes);
+};
+//# sourceMappingURL=body.js.map

package/dist/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../src/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,wBAAwB,QAAQ,QAAQ,CAAC,CAAC;QAD7B,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,CAAC,QAAQ;AAEzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,SAAS;AAEzD,MAAM,qBAAqB,GAAG,CAAC,OAE9B,EAAiB,EAAE;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAoB,EAAE,KAAa,EAAc,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAA0B,EAAc,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,OAAgB,EAAE,QAAgB,EAAmB,EAAE;IAC3F,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YACzD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,8EAA8E;YAC9E,kEAAkE;YAClE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC;AAqBF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC1E,OAAQ,KAAiC,EAAE,EAAE,KAAK,UAAU;IAC5D,OAAQ,KAAoC,EAAE,KAAK,KAAK,UAAU;IAClE,OAAQ,KAA6C,EAAE,cAAc,KAAK,UAAU,CAAC;AAEvF,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAE,QAAgB,EAAuB,EAAE,CACzF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAQ,EAAE;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAsC,CAAC,CAAC;QACtE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAqC,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAuC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAQ,EAAE;QAChC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,KAAK,EACjC,MAA0C,EAC1C,QAAgB,EACK,EAAE;IACvB,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAA6D,EAC7D,QAAgB,EAChB,UAAkC,EAAE,EACf,EAAE;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC,CAAC"}

package/dist/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,wBAAwB,EAAE,uBAAuB,EAAE,CAAC;IACpD;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAyB7D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAAU,EAAe,CAAC;AAExD,kEAAkE;AAClE,eAAO,MAAM,eAAe,GAAI,SAAS,UAAU,EAAE,KAAG,MAAM,EAE7D,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,cAAc,GACzB,SAAS,UAAU,EAAE,KACpB,uBAAuB,EASzB,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,EAAE,KAAG,UAAU,EACR,CAAC;AAEhE,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,GAAI,SAAS,UAAU,EAAE,KAAG,OACK,CAAC;AAE/D,eAAO,MAAM,uBAAuB,GAClC,SAAS,UAAU,EAAE,EACrB,aAAa,WAAW,GAAG,SAAS,KACnC,IASF,CAAC"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA+B,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,wBAAwB,EAAE,uBAAuB,EAAE,CAAC;IACpD;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAsB7D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAAU,EAAe,CAAC;AAExD,kEAAkE;AAClE,eAAO,MAAM,eAAe,GAAI,SAAS,UAAU,EAAE,KAAG,MAAM,EAE7D,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,cAAc,GAAI,SAAS,UAAU,EAAE,KAAG,uBAAuB,EAS7E,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,EAAE,KAAG,UAAU,EACR,CAAC;AAEhE,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,GAAI,SAAS,UAAU,EAAE,KAAG,OACK,CAAC;AAE/D,eAAO,MAAM,uBAAuB,GAClC,SAAS,UAAU,EAAE,EACrB,aAAa,WAAW,GAAG,SAAS,KACnC,IASF,CAAC"}

package/dist/clients.js

@@ -5,7 +5,7 @@
  * callback URLs, different registration models. Encoding that here is the
  * point: you name your clients, the library configures the AS to match.
  */
-import { TOKEN_ENDPOINT_AUTH_METHODS, } from "./oauth/constants.js";
+import { TOKEN_ENDPOINT_AUTH_METHODS } from "./oauth/constants.js";
 import { CLAUDE_CALLBACK } from "./oauth/redirect.js";
 export const CLIENT_PROFILES = {
     /** Claude Custom Connectors — dynamic registration, public client + PKCE. */
@@ -20,10 +20,7 @@ export const CLIENT_PROFILES = {
      */
     gemini: {
         redirectUris: [],
-        tokenEndpointAuthMethods: [
-            TOKEN_ENDPOINT_AUTH_METHODS.basic,
-            TOKEN_ENDPOINT_AUTH_METHODS.post,
-        ],
+        tokenEndpointAuthMethods: [TOKEN_ENDPOINT_AUTH_METHODS.basic, TOKEN_ENDPOINT_AUTH_METHODS.post],
         preRegistered: true,
     },
     /** OpenAI Codex / ChatGPT connectors — OAuth 2.1 per the MCP auth spec. */

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiBtD,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE;YACxB,2BAA2B,CAAC,KAAK;YACjC,2BAA2B,CAAC,IAAI;SACjC;QACD,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAqB,EACM,EAAE;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiBtD,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/dispatch.d.ts

@@ -1,5 +1,5 @@
 import { type McpHandlerOptions } from "./methods.js";
-export type { Principal, AuditEntry, McpPorts, ServerInfo, McpHandlerOptions, } from "./methods.js";
+export type { AuditEntry, McpHandlerOptions, McpPorts, Principal, ServerInfo, } from "./methods.js";
 export type McpHandler = {
     fetch: (request: Request) => Promise<Response>;
 };

package/dist/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAeA,OAAO,EAOL,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,SAAS,EACT,UAAU,EACV,QAAQ,EACR,UAAU,EACV,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AA+FF,eAAO,MAAM,gBAAgB,GAAI,IAAI,EACnC,SAAS,iBAAiB,CAAC,IAAI,CAAC,KAC/B,UA8BF,CAAC"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAkBA,OAAO,EAIL,KAAK,iBAAiB,EAIvB,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,QAAQ,EACR,SAAS,EACT,UAAU,GACX,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAiIF,eAAO,MAAM,gBAAgB,GAAI,IAAI,EAAE,SAAS,iBAAiB,CAAC,IAAI,CAAC,KAAG,UAyBzE,CAAC"}

package/dist/dispatch.js

@@ -1,39 +1,74 @@
-import { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_PARSE_ERROR, rpcError, } from "./jsonrpc.js";
-import { INTERNAL_ERROR, emptyResponse, jsonResponse, methodNotAllowed, optionsResponse, } from "./http.js";
 import { rejectQueryToken } from "./auth/bearer.js";
+import { BodyTooLargeError, DEFAULT_MCP_BODY_LIMIT, readBoundedText } from "./body.js";
+import { emptyResponse, INTERNAL_ERROR, jsonResponse, methodNotAllowed, optionsResponse, } from "./http.js";
+import { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_REQUEST, JSONRPC_PARSE_ERROR, JSONRPC_PAYLOAD_TOO_LARGE, rpcError, } from "./jsonrpc.js";
 import { DEFAULT_PUBLIC_METHODS, dispatchRpc, isNotification, resolveWww, safeAudit, unauthorized, } from "./methods.js";
+import { PROTOCOL_VERSIONS } from "./protocol.js";
 const parseBody = async (request) => {
+    let text;
     try {
-        return await request.json();
+        text = await readBoundedText(request, DEFAULT_MCP_BODY_LIMIT);
+    }
+    catch (exc) {
+        if (exc instanceof BodyTooLargeError) {
+            return jsonResponse(rpcError(null, JSONRPC_PAYLOAD_TOO_LARGE, "Payload too large"), 413);
+        }
+        return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
+    }
+    try {
+        return JSON.parse(text);
     }
     catch {
         return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
     }
 };
 /** Transport-level denial: no JSON-RPC method has been parsed yet. */
-const auditDenial = (options, error) => safeAudit(options, { method: "", ok: false, error, durationMs: 0 });
-const guardPost = async (request, options) => {
+const auditDenial = (options, error, startedAt) => safeAudit(options, { method: "", ok: false, error, durationMs: Date.now() - startedAt });
+const guardPost = async (request, options, startedAt) => {
     if (rejectQueryToken(new URL(request.url))) {
-        await auditDenial(options, "query_string_token");
+        await auditDenial(options, "query_string_token", startedAt);
         return unauthorized(resolveWww(options, request), "Token in query string is rejected. Use Authorization Bearer.");
     }
     return null;
 };
-const handleGet = async (request, options) => {
+const handleGet = async (request, options, startedAt) => {
     if (rejectQueryToken(new URL(request.url))) {
-        await auditDenial(options, "query_string_token");
+        await auditDenial(options, "query_string_token", startedAt);
         return jsonResponse({
             error: "Pass token via Authorization: Bearer header, not query string",
         }, 400);
     }
     if (!request.headers.get("authorization")) {
-        await auditDenial(options, "unauthorized");
+        await auditDenial(options, "unauthorized", startedAt);
         return unauthorized(resolveWww(options, request));
     }
     return methodNotAllowed("Use POST for MCP");
 };
-const handlePost = async (request, options, publicMethods) => {
-    const denied = await guardPost(request, options);
+/**
+ * RFC-shaped JSON-RPC id extraction for an error response before
+ * `dispatchRpc`'s own normalization runs — `undefined` (omitted, as on a
+ * notification) becomes `null`; anything else is echoed as-is, matching
+ * `dispatchRpc`'s rule so a client sees the same id either way.
+ */
+const errorId = (msg) => (msg.id === undefined ? null : msg.id);
+/**
+ * The 2025-06-18 spec requires `MCP-Protocol-Version` on every request past
+ * `initialize` (which is what negotiates it in the first place — the
+ * client can't have the header yet). Unknown/unsupported → 400. Missing →
+ * assume `2025-03-26` per the spec's own backwards-compatibility rule for
+ * the header specifically (not the same default `initialize` falls back
+ * to — see `protocol.ts`).
+ */
+const protocolVersionHeaderError = (request, msg) => {
+    if (msg.method === "initialize")
+        return null;
+    const header = request.headers.get("MCP-Protocol-Version");
+    if (!header || PROTOCOL_VERSIONS.has(header))
+        return null;
+    return jsonResponse(rpcError(errorId(msg), JSONRPC_INVALID_REQUEST, `Unsupported MCP-Protocol-Version: ${header}`), 400);
+};
+const handlePost = async (request, options, publicMethods, startedAt) => {
+    const denied = await guardPost(request, options, startedAt);
     if (denied)
         return denied;
     const parsed = await parseBody(request);
@@ -46,31 +81,36 @@ const handlePost = async (request, options, publicMethods) => {
         return jsonResponse(rpcError(null, JSONRPC_PARSE_ERROR, "Parse error"), 400);
     }
     const msg = parsed;
+    if (msg.jsonrpc !== "2.0") {
+        return jsonResponse(rpcError(errorId(msg), JSONRPC_INVALID_REQUEST, 'jsonrpc must be "2.0"'), 400);
+    }
+    const versionError = protocolVersionHeaderError(request, msg);
+    if (versionError)
+        return versionError;
     if (isNotification(msg))
         return emptyResponse(202);
-    return dispatchRpc({ req: request, body: msg, options, publicMethods });
+    return dispatchRpc({ req: request, body: msg, options, publicMethods, startedAt });
 };
 export const createMcpHandler = (options) => {
     const publicMethods = options.publicMethods ?? DEFAULT_PUBLIC_METHODS;
     const HTTP_METHODS = {
         OPTIONS: () => optionsResponse(),
-        GET: (request) => handleGet(request, options),
-        POST: (request) => handlePost(request, options, publicMethods),
+        GET: (request, startedAt) => handleGet(request, options, startedAt),
+        POST: (request, startedAt) => handlePost(request, options, publicMethods, startedAt),
     };
     return {
         fetch: async (request) => {
+            const startedAt = Date.now();
             try {
                 const handler = HTTP_METHODS[request.method];
-                return await (handler
-                    ? handler(request, options, publicMethods)
-                    : methodNotAllowed());
+                return await (handler ? handler(request, startedAt) : methodNotAllowed());
             }
             catch (exc) {
                 // A host port (authenticate/context/audit) threw. `fetch` must never
                 // reject — the caller gets an honest 500, not an unhandled rejection
                 // whose shape depends on which runtime is hosting this.
                 const error = exc instanceof Error && exc.message ? exc.message : INTERNAL_ERROR;
-                await auditDenial(options, error);
+                await auditDenial(options, error, startedAt);
                 return jsonResponse(rpcError(null, JSONRPC_INTERNAL_ERROR, "Internal error"), 500);
             }
         },

package/dist/dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EAEnB,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,cAAc,EACd,UAAU,EACV,SAAS,EACT,YAAY,GAEb,MAAM,cAAc,CAAC;AActB,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgB,EAA+B,EAAE;IACxE,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAClD,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,GAAG,CAClB,OAAgC,EAChC,KAAa,EACE,EAAE,CACjB,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;AAEtE,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EACN,EAAE;IAC5B,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACjD,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EACb,EAAE;IACrB,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACjD,OAAO,YAAY,CACjB;YACE,KAAK,EACH,+DAA+D;SAClE,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAC3C,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EACtB,OAAgB,EAChB,OAAgC,EAChC,aAA0B,EACP,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CACjB,QAAQ,CACN,IAAI,EACJ,uBAAuB,EACvB,8BAA8B,CAC/B,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAClD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAwB,CAAC;IACrC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAgC,EACpB,EAAE;IACd,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEtE,MAAM,YAAY,GAAuC;QACvD,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAChC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;QAC7C,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC;KAC/D,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,OAAO;oBACnB,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC;oBAC1C,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC1B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,KAAK,GACT,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACrE,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,EACxD,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACvF,OAAO,EACL,aAAa,EACb,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,yBAAyB,EAGzB,QAAQ,GACT,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,cAAc,EAEd,UAAU,EACV,SAAS,EACT,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAclD,MAAM,SAAS,GAAG,KAAK,EAAE,OAAgB,EAA+B,EAAE;IACxE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;YACrC,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,EAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC,CAAC;AAEF,sEAAsE;AACtE,MAAM,WAAW,GAAG,CAClB,OAAgC,EAChC,KAAa,EACb,SAAiB,EACF,EAAE,CACjB,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAE3F,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACS,EAAE;IAC5B,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,YAAY,CACjB,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,EAC5B,8DAA8D,CAC/D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,EACrB,OAAgB,EAChB,OAAgC,EAChC,SAAiB,EACE,EAAE;IACrB,IAAI,gBAAgB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,WAAW,CAAC,OAAO,EAAE,oBAAoB,EAAE,SAAS,CAAC,CAAC;QAC5D,OAAO,YAAY,CACjB;YACE,KAAK,EAAE,+DAA+D;SACvE,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;QAC1C,MAAM,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;QACtD,OAAO,YAAY,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,OAAO,GAAG,CAAC,GAAmB,EAAa,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAAG,CAAC,OAAgB,EAAE,GAAmB,EAAmB,EAAE;IAC5F,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,OAAO,YAAY,CACjB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,uBAAuB,EAAE,qCAAqC,MAAM,EAAE,CAAC,EAC9F,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EACtB,OAAgB,EAChB,OAAgC,EAChC,aAA0B,EAC1B,SAAiB,EACE,EAAE;IACrB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,YAAY,QAAQ;QAAE,OAAO,MAAM,CAAC;IAE9C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,YAAY,CACjB,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE,8BAA8B,CAAC,EACvE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,GAAG,GAAG,MAAwB,CAAC;IACrC,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,YAAY,CACjB,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,EACxE,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,0BAA0B,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAO,OAAgC,EAAc,EAAE;IACrF,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAEtE,MAAM,YAAY,GAAiC;QACjD,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QAChC,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QACnE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC;KACrF,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC5E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;gBACjF,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;gBAC7C,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,eAAO,MAAM,WAAW,GACtB,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAMtB,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,MAAM,OAAO,EACb,eAAY,EACZ,eAAe,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,mBAAmB,KAC5B,QAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,QACS,CAAC;AAEzD,eAAO,MAAM,eAAe,GAAI,UAAU,mBAAmB,KAAG,QAI5D,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAC3B,gBAA8B,EAC9B,UAAU,mBAAmB,KAC5B,QAAqE,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,UAAU,mBAAmB,KAC5B,QAAQ,GAAG,IASb,CAAC"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAKhF,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,MAAM,OAAO,EACb,eAAY,EACZ,eAAe,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACrC,UAAU,mBAAmB,KAC5B,QAWF,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,QACS,CAAC;AAEzD,eAAO,MAAM,eAAe,GAAI,UAAU,mBAAmB,KAAG,QAI5D,CAAC;AAEL,eAAO,MAAM,gBAAgB,GAC3B,gBAA8B,EAC9B,UAAU,mBAAmB,KAC5B,QAAqE,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,UAAU,mBAAmB,KAC5B,QAAQ,GAAG,IAIb,CAAC"}

package/dist/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,KAA8B,EACN,EAAE,CAAC,CAAC;IAC5B,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;IACrD,GAAG,KAAK;CACT,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,YAAqC,EACrC,OAA6B,EACnB,EAAE;IACZ,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,YAAY;SAChB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;CACnF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,CACjB,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAChC,GAAG,EACH,SAAS,EACT,OAAO,CACR,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;IACtF,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;IACnF,GAAG,KAAK;CACT,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,IAAa,EACb,MAAM,GAAG,GAAG,EACZ,YAAqC,EACrC,OAA6B,EACnB,EAAE;IACZ,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IACrC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,YAAY;SAChB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE;CACnF,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAEzE;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACjF,CAAC,CAAC"}

package/dist/jsonrpc.d.ts

@@ -27,6 +27,7 @@ export declare const JSONRPC_METHOD_NOT_FOUND = -32601;
 export declare const JSONRPC_INVALID_PARAMS = -32602;
 export declare const JSONRPC_INTERNAL_ERROR = -32603;
 export declare const JSONRPC_UNAUTHORIZED = -32001;
+export declare const JSONRPC_PAYLOAD_TOO_LARGE = -32002;
 export declare const rpcResult: (id: JsonRpcId, result: unknown) => JsonRpcSuccess;
 export declare const rpcError: (id: JsonRpcId, code: number, message: string) => JsonRpcFailure;
 //# sourceMappingURL=jsonrpc.d.ts.map

package/dist/jsonrpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAE3C,eAAO,MAAM,SAAS,GACpB,IAAI,SAAS,EACb,QAAQ,OAAO,KACd,cAID,CAAC;AAEH,eAAO,MAAM,QAAQ,GACnB,IAAI,SAAS,EACb,MAAM,MAAM,EACZ,SAAS,MAAM,KACd,cAID,CAAC"}
+{"version":3,"file":"jsonrpc.d.ts","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,SAAS,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAE9D,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAC1C,eAAO,MAAM,uBAAuB,SAAS,CAAC;AAC9C,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAEhD,eAAO,MAAM,SAAS,GAAI,IAAI,SAAS,EAAE,QAAQ,OAAO,KAAG,cAIzD,CAAC;AAEH,eAAO,MAAM,QAAQ,GAAI,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,SAAS,MAAM,KAAG,cAItE,CAAC"}

package/dist/jsonrpc.js

@@ -4,6 +4,7 @@ export const JSONRPC_METHOD_NOT_FOUND = -32601;
 export const JSONRPC_INVALID_PARAMS = -32602;
 export const JSONRPC_INTERNAL_ERROR = -32603;
 export const JSONRPC_UNAUTHORIZED = -32001;
+export const JSONRPC_PAYLOAD_TOO_LARGE = -32002;
 export const rpcResult = (id, result) => ({
     jsonrpc: "2.0",
     id,

package/dist/jsonrpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAE3C,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,EAAa,EACb,MAAe,EACC,EAAE,CAAC,CAAC;IACpB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,EAAa,EACb,IAAY,EACZ,OAAe,EACC,EAAE,CAAC,CAAC;IACpB,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC"}
+{"version":3,"file":"jsonrpc.js","sourceRoot":"","sources":["../src/jsonrpc.ts"],"names":[],"mappings":"AAyBA,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAK,CAAC;AAC1C,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAK,CAAC;AAC9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAK,CAAC;AAC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,KAAK,CAAC;AAC3C,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,CAAC;AAEhD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,EAAa,EAAE,MAAe,EAAkB,EAAE,CAAC,CAAC;IAC5E,OAAO,EAAE,KAAK;IACd,EAAE;IACF,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,EAAa,EAAE,IAAY,EAAE,OAAe,EAAkB,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,KAAK;IACd,EAAE;IACF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC"}

package/dist/methods.d.ts

@@ -1,32 +1,36 @@
-import { type JsonRpcRequest } from "./jsonrpc.js";
-import type { ToolRegistry } from "./registry.js";
 import { type WwwAuthenticateOptions } from "./auth/bearer.js";
+import { type JsonRpcId, type JsonRpcRequest } from "./jsonrpc.js";
+import type { ToolRegistry } from "./registry.js";
 export type Principal = {
     id: string;
     scopes: string[];
     /** Optional host claims from `verifyToken` (tenant, plan, role, …). */
-    claims?: Record<string, unknown>;
+    claims?: Record<string, unknown> | undefined;
 };
 /** Per-request metrics emitted through the optional `audit` port. */
 export type AuditEntry = {
     /** JSON-RPC method, or `""` for transport-level rejections made before parsing. */
     method: string;
-    tool?: string;
-    principalId?: string;
+    tool?: string | undefined;
+    principalId?: string | undefined;
     ok: boolean;
-    error?: string;
+    error?: string | undefined;
     durationMs: number;
 };
 export type McpPorts<TCtx> = {
     authenticate: (req: Request, method: string, tool?: string) => Promise<Principal | null>;
     context: (req: Request, principal: Principal | null) => TCtx | Promise<TCtx>;
     /**
-     * Opt-in metrics hook. Pass any function to receive each tool result and
-     * every denial (bad token, missing scope, query-string token). Omit it and
-     * the library stays silent — no stdout, no store. Do what you want with
-     * `entry` (DB, APM, admin UI). Throwing never fails the request.
+     * Opt-in metrics hook. Pass any function to receive tool results and auth
+     * denials (bad token, missing scope, query-string token), plus the 500
+     * path when a host port throws. Protocol errors (malformed JSON, bad
+     * `jsonrpc`, unsupported protocol version, oversized body, batch) are not
+     * audited. Omit it and the library stays silent — no stdout, no store.
+     * Do what you want with `entry` (DB, APM, admin UI). Throwing never fails
+     * the request, and neither does hanging — see
+     * `McpHandlerOptions.auditTimeoutMs`.
      */
-    audit?: (entry: AuditEntry) => void | Promise<void>;
+    audit?: ((entry: AuditEntry) => void | Promise<void>) | undefined;
 };
 export type ServerInfo = {
     name: string;
@@ -40,15 +44,32 @@ export type McpHandlerOptions<TCtx> = {
     wwwAuthenticate: WwwAuthenticateOptions | ((req: Request) => WwwAuthenticateOptions);
     /** Methods that skip auth (default: initialize, ping, notifications/*). */
     publicMethods?: Set<string>;
+    /**
+     * Max time to wait for `ports.audit` before giving up on it and
+     * responding anyway. Default 1000ms. A hanging audit sink can't fail a
+     * request (see `safeAudit`), but without this it could stall one
+     * indefinitely — "can't fail" isn't "can't delay."
+     */
+    auditTimeoutMs?: number;
 };
 export declare const DEFAULT_PUBLIC_METHODS: Set<string>;
 export declare const isNotification: (body: JsonRpcRequest) => boolean;
 export declare const resolveWww: <TCtx>(options: McpHandlerOptions<TCtx>, req: Request) => WwwAuthenticateOptions;
-export declare const unauthorized: (www: WwwAuthenticateOptions, message?: string) => Response;
 /**
- * Invoke the audit metrics hook, swallowing any failure.
- * Telemetry must never turn a served response into a transport error —
- * this is the only call path to `ports.audit`.
+ * `id` defaults to `null` for the transport-level call sites in
+ * `dispatch.ts` — a body hasn't been parsed yet there, so there's no real
+ * id to echo. Call sites past that point (inside `dispatchRpc` and the
+ * method handlers) have one and must pass it, or a client correlating
+ * responses by id sees `null` on every 401 regardless of what it sent.
+ */
+export declare const unauthorized: (www: WwwAuthenticateOptions, message?: string, id?: JsonRpcId) => Response;
+/**
+ * Invoke the audit metrics hook, swallowing any failure and racing it
+ * against `auditTimeoutMs` so a hanging sink can't stall the response
+ * either — "can't fail a request" was already true; this adds "can't
+ * delay one" past a bound. The audit call keeps running in the background
+ * if the timer wins; its own `catch` below means it can never surface as
+ * an unhandled rejection whenever it does finish.
  */
 export declare const safeAudit: <TCtx>(options: McpHandlerOptions<TCtx>, entry: AuditEntry) => Promise<void>;
 export declare const hasScope: (principal: Principal, scope: string | undefined) => boolean;
@@ -57,5 +78,7 @@ export declare const dispatchRpc: <TCtx>(input: {
     body: JsonRpcRequest;
     options: McpHandlerOptions<TCtx>;
     publicMethods: Set<string>;
+    /** Request start (captured in `createMcpHandler.fetch`), for denial-path audit timing. */
+    startedAt: number;
 }) => Promise<Response>;
 //# sourceMappingURL=methods.d.ts.map

package/dist/methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,kBAAkB,CAAC;AAE1B,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI;IAC3B,YAAY,EAAE,CACZ,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,KACV,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;;;OAKG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,IAAI;IACpC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EACX,sBAAsB,GACtB,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,sBAAsB,CAAC,CAAC;IAC/C,2EAA2E;IAC3E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,sBAAsB,aAKjC,CAAC;AAUH,eAAO,MAAM,cAAc,GAAI,MAAM,cAAc,KAAG,OACQ,CAAC;AAE/D,eAAO,MAAM,UAAU,GAAI,IAAI,EAC7B,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,KAAK,OAAO,KACX,sBAG0B,CAAC;AAE9B,eAAO,MAAM,YAAY,GACvB,KAAK,sBAAsB,EAC3B,gBAAwB,KACvB,QAGC,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAU,IAAI,EAClC,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAMd,CAAC;AAEF,eAAO,MAAM,QAAQ,GACnB,WAAW,SAAS,EACpB,OAAO,MAAM,GAAG,SAAS,KACxB,OAGF,CAAC;AAoEF,eAAO,MAAM,WAAW,GAAU,IAAI,EAAE,OAAO;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAC5B,KAAG,OAAO,CAAC,QAAQ,CAsCnB,CAAC"}
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../src/methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,sBAAsB,EAAyB,MAAM,kBAAkB,CAAC;AAEtF,OAAO,EAGL,KAAK,SAAS,EACd,KAAK,cAAc,EAGpB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;CAC9C,CAAC;AAEF,qEAAqE;AACrE,MAAM,MAAM,UAAU,GAAG;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,QAAQ,CAAC,IAAI,IAAI;IAC3B,YAAY,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IACzF,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E;;;;;;;;;OASG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;CACnE,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,CAAC,IAAI,IAAI;IACpC,QAAQ,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,sBAAsB,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,sBAAsB,CAAC,CAAC;IACrF,2EAA2E;IAC3E,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAIF,eAAO,MAAM,sBAAsB,aAKjC,CAAC;AAQH,eAAO,MAAM,cAAc,GAAI,MAAM,cAAc,KAAG,OACQ,CAAC;AAE/D,eAAO,MAAM,UAAU,GAAI,IAAI,EAC7B,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,KAAK,OAAO,KACX,sBAG0B,CAAC;AAE9B;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GACvB,KAAK,sBAAsB,EAC3B,gBAAwB,EACxB,KAAI,SAAgB,KACnB,QAGC,CAAC;AAEL;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GAAU,IAAI,EAClC,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAChC,OAAO,UAAU,KAChB,OAAO,CAAC,IAAI,CAcd,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,WAAW,SAAS,EAAE,OAAO,MAAM,GAAG,SAAS,KAAG,OAG1E,CAAC;AAiEF,eAAO,MAAM,WAAW,GAAU,IAAI,EAAE,OAAO;IAC7C,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACjC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,0FAA0F;IAC1F,SAAS,EAAE,MAAM,CAAC;CACnB,KAAG,OAAO,CAAC,QAAQ,CAgCnB,CAAC"}