mcp-trellis 0.2.1 → 2.1.0

package/dist/auth/bearer.js

@@ -1,11 +1,16 @@
 /** Bearer auth helpers for MCP (RFC 9728 WWW-Authenticate). */
-export const BEARER_PREFIX = "Bearer ";
+const BEARER_PREFIX = "Bearer ";
 /** Above any real JWT / HMAC sig; prevents allocation DoS on attacker input. */
 export const MAX_COMPARE_LENGTH = 4096;
+/** RFC 7235 §2.1 — the auth-scheme token is case-insensitive ("bearer", "BEARER", "Bearer" all valid). */
+const BEARER_SCHEME_RE = /^bearer\s+/i;
 export const parseBearer = (authorization) => {
-    if (!authorization?.startsWith(BEARER_PREFIX))
+    if (!authorization)
         return null;
-    const token = authorization.slice(BEARER_PREFIX.length).trim();
+    const match = BEARER_SCHEME_RE.exec(authorization);
+    if (!match)
+        return null;
+    const token = authorization.slice(match[0].length).trim();
     return token.length > 0 ? token : null;
 };
 /**
@@ -14,6 +19,11 @@ export const parseBearer = (authorization) => {
  * so unequal lengths do not short-circuit. Rejects over-long inputs.
  */
 export const timingSafeEqual = (a, b) => {
+    // Both empty: the reduce below never runs and the seed 0 ^ 0 is 0 — "equal"
+    // by the accumulator's math, but never the right semantics for a secret
+    // comparison. An empty presented value must never authenticate.
+    if (a.length === 0 || b.length === 0)
+        return false;
     if (a.length > MAX_COMPARE_LENGTH || b.length > MAX_COMPARE_LENGTH) {
         return false;
     }
@@ -25,8 +35,18 @@ export const timingSafeEqual = (a, b) => {
     }, a.length ^ b.length);
     return diff === 0;
 };
-export const matchesAny = (presented, accepted) => accepted.some((token) => token.length > 0 && timingSafeEqual(presented, token));
-export const wwwAuthenticateHeader = (options) => `${BEARER_PREFIX}realm="${options.realm}", resource_metadata="${options.resourceMetadataUrl}"`;
+export const matchesAny = (presented, accepted) => accepted.some((token) => timingSafeEqual(presented, token));
+/** RFC 6750 / RFC 7235 quoted-string — escape `\` and `"` so host-controlled values cannot break or inject header params. */
+const escapeWwwAuthenticateValue = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+export const wwwAuthenticateHeader = (options) => {
+    const parts = [
+        `realm="${escapeWwwAuthenticateValue(options.realm)}"`,
+        `resource_metadata="${escapeWwwAuthenticateValue(options.resourceMetadataUrl)}"`,
+        ...(options.error ? [`error="${escapeWwwAuthenticateValue(options.error)}"`] : []),
+        ...(options.scope ? [`scope="${escapeWwwAuthenticateValue(options.scope)}"`] : []),
+    ];
+    return `${BEARER_PREFIX}${parts.join(", ")}`;
+};
 /** RFC 6750 §2.3 uses `access_token`; also reject legacy `token`. */
 export const rejectQueryToken = (url) => url.searchParams.has("token") || url.searchParams.has("access_token");
 //# sourceMappingURL=bearer.js.map

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAA4B,EAAiB,EAAE;IACzE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC/D,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAkB,EAAW,EAAE,CAC3E,QAAQ,CAAC,IAAI,CACX,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CACjE,CAAC;AAQJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACnC,OAA+B,EACvB,EAAE,CACV,GAAG,aAAa,UAAU,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,mBAAmB,GAAG,CAAC;AAEjG,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAW,EAAE,CACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAA4B,EAAiB,EAAE;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC/D,4EAA4E;IAC5E,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAkB,EAAW,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAY9D,6HAA6H;AAC7H,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3D,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAA+B,EAAU,EAAE;IAC/E,MAAM,KAAK,GAAG;QACZ,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;QACtD,sBAAsB,0BAA0B,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG;QAChF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAW,EAAE,CACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC"}

package/dist/clients.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,wBAAwB,EAAE,uBAAuB,EAAE,CAAC;IACpD;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAyB7D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAAU,EAAe,CAAC;AAExD,kEAAkE;AAClE,eAAO,MAAM,eAAe,GAAI,SAAS,UAAU,EAAE,KAAG,MAAM,EAE7D,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,cAAc,GACzB,SAAS,UAAU,EAAE,KACpB,uBAAuB,EASzB,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,EAAE,KAAG,UAAU,EACR,CAAC;AAEhE,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,GAAI,SAAS,UAAU,EAAE,KAAG,OACK,CAAC;AAE/D,eAAO,MAAM,uBAAuB,GAClC,SAAS,UAAU,EAAE,EACrB,aAAa,WAAW,GAAG,SAAS,KACnC,IASF,CAAC"}
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAA+B,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEjG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,aAAa,GAAG;IAC1B,sDAAsD;IACtD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,gDAAgD;IAChD,wBAAwB,EAAE,uBAAuB,EAAE,CAAC;IACpD;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,UAAU,EAAE,aAAa,CAsB7D,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,UAAU,EAAe,CAAC;AAExD,kEAAkE;AAClE,eAAO,MAAM,eAAe,GAAI,SAAS,UAAU,EAAE,KAAG,MAAM,EAE7D,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,cAAc,GAAI,SAAS,UAAU,EAAE,KAAG,uBAAuB,EAS7E,CAAC;AAEF,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,GAAI,SAAS,UAAU,EAAE,KAAG,UAAU,EACR,CAAC;AAEhE,2FAA2F;AAC3F,eAAO,MAAM,gBAAgB,GAAI,SAAS,UAAU,EAAE,KAAG,OACK,CAAC;AAE/D,eAAO,MAAM,uBAAuB,GAClC,SAAS,UAAU,EAAE,EACrB,aAAa,WAAW,GAAG,SAAS,KACnC,IASF,CAAC"}

package/dist/clients.js

@@ -5,8 +5,8 @@
  * callback URLs, different registration models. Encoding that here is the
  * point: you name your clients, the library configures the AS to match.
  */
-import { TOKEN_ENDPOINT_AUTH_METHODS, } from "./oauth/constants.js";
-import { CLAUDE_CALLBACK } from "./oauth/redirect.js";
+import { TOKEN_ENDPOINT_AUTH_METHODS } from "./oauth/constants.js";
+import { CLAUDE_CALLBACK } from "./oauth/policy/redirect.js";
 export const CLIENT_PROFILES = {
     /** Claude Custom Connectors — dynamic registration, public client + PKCE. */
     claude: {
@@ -20,10 +20,7 @@ export const CLIENT_PROFILES = {
      */
     gemini: {
         redirectUris: [],
-        tokenEndpointAuthMethods: [
-            TOKEN_ENDPOINT_AUTH_METHODS.basic,
-            TOKEN_ENDPOINT_AUTH_METHODS.post,
-        ],
+        tokenEndpointAuthMethods: [TOKEN_ENDPOINT_AUTH_METHODS.basic, TOKEN_ENDPOINT_AUTH_METHODS.post],
         preRegistered: true,
     },
     /** OpenAI Codex / ChatGPT connectors — OAuth 2.1 per the MCP auth spec. */

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiBtD,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE;YACxB,2BAA2B,CAAC,KAAK;YACjC,2BAA2B,CAAC,IAAI;SACjC;QACD,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAAqB,EACM,EAAE;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAiB7D,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/deprecated.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
+ * Declared as consts (not `export { } from`) so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const timingSafeEqual: (a: string, b: string) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const matchesAny: (presented: string, accepted: string[]) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const emptyResponse: (status: number) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const methodNotAllowed: (message?: string, options?: import("./server.js").JsonResponseOptions) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const optionsResponse: (options?: import("./server.js").JsonResponseOptions) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const pickProtocolVersion: (params?: Record<string, unknown>) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const ASSUMED_HEADER_PROTOCOL_VERSION = "2025-03-26";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const validateAgainstSchema: (value: unknown, schema: import("./server.js").JsonSchema) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const unsupportedKeywords: (schema: import("./server.js").JsonSchema, path?: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const missingObjectType: (schema: import("./server.js").JsonSchema, path?: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const JSON_SCHEMA_TYPES: {
+    readonly string: "string";
+    readonly number: "number";
+    readonly integer: "integer";
+    readonly boolean: "boolean";
+    readonly object: "object";
+    readonly array: "array";
+    readonly null: "null";
+};
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const SUPPORTED_SCHEMA_KEYWORDS: ReadonlySet<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
+//# sourceMappingURL=deprecated.d.ts.map

package/dist/deprecated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sEAAsE;AACtE,eAAO,MAAM,eAAe,mCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,UAAU,oDAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,WAAW,4DAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,8BAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,qFAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,eAAe,mEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,8CAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,+BAA+B,eAA2C,CAAC;AACxF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,wEAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,uEAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uEAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB;;;;;;;;CAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,qBAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,qBAAmC,CAAC"}

package/dist/deprecated.js

@@ -0,0 +1,35 @@
+/**
+ * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
+ * Declared as consts (not `export { } from`) so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "./advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const timingSafeEqual = advanced.timingSafeEqual;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const matchesAny = advanced.matchesAny;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const corsHeaders = advanced.corsHeaders;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const emptyResponse = advanced.emptyResponse;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const methodNotAllowed = advanced.methodNotAllowed;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const optionsResponse = advanced.optionsResponse;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const pickProtocolVersion = advanced.pickProtocolVersion;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const ASSUMED_HEADER_PROTOCOL_VERSION = advanced.ASSUMED_HEADER_PROTOCOL_VERSION;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const validateAgainstSchema = advanced.validateAgainstSchema;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const unsupportedKeywords = advanced.unsupportedKeywords;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const missingObjectType = advanced.missingObjectType;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const JSON_SCHEMA_TYPES = advanced.JSON_SCHEMA_TYPES;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const SUPPORTED_SCHEMA_KEYWORDS = advanced.SUPPORTED_SCHEMA_KEYWORDS;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const IGNORED_SCHEMA_KEYWORDS = advanced.IGNORED_SCHEMA_KEYWORDS;
+//# sourceMappingURL=deprecated.js.map

package/dist/deprecated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,+BAA+B,CAAC;AACxF,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC"}

package/dist/http/body.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Request-body size limits. Nothing upstream caps body size on its own —
+ * `request.json()` / `request.text()` and a raw `http.createServer` stream
+ * both buffer the whole body in memory first, so an uncapped read is a
+ * straightforward memory-exhaustion DoS.
+ */
+export declare class BodyTooLargeError extends Error {
+    readonly maxBytes: number;
+    constructor(maxBytes: number);
+}
+/** Default cap for `/mcp` — JSON-RPC payloads, generally small but tool args can be text-heavy. */
+export declare const DEFAULT_MCP_BODY_LIMIT = 1048576;
+/** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */
+export declare const DEFAULT_OAUTH_BODY_LIMIT = 65536;
+/**
+ * Structural subset of `Request`/`Response` that `readBoundedBytes` actually
+ * needs — both are real `Request`s (every caller inside this package) and,
+ * via `tools.ts`'s `apiTool`, a `Response` from an upstream `fetch` call
+ * capping how much of that body a tool ever buffers into memory.
+ */
+export type BoundedBodySource = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+    body: ReadableStream<Uint8Array> | null;
+    text: () => Promise<string>;
+    /** Preferred over `text` for the no-stream fallback — keeps binary bodies intact. */
+    arrayBuffer?: () => Promise<ArrayBuffer>;
+};
+/**
+ * Reads a bounded body as raw bytes, rejecting early on an honest oversized
+ * `Content-Length`, then aborting mid-stream — before the whole body is
+ * buffered — if a chunked body (no `Content-Length`) exceeds `maxBytes`.
+ * Falls back to `source.arrayBuffer()` (or `source.text()`) when
+ * `source.body` is null (some runtimes don't expose a streaming body),
+ * still enforcing the cap.
+ *
+ * Optional `signal` cancels the active reader on abort — needed when a hop
+ * timeout must stop a stalled stream (a locked `body.cancel()` is a no-op).
+ */
+export declare const readBoundedBytes: (source: BoundedBodySource, maxBytes: number, signal?: AbortSignal) => Promise<Uint8Array>;
+/** `readBoundedBytes`, decoded as UTF-8 — for JSON / form / text bodies. */
+export declare const readBoundedText: (source: BoundedBodySource, maxBytes: number, signal?: AbortSignal) => Promise<string>;
+export type BoundedNodeBodyOptions = {
+    /** Declared `Content-Length` header value, checked before reading anything. */
+    contentLength?: string | undefined;
+};
+/**
+ * Node `IncomingMessage`-shaped readable: event listeners + pause.
+ * Prefer this over `for await` — throwing out of `for await` on an
+ * IncomingMessage runs the async iterator's `return()`, which **destroys**
+ * the request before the caller can write a 413.
+ */
+export type NodeReadableLike = {
+    on(event: "data", listener: (chunk: Uint8Array | string) => void): void;
+    on(event: "end", listener: () => void): void;
+    on(event: "error", listener: (err: Error) => void): void;
+    pause(): void;
+    removeListener(event: string, listener: (...args: unknown[]) => void): void;
+};
+export declare const isNodeReadable: (value: unknown) => value is NodeReadableLike;
+/**
+ * Same contract as `readBoundedText` for a raw Node request stream.
+ * Does **not** destroy the socket — that races a 413 response into EPIPE.
+ * On overflow the event path pauses and drops listeners; the caller writes
+ * 413 then tears down after flush.
+ */
+export declare const readBoundedNodeBody: (source: NodeReadableLike | AsyncIterable<Uint8Array | string>, maxBytes: number, options?: BoundedNodeBodyOptions) => Promise<Uint8Array>;
+//# sourceMappingURL=body.d.ts.map

package/dist/http/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAuB/C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE;QAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,UAAU,CA6CpB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,GAC1B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,MAAM,CAA+E,CAAC;AAEjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACxE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC7C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAG6B,CAAC;AA+DvF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,gBAAgB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,EAC7D,UAAU,MAAM,EAChB,UAAS,sBAA2B,KACnC,OAAO,CAAC,UAAU,CAQpB,CAAC"}

package/dist/http/body.js

@@ -0,0 +1,165 @@
+/**
+ * Request-body size limits. Nothing upstream caps body size on its own —
+ * `request.json()` / `request.text()` and a raw `http.createServer` stream
+ * both buffer the whole body in memory first, so an uncapped read is a
+ * straightforward memory-exhaustion DoS.
+ */
+export class BodyTooLargeError extends Error {
+    maxBytes;
+    constructor(maxBytes) {
+        super(`request body exceeds ${maxBytes} bytes`);
+        this.maxBytes = maxBytes;
+        this.name = "BodyTooLargeError";
+    }
+}
+/** Default cap for `/mcp` — JSON-RPC payloads, generally small but tool args can be text-heavy. */
+export const DEFAULT_MCP_BODY_LIMIT = 1_048_576; // 1 MiB
+/** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */
+export const DEFAULT_OAUTH_BODY_LIMIT = 65_536; // 64 KiB
+const declaredContentLength = (headers) => {
+    const header = headers.get("content-length");
+    if (!header)
+        return null;
+    const declared = Number(header);
+    return Number.isFinite(declared) ? declared : null;
+};
+const concatBytes = (chunks, total) => {
+    const combined = new Uint8Array(total);
+    chunks.reduce((offset, chunk) => {
+        combined.set(chunk, offset);
+        return offset + chunk.byteLength;
+    }, 0);
+    return combined;
+};
+const toBytes = (chunk) => typeof chunk === "string" ? new TextEncoder().encode(chunk) : chunk;
+/**
+ * Reads a bounded body as raw bytes, rejecting early on an honest oversized
+ * `Content-Length`, then aborting mid-stream — before the whole body is
+ * buffered — if a chunked body (no `Content-Length`) exceeds `maxBytes`.
+ * Falls back to `source.arrayBuffer()` (or `source.text()`) when
+ * `source.body` is null (some runtimes don't expose a streaming body),
+ * still enforcing the cap.
+ *
+ * Optional `signal` cancels the active reader on abort — needed when a hop
+ * timeout must stop a stalled stream (a locked `body.cancel()` is a no-op).
+ */
+export const readBoundedBytes = async (source, maxBytes, signal) => {
+    if (signal?.aborted)
+        throw new Error("body read aborted");
+    const declared = declaredContentLength(source.headers);
+    if (declared !== null && declared > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    const reader = source.body?.getReader();
+    if (!reader) {
+        // ponytail: no stream → arrayBuffer/text ignore signal; fine for request
+        // bodies. CIMD always has a stream on Node/undici. Upgrade: race abort
+        // or refuse the fallback when signal is required.
+        const bytes = source.arrayBuffer
+            ? new Uint8Array(await source.arrayBuffer())
+            : new TextEncoder().encode(await source.text());
+        if (bytes.byteLength > maxBytes)
+            throw new BodyTooLargeError(maxBytes);
+        return bytes;
+    }
+    const onAbort = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            // Cancel may settle read() as done — still treat abort as failure.
+            if (signal?.aborted)
+                throw new Error("body read aborted");
+            if (done)
+                break;
+            // ponytail: one oversized chunk can briefly allocate maxBytes + highWaterMark
+            // (~64 KiB on Node) before reject — fine for 1 MiB / 64 KiB caps.
+            total += value.byteLength;
+            if (total > maxBytes)
+                throw new BodyTooLargeError(maxBytes);
+            chunks.push(value);
+        }
+    }
+    finally {
+        signal?.removeEventListener("abort", onAbort);
+        await reader.cancel().catch(() => { });
+    }
+    return concatBytes(chunks, total);
+};
+/** `readBoundedBytes`, decoded as UTF-8 — for JSON / form / text bodies. */
+export const readBoundedText = async (source, maxBytes, signal) => new TextDecoder().decode(await readBoundedBytes(source, maxBytes, signal));
+export const isNodeReadable = (value) => typeof value?.on === "function" &&
+    typeof value?.pause === "function" &&
+    typeof value?.removeListener === "function";
+const readFromEvents = (stream, maxBytes) => new Promise((resolve, reject) => {
+    const collected = [];
+    let total = 0;
+    let settled = false;
+    const onData = (chunk) => {
+        const bytes = toBytes(chunk);
+        total += bytes.byteLength;
+        if (total > maxBytes) {
+            fail(new BodyTooLargeError(maxBytes));
+            return;
+        }
+        collected.push(bytes);
+    };
+    const onEnd = () => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        resolve(concatBytes(collected, total));
+    };
+    const onError = (err) => {
+        fail(err);
+    };
+    const cleanup = () => {
+        stream.removeListener("data", onData);
+        stream.removeListener("end", onEnd);
+        stream.removeListener("error", onError);
+    };
+    const fail = (err) => {
+        if (settled)
+            return;
+        settled = true;
+        stream.pause();
+        cleanup();
+        reject(err);
+    };
+    stream.on("data", onData);
+    stream.on("end", onEnd);
+    stream.on("error", onError);
+});
+const readFromAsyncIterable = async (chunks, maxBytes) => {
+    const collected = [];
+    let total = 0;
+    for await (const chunk of chunks) {
+        const bytes = toBytes(chunk);
+        total += bytes.byteLength;
+        if (total > maxBytes)
+            throw new BodyTooLargeError(maxBytes);
+        collected.push(bytes);
+    }
+    return concatBytes(collected, total);
+};
+/**
+ * Same contract as `readBoundedText` for a raw Node request stream.
+ * Does **not** destroy the socket — that races a 413 response into EPIPE.
+ * On overflow the event path pauses and drops listeners; the caller writes
+ * 413 then tears down after flush.
+ */
+export const readBoundedNodeBody = async (source, maxBytes, options = {}) => {
+    const declared = options.contentLength ? Number(options.contentLength) : NaN;
+    if (Number.isFinite(declared) && declared > maxBytes) {
+        throw new BodyTooLargeError(maxBytes);
+    }
+    if (isNodeReadable(source))
+        return readFromEvents(source, maxBytes);
+    return readFromAsyncIterable(source, maxBytes);
+};
+//# sourceMappingURL=body.js.map

package/dist/http/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,QAAgB;QACnC,KAAK,CAAC,wBAAwB,QAAQ,QAAQ,CAAC,CAAC;QAD7B,aAAQ,GAAR,QAAQ,CAAQ;QAEnC,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC,CAAC,QAAQ;AAEzD,uGAAuG;AACvG,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,SAAS;AAEzD,MAAM,qBAAqB,GAAG,CAAC,OAE9B,EAAiB,EAAE;IAClB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAAoB,EAAE,KAAa,EAAc,EAAE;IACtE,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,CAAC,EAAE,CAAC,CAAC,CAAC;IACN,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAA0B,EAAc,EAAE,CACzD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAgBtE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACnC,MAAyB,EACzB,QAAgB,EAChB,MAAoB,EACC,EAAE;IACvB,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAE1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,yEAAyE;QACzE,uEAAuE;QACvE,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW;YAC9B,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5C,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,mEAAmE;YACnE,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YAC1D,IAAI,IAAI;gBAAE,MAAM;YAChB,8EAA8E;YAC9E,kEAAkE;YAClE,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;YAC1B,IAAI,KAAK,GAAG,QAAQ;gBAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,MAAyB,EACzB,QAAgB,EAChB,MAAoB,EACH,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAqBjG,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAA6B,EAAE,CAC1E,OAAQ,KAAiC,EAAE,EAAE,KAAK,UAAU;IAC5D,OAAQ,KAAoC,EAAE,KAAK,KAAK,UAAU;IAClE,OAAQ,KAA6C,EAAE,cAAc,KAAK,UAAU,CAAC;AAEvF,MAAM,cAAc,GAAG,CAAC,MAAwB,EAAE,QAAgB,EAAuB,EAAE,CACzF,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,CAAC,KAA0B,EAAQ,EAAE;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAsC,CAAC,CAAC;QACtE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,KAAqC,CAAC,CAAC;QACpE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAuC,CAAC,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,CAAC,GAAU,EAAQ,EAAE;QAChC,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;QACV,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9B,CAAC,CAAC,CAAC;AAEL,MAAM,qBAAqB,GAAG,KAAK,EACjC,MAA0C,EAC1C,QAAgB,EACK,EAAE;IACvB,MAAM,SAAS,GAAiB,EAAE,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,QAAQ;YAAE,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5D,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,WAAW,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACtC,MAA6D,EAC7D,QAAgB,EAChB,UAAkC,EAAE,EACf,EAAE;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACrD,MAAM,IAAI,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpE,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC,CAAC"}

package/dist/http/http.d.ts

@@ -0,0 +1,42 @@
+/** JSON `error` body / audit reason when a host port throws. */
+export declare const INTERNAL_ERROR = "internal_error";
+/** A caught value's audit-safe message — an `Error`'s own message, else its `String()` form. */
+export declare const errorReason: (caught: unknown) => string;
+/** Default cap on how long a response waits for an audit sink. */
+export declare const DEFAULT_AUDIT_TIMEOUT_MS = 1000;
+/**
+ * Run an audit sink so it can neither fail nor stall the response: errors
+ * are swallowed, and the wait is capped at `timeoutMs`. The timer is cleared
+ * as soon as the sink settles — a fast sink must not leave a pending timer
+ * holding the process (or a serverless invocation) open. Shared by the MCP
+ * `safeAudit` and OAuth `safeOAuthAudit`.
+ */
+export declare const runAuditBounded: (sink: () => void | Promise<void>, timeoutMs: number) => Promise<void>;
+export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
+export type JsonResponseOptions = {
+    /** Include permissive CORS headers. Default true (MCP). OAuth token set false. */
+    cors?: boolean;
+};
+/** Single-object JSON response — keeps the call site under the ≤3-params rule. */
+export type JsonResponseInput = {
+    data: unknown;
+    status?: number;
+    headers?: Record<string, string>;
+    cors?: boolean;
+};
+export declare const jsonResponse: (input: JsonResponseInput) => Response;
+export declare const emptyResponse: (status: number) => Response;
+export declare const optionsResponse: (options?: JsonResponseOptions) => Response;
+/** Reflect a validated browser Origin on MCP CORS instead of `*`. */
+export declare const withReflectedCorsOrigin: (response: Response, origin: string) => Response;
+export declare const methodNotAllowed: (message?: string, options?: JsonResponseOptions) => Response;
+export declare const GET_ONLY: ReadonlySet<string>;
+export declare const POST_ONLY: ReadonlySet<string>;
+/** For endpoints that must not send permissive CORS headers (`/token`, `/revoke`, `/consent`). */
+export declare const NO_CORS: JsonResponseOptions;
+/**
+ * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
+ * Shared by OAuth handlers that all need the same method gate.
+ */
+export declare const requireHttpMethod: (request: Request, allowed: ReadonlySet<string>, options?: JsonResponseOptions) => Response | null;
+//# sourceMappingURL=http.d.ts.map

package/dist/http/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C,gGAAgG;AAChG,eAAO,MAAM,WAAW,GAAI,QAAQ,OAAO,KAAG,MACa,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,EAChC,WAAW,MAAM,KAChB,OAAO,CAAC,IAAI,CAiBd,CAAC;AAEF,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAUhF,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG;IAChC,kFAAkF;IAClF,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,OAAO,iBAAiB,KAAG,QAWvD,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,QAI3C,CAAC;AAEL,eAAO,MAAM,eAAe,GAAI,UAAU,mBAAmB,KAAG,QAO5D,CAAC;AAEL,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,GAAI,UAAU,QAAQ,EAAE,QAAQ,MAAM,KAAG,QAU5E,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,gBAA8B,EAC9B,UAAU,mBAAmB,KAC5B,QAKC,CAAC;AAEL,eAAO,MAAM,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAoB,CAAC;AAC9D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC;AAChE,kGAAkG;AAClG,eAAO,MAAM,OAAO,EAAE,mBAAqC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,SAAS,WAAW,CAAC,MAAM,CAAC,EAC5B,UAAU,mBAAmB,KAC5B,QAAQ,GAAG,IAIb,CAAC"}

package/dist/http/http.js

@@ -0,0 +1,100 @@
+/** JSON `error` body / audit reason when a host port throws. */
+export const INTERNAL_ERROR = "internal_error";
+/** A caught value's audit-safe message — an `Error`'s own message, else its `String()` form. */
+export const errorReason = (caught) => caught instanceof Error ? caught.message : String(caught);
+/** Default cap on how long a response waits for an audit sink. */
+export const DEFAULT_AUDIT_TIMEOUT_MS = 1000;
+/**
+ * Run an audit sink so it can neither fail nor stall the response: errors
+ * are swallowed, and the wait is capped at `timeoutMs`. The timer is cleared
+ * as soon as the sink settles — a fast sink must not leave a pending timer
+ * holding the process (or a serverless invocation) open. Shared by the MCP
+ * `safeAudit` and OAuth `safeOAuthAudit`.
+ */
+export const runAuditBounded = async (sink, timeoutMs) => {
+    const settled = (async () => {
+        try {
+            await sink();
+        }
+        catch {
+            // Intentionally ignored.
+        }
+    })();
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(resolve, timeoutMs);
+    });
+    try {
+        await Promise.race([settled, timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+};
+export const corsHeaders = (extra) => ({
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, MCP-Protocol-Version",
+    // Response headers are opaque to browser JS by default unless explicitly
+    // exposed — without this, a browser-based MCP client reading a 401 can
+    // see the status but not WWW-Authenticate itself, i.e. not the
+    // resource_metadata URL RFC 9728 discovery depends on.
+    "Access-Control-Expose-Headers": "WWW-Authenticate",
+    ...extra,
+});
+export const jsonResponse = (input) => {
+    const cors = input.cors !== false;
+    return new Response(JSON.stringify(input.data), {
+        status: input.status ?? 200,
+        headers: {
+            "Content-Type": "application/json",
+            "Cache-Control": "no-store",
+            ...(cors ? corsHeaders() : {}),
+            ...input.headers,
+        },
+    });
+};
+export const emptyResponse = (status) => new Response(null, {
+    status,
+    headers: { ...corsHeaders(), "Cache-Control": "no-store" },
+});
+export const optionsResponse = (options) => new Response(null, {
+    status: 204,
+    headers: options?.cors === false
+        ? { "Cache-Control": "no-store" }
+        : { ...corsHeaders(), "Cache-Control": "no-store" },
+});
+/** Reflect a validated browser Origin on MCP CORS instead of `*`. */
+export const withReflectedCorsOrigin = (response, origin) => {
+    const headers = new Headers(response.headers);
+    if (!headers.has("Access-Control-Allow-Origin"))
+        return response;
+    headers.set("Access-Control-Allow-Origin", origin);
+    headers.set("Vary", "Origin");
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+};
+export const methodNotAllowed = (message = "Method not allowed", options) => jsonResponse({
+    data: { error: message },
+    status: 405,
+    ...(options?.cors !== undefined ? { cors: options.cors } : {}),
+});
+export const GET_ONLY = new Set(["GET"]);
+export const POST_ONLY = new Set(["POST"]);
+/** For endpoints that must not send permissive CORS headers (`/token`, `/revoke`, `/consent`). */
+export const NO_CORS = { cors: false };
+/**
+ * OPTIONS → 204; allowed verb → null (continue); otherwise → 405.
+ * Shared by OAuth handlers that all need the same method gate.
+ */
+export const requireHttpMethod = (request, allowed, options) => {
+    if (request.method === "OPTIONS")
+        return optionsResponse(options);
+    if (allowed.has(request.method))
+        return null;
+    return methodNotAllowed(undefined, options);
+};
+//# sourceMappingURL=http.js.map

package/dist/http/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/http/http.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C,gGAAgG;AAChG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,MAAe,EAAU,EAAE,CACrD,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAE5D,kEAAkE;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAClC,IAAgC,EAChC,SAAiB,EACF,EAAE;IACjB,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAC5C,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA8B,EAA0B,EAAE,CAAC,CAAC;IACtF,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAAE,mDAAmD;IACnF,yEAAyE;IACzE,uEAAuE;IACvE,+DAA+D;IAC/D,uDAAuD;IACvD,+BAA+B,EAAE,kBAAkB;IACnD,GAAG,KAAK;CACT,CAAC,CAAC;AAeH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAY,EAAE;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;IAClC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG;QAC3B,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,GAAG,KAAK,CAAC,OAAO;SACjB;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAc,EAAY,EAAE,CACxD,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM;IACN,OAAO,EAAE,EAAE,GAAG,WAAW,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;CAC3D,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA6B,EAAY,EAAE,CACzE,IAAI,QAAQ,CAAC,IAAI,EAAE;IACjB,MAAM,EAAE,GAAG;IACX,OAAO,EACL,OAAO,EAAE,IAAI,KAAK,KAAK;QACrB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;QACjC,CAAC,CAAC,EAAE,GAAG,WAAW,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;CACxD,CAAC,CAAC;AAEL,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAAkB,EAAE,MAAc,EAAY,EAAE;IACtF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAAE,OAAO,QAAQ,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,OAAO,GAAG,oBAAoB,EAC9B,OAA6B,EACnB,EAAE,CACZ,YAAY,CAAC;IACX,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;IACxB,MAAM,EAAE,GAAG;IACX,GAAG,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,kGAAkG;AAClG,MAAM,CAAC,MAAM,OAAO,GAAwB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAE5D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,OAAgB,EAChB,OAA4B,EAC5B,OAA6B,EACZ,EAAE;IACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC,CAAC"}