mcp-trellis 1.0.0 → 2.1.0

package/dist/app.js

@@ -6,35 +6,45 @@
  */
 import { parseBearer } from "./auth/bearer.js";
 import { assertClientsConfigured, authMethodsFor, DEFAULT_CLIENTS, hasDynamicClient, redirectUrisFor, } from "./clients.js";
-import { createMcpHandler } from "./dispatch.js";
-import { INTERNAL_ERROR, jsonResponse } from "./http.js";
-import { canonicalResource, DEFAULT_RESOURCE_PATH, normalizeConfiguredPath, resourcesEqual, } from "./oauth/resource.js";
+import { errorReason, INTERNAL_ERROR, jsonResponse } from "./http/http.js";
+import { createMcpHandler } from "./mcp/dispatch.js";
+import { safeAudit } from "./mcp/methods.js";
+import { createToolRegistry } from "./mcp/registry.js";
+import { safeOAuthAudit } from "./oauth/audit.js";
+import { DEFAULT_SCOPE } from "./oauth/constants.js";
+import { canonicalResource, DEFAULT_RESOURCE_PATH, normalizeConfiguredPath, resourcesEqual, } from "./oauth/policy/resource.js";
 import { createOAuthRouter } from "./oauth/router.js";
-import { createToolRegistry } from "./registry.js";
-export const createMcpApp = (options) => {
-    // Normalized once here — "/mcp/" and "/mcp" must route identically, not
-    // diverge into a 404 for one of them. See `normalizeConfiguredPath`.
-    const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
-    const oauthPath = options.oauthPath ?? `${resourcePath}/oauth`;
-    const clients = options.clients ?? DEFAULT_CLIENTS;
-    const realm = options.realm ?? options.serverInfo.name;
-    assertClientsConfigured(clients, options.auth.clientStore);
-    const registry = createToolRegistry(options.tools, {
-        ...(options.validateArgs !== undefined ? { validateArgs: options.validateArgs } : {}),
-        ...(options.onToolError !== undefined ? { onToolError: options.onToolError } : {}),
-    });
-    /**
-     * The audience check lives here, not in user code — a token minted for
-     * another MCP server must never be accepted by this one.
-     */
-    const authenticate = async (req) => {
-        const token = parseBearer(req.headers.get("authorization"));
+import { pickDefined } from "./util/defined.js";
+/**
+ * On a multi-scope server a tool with no `scope` is callable by a principal
+ * holding none of the advertised scopes, silently defeating
+ * `defaultScopes: []`. Single-scope servers have no such ambiguity. Pass
+ * `scope: null` on a tool to state the omission on purpose.
+ */
+const assertToolScopesConfigured = (tools, scopes) => {
+    if (scopes.length <= 1)
+        return;
+    const unscoped = tools.filter((tool) => tool.scope === undefined).map((tool) => tool.name);
+    if (unscoped.length === 0)
+        return;
+    throw new Error(`scopes has more than one entry (${scopes.join(", ")}), but these tools have no ` +
+        `scope and would be callable by any authenticated principal regardless of what ` +
+        `scopes it holds: ${unscoped.join(", ")}. Set scope: "<one of the entries above>" ` +
+        `on each, or scope: null to state the omission on purpose.`);
+};
+/**
+ * The audience check lives here, not in user code — a token minted for
+ * another MCP server must never be accepted by this one.
+ */
+const buildAuthenticate = (options, resourcePath) => {
+    return async (request) => {
+        const token = parseBearer(request.headers.get("authorization"));
         if (!token)
             return null;
-        const verified = await options.auth.verifyToken(token, req);
+        const verified = await options.auth.verifyToken(token, request);
         if (!verified)
             return null;
-        const expected = canonicalResource(new URL(req.url).origin, resourcePath);
+        const expected = canonicalResource(new URL(request.url).origin, resourcePath);
         if (!resourcesEqual(verified.audience, expected))
             return null;
         return {
@@ -43,33 +53,60 @@ export const createMcpApp = (options) => {
             ...(verified.claims !== undefined ? { claims: verified.claims } : {}),
         };
     };
-    const handler = createMcpHandler({
+};
+/** Top-level `audit` wraps MCP + OAuth; `auth.audit` wins for OAuth if both set. */
+const buildAuditAdapters = (options) => {
+    const unifiedAudit = options.audit;
+    const toMcpAudit = unifiedAudit !== undefined
+        ? (entry) => unifiedAudit({ source: "mcp", ...entry })
+        : undefined;
+    const oauthAudit = options.auth.audit ??
+        (unifiedAudit !== undefined
+            ? (entry) => unifiedAudit({ source: "oauth", ...entry })
+            : undefined);
+    return { toMcpAudit, oauthAudit };
+};
+const buildMcpHandlerOptions = (options, input) => {
+    const { resourcePath, realm, registry, authenticate, toMcpAudit } = input;
+    return {
         registry,
         serverInfo: options.serverInfo,
-        ...(options.instructions !== undefined ? { instructions: options.instructions } : {}),
-        ...(options.auditTimeoutMs !== undefined ? { auditTimeoutMs: options.auditTimeoutMs } : {}),
-        wwwAuthenticate: (req) => ({
+        ...pickDefined(options, [
+            "instructions",
+            "auditTimeoutMs",
+            "allowedRequestOrigins",
+            "hideToolsOutsideScope",
+        ]),
+        wwwAuthenticate: (request) => ({
             realm,
-            resourceMetadataUrl: `${new URL(req.url).origin}/.well-known/oauth-protected-resource${resourcePath}`,
+            resourceMetadataUrl: `${new URL(request.url).origin}/.well-known/oauth-protected-resource${resourcePath}`,
         }),
         ports: {
             authenticate,
             context: options.context ?? (() => ({})),
-            ...(options.audit !== undefined ? { audit: options.audit } : {}),
+            ...(toMcpAudit !== undefined ? { audit: toMcpAudit } : {}),
         },
-    });
-    const oauth = createOAuthRouter({
+    };
+};
+const buildOAuthOptions = (options, input) => {
+    const { resourcePath, oauthPath, realm, clients, oauthAudit } = input;
+    return {
         resourcePath,
         oauthPath,
         realm,
-        ...(options.scopes !== undefined ? { scopes: options.scopes } : {}),
-        ...(options.defaultScopes !== undefined ? { defaultScopes: options.defaultScopes } : {}),
+        ...pickDefined(options, [
+            "scopes",
+            "defaultScopes",
+            "auditTimeoutMs",
+            "allowInMemoryCodeStore",
+            "cimd",
+            "cimdCache",
+            "cimdLookup",
+            "requireRegisteredClients",
+            "consent",
+        ]),
         tokenEndpointAuthMethods: authMethodsFor(clients),
         allowUnregisteredClients: hasDynamicClient(clients),
-        ...(options.requireRegisteredClients !== undefined
-            ? { requireRegisteredClients: options.requireRegisteredClients }
-            : {}),
-        ...(options.consent !== undefined ? { consent: options.consent } : {}),
         redirect: {
             // Client profiles are the source of truth for callbacks.
             extra: [...redirectUrisFor(clients), ...(options.extraRedirectUris ?? [])],
@@ -81,34 +118,77 @@ export const createMcpApp = (options) => {
             resolveUser: options.auth.resolveUser,
             loginUrl: options.auth.loginUrl,
             mintAccessToken: options.auth.mintAccessToken,
-            ...(options.auth.refreshAccessToken !== undefined
-                ? { refreshAccessToken: options.auth.refreshAccessToken }
-                : {}),
-            ...(options.auth.revokeToken !== undefined ? { revokeToken: options.auth.revokeToken } : {}),
-            ...(options.auth.codeStore !== undefined ? { codeStore: options.auth.codeStore } : {}),
-            ...(options.auth.clientStore !== undefined ? { clientStore: options.auth.clientStore } : {}),
-            ...(options.auth.audit !== undefined ? { audit: options.auth.audit } : {}),
+            ...pickDefined(options.auth, [
+                "refreshAccessToken",
+                "revokeToken",
+                "codeStore",
+                "clientStore",
+            ]),
+            ...(oauthAudit !== undefined ? { audit: oauthAudit } : {}),
         },
+    };
+};
+const createAppFetch = (parts) => async (request) => {
+    try {
+        const oauthResponse = await parts.oauth.tryHandle(request);
+        if (oauthResponse)
+            return oauthResponse;
+        const requestPath = normalizeConfiguredPath(new URL(request.url).pathname);
+        if (requestPath === parts.resourcePath)
+            return await parts.handler.fetch(request);
+        return jsonResponse({ data: { error: "Not found" }, status: 404 });
+    }
+    catch (caught) {
+        // Defense in depth: `oauth` and `handler` already turn port failures
+        // into responses, but `fetch` must never reject, and this path is
+        // audited so it is never silent.
+        const reason = errorReason(caught);
+        await safeOAuthAudit(parts.oauthOptions, { event: "server_error", reason });
+        await safeAudit(parts.mcpHandlerOptions, {
+            method: "",
+            ok: false,
+            error: reason,
+            durationMs: 0,
+        });
+        return jsonResponse({ data: { error: INTERNAL_ERROR }, status: 500 });
+    }
+};
+export const createMcpApp = (options) => {
+    // "/mcp/" and "/mcp" must route identically.
+    const resourcePath = normalizeConfiguredPath(options.resourcePath ?? DEFAULT_RESOURCE_PATH);
+    // Avoid "//oauth" when the resource is mounted at "/".
+    const oauthPath = options.oauthPath ?? (resourcePath === "/" ? "/oauth" : `${resourcePath}/oauth`);
+    const clients = options.clients ?? DEFAULT_CLIENTS;
+    const realm = options.realm ?? options.serverInfo.name;
+    assertClientsConfigured(clients, options.auth.clientStore);
+    assertToolScopesConfigured(options.tools, options.scopes ?? [DEFAULT_SCOPE]);
+    const registry = createToolRegistry(options.tools, pickDefined(options, ["validateArgs", "onToolError"]));
+    const authenticate = buildAuthenticate(options, resourcePath);
+    const { toMcpAudit, oauthAudit } = buildAuditAdapters(options);
+    // Built once and shared with the `fetch` catch path below, so the fallback
+    // audit sees exactly the same ports/timeout as the handler itself.
+    const mcpHandlerOptions = buildMcpHandlerOptions(options, {
+        resourcePath,
+        realm,
+        registry,
+        authenticate,
+        toMcpAudit,
+    });
+    const oauthOptions = buildOAuthOptions(options, {
+        resourcePath,
+        oauthPath,
+        realm,
+        clients,
+        oauthAudit,
     });
     return {
-        fetch: async (request) => {
-            try {
-                const oauthResponse = await oauth.tryHandle(request);
-                if (oauthResponse)
-                    return oauthResponse;
-                const requestPath = normalizeConfiguredPath(new URL(request.url).pathname);
-                if (requestPath === resourcePath) {
-                    return await handler.fetch(request);
-                }
-                return jsonResponse({ error: "Not found" }, 404);
-            }
-            catch {
-                // Both `oauth` and `handler` already turn port failures into a
-                // Response themselves — this is defense in depth, not the primary
-                // guard. `fetch` must never reject.
-                return jsonResponse({ error: INTERNAL_ERROR }, 500);
-            }
-        },
+        fetch: createAppFetch({
+            resourcePath,
+            oauth: createOAuthRouter(oauthOptions),
+            oauthOptions,
+            handler: createMcpHandler(mcpHandlerOptions),
+            mcpHandlerOptions,
+        }),
     };
 };
 //# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,cAAc,EAEd,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAIzD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,GACf,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAUtD,OAAO,EAAE,kBAAkB,EAAgB,MAAM,eAAe,CAAC;AA4FjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAO,OAA4B,EAAU,EAAE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,YAAY,QAAQ,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAEvD,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,kBAAkB,CAAO,OAAO,CAAC,KAAK,EAAE;QACvD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH;;;OAGG;IACH,MAAM,YAAY,GAAG,KAAK,EAAE,GAAY,EAA6B,EAAE;QACrE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC1E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,MAAM;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,gBAAgB,CAAO;QACrC,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,eAAe,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACzB,KAAK;YACL,mBAAmB,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,YAAY,EAAE;SACtG,CAAC;QACF,KAAK,EAAE;YACL,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAS,CAAC;YAChD,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,YAAY;QACZ,SAAS;QACT,KAAK;QACL,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACnD,GAAG,CAAC,OAAO,CAAC,wBAAwB,KAAK,SAAS;YAChD,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,wBAAwB,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,QAAQ,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC1E,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C;QACD,KAAK,EAAE;YACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtF,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E;KACF,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,KAAK,EAAE,OAAgB,EAAqB,EAAE;YACnD,IAAI,CAAC;gBACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBACrD,IAAI,aAAa;oBAAE,OAAO,aAAa,CAAC;gBAExC,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC3E,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;oBACjC,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,CAAC;gBACD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,+DAA+D;gBAC/D,kEAAkE;gBAClE,oCAAoC;gBACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,cAAc,EAEd,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAA2C,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAmC,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAgB,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAahD;;;;;GAKG;AACH,MAAM,0BAA0B,GAAG,CAAO,KAAsB,EAAE,MAAgB,EAAQ,EAAE;IAC1F,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B;QAC/E,gFAAgF;QAChF,oBAAoB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C;QACnF,2DAA2D,CAC9D,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,iBAAiB,GAAG,CACxB,OAA4B,EAC5B,YAAoB,EAC+B,EAAE;IACrD,OAAO,KAAK,EAAE,OAAgB,EAA6B,EAAE;QAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE9D,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,MAAM;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,oFAAoF;AACpF,MAAM,kBAAkB,GAAG,CACzB,OAA4B,EAI5B,EAAE;IACF,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC;IACnC,MAAM,UAAU,GACd,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,CAAC,KAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC;QAClE,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,CAAC,KAAK;QAClB,CAAC,YAAY,KAAK,SAAS;YACzB,CAAC,CAAC,CAAC,KAAsB,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;YACzE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,OAA4B,EAC5B,KAMC,EACwB,EAAE;IAC3B,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IAC1E,OAAO;QACL,QAAQ;QACR,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,WAAW,CAAC,OAAO,EAAE;YACtB,cAAc;YACd,gBAAgB;YAChB,uBAAuB;YACvB,uBAAuB;SACxB,CAAC;QACF,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK;YACL,mBAAmB,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,wCAAwC,YAAY,EAAE;SAC1G,CAAC;QACF,KAAK,EAAE;YACL,YAAY;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAS,CAAC;YAChD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,OAA4B,EAC5B,KAOC,EACmB,EAAE;IACtB,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACtE,OAAO;QACL,YAAY;QACZ,SAAS;QACT,KAAK;QACL,GAAG,WAAW,CAAC,OAAO,EAAE;YACtB,QAAQ;YACR,eAAe;YACf,gBAAgB;YAChB,wBAAwB;YACxB,MAAM;YACN,WAAW;YACX,YAAY;YACZ,0BAA0B;YAC1B,SAAS;SACV,CAAC;QACF,wBAAwB,EAAE,cAAc,CAAC,OAAO,CAAC;QACjD,wBAAwB,EAAE,gBAAgB,CAAC,OAAO,CAAC;QACnD,QAAQ,EAAE;YACR,yDAAyD;YACzD,KAAK,EAAE,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;YAC1E,WAAW,EAAE,KAAK;YAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,IAAI;SAC7C;QACD,KAAK,EAAE;YACL,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,UAAU;YACnC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW;YACrC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;YAC/B,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe;YAC7C,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC3B,oBAAoB;gBACpB,aAAa;gBACb,WAAW;gBACX,aAAa;aACd,CAAC;YACF,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC;AACJ,CAAC,CAAC;AAWF,MAAM,cAAc,GAClB,CAAO,KAAqB,EAAmB,EAAE,CACjD,KAAK,EAAE,OAAO,EAAE,EAAE;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,aAAa;YAAE,OAAO,aAAa,CAAC;QAExC,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,WAAW,KAAK,KAAK,CAAC,YAAY;YAAE,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClF,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,qEAAqE;QACrE,kEAAkE;QAClE,iCAAiC;QACjC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,MAAM,SAAS,CAAC,KAAK,CAAC,iBAAiB,EAAE;YACvC,MAAM,EAAE,EAAE;YACV,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,CAAC;SACd,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAO,OAA4B,EAAU,EAAE;IACzE,6CAA6C;IAC7C,MAAM,YAAY,GAAG,uBAAuB,CAAC,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC,CAAC;IAC5F,uDAAuD;IACvD,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,IAAI,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;IAEvD,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3D,0BAA0B,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,kBAAkB,CACjC,OAAO,CAAC,KAAK,EACb,WAAW,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CACtD,CAAC;IAEF,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE/D,2EAA2E;IAC3E,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,EAAE;QACxD,YAAY;QACZ,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,EAAE;QAC9C,YAAY;QACZ,SAAS;QACT,KAAK;QACL,OAAO;QACP,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,cAAc,CAAC;YACpB,YAAY;YACZ,KAAK,EAAE,iBAAiB,CAAC,YAAY,CAAC;YACtC,YAAY;YACZ,OAAO,EAAE,gBAAgB,CAAO,iBAAiB,CAAC;YAClD,iBAAiB;SAClB,CAAC;KACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/audit.d.ts

@@ -1,4 +1,4 @@
-import type { AuditEntry } from "./methods.js";
+import type { UnifiedAuditEntry } from "./app-options.js";
 /**
  * Convenience `audit` sink that logs each entry to the console.
  *
@@ -10,9 +10,9 @@ import type { AuditEntry } from "./methods.js";
  *   createMcpApp({ ..., audit: consoleAudit })
  *   createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
  *
- * Failures (`ok: false`, including transport-level denials and tool
- * exceptions) go to `console.error`; everything else to `console.log`.
- * Entries never carry raw exceptions or stack traces (see `AuditEntry`).
+ * MCP failures (`ok: false`) go to `console.error`; MCP successes and
+ * OAuth events go to `console.log`. Entries never carry raw exceptions or
+ * stack traces (see `AuditEntry` / `OAuthAuditEntry`).
  */
-export declare const consoleAudit: (entry: AuditEntry) => void;
+export declare const consoleAudit: (entry: UnifiedAuditEntry) => void;
 //# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/C;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,UAAU,KAAG,IAiBhD,CAAC"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,iBAAiB,KAAG,IA8BvD,CAAC"}

package/dist/audit.js

@@ -9,13 +9,25 @@
  *   createMcpApp({ ..., audit: consoleAudit })
  *   createMcpApp({ ..., audit: (entry) => { void insert(entry) } })
  *
- * Failures (`ok: false`, including transport-level denials and tool
- * exceptions) go to `console.error`; everything else to `console.log`.
- * Entries never carry raw exceptions or stack traces (see `AuditEntry`).
+ * MCP failures (`ok: false`) go to `console.error`; MCP successes and
+ * OAuth events go to `console.log`. Entries never carry raw exceptions or
+ * stack traces (see `AuditEntry` / `OAuthAuditEntry`).
  */
 export const consoleAudit = (entry) => {
+    if (entry.source === "oauth") {
+        const line = [
+            `[mcp-trellis] oauth`,
+            entry.event,
+            entry.clientId ? `client=${entry.clientId}` : undefined,
+            `reason=${entry.reason}`,
+        ]
+            .filter(Boolean)
+            .join(" ");
+        console.log(line);
+        return;
+    }
     const line = [
-        `[mcp-trellis] ${entry.method || "(transport)"}`,
+        `[mcp-trellis] mcp ${entry.method || "(transport)"}`,
         entry.tool ? `tool=${entry.tool}` : undefined,
         entry.ok ? "ok" : "fail",
         `${entry.durationMs}ms`,
@@ -24,11 +36,10 @@ export const consoleAudit = (entry) => {
     ]
         .filter(Boolean)
         .join(" ");
-    if (entry.ok) {
-        console.log(line);
-    }
-    else {
+    if (!entry.ok) {
         console.error(line);
+        return;
     }
+    console.log(line);
 };
 //# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAQ,EAAE;IACtD,MAAM,IAAI,GAAG;QACX,iBAAiB,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE;QAChD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxB,GAAG,KAAK,CAAC,UAAU,IAAI;QACvB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACjD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAQ,EAAE;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG;YACX,qBAAqB;YACrB,KAAK,CAAC,KAAK;YACX,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YACvD,UAAU,KAAK,CAAC,MAAM,EAAE;SACzB;aACE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG;QACX,qBAAqB,KAAK,CAAC,MAAM,IAAI,aAAa,EAAE;QACpD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QACxB,GAAG,KAAK,CAAC,UAAU,IAAI;QACvB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;KACjD;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IAEb,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC,CAAC"}

package/dist/auth/bearer.d.ts

@@ -1,5 +1,4 @@
 /** Bearer auth helpers for MCP (RFC 9728 WWW-Authenticate). */
-export declare const BEARER_PREFIX = "Bearer ";
 /** Above any real JWT / HMAC sig; prevents allocation DoS on attacker input. */
 export declare const MAX_COMPARE_LENGTH = 4096;
 export declare const parseBearer: (authorization: string | null) => string | null;
@@ -14,6 +13,10 @@ export type WwwAuthenticateOptions = {
     realm: string;
     /** Absolute URL to RFC 9728 protected resource metadata. */
     resourceMetadataUrl: string;
+    /** RFC 6750 §3.1 error code, e.g. `"insufficient_scope"`. Omitted on a plain 401. */
+    error?: string | undefined;
+    /** RFC 6750 §3.1 — the scope(s) that would satisfy the request. Paired with `error`. */
+    scope?: string | undefined;
 };
 export declare const wwwAuthenticateHeader: (options: WwwAuthenticateOptions) => string;
 /** RFC 6750 §2.3 uses `access_token`; also reject legacy `token`. */

package/dist/auth/bearer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,eAAO,MAAM,aAAa,YAAY,CAAC;AAEvC,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAEvC,eAAO,MAAM,WAAW,GAAI,eAAe,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAInE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAetD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,OACN,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAAI,SAAS,sBAAsB,KAAG,MACwB,CAAC;AAEjG,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,GAAI,KAAK,GAAG,KAAG,OAC2B,CAAC"}
+{"version":3,"file":"bearer.d.ts","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAI/D,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,OAAO,CAAC;AAKvC,eAAO,MAAM,WAAW,GAAI,eAAe,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAMnE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,KAAG,OAetD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,EAAE,KAAG,OACN,CAAC;AAE9D,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B,CAAC;AAMF,eAAO,MAAM,qBAAqB,GAAI,SAAS,sBAAsB,KAAG,MAQvE,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,gBAAgB,GAAI,KAAK,GAAG,KAAG,OAC2B,CAAC"}

package/dist/auth/bearer.js

@@ -1,11 +1,16 @@
 /** Bearer auth helpers for MCP (RFC 9728 WWW-Authenticate). */
-export const BEARER_PREFIX = "Bearer ";
+const BEARER_PREFIX = "Bearer ";
 /** Above any real JWT / HMAC sig; prevents allocation DoS on attacker input. */
 export const MAX_COMPARE_LENGTH = 4096;
+/** RFC 7235 §2.1 — the auth-scheme token is case-insensitive ("bearer", "BEARER", "Bearer" all valid). */
+const BEARER_SCHEME_RE = /^bearer\s+/i;
 export const parseBearer = (authorization) => {
-    if (!authorization?.startsWith(BEARER_PREFIX))
+    if (!authorization)
         return null;
-    const token = authorization.slice(BEARER_PREFIX.length).trim();
+    const match = BEARER_SCHEME_RE.exec(authorization);
+    if (!match)
+        return null;
+    const token = authorization.slice(match[0].length).trim();
     return token.length > 0 ? token : null;
 };
 /**
@@ -31,7 +36,17 @@ export const timingSafeEqual = (a, b) => {
     return diff === 0;
 };
 export const matchesAny = (presented, accepted) => accepted.some((token) => timingSafeEqual(presented, token));
-export const wwwAuthenticateHeader = (options) => `${BEARER_PREFIX}realm="${options.realm}", resource_metadata="${options.resourceMetadataUrl}"`;
+/** RFC 6750 / RFC 7235 quoted-string — escape `\` and `"` so host-controlled values cannot break or inject header params. */
+const escapeWwwAuthenticateValue = (value) => value.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+export const wwwAuthenticateHeader = (options) => {
+    const parts = [
+        `realm="${escapeWwwAuthenticateValue(options.realm)}"`,
+        `resource_metadata="${escapeWwwAuthenticateValue(options.resourceMetadataUrl)}"`,
+        ...(options.error ? [`error="${escapeWwwAuthenticateValue(options.error)}"`] : []),
+        ...(options.scope ? [`scope="${escapeWwwAuthenticateValue(options.scope)}"`] : []),
+    ];
+    return `${BEARER_PREFIX}${parts.join(", ")}`;
+};
 /** RFC 6750 §2.3 uses `access_token`; also reject legacy `token`. */
 export const rejectQueryToken = (url) => url.searchParams.has("token") || url.searchParams.has("access_token");
 //# sourceMappingURL=bearer.js.map

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAA4B,EAAiB,EAAE;IACzE,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC/D,4EAA4E;IAC5E,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAkB,EAAW,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAQ9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAA+B,EAAU,EAAE,CAC/E,GAAG,aAAa,UAAU,OAAO,CAAC,KAAK,yBAAyB,OAAO,CAAC,mBAAmB,GAAG,CAAC;AAEjG,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAW,EAAE,CACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAE/D,MAAM,aAAa,GAAG,SAAS,CAAC;AAEhC,gFAAgF;AAChF,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC,0GAA0G;AAC1G,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAA4B,EAAiB,EAAE;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE;IAC/D,4EAA4E;IAC5E,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACnE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACtE,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzB,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,SAAiB,EAAE,QAAkB,EAAW,EAAE,CAC3E,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAY9D,6HAA6H;AAC7H,MAAM,0BAA0B,GAAG,CAAC,KAAa,EAAU,EAAE,CAC3D,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAEpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,OAA+B,EAAU,EAAE;IAC/E,MAAM,KAAK,GAAG;QACZ,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG;QACtD,sBAAsB,0BAA0B,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG;QAChF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,0BAA0B,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,GAAQ,EAAW,EAAE,CACpD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC"}

package/dist/clients.js

@@ -6,7 +6,7 @@
  * point: you name your clients, the library configures the AS to match.
  */
 import { TOKEN_ENDPOINT_AUTH_METHODS } from "./oauth/constants.js";
-import { CLAUDE_CALLBACK } from "./oauth/redirect.js";
+import { CLAUDE_CALLBACK } from "./oauth/policy/redirect.js";
 export const CLIENT_PROFILES = {
     /** Claude Custom Connectors — dynamic registration, public client + PKCE. */
     claude: {

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiBtD,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAiB7D,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/deprecated.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
+ * Declared as consts (not `export { } from`) so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const timingSafeEqual: (a: string, b: string) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const matchesAny: (presented: string, accepted: string[]) => boolean;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const emptyResponse: (status: number) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const methodNotAllowed: (message?: string, options?: import("./server.js").JsonResponseOptions) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const optionsResponse: (options?: import("./server.js").JsonResponseOptions) => Response;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const pickProtocolVersion: (params?: Record<string, unknown>) => string;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const ASSUMED_HEADER_PROTOCOL_VERSION = "2025-03-26";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const validateAgainstSchema: (value: unknown, schema: import("./server.js").JsonSchema) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const unsupportedKeywords: (schema: import("./server.js").JsonSchema, path?: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const missingObjectType: (schema: import("./server.js").JsonSchema, path?: string) => string[];
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const JSON_SCHEMA_TYPES: {
+    readonly string: "string";
+    readonly number: "number";
+    readonly integer: "integer";
+    readonly boolean: "boolean";
+    readonly object: "object";
+    readonly array: "array";
+    readonly null: "null";
+};
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const SUPPORTED_SCHEMA_KEYWORDS: ReadonlySet<string>;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
+//# sourceMappingURL=deprecated.d.ts.map

package/dist/deprecated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sEAAsE;AACtE,eAAO,MAAM,eAAe,mCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,UAAU,oDAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,WAAW,4DAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,8BAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,qFAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,eAAe,mEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,8CAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,+BAA+B,eAA2C,CAAC;AACxF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,wEAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,uEAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uEAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB;;;;;;;;CAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,qBAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,qBAAmC,CAAC"}

package/dist/deprecated.js

@@ -0,0 +1,35 @@
+/**
+ * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
+ * Declared as consts (not `export { } from`) so `@deprecated` reaches
+ * editors. Removed in 3.0.
+ */
+import * as advanced from "./advanced.js";
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const timingSafeEqual = advanced.timingSafeEqual;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const matchesAny = advanced.matchesAny;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const corsHeaders = advanced.corsHeaders;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const emptyResponse = advanced.emptyResponse;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const methodNotAllowed = advanced.methodNotAllowed;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const optionsResponse = advanced.optionsResponse;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const pickProtocolVersion = advanced.pickProtocolVersion;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const ASSUMED_HEADER_PROTOCOL_VERSION = advanced.ASSUMED_HEADER_PROTOCOL_VERSION;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const validateAgainstSchema = advanced.validateAgainstSchema;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const unsupportedKeywords = advanced.unsupportedKeywords;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const missingObjectType = advanced.missingObjectType;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const JSON_SCHEMA_TYPES = advanced.JSON_SCHEMA_TYPES;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const SUPPORTED_SCHEMA_KEYWORDS = advanced.SUPPORTED_SCHEMA_KEYWORDS;
+/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+export const IGNORED_SCHEMA_KEYWORDS = advanced.IGNORED_SCHEMA_KEYWORDS;
+//# sourceMappingURL=deprecated.js.map

package/dist/deprecated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,+BAA+B,CAAC;AACxF,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC"}

package/dist/{body.d.ts → http/body.d.ts}

@@ -13,13 +13,34 @@ export declare const DEFAULT_MCP_BODY_LIMIT = 1048576;
 /** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */
 export declare const DEFAULT_OAUTH_BODY_LIMIT = 65536;
 /**
- * Reads a Web `Request` body as text, rejecting early on an honest
- * oversized `Content-Length`, then aborting mid-stream — before the whole
- * body is buffered — if a chunked body (no `Content-Length`) exceeds
- * `maxBytes`. Falls back to `request.text()` when `request.body` is null
- * (some runtimes don't expose a streaming body), still enforcing the cap.
+ * Structural subset of `Request`/`Response` that `readBoundedBytes` actually
+ * needs — both are real `Request`s (every caller inside this package) and,
+ * via `tools.ts`'s `apiTool`, a `Response` from an upstream `fetch` call
+ * capping how much of that body a tool ever buffers into memory.
  */
-export declare const readBoundedText: (request: Request, maxBytes: number) => Promise<string>;
+export type BoundedBodySource = {
+    headers: {
+        get: (name: string) => string | null;
+    };
+    body: ReadableStream<Uint8Array> | null;
+    text: () => Promise<string>;
+    /** Preferred over `text` for the no-stream fallback — keeps binary bodies intact. */
+    arrayBuffer?: () => Promise<ArrayBuffer>;
+};
+/**
+ * Reads a bounded body as raw bytes, rejecting early on an honest oversized
+ * `Content-Length`, then aborting mid-stream — before the whole body is
+ * buffered — if a chunked body (no `Content-Length`) exceeds `maxBytes`.
+ * Falls back to `source.arrayBuffer()` (or `source.text()`) when
+ * `source.body` is null (some runtimes don't expose a streaming body),
+ * still enforcing the cap.
+ *
+ * Optional `signal` cancels the active reader on abort — needed when a hop
+ * timeout must stop a stalled stream (a locked `body.cancel()` is a no-op).
+ */
+export declare const readBoundedBytes: (source: BoundedBodySource, maxBytes: number, signal?: AbortSignal) => Promise<Uint8Array>;
+/** `readBoundedBytes`, decoded as UTF-8 — for JSON / form / text bodies. */
+export declare const readBoundedText: (source: BoundedBodySource, maxBytes: number, signal?: AbortSignal) => Promise<string>;
 export type BoundedNodeBodyOptions = {
     /** Declared `Content-Length` header value, checked before reading anything. */
     contentLength?: string | undefined;

package/dist/http/body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAuB/C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE;QAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,UAAU,CA6CpB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,GAC1B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,MAAM,CAA+E,CAAC;AAEjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACxE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC7C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAG6B,CAAC;AA+DvF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,gBAAgB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,EAC7D,UAAU,MAAM,EAChB,UAAS,sBAA2B,KACnC,OAAO,CAAC,UAAU,CAQpB,CAAC"}