mcp-trellis 1.0.0 → 2.2.0

package/dist/server.d.ts

@@ -1,16 +1,17 @@
-export { createMcpApp, type McpApp, type McpAppAuth, type McpAppOptions, type VerifiedToken, } from "./app.js";
+export { createMcpApp, type McpApp, type McpAppAuth, type McpAppOptions, type UnifiedAuditEntry, type VerifiedToken, } from "./app.js";
 export { consoleAudit } from "./audit.js";
-export { matchesAny, parseBearer, rejectQueryToken, timingSafeEqual, type WwwAuthenticateOptions, wwwAuthenticateHeader, } from "./auth/bearer.js";
+export { parseBearer, rejectQueryToken, type WwwAuthenticateOptions, wwwAuthenticateHeader, } from "./auth/bearer.js";
+export { type SignedTokenAuthOptions, signedTokenAuth, } from "./auth/signed-token.js";
 export { authMethodsFor, CLIENT_PROFILES, type ClientName, type ClientProfile, DEFAULT_CLIENTS, hasDynamicClient, preRegisteredClients, redirectUrisFor, } from "./clients.js";
-export { type AuditEntry, createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type ServerInfo, } from "./dispatch.js";
-export { corsHeaders, emptyResponse, jsonResponse, methodNotAllowed, optionsResponse, } from "./http.js";
-export { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, rpcError, rpcResult, } from "./jsonrpc.js";
-export type { CodeStore } from "./oauth/codes.js";
-export type { ConsentOptions, ConsentRequest } from "./oauth/consent.js";
+export * from "./deprecated.js";
+export { type JsonResponseInput, type JsonResponseOptions, jsonResponse, } from "./http/http.js";
+export { type AuditEntry, createMcpHandler, type McpHandler, type McpHandlerOptions, type McpPorts, type Principal, type ServerInfo, } from "./mcp/dispatch.js";
+export { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, JSONRPC_UNAUTHORIZED, type JsonRpcId, type JsonRpcRequest, type JsonRpcResponse, rpcError, rpcResult, } from "./mcp/jsonrpc.js";
+export { DEFAULT_PROTOCOL_VERSION, PROTOCOL_VERSIONS } from "./mcp/protocol.js";
+export { createToolRegistry, type RegistryOptions, type ToolDef, type ToolHandler, type ToolListEntry, type ToolRegistry, type ToolResult, } from "./mcp/registry.js";
+export { type ApiRequest, type ApiToolOptions, apiTool, type DefineToolOptions, defineTool, type StandardSchemaV1, } from "./mcp/tools.js";
+export type { JsonSchema } from "./mcp/validate.js";
+export type { CodeStore } from "./oauth/crypto/codes.js";
 /** Auth-port types used by `McpAppAuth` — annotate extracted stores/callbacks. */
-export type { ClientStore, MintAccessTokenInput, MintedToken, OAuthUser, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./oauth/types.js";
-export { ASSUMED_HEADER_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, PROTOCOL_VERSIONS, pickProtocolVersion, } from "./protocol.js";
-export { createToolRegistry, type RegistryOptions, type ToolDef, type ToolHandler, type ToolListEntry, type ToolRegistry, type ToolResult, } from "./registry.js";
-export { type ApiRequest, type ApiToolOptions, apiTool, type DefineToolOptions, defineTool, type StandardSchemaV1, } from "./tools.js";
-export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, type JsonSchema, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./validate.js";
+export type { ClientStore, ConsentOptions, ConsentRequest, MintAccessTokenInput, MintedToken, OAuthUser, RefreshAccessTokenInput, RegisteredClient, RevokeTokenInput, } from "./oauth/types.js";
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,KAAK,sBAAsB,EAC3B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,eAAe,EACf,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzE,kFAAkF;AAClF,YAAY,EACV,WAAW,EACX,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,iBAAiB,EACtB,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,KAAK,UAAU,EACf,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,KAAK,MAAM,EACX,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,KAAK,sBAAsB,EAC3B,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,KAAK,sBAAsB,EAC3B,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,eAAe,EACf,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,cAAc,iBAAiB,CAAC;AAChC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,UAAU,EACf,gBAAgB,EAChB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,QAAQ,EACR,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,GAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,OAAO,EACP,KAAK,iBAAiB,EACtB,UAAU,EACV,KAAK,gBAAgB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,kFAAkF;AAClF,YAAY,EACV,WAAW,EACX,cAAc,EACd,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,SAAS,EACT,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,kBAAkB,CAAC"}

package/dist/server.js

@@ -1,12 +1,14 @@
 export { createMcpApp, } from "./app.js";
 export { consoleAudit } from "./audit.js";
-export { matchesAny, parseBearer, rejectQueryToken, timingSafeEqual, wwwAuthenticateHeader, } from "./auth/bearer.js";
+export { parseBearer, rejectQueryToken, wwwAuthenticateHeader, } from "./auth/bearer.js";
+export { signedTokenAuth, } from "./auth/signed-token.js";
 export { authMethodsFor, CLIENT_PROFILES, DEFAULT_CLIENTS, hasDynamicClient, preRegisteredClients, redirectUrisFor, } from "./clients.js";
-export { createMcpHandler, } from "./dispatch.js";
-export { corsHeaders, emptyResponse, jsonResponse, methodNotAllowed, optionsResponse, } from "./http.js";
-export { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, JSONRPC_UNAUTHORIZED, rpcError, rpcResult, } from "./jsonrpc.js";
-export { ASSUMED_HEADER_PROTOCOL_VERSION, DEFAULT_PROTOCOL_VERSION, PROTOCOL_VERSIONS, pickProtocolVersion, } from "./protocol.js";
-export { createToolRegistry, } from "./registry.js";
-export { apiTool, defineTool, } from "./tools.js";
-export { IGNORED_SCHEMA_KEYWORDS, JSON_SCHEMA_TYPES, missingObjectType, SUPPORTED_SCHEMA_KEYWORDS, unsupportedKeywords, validateAgainstSchema, } from "./validate.js";
+// Moved to `mcp-trellis/advanced`; deprecated aliases until 3.0.
+export * from "./deprecated.js";
+export { jsonResponse, } from "./http/http.js";
+export { createMcpHandler, } from "./mcp/dispatch.js";
+export { JSONRPC_INTERNAL_ERROR, JSONRPC_INVALID_PARAMS, JSONRPC_INVALID_REQUEST, JSONRPC_METHOD_NOT_FOUND, JSONRPC_PARSE_ERROR, JSONRPC_UNAUTHORIZED, rpcError, rpcResult, } from "./mcp/jsonrpc.js";
+export { DEFAULT_PROTOCOL_VERSION, PROTOCOL_VERSIONS } from "./mcp/protocol.js";
+export { createToolRegistry, } from "./mcp/registry.js";
+export { apiTool, defineTool, } from "./mcp/tools.js";
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAKb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EAEf,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,cAAc,EACd,eAAe,EAGf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAEL,gBAAgB,GAMjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EAIpB,QAAQ,EACR,SAAS,GACV,MAAM,cAAc,CAAC;AActB,OAAO,EACL,+BAA+B,EAC/B,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kBAAkB,GAOnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAGL,OAAO,EAEP,UAAU,GAEX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EAEjB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,GAMb,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EACL,WAAW,EACX,gBAAgB,EAEhB,qBAAqB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,cAAc,EACd,eAAe,EAGf,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,iEAAiE;AACjE,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAGL,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAEL,gBAAgB,GAMjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EAIpB,QAAQ,EACR,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,kBAAkB,GAOnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,OAAO,EAEP,UAAU,GAEX,MAAM,gBAAgB,CAAC"}

package/dist/util/defined.d.ts

@@ -0,0 +1,11 @@
+/** `keys` of `T` with `undefined` removed from each value type, all optional. */
+export type DefinedProps<T, K extends keyof T> = {
+    [P in K]?: Exclude<T[P], undefined>;
+};
+/**
+ * Copies only the listed keys whose value is not `undefined`. Under
+ * `exactOptionalPropertyTypes` an explicit `undefined` is not assignable to
+ * an optional property, so forwarding optional options needs exactly this.
+ */
+export declare const pickDefined: <T extends object, K extends keyof T>(source: T, keys: readonly K[]) => DefinedProps<T, K>;
+//# sourceMappingURL=defined.d.ts.map

package/dist/util/defined.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defined.d.ts","sourceRoot":"","sources":["../../src/util/defined.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,MAAM,MAAM,YAAY,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,CAAC,IAAI;KAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;CAAE,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,MAAM,CAAC,EAC7D,QAAQ,CAAC,EACT,MAAM,SAAS,CAAC,EAAE,KACjB,YAAY,CAAC,CAAC,EAAE,CAAC,CAOnB,CAAC"}

package/dist/util/defined.js

@@ -0,0 +1,15 @@
+/**
+ * Copies only the listed keys whose value is not `undefined`. Under
+ * `exactOptionalPropertyTypes` an explicit `undefined` is not assignable to
+ * an optional property, so forwarding optional options needs exactly this.
+ */
+export const pickDefined = (source, keys) => {
+    const picked = {};
+    for (const key of keys) {
+        const value = source[key];
+        if (value !== undefined)
+            picked[key] = value;
+    }
+    return picked;
+};
+//# sourceMappingURL=defined.js.map

package/dist/util/defined.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defined.js","sourceRoot":"","sources":["../../src/util/defined.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAAS,EACT,IAAkB,EACE,EAAE;IACtB,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAiC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/util/json.d.ts

@@ -0,0 +1,3 @@
+/** A parsed JSON object — not `null`, not an array. */
+export declare const isJsonObject: (value: unknown) => value is Record<string, unknown>;
+//# sourceMappingURL=json.d.ts.map

package/dist/util/json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.d.ts","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,eAAO,MAAM,YAAY,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACP,CAAC"}

package/dist/util/json.js

@@ -0,0 +1,3 @@
+/** A parsed JSON object — not `null`, not an array. */
+export const isJsonObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//# sourceMappingURL=json.js.map

package/dist/util/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/util/json.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC/E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/docs/ROADMAP.md

@@ -1,24 +1,33 @@
 # mcp-trellis — roadmap
 
-Status: 2026-08-21. Written against MCP spec revision `2026-07-28`.
+Status: 2026-09-14. Written against MCP spec revision `2026-07-28`.
 
 ## What this library is
 
-> **The easy way to build a secure MCP server that works with Claude, Gemini,
-> and Codex** — on any Web-standard runtime, with no database and no vendor.
+> **Existing SaaS → authenticated AI connector SDK** — MCP + self-hosted OAuth
+> AS in one npm install, on any Web-standard runtime, with no database and no
+> vendor.
 
 The differentiating axis is **clients**, not runtimes. Runtime portability is
 table stakes; the official SDK has it too. What nobody in TypeScript ships is
 both halves — the MCP handler *and* a self-hosted OAuth authorization server —
 in one package you can drop into a Next.js route or a Deno server.
 
-| | Portable runtime | Self-hosted | AS included | Zero-dep |
+Contrast composition stacks that split the MCP runtime from the identity
+product (e.g. xmcp + Scalekit): those are 2–3 products to wire; mcp-trellis is
+one package with BYO-auth ports.
+
+| | Portable runtime | Self-hosted AS | One npm install | Zero-dep |
 |---|---|---|---|---|
-| Official SDK v2 | yes | yes | **no** | no |
+| Official SDK v2 | yes | **no** | yes (handler only) | no |
 | `workers-oauth-provider` | Workers only | yes | yes | — |
-| Auth0 / Authlete / Clerk / WorkOS | yes | **no** (SaaS) | yes | — |
+| Auth0 / Authlete / Clerk | yes | **no** (SaaS) | no (IdP + MCP) | — |
 | Better Auth | yes | yes | yes, but full stack + DB | no |
-| **mcp-trellis** | yes | yes | yes | yes |
+| **xmcp** | yes | **no** (compose) | no — pair with IdP | — |
+| **Scalekit** | yes | managed connector IdP | no — pair with MCP runtime | — |
+| **WorkOS Standalone Connect** | yes | managed | no — IdP + your MCP | — |
+| **Descope** | yes | managed | no — IdP + your MCP | — |
+| **mcp-trellis** | yes | yes | **yes** (handler + AS) | yes |
 
 The official SDK explicitly does not provide an authorization server — it offers
 SDK-level opt-ins and expects you to bring the infrastructure. That gap is the
@@ -110,7 +119,9 @@ a proper JSON-RPC error.
 - **Claims on `Principal`.** Optional `claims` from `verifyToken` /
   `VerifiedToken` flow into `context` (plan/role metadata — not the
   Host→tenant isolation key). Host-origin allowlisting (`allowedOrigins` on
-  `asNodeHandler`) is **required** when origin is Host-derived.
+  `asNodeHandler`) is **required** when origin is Host-derived. Separately,
+  browser `Origin` on MCP is gated by `allowedRequestOrigins` (fail-closed
+  when the header is present; native clients omit it).
 
 - **`validateArgs` fail-fast.** With `validateArgs: true`, unsupported JSON
   Schema keywords throw at `createToolRegistry` construction instead of
@@ -210,49 +221,28 @@ a proper JSON-RPC error.
   MCP audit hook. Sees the real reason behind a collapsed `invalid_client`
   or a rejected `codeSecret`, which the caller never does.
 
+**2.0 — CIMD, unified audit, recipes.**
+
+- **CIMD (Client ID Metadata Documents)** — opt-in (`cimd: true`). HTTPS URL
+  `client_id`s are fetched and validated with SSRF hardening (public hosts
+  only, size / redirect / timeout caps). Advertises
+  `client_id_metadata_document_supported`. Optional `cimdCache` port.
+  Off by default until connect-pinned fetch closes the DNS-rebinding ceiling.
+- **Unified `audit` sink** on `createMcpApp` — one callback for MCP and
+  OAuth events (`source: "mcp" | "oauth"`); `auth.audit` remains an
+  OAuth-only override.
+- **Framework recipes** — `examples/nextjs-saas/`, `examples/express.ts`.
+- **Reference MCP Registry server** — `examples/project-desk/`
+  (`io.github.amir1824/project-desk`, remotes only; not the SDK package).
+- Fail-closed defaults: `allowInMemoryCodeStore` / `validateArgs`.
+- **RFC 9207 `iss`** on authorize / error redirects; AS metadata advertises
+  `authorization_response_iss_parameter_supported`.
+
 ---
 
 ## Next
 
-### 1. CIMD — Client ID Metadata Documents
-
-DCR is deprecated as of `2026-07-28`; CIMD is the recommended replacement and
-the direction Claude and Codex are heading. The client publishes JSON at an
-HTTPS URL and uses that URL as its `client_id`; the AS resolves it on demand.
-
-AS-side requirements: detect URL-formatted `client_id`; fetch it; **MUST**
-validate the document's `client_id` equals the URL exactly; **MUST** validate
-the request's `redirect_uri` against the document's `redirect_uris`; **SHOULD**
-cache respecting HTTP cache headers; advertise
-`client_id_metadata_document_supported: true`.
-
-This slots cleanly into the existing shape — pure `fetch` plus validation, with
-caching as a port. It also completes the picture: the spec defines exactly three
-registration mechanisms, and they map one-to-one onto the three clients.
-
-```
-CIMD             → Claude, Codex     (public + PKCE)
-pre-registration → Gemini Enterprise (confidential)   ← shipped
-DCR              → legacy fallback                    ← shipped
-```
-
-The security work is the real work: an AS that fetches attacker-supplied URLs is
-an SSRF engine unless it blocks private/loopback/link-local ranges and DNS
-rebinding, caps redirects, response size, and timeout, and refuses non-HTTPS.
-Cloudflare's implementation is a useful reference for what "done right" means
-(5 KB cap, 10 s timeout, public clients only).
-
-Note: CIMD is not unclaimed. Authlete, Auth0, Clerk, and `workers-oauth-provider`
-all ship it. The claim here is narrower and still true — none of them is a
-portable, self-hosted, zero-dependency library.
-
-### 2. RFC 9207 — `iss` in the authorization response
-
-Add `iss` to the authorize redirect and
-`authorization_response_iss_parameter_supported` to AS metadata. Small, and a
-spec-level SHOULD.
-
-### 3. Protocol currency — `2026-07-28`
+### 1. Protocol currency — `2026-07-28`
 
 Deferred deliberately: Claude, Gemini, and Codex all work against current
 revisions today, and the official SDK already covers dual-era for anyone who

package/docs/compatibility.md

@@ -0,0 +1,86 @@
+# Compatibility evidence
+
+Updated 2026-09-14. Repository implementation and automated coverage are in good
+shape after the pre-prod security pass. **Vendor-client UI sessions are still
+Pending** — do not convert product rows to ✅ until a live Claude/ChatGPT/Codex/Gemini
+check below is filled in.
+
+| Product | Server profile | Repository evidence | Live evidence |
+|---|---|---|---|
+| Claude custom connector | `claude`: DCR / CIMD, public client, S256 PKCE; built-in callback | `test/oauth/policy/clients.test.ts`, `test/oauth/endpoints/dcr.test.ts`, `test/oauth/cimd/cimd.test.ts`, `test/oauth/crypto/pkce.test.ts`; saas-demo e2e + `scripts/prep-claude-oauth.mjs` | Pending (UI) |
+| ChatGPT | `codex`: public-client profile; exact hosted callback must be configured | Profile tests only; no ChatGPT UI test | Pending |
+| Codex | `codex`: public client, PKCE, loopback callbacks allowed | Profile/redirect tests; no actual Codex login run | Pending |
+| Gemini Enterprise | `gemini`: `clientStore`, pre-registration, `client_secret_basic` / `client_secret_post` | Client authentication tests; no Enterprise environment | Pending |
+
+The Gemini profile does not imply compatibility with Gemini CLI or every Gemini product. ChatGPT and Codex need separate live checks even though the package groups them under one profile.
+
+`src/mcp/protocol.ts` implements `2024-11-05`, `2025-03-26`, `2025-06-18`. Initialization defaults to `2025-06-18`; absent request headers use `2025-03-26`. This is an implementation inventory, not a claim to implement the latest revision. **CIMD is shipped opt-in** (`cimd: true` on `createMcpApp` / `createOAuthRouter`; off by default — see [security.md](security.md) SSRF ceiling). Live vendor UI evidence stays **Pending** until an operator connects a real client.
+
+## Demo deploy (Worker)
+
+**Project desk** (Registry remotes target): [`examples/project-desk/worker.ts`](../examples/project-desk/worker.ts)
+via root [`wrangler.toml`](../wrangler.toml).
+
+```bash
+npx wrangler secret put DEMO_PASSWORD   # project-desk-demo for the public demo
+npx wrangler secret put OAUTH_CODE_SECRET
+npx wrangler deploy
+```
+
+MCP URL: `https://mcp-trellis-project-desk.<workers-subdomain>.workers.dev/mcp`.
+Operator checklist: [`examples/project-desk/PUBLISH.md`](../examples/project-desk/PUBLISH.md).
+This does **not** replace the live client rows below.
+
+Minimal ping-only Worker recipe (not the hosted demo):
+[`examples/cloudflare-worker.ts`](../examples/cloudflare-worker.ts).
+
+## Host contract covered in-repo
+
+`examples/project-desk` mints refresh tokens and enforces RFC 6749 §6: requested
+refresh `scope` must be ⊆ the scopes originally bound to that refresh token
+(`isScopeSubset` pattern also in `examples/stores.ts`). Escalation →
+`invalid_grant`. Covered by `test/e2e/saas-demo.test.ts`.
+
+## Automated package smoke (not a vendor live pass)
+
+```bash
+npm run smoke:pack
+```
+
+Installs the local `npm pack` tarball in a temp directory and imports
+`createMcpApp` / `asNodeHandler`. Record date/commit when you run it before a
+release; it does **not** replace the live client row.
+
+| Date | Commit / package | Command | Result |
+|---|---|---|---|
+| 2026-09-12 | unreleased working tree (`1.1.0` pack) | `npm run smoke:pack` | Pass — `createMcpApp` + `asNodeHandler` import from tarball |
+
+## Evidence required for a live pass
+
+Record client product, version/build (or web UI and test date), account tier, package version/commit, hosting environment and configured callback. Capture discovery → registration → app login → consent → token exchange → initialize → tools/list → `list_my_projects`. Verify wrong audience/invalid token rejection and user isolation separately. Save sanitized output or recording; exclude cookies, passwords, codes and tokens.
+
+Against a public HTTPS demo (`PUBLIC_ORIGIN` + `DEMO_PASSWORD=project-desk-demo`):
+
+```bash
+npm run demo   # reverse-proxy to HTTPS; set PUBLIC_ORIGIN
+# or use the deployed Worker from examples/project-desk/PUBLISH.md
+node scripts/prep-claude-oauth.mjs   # scripted OAuth + refresh scope + tool
+# Then open the vendor UI with MCP URL https://YOUR-HOST/mcp and record below.
+```
+
+| Date | Client/build | Package/commit | Protocol negotiated | Tool + expected result | Evidence | Result |
+|---|---|---|---|---|---|---|
+| — | — | — | — | — | — | Pending |
+
+## Under-ten-minute onboarding test
+
+Use a clean folder and the published npm tarball, start a timer at `npm install`, and stop at a real client's first correct user-scoped tool response. Record setup prerequisites, elapsed time, every edit and any error. A local source import or simulated OAuth flow is insufficient. Target: under ten minutes with hosting and a supported client account available; no time claim is published until measured.
+
+| Field | Value |
+|---|---|
+| Start (`npm install`) | — |
+| Stop (first correct tool in real client) | — |
+| Elapsed | — |
+| Prerequisites (hosting, account, callback) | — |
+| Edits / errors | — |
+| Result | Pending |