mcp-trellis 2.2.0 → 3.1.0

package/dist/auth/signed/payload.js

@@ -0,0 +1,85 @@
+/**
+ * HMAC-signed JSON payloads for `signedTokenAuth`. Internal: not exported
+ * from the package.
+ *
+ * The HKDF `info` string is the only thing that stops one token type being
+ * presented as another (they share the `body.signature` shape), so the kind
+ * is a closed set here and never a caller-chosen label.
+ */
+import { bytesToBase64Url, fromBase64Url } from "../../oauth/crypto/base64url.js";
+import { hkdfKey } from "../../oauth/crypto/hkdf.js";
+import { isJsonObject } from "../../util/json.js";
+const TOKEN_LABELS = {
+    access: "mcp-trellis:signed-access-token:v1",
+    refresh: "mcp-trellis:signed-refresh-token:v1",
+};
+/**
+ * Refresh tokens are capped, and `signPayload` enforces it so an oversized one
+ * fails when issued, not on every later use. Access tokens are bounded only by
+ * the server's header limit, so a long user id still verifies.
+ */
+const MAX_REFRESH_TOKEN_LENGTH = 4096;
+const exceedsCap = (kind, token) => kind === "refresh" && token.length > MAX_REFRESH_TOKEN_LENGTH;
+const HMAC_SHA256 = { name: "HMAC", hash: "SHA-256", length: 256 };
+const tokenKey = (secret, kind, usage) => hkdfKey(secret, { info: TOKEN_LABELS[kind], algorithm: HMAC_SHA256, usage });
+export const signPayload = async (secret, kind, payload) => {
+    const key = await tokenKey(secret, kind, "sign");
+    const body = bytesToBase64Url(new TextEncoder().encode(JSON.stringify(payload)));
+    const signature = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(body));
+    const token = `${body}.${bytesToBase64Url(signature)}`;
+    if (exceedsCap(kind, token)) {
+        throw new Error(`signedTokenAuth: a refresh token would be ${token.length} characters, over the ` +
+            `${MAX_REFRESH_TOKEN_LENGTH} limit — shorten the user id or the scope list`);
+    }
+    return token;
+};
+/**
+ * True when `signature` verifies `body` under any of `secrets`, tried in order.
+ * ponytail: one HMAC per rotation entry for a forged token; `signedTokenAuth`
+ * caps the list at 8. Upgrade: carry a key id in the token and look the key up.
+ */
+const signedByAny = async (secrets, kind, token) => {
+    const signature = fromBase64Url(token.signature);
+    const message = new TextEncoder().encode(token.body);
+    for (const secret of secrets) {
+        const key = await tokenKey(secret, kind, "verify");
+        if (await crypto.subtle.verify("HMAC", key, signature, message))
+            return true;
+    }
+    return false;
+};
+/**
+ * The decoded payload of a token of `kind` signed by one of `secrets`, or
+ * null for anything else. Callers still shape-check what comes back: a valid
+ * signature proves who signed it, not what it contains.
+ */
+export const verifyPayload = async (secrets, kind, token) => {
+    if (exceedsCap(kind, token))
+        return null;
+    const parts = token.split(".");
+    const [body, signature] = parts;
+    if (parts.length !== 2 || !body || !signature)
+        return null;
+    try {
+        if (!(await signedByAny(secrets, kind, { body, signature })))
+            return null;
+        return JSON.parse(new TextDecoder().decode(fromBase64Url(body)));
+    }
+    catch {
+        return null;
+    }
+};
+const isStringArray = (value) => Array.isArray(value) && value.every((entry) => typeof entry === "string");
+/** The shared claims of a verified payload, or null if one is missing, malformed or expired. */
+export const parseGrantClaims = (payload) => {
+    if (!isJsonObject(payload))
+        return null;
+    const { userId, scopes, audience, exp } = payload;
+    if (typeof userId !== "string" || typeof audience !== "string" || !isStringArray(scopes)) {
+        return null;
+    }
+    if (typeof exp !== "number" || !Number.isFinite(exp) || exp < Date.now())
+        return null;
+    return { userId, scopes, audience, exp };
+};
+//# sourceMappingURL=payload.js.map

package/dist/auth/signed/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../../src/auth/signed/payload.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,YAAY,GAAG;IACnB,MAAM,EAAE,oCAAoC;IAC5C,OAAO,EAAE,qCAAqC;CACtC,CAAC;AAIX;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAEtC,MAAM,UAAU,GAAG,CAAC,IAAqB,EAAE,KAAa,EAAW,EAAE,CACnE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,wBAAwB,CAAC;AAEhE,MAAM,WAAW,GAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAErF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAqB,EAAE,KAAwB,EAAE,EAAE,CACnF,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AAE/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAC9B,MAAc,EACd,IAAqB,EACrB,OAAe,EACE,EAAE;IACnB,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;IACvD,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6CAA6C,KAAK,CAAC,MAAM,wBAAwB;YAC/E,GAAG,wBAAwB,gDAAgD,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAA0B,EAC1B,IAAqB,EACrB,KAA0C,EACxB,EAAE;IACpB,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,OAA0B,EAC1B,IAAqB,EACrB,KAAa,EACK,EAAE;IACpB,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAKF,MAAM,aAAa,GAAG,CAAC,KAAc,EAAqB,EAAE,CAC1D,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;AAE5E,gGAAgG;AAChG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAgB,EAAsB,EAAE;IACvE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IAClD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC,CAAC"}

package/dist/auth/signed/refresh.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Stateless refresh tokens for `signedTokenAuth`. Internal: not exported
+ * from the package.
+ *
+ * Signed, not stored. The only state is the single-use `jti` mark in the
+ * shared `codeStore`, which is what makes rotation work: a refresh token is
+ * accepted once and its successor is a different token. The mark lives until
+ * the grant's `exp`, one per refresh.
+ *
+ * ponytail: a replayed, already-rotated token is refused, but there is no
+ * token family to revoke when that happens, so the thief's successor stays
+ * valid until `exp` or until `isUserActive` turns false. Upgrade: an opaque
+ * server-side refresh store (see `examples/project-desk/src/tokens.ts`).
+ */
+import type { CodeStore } from "../../oauth/crypto/codes.js";
+import type { MintAccessTokenInput, MintedToken, RefreshAccessTokenInput, RevokeTokenInput } from "../../oauth/types.js";
+export type SecretList = readonly [string, ...string[]];
+export type UserCheck = (userId: string) => boolean | Promise<boolean>;
+export type AccessMinter = (input: MintAccessTokenInput) => Promise<MintedToken>;
+type RefreshTokenConfig = {
+    secrets: SecretList;
+    lifetimeMs: number;
+    codeStore: CodeStore;
+    isUserActive: UserCheck;
+    mintAccess: AccessMinter;
+};
+export type RefreshTokens = {
+    issue: (grant: MintAccessTokenInput) => Promise<string>;
+    refresh: (input: RefreshAccessTokenInput) => Promise<MintedToken | null>;
+    revoke: (input: RevokeTokenInput) => Promise<void>;
+};
+export declare const createRefreshTokens: (config: RefreshTokenConfig) => RefreshTokens;
+export {};
+//# sourceMappingURL=refresh.d.ts.map

package/dist/auth/signed/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/auth/signed/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAI7D,OAAO,KAAK,EACV,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAoB9B,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,MAAM,SAAS,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACvE,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAEjF,KAAK,kBAAkB,GAAG;IACxB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,SAAS,CAAC;IACxB,UAAU,EAAE,YAAY,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD,CAAC;AAqFF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,kBAAkB,KAAG,aAI/D,CAAC"}

package/dist/auth/signed/refresh.js

@@ -0,0 +1,95 @@
+/**
+ * Stateless refresh tokens for `signedTokenAuth`. Internal: not exported
+ * from the package.
+ *
+ * Signed, not stored. The only state is the single-use `jti` mark in the
+ * shared `codeStore`, which is what makes rotation work: a refresh token is
+ * accepted once and its successor is a different token. The mark lives until
+ * the grant's `exp`, one per refresh.
+ *
+ * ponytail: a replayed, already-rotated token is refused, but there is no
+ * token family to revoke when that happens, so the thief's successor stays
+ * valid until `exp` or until `isUserActive` turns false. Upgrade: an opaque
+ * server-side refresh store (see `examples/project-desk/src/tokens.ts`).
+ */
+import { randomBase64Url, sha256Base64Url } from "../../oauth/crypto/pkce.js";
+import { resourcesEqual } from "../../oauth/policy/resource.js";
+import { formatScope, parseScope } from "../../oauth/policy/scope.js";
+import { isJsonObject } from "../../util/json.js";
+import { parseGrantClaims, signPayload, verifyPayload } from "./payload.js";
+const JTI_BYTES = 16;
+const MAX_JTI_LENGTH = 64;
+/** Keeps a refresh `jti` apart from auth-code jtis (bare) and consent tickets (`ct:`). */
+const JTI_KEY_PREFIX = "rt:";
+const hasText = (value) => typeof value === "string" && value !== "";
+const parseRefreshPayload = (payload) => {
+    if (!isJsonObject(payload))
+        return null;
+    const claims = parseGrantClaims(payload);
+    if (!claims || claims.userId === "" || claims.audience === "")
+        return null;
+    const { clientHash, jti } = payload;
+    if (!hasText(clientHash) || !hasText(jti) || jti.length > MAX_JTI_LENGTH)
+        return null;
+    return { ...claims, clientHash, jti };
+};
+/** The requested scope narrowed to what the grant holds, or null if it asks for more. */
+const narrowedScopes = (granted, requested) => {
+    if (requested === undefined)
+        return granted;
+    const wanted = parseScope(requested);
+    return wanted.length > 0 && wanted.every((scope) => granted.includes(scope)) ? wanted : null;
+};
+const signRefresh = (config, payload) => signPayload(config.secrets[0], "refresh", payload);
+const readRefresh = async (config, token) => parseRefreshPayload(await verifyPayload(config.secrets, "refresh", token));
+// `=== true`: only a store that says so burns the token; a throw propagates
+// as a 500 instead of letting a replay through.
+const burnRefresh = async (config, payload) => (await config.codeStore.consume(`${JTI_KEY_PREFIX}${payload.jti}`, payload.exp)) === true;
+const issueRefresh = async (config, grant) => signRefresh(config, {
+    userId: grant.userId,
+    scopes: parseScope(grant.scope),
+    audience: grant.resource,
+    clientHash: await sha256Base64Url(grant.clientId),
+    exp: Date.now() + config.lifetimeMs,
+    jti: randomBase64Url(JTI_BYTES),
+});
+/**
+ * Order matters: every check that can fail on the caller's input runs before
+ * the burn, so a wrong-client or wrong-resource attempt cannot spend the
+ * rightful holder's token.
+ */
+const rotateRefresh = async (config, input) => {
+    const payload = await readRefresh(config, input.refreshToken);
+    if (!payload || payload.clientHash !== (await sha256Base64Url(input.clientId)))
+        return null;
+    if (!resourcesEqual(payload.audience, input.resource))
+        return null;
+    const scopes = narrowedScopes(payload.scopes, input.scope);
+    if (!scopes)
+        return null;
+    if ((await config.isUserActive(payload.userId)) !== true)
+        return null;
+    if (!(await burnRefresh(config, payload)))
+        return null;
+    const access = await config.mintAccess({
+        userId: payload.userId,
+        clientId: input.clientId,
+        scope: formatScope(scopes),
+        resource: payload.audience,
+    });
+    const successor = await signRefresh(config, { ...payload, jti: randomBase64Url(JTI_BYTES) });
+    return { ...access, refreshToken: successor };
+};
+/** RFC 7009: an unusable or foreign token is a silent no-op; a store failure is not. */
+const revokeRefresh = async (config, input) => {
+    const payload = await readRefresh(config, input.token);
+    if (payload && payload.clientHash === (await sha256Base64Url(input.clientId))) {
+        await burnRefresh(config, payload);
+    }
+};
+export const createRefreshTokens = (config) => ({
+    issue: (grant) => issueRefresh(config, grant),
+    refresh: (input) => rotateRefresh(config, input),
+    revoke: (input) => revokeRefresh(config, input),
+});
+//# sourceMappingURL=refresh.js.map

package/dist/auth/signed/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../../src/auth/signed/refresh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAOtE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAoB,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE9F,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,0FAA0F;AAC1F,MAAM,cAAc,GAAG,KAAK,CAAC;AA+B7B,MAAM,OAAO,GAAG,CAAC,KAAc,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC;AAE/F,MAAM,mBAAmB,GAAG,CAAC,OAAgB,EAAyB,EAAE;IACtE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC;IACtF,OAAO,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACxC,CAAC,CAAC;AAEF,yFAAyF;AACzF,MAAM,cAAc,GAAG,CAAC,OAAiB,EAAE,SAA6B,EAAmB,EAAE;IAC3F,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/F,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,MAA0B,EAAE,OAAuB,EAAmB,EAAE,CAC3F,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAErD,MAAM,WAAW,GAAG,KAAK,EACvB,MAA0B,EAC1B,KAAa,EACmB,EAAE,CAClC,mBAAmB,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7E,4EAA4E;AAC5E,gDAAgD;AAChD,MAAM,WAAW,GAAG,KAAK,EAAE,MAA0B,EAAE,OAAuB,EAAE,EAAE,CAChF,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC;AAE5F,MAAM,YAAY,GAAG,KAAK,EACxB,MAA0B,EAC1B,KAA2B,EACV,EAAE,CACnB,WAAW,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;IACxB,UAAU,EAAE,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;IACjD,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU;IACnC,GAAG,EAAE,eAAe,CAAC,SAAS,CAAC;CAChC,CAAC,CAAC;AAEL;;;;GAIG;AACH,MAAM,aAAa,GAAG,KAAK,EACzB,MAA0B,EAC1B,KAA8B,EACD,EAAE;IAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5F,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC;QACrC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;AAChD,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,aAAa,GAAG,KAAK,EACzB,MAA0B,EAC1B,KAAuB,EACR,EAAE;IACjB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA0B,EAAiB,EAAE,CAAC,CAAC;IACjF,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC;IAC7C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;IAChD,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC;CAChD,CAAC,CAAC"}

package/dist/auth/signed/token.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Convenience auth: one secret seals OAuth codes (via `codeSecret`) and
+ * signs short-lived access tokens. Domain separation is HKDF, not luck —
+ * access tokens, refresh tokens and sealed codes each use their own label.
+ *
+ * Tokens are stateless, so an issued access token stays valid until `exp`
+ * whatever happens to the login session. Pass `isUserActive` to close that:
+ * it runs on every verified token. Refresh is opt-in (`refreshTtlSeconds`);
+ * see `refresh.ts` for its limits.
+ *
+ * ponytail: access tokens cannot be revoked before `exp`; `/revoke` burns
+ * refresh tokens only. Upgrade: supply your own `mintAccessToken` /
+ * `verifyToken` over a store (see `examples/project-desk/src/tokens.ts`).
+ */
+import type { McpAppAuth } from "../../app-options.js";
+import type { CodeStore } from "../../oauth/crypto/codes.js";
+import type { OAuthUser } from "../../oauth/types.js";
+import { type UserCheck } from "./refresh.js";
+export type SignedTokenAuthOptions = {
+    /** One secret, or a rotation list: the first signs, every entry verifies (and seals codes). */
+    secret: string | string[];
+    resolveUser: (request: Request) => Promise<OAuthUser | null>;
+    loginUrl: (request: Request, nextPath: string) => string;
+    /** Access-token lifetime in seconds. Default 3600. Must be finite and > 0. */
+    ttlSeconds?: number;
+    /** Passthrough — production still needs a shared store across instances. */
+    codeStore?: CodeStore;
+    /**
+     * Checked on every verified token and every refresh; only `true` passes and a
+     * throw is a 500. See docs/security.md#sessions-and-expiry.
+     */
+    isUserActive?: UserCheck;
+    /**
+     * Enables rotating refresh tokens; also the absolute lifetime of one grant, counted from the code exchange.
+     * Needs `codeStore` and `isUserActive`. See docs/security.md#sessions-and-expiry.
+     */
+    refreshTtlSeconds?: number;
+};
+/** Builds a complete `McpAppAuth` from one secret plus your session resolver. */
+export declare const signedTokenAuth: (options: SignedTokenAuthOptions) => McpAppAuth;
+//# sourceMappingURL=token.d.ts.map

package/dist/auth/signed/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/auth/signed/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAMtB,MAAM,MAAM,sBAAsB,GAAG;IACnC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAC7D,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IACzD,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,CAAC;IACzB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AA8EF,iFAAiF;AACjF,eAAO,MAAM,eAAe,GAAI,SAAS,sBAAsB,KAAG,UAoBjE,CAAC"}

package/dist/auth/signed/token.js

@@ -0,0 +1,103 @@
+/**
+ * Convenience auth: one secret seals OAuth codes (via `codeSecret`) and
+ * signs short-lived access tokens. Domain separation is HKDF, not luck —
+ * access tokens, refresh tokens and sealed codes each use their own label.
+ *
+ * Tokens are stateless, so an issued access token stays valid until `exp`
+ * whatever happens to the login session. Pass `isUserActive` to close that:
+ * it runs on every verified token. Refresh is opt-in (`refreshTtlSeconds`);
+ * see `refresh.ts` for its limits.
+ *
+ * ponytail: access tokens cannot be revoked before `exp`; `/revoke` burns
+ * refresh tokens only. Upgrade: supply your own `mintAccessToken` /
+ * `verifyToken` over a store (see `examples/project-desk/src/tokens.ts`).
+ */
+import { assertCodeSecret } from "../../oauth/config.js";
+import { parseScope } from "../../oauth/policy/scope.js";
+import { parseGrantClaims, signPayload, verifyPayload } from "./payload.js";
+import { createRefreshTokens, } from "./refresh.js";
+const DEFAULT_TTL_SECONDS = 3600;
+/** Each secret costs a key derivation per token kind, so rotation lists stay short. */
+const MAX_SECRETS = 8;
+const toVerified = ({ userId, scopes, audience }) => ({
+    userId,
+    scopes,
+    audience,
+});
+const assertPositiveSeconds = (name, value) => {
+    if (!Number.isFinite(value) || value <= 0) {
+        throw new Error(`signedTokenAuth: ${name} must be a finite number > 0 (got ${value})`);
+    }
+};
+const resolveSecretList = (secret) => {
+    const secrets = Array.isArray(secret) ? [...secret] : [secret];
+    const [first, ...rest] = secrets;
+    if (first === undefined || secrets.length > MAX_SECRETS) {
+        throw new Error(`signedTokenAuth: secret needs 1 to ${MAX_SECRETS} entries (got ${secrets.length})`);
+    }
+    secrets.forEach(assertCodeSecret);
+    return [first, ...rest];
+};
+const accessMinter = (secrets, ttlSeconds) => async (input) => ({
+    accessToken: await signPayload(secrets[0], "access", {
+        userId: input.userId,
+        scopes: parseScope(input.scope),
+        audience: input.resource,
+        exp: Date.now() + ttlSeconds * 1000,
+    }),
+    expiresIn: ttlSeconds,
+    scope: input.scope,
+});
+/** Signature, then expiry and shape, then the user check: a garbage token never reaches the host. */
+const accessVerifier = (secrets, isUserActive) => async (token) => {
+    const payload = parseGrantClaims(await verifyPayload(secrets, "access", token));
+    if (!payload)
+        return null;
+    if (isUserActive && (await isUserActive(payload.userId)) !== true)
+        return null;
+    return toVerified(payload);
+};
+/** The refresh machinery, or undefined when `refreshTtlSeconds` is unset. */
+const refreshTokensFor = (options, secrets, mintAccess) => {
+    const { refreshTtlSeconds, codeStore, isUserActive } = options;
+    if (refreshTtlSeconds === undefined)
+        return undefined;
+    assertPositiveSeconds("refreshTtlSeconds", refreshTtlSeconds);
+    if (!codeStore) {
+        throw new Error("signedTokenAuth: refreshTtlSeconds needs an explicit codeStore (single-use refresh tokens " +
+            "must share the router's store; allowInMemoryCodeStore's hidden default is not visible here)");
+    }
+    if (!isUserActive) {
+        throw new Error("signedTokenAuth: refreshTtlSeconds needs isUserActive, or a removed user keeps the connector until the refresh token expires");
+    }
+    return createRefreshTokens({
+        secrets,
+        lifetimeMs: refreshTtlSeconds * 1000,
+        codeStore,
+        isUserActive,
+        mintAccess,
+    });
+};
+/** Builds a complete `McpAppAuth` from one secret plus your session resolver. */
+export const signedTokenAuth = (options) => {
+    const ttlSeconds = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    assertPositiveSeconds("ttlSeconds", ttlSeconds);
+    const secrets = resolveSecretList(options.secret);
+    const mintAccess = accessMinter(secrets, ttlSeconds);
+    const refresh = refreshTokensFor(options, secrets, mintAccess);
+    return {
+        codeSecret: [...secrets],
+        resolveUser: options.resolveUser,
+        loginUrl: options.loginUrl,
+        mintAccessToken: async (input) => {
+            if (!refresh)
+                return mintAccess(input);
+            const [access, refreshToken] = await Promise.all([mintAccess(input), refresh.issue(input)]);
+            return { ...access, refreshToken };
+        },
+        verifyToken: accessVerifier(secrets, options.isUserActive),
+        ...(refresh ? { refreshAccessToken: refresh.refresh, revokeToken: refresh.revoke } : {}),
+        ...(options.codeStore !== undefined ? { codeStore: options.codeStore } : {}),
+    };
+};
+//# sourceMappingURL=token.js.map

package/dist/auth/signed/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../../src/auth/signed/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEzD,OAAO,EAAoB,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAEL,mBAAmB,GAIpB,MAAM,cAAc,CAAC;AAEtB,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,uFAAuF;AACvF,MAAM,WAAW,GAAG,CAAC,CAAC;AAuBtB,MAAM,UAAU,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAe,EAAiB,EAAE,CAAC,CAAC;IAChF,MAAM;IACN,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,IAAY,EAAE,KAAa,EAAQ,EAAE;IAClE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,qCAAqC,KAAK,GAAG,CAAC,CAAC;IACzF,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,MAAyB,EAAc,EAAE;IAClE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,sCAAsC,WAAW,iBAAiB,OAAO,CAAC,MAAM,GAAG,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,YAAY,GAChB,CAAC,OAAmB,EAAE,UAAkB,EAAgB,EAAE,CAC1D,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChB,WAAW,EAAE,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE;QACnD,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI;KACd,CAAC;IACxB,SAAS,EAAE,UAAU;IACrB,KAAK,EAAE,KAAK,CAAC,KAAK;CACnB,CAAC,CAAC;AAEL,qGAAqG;AACrG,MAAM,cAAc,GAClB,CAAC,OAAmB,EAAE,YAAmC,EAAE,EAAE,CAC7D,KAAK,EAAE,KAAa,EAAiC,EAAE;IACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,YAAY,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC,CAAC;AAEJ,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,CACvB,OAA+B,EAC/B,OAAmB,EACnB,UAAwB,EACG,EAAE;IAC7B,MAAM,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC/D,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,qBAAqB,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;IAC9D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,4FAA4F;YAC1F,6FAA6F,CAChG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC;QACzB,OAAO;QACP,UAAU,EAAE,iBAAiB,GAAG,IAAI;QACpC,SAAS;QACT,YAAY;QACZ,UAAU;KACX,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAA+B,EAAc,EAAE;IAC7E,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,qBAAqB,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAE/D,OAAO;QACL,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,CAAC,OAAO;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5F,OAAO,EAAE,GAAG,MAAM,EAAE,YAAY,EAAE,CAAC;QACrC,CAAC;QACD,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC,CAAC"}

package/dist/clients.js

@@ -6,7 +6,7 @@
  * point: you name your clients, the library configures the AS to match.
  */
 import { TOKEN_ENDPOINT_AUTH_METHODS } from "./oauth/constants.js";
-import { CLAUDE_CALLBACK } from "./oauth/policy/redirect.js";
+import { CHATGPT_CALLBACK, CLAUDE_CALLBACK } from "./oauth/policy/redirect.js";
 export const CLIENT_PROFILES = {
     /** Claude Custom Connectors — dynamic registration, public client + PKCE. */
     claude: {
@@ -25,7 +25,7 @@ export const CLIENT_PROFILES = {
     },
     /** OpenAI Codex / ChatGPT connectors — OAuth 2.1 per the MCP auth spec. */
     codex: {
-        redirectUris: [],
+        redirectUris: [CHATGPT_CALLBACK],
         tokenEndpointAuthMethods: [TOKEN_ENDPOINT_AUTH_METHODS.none],
         preRegistered: false,
     },

package/dist/clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAiB7D,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"clients.js","sourceRoot":"","sources":["../src/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,2BAA2B,EAAgC,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAiB/E,MAAM,CAAC,MAAM,eAAe,GAAsC;IAChE,6EAA6E;IAC7E,MAAM,EAAE;QACN,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;IACD;;;OAGG;IACH,MAAM,EAAE;QACN,YAAY,EAAE,EAAE;QAChB,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,KAAK,EAAE,2BAA2B,CAAC,IAAI,CAAC;QAC/F,aAAa,EAAE,IAAI;KACpB;IACD,2EAA2E;IAC3E,KAAK,EAAE;QACL,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,wBAAwB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CAAC;QAC5D,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAiB,CAAC,QAAQ,CAAC,CAAC;AAExD,kEAAkE;AAClE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAqB,EAAY,EAAE,CAAC;IAClE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;CAC1E,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAqB,EAA6B,EAAE;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAC1E,CAAC;IACF,OAAO;QACL,2BAA2B,CAAC,IAAI;QAChC,2BAA2B,CAAC,KAAK;QACjC,2BAA2B,CAAC,IAAI;KACjC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAqB,EAAgB,EAAE,CAC1E,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAqB,EAAW,EAAE,CACjE,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,OAAqB,EACrB,WAAoC,EAC9B,EAAE;IACR,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACtF,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB;YACxD,0EAA0E,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/deprecated.d.ts

@@ -1,31 +1,31 @@
 /**
  * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
  * Declared as consts (not `export { } from`) so `@deprecated` reaches
- * editors. Removed in 3.0.
+ * editors. Removed in the next major release.
  */
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const timingSafeEqual: (a: string, b: string) => boolean;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const matchesAny: (presented: string, accepted: string[]) => boolean;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const corsHeaders: (extra?: Record<string, string>) => Record<string, string>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const emptyResponse: (status: number) => Response;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const methodNotAllowed: (message?: string, options?: import("./server.js").JsonResponseOptions) => Response;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const optionsResponse: (options?: import("./server.js").JsonResponseOptions) => Response;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const pickProtocolVersion: (params?: Record<string, unknown>) => string;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const ASSUMED_HEADER_PROTOCOL_VERSION = "2025-03-26";
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const validateAgainstSchema: (value: unknown, schema: import("./server.js").JsonSchema) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const unsupportedKeywords: (schema: import("./server.js").JsonSchema, path?: string) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const missingObjectType: (schema: import("./server.js").JsonSchema, path?: string) => string[];
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const JSON_SCHEMA_TYPES: {
     readonly string: "string";
     readonly number: "number";
@@ -35,8 +35,8 @@ export declare const JSON_SCHEMA_TYPES: {
     readonly array: "array";
     readonly null: "null";
 };
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const SUPPORTED_SCHEMA_KEYWORDS: ReadonlySet<string>;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export declare const IGNORED_SCHEMA_KEYWORDS: ReadonlySet<string>;
 //# sourceMappingURL=deprecated.d.ts.map

package/dist/deprecated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,sEAAsE;AACtE,eAAO,MAAM,eAAe,mCAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,UAAU,oDAAsB,CAAC;AAC9C,sEAAsE;AACtE,eAAO,MAAM,WAAW,4DAAuB,CAAC;AAChD,sEAAsE;AACtE,eAAO,MAAM,aAAa,8BAAyB,CAAC;AACpD,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,qFAA4B,CAAC;AAC1D,sEAAsE;AACtE,eAAO,MAAM,eAAe,mEAA2B,CAAC;AACxD,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,8CAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,+BAA+B,eAA2C,CAAC;AACxF,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,wEAAiC,CAAC;AACpE,sEAAsE;AACtE,eAAO,MAAM,mBAAmB,uEAA+B,CAAC;AAChE,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,uEAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,iBAAiB;;;;;;;;CAA6B,CAAC;AAC5D,sEAAsE;AACtE,eAAO,MAAM,yBAAyB,qBAAqC,CAAC;AAC5E,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,qBAAmC,CAAC"}
+{"version":3,"file":"deprecated.d.ts","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,yFAAyF;AACzF,eAAO,MAAM,eAAe,mCAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,UAAU,oDAAsB,CAAC;AAC9C,yFAAyF;AACzF,eAAO,MAAM,WAAW,4DAAuB,CAAC;AAChD,yFAAyF;AACzF,eAAO,MAAM,aAAa,8BAAyB,CAAC;AACpD,yFAAyF;AACzF,eAAO,MAAM,gBAAgB,qFAA4B,CAAC;AAC1D,yFAAyF;AACzF,eAAO,MAAM,eAAe,mEAA2B,CAAC;AACxD,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,8CAA+B,CAAC;AAChE,yFAAyF;AACzF,eAAO,MAAM,+BAA+B,eAA2C,CAAC;AACxF,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,wEAAiC,CAAC;AACpE,yFAAyF;AACzF,eAAO,MAAM,mBAAmB,uEAA+B,CAAC;AAChE,yFAAyF;AACzF,eAAO,MAAM,iBAAiB,uEAA6B,CAAC;AAC5D,yFAAyF;AACzF,eAAO,MAAM,iBAAiB;;;;;;;;CAA6B,CAAC;AAC5D,yFAAyF;AACzF,eAAO,MAAM,yBAAyB,qBAAqC,CAAC;AAC5E,yFAAyF;AACzF,eAAO,MAAM,uBAAuB,qBAAmC,CAAC"}

package/dist/deprecated.js

@@ -1,35 +1,35 @@
 /**
  * Root-entry aliases for symbols that moved to `mcp-trellis/advanced`.
  * Declared as consts (not `export { } from`) so `@deprecated` reaches
- * editors. Removed in 3.0.
+ * editors. Removed in the next major release.
  */
 import * as advanced from "./advanced.js";
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const timingSafeEqual = advanced.timingSafeEqual;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const matchesAny = advanced.matchesAny;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const corsHeaders = advanced.corsHeaders;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const emptyResponse = advanced.emptyResponse;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const methodNotAllowed = advanced.methodNotAllowed;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const optionsResponse = advanced.optionsResponse;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const pickProtocolVersion = advanced.pickProtocolVersion;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const ASSUMED_HEADER_PROTOCOL_VERSION = advanced.ASSUMED_HEADER_PROTOCOL_VERSION;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const validateAgainstSchema = advanced.validateAgainstSchema;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const unsupportedKeywords = advanced.unsupportedKeywords;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const missingObjectType = advanced.missingObjectType;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const JSON_SCHEMA_TYPES = advanced.JSON_SCHEMA_TYPES;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const SUPPORTED_SCHEMA_KEYWORDS = advanced.SUPPORTED_SCHEMA_KEYWORDS;
-/** @deprecated Import from "mcp-trellis/advanced". Removed in 3.0. */
+/** @deprecated Import from "mcp-trellis/advanced". Removed in the next major release. */
 export const IGNORED_SCHEMA_KEYWORDS = advanced.IGNORED_SCHEMA_KEYWORDS;
 //# sourceMappingURL=deprecated.js.map

package/dist/deprecated.js.map

@@ -1 +1 @@
-{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,sEAAsE;AACtE,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,sEAAsE;AACtE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,+BAA+B,CAAC;AACxF,sEAAsE;AACtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC"}
+{"version":3,"file":"deprecated.js","sourceRoot":"","sources":["../src/deprecated.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;AAC9C,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;AAChD,yFAAyF;AACzF,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;AACpD,yFAAyF;AACzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,CAAC;AAC1D,yFAAyF;AACzF,MAAM,CAAC,MAAM,eAAe,GAAG,QAAQ,CAAC,eAAe,CAAC;AACxD,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,yFAAyF;AACzF,MAAM,CAAC,MAAM,+BAA+B,GAAG,QAAQ,CAAC,+BAA+B,CAAC;AACxF,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC,qBAAqB,CAAC;AACpE,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;AAChE,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,yFAAyF;AACzF,MAAM,CAAC,MAAM,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAC5D,yFAAyF;AACzF,MAAM,CAAC,MAAM,yBAAyB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAC5E,yFAAyF;AACzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,QAAQ,CAAC,uBAAuB,CAAC"}

package/dist/http/body.d.ts

@@ -8,6 +8,10 @@ export declare class BodyTooLargeError extends Error {
     readonly maxBytes: number;
     constructor(maxBytes: number);
 }
+/** The caller's `signal` aborted the read — a timeout everywhere this library passes one. */
+export declare class BodyReadAbortedError extends Error {
+    constructor();
+}
 /** Default cap for `/mcp` — JSON-RPC payloads, generally small but tool args can be text-heavy. */
 export declare const DEFAULT_MCP_BODY_LIMIT = 1048576;
 /** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */

package/dist/http/body.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAuB/C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE;QAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,UAAU,CA6CpB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,GAC1B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,MAAM,CAA+E,CAAC;AAEjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACxE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC7C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAG6B,CAAC;AA+DvF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,gBAAgB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,EAC7D,UAAU,MAAM,EAChB,UAAS,sBAA2B,KACnC,OAAO,CAAC,UAAU,CAQpB,CAAC"}
+{"version":3,"file":"body.d.ts","sourceRoot":"","sources":["../../src/http/body.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM;gBAAhB,QAAQ,EAAE,MAAM;CAItC;AAED,6FAA6F;AAC7F,qBAAa,oBAAqB,SAAQ,KAAK;;CAK9C;AAED,mGAAmG;AACnG,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD,uGAAuG;AACvG,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAuB/C;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE;QAAE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACxC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;CAC1C,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,UAAU,CA6CpB,CAAC;AAEF,4EAA4E;AAC5E,eAAO,MAAM,eAAe,GAC1B,QAAQ,iBAAiB,EACzB,UAAU,MAAM,EAChB,SAAS,WAAW,KACnB,OAAO,CAAC,MAAM,CAA+E,CAAC;AAEjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,+EAA+E;IAC/E,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IACxE,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC7C,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IACzD,KAAK,IAAI,IAAI,CAAC;IACd,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,IAAI,CAAC;CAC7E,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBAG6B,CAAC;AA+DvF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,QAAQ,gBAAgB,GAAG,aAAa,CAAC,UAAU,GAAG,MAAM,CAAC,EAC7D,UAAU,MAAM,EAChB,UAAS,sBAA2B,KACnC,OAAO,CAAC,UAAU,CAQpB,CAAC"}

package/dist/http/body.js

@@ -12,6 +12,13 @@ export class BodyTooLargeError extends Error {
         this.name = "BodyTooLargeError";
     }
 }
+/** The caller's `signal` aborted the read — a timeout everywhere this library passes one. */
+export class BodyReadAbortedError extends Error {
+    constructor() {
+        super("body read aborted");
+        this.name = "BodyReadAbortedError";
+    }
+}
 /** Default cap for `/mcp` — JSON-RPC payloads, generally small but tool args can be text-heavy. */
 export const DEFAULT_MCP_BODY_LIMIT = 1_048_576; // 1 MiB
 /** Default cap for OAuth endpoints (`/token`, `/revoke`, `/register`, `/consent`) — tiny form/JSON. */
@@ -45,7 +52,7 @@ const toBytes = (chunk) => typeof chunk === "string" ? new TextEncoder().encode(
  */
 export const readBoundedBytes = async (source, maxBytes, signal) => {
     if (signal?.aborted)
-        throw new Error("body read aborted");
+        throw new BodyReadAbortedError();
     const declared = declaredContentLength(source.headers);
     if (declared !== null && declared > maxBytes) {
         throw new BodyTooLargeError(maxBytes);
@@ -73,7 +80,7 @@ export const readBoundedBytes = async (source, maxBytes, signal) => {
             const { done, value } = await reader.read();
             // Cancel may settle read() as done — still treat abort as failure.
             if (signal?.aborted)
-                throw new Error("body read aborted");
+                throw new BodyReadAbortedError();
             if (done)
                 break;
             // ponytail: one oversized chunk can briefly allocate maxBytes + highWaterMark