okengine 0.23.1 → 0.23.2

package/src/mcp/mcp.test.ts

@@ -12,9 +12,14 @@ import type { WideEvent } from "../runs/types.ts";
 import { authorizeToolCall, expandOperatorScopes } from "./authorization.ts";
 import { MCP_CONFIRM_PHRASE } from "./confirmation.ts";
 import { asData, isDataEnvelope, MCP_DATA_KIND } from "./data.ts";
-import { authenticateMcpRequest, mintMcpSession, MCP_AUDIENCE } from "./session.ts";
+import {
+  authenticateMcpRequest,
+  mintMcpSession,
+  MCP_AUDIENCE,
+  type McpRequester,
+} from "./session.ts";
 import { createMcpServer } from "./server.ts";
-import { createToolRuntime } from "./tools.ts";
+import { createToolRuntime, type McpContext } from "./tools.ts";
 import { MCP_CLIENT_PROTOCOL_VERSION, MCP_PROTOCOL_VERSION } from "./versions.ts";
 
 const SECRET = "mcp-test-secret";
@@ -106,6 +111,69 @@ describe("MCP audience validation", () => {
   });
 });
 
+const CONFIRM_REASON = "operator approved test invoke";
+
+function stringField(content: unknown, key: string): string {
+  if (content === null || typeof content !== "object" || Array.isArray(content)) {
+    throw new Error(`expected object content for ${key}`);
+  }
+  const value = (content as Record<string, unknown>)[key];
+  if (typeof value !== "string" || value.length === 0) {
+    throw new Error(`expected string ${key}`);
+  }
+  return value;
+}
+
+function runtimeWithInvoke(onInvoke: () => void): ReturnType<typeof createToolRuntime> {
+  const ctx: McpContext = {
+    getManifest: () => SAMPLE_MANIFEST,
+    listRuns: async () => [],
+    invokeFlow: async (input) => {
+      onInvoke();
+      return { ok: true, flowId: input.flowId };
+    },
+    proposeStructural: async () => {
+      onInvoke();
+      return { ok: true };
+    },
+  };
+  return createToolRuntime(ctx);
+}
+
+async function twoSessionsOf(
+  principalId: string,
+): Promise<{ readonly a: McpRequester; readonly b: McpRequester }> {
+  const store = createSessionStore();
+  const mint = () =>
+    mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId,
+      scopes: ["console:*"],
+    });
+  const issuedA = await mint();
+  const issuedB = await mint();
+  const a = await authenticateMcpRequest(store, SECRET, issuedA.accessToken);
+  const b = await authenticateMcpRequest(store, SECRET, issuedB.accessToken);
+  return { a, b };
+}
+
+async function openConfirmation(
+  runtime: ReturnType<typeof createToolRuntime>,
+  requester: McpRequester,
+  tool: string,
+  args: Record<string, unknown>,
+): Promise<string> {
+  const opened = await runtime.callTool(requester, tool, args);
+  expect(opened.ok).toBe(false);
+  if (opened.ok) throw new Error("expected confirmation challenge");
+  const confirmationId = stringField(opened.data.content, "confirmationId");
+  expect(confirmationId.startsWith("mcp_id_")).toBe(true);
+  expect(JSON.stringify(opened.data)).not.toContain("mcp_c_");
+  expect(JSON.stringify(opened.data)).not.toContain("confirmToken");
+  return confirmationId;
+}
+
 describe("MCP write confirmation", () => {
   test("agent cannot invoke a write tool without confirmation", async () => {
     const decision = authorizeToolCall(
@@ -119,12 +187,8 @@ describe("MCP write confirmation", () => {
       expect(decision.reason).toBe("confirmation-required");
     }
 
-    const runtime = createToolRuntime({
-      getManifest: () => SAMPLE_MANIFEST,
-      listRuns: async () => [],
-      invokeFlow: async () => {
-        throw new Error("must not invoke");
-      },
+    const runtime = runtimeWithInvoke(() => {
+      throw new Error("must not invoke");
     });
     const store = createSessionStore();
     const issued = await mintMcpSession({
@@ -143,59 +207,211 @@ describe("MCP write confirmation", () => {
       expect(result.code).toBe("forbidden");
       expect(result.message).toContain("confirmation");
       expect(isDataEnvelope(result.data)).toBe(true);
+      const confirmationId = stringField(result.data.content, "confirmationId");
+      expect(confirmationId.startsWith("mcp_id_")).toBe(true);
+      expect(JSON.stringify(result.data)).not.toContain("mcp_c_");
+      expect(JSON.stringify(result.data)).not.toContain("confirmToken");
     }
   });
 
-  test("write succeeds only with fresh per-call confirmation (no consent cache)", async () => {
+  test("one session cannot request, confirm, and invoke", async () => {
     let invoked = 0;
-    const runtime = createToolRuntime({
-      getManifest: () => SAMPLE_MANIFEST,
-      listRuns: async () => [],
-      invokeFlow: async (input) => {
-        invoked += 1;
-        return { ok: true, flowId: input.flowId };
-      },
+    const runtime = runtimeWithInvoke(() => {
+      invoked += 1;
     });
-    const store = createSessionStore();
-    const issued = await mintMcpSession({
-      store,
-      secret: SECRET,
-      principalId: "op1",
-      scopes: ["console:*"],
+    const { a } = await twoSessionsOf("op1");
+    const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
+    const confirmationId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+
+    const confirm = await runtime.callTool(a, "oke.action.confirm", {
+      confirmationId,
+      reason: CONFIRM_REASON,
     });
-    const requester = await authenticateMcpRequest(store, SECRET, issued.accessToken);
+    expect(confirm.ok).toBe(false);
+    if (!confirm.ok) {
+      expect(confirm.message).toContain("different auth session");
+      expect(JSON.stringify(confirm.data)).not.toContain("mcp_c_");
+    }
+
+    const invoke = await runtime.callTool(a, "oke.action.invoke", {
+      ...actionArgs,
+      confirmation: MCP_CONFIRM_PHRASE,
+      reason: CONFIRM_REASON,
+    });
+    expect(invoke.ok).toBe(false);
+    expect(invoked).toBe(0);
+  });
+
+  test("a second session of the same principal confirms and the first invokes once", async () => {
+    let invoked = 0;
+    const runtime = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const { a, b } = await twoSessionsOf("op1");
+    expect(a.principalId).toBe(b.principalId);
+    expect(a.sessionId).not.toBe(b.sessionId);
 
     const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
-    const confirm = await runtime.callTool(requester, "oke.action.confirm", {
-      tool: "oke.action.invoke",
-      args: actionArgs,
-      reason: "operator approved test invoke",
+    const confirmationId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+    const confirm = await runtime.callTool(b, "oke.action.confirm", {
+      confirmationId,
+      reason: CONFIRM_REASON,
     });
     expect(confirm.ok).toBe(true);
     if (!confirm.ok) return;
-    const token = (confirm.data.content as { confirmToken: string }).confirmToken;
+    const token = stringField(confirm.data.content, "confirmToken");
     expect(token.startsWith("mcp_c_")).toBe(true);
+    expect(token).not.toBe(confirmationId);
 
-    const first = await runtime.callTool(requester, "oke.action.invoke", {
+    const first = await runtime.callTool(a, "oke.action.invoke", {
       ...actionArgs,
       confirmation: MCP_CONFIRM_PHRASE,
       confirmToken: token,
-      reason: "operator approved test invoke",
+      reason: CONFIRM_REASON,
     });
     expect(first.ok).toBe(true);
     expect(invoked).toBe(1);
+  });
 
-    // Same token cannot be reused — no session-level consent cache.
-    const replay = await runtime.callTool(requester, "oke.action.invoke", {
+  test("the issuer cannot consume the token", async () => {
+    let invoked = 0;
+    const runtime = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const { a, b } = await twoSessionsOf("op1");
+    const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
+    const confirmationId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+    const confirm = await runtime.callTool(b, "oke.action.confirm", {
+      confirmationId,
+      reason: CONFIRM_REASON,
+    });
+    expect(confirm.ok).toBe(true);
+    if (!confirm.ok) return;
+    const token = stringField(confirm.data.content, "confirmToken");
+
+    const stolen = await runtime.callTool(b, "oke.action.invoke", {
+      ...actionArgs,
+      confirmation: MCP_CONFIRM_PHRASE,
+      confirmToken: token,
+      reason: CONFIRM_REASON,
+    });
+    expect(stolen.ok).toBe(false);
+    if (!stolen.ok) expect(stolen.message).toContain("session-mismatch");
+    expect(invoked).toBe(0);
+  });
+
+  test("replay of a consumed token fails", async () => {
+    let invoked = 0;
+    const runtime = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const { a, b } = await twoSessionsOf("op1");
+    const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
+    const confirmationId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+    const confirm = await runtime.callTool(b, "oke.action.confirm", {
+      confirmationId,
+      reason: CONFIRM_REASON,
+    });
+    expect(confirm.ok).toBe(true);
+    if (!confirm.ok) return;
+    const token = stringField(confirm.data.content, "confirmToken");
+
+    const first = await runtime.callTool(a, "oke.action.invoke", {
       ...actionArgs,
       confirmation: MCP_CONFIRM_PHRASE,
       confirmToken: token,
-      reason: "operator approved test invoke",
+      reason: CONFIRM_REASON,
+    });
+    expect(first.ok).toBe(true);
+
+    const replay = await runtime.callTool(a, "oke.action.invoke", {
+      ...actionArgs,
+      confirmation: MCP_CONFIRM_PHRASE,
+      confirmToken: token,
+      reason: CONFIRM_REASON,
     });
     expect(replay.ok).toBe(false);
+    if (!replay.ok) expect(replay.message).toContain("unknown");
     expect(invoked).toBe(1);
     expect(runtime.confirmationSize()).toBe(0);
   });
+
+  test("wrong tool or args is rejected", async () => {
+    let invoked = 0;
+    const runtime = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const { a, b } = await twoSessionsOf("op1");
+    const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
+
+    const argsId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+    const argsConfirm = await runtime.callTool(b, "oke.action.confirm", {
+      confirmationId: argsId,
+      reason: CONFIRM_REASON,
+    });
+    expect(argsConfirm.ok).toBe(true);
+    if (!argsConfirm.ok) return;
+    const argsToken = stringField(argsConfirm.data.content, "confirmToken");
+    const wrongArgs = await runtime.callTool(a, "oke.action.invoke", {
+      flowId: "bookings.create",
+      body: { name: "other" },
+      confirmation: MCP_CONFIRM_PHRASE,
+      confirmToken: argsToken,
+      reason: CONFIRM_REASON,
+    });
+    expect(wrongArgs.ok).toBe(false);
+    if (!wrongArgs.ok) expect(wrongArgs.message).toContain("args-mismatch");
+
+    const toolId = await openConfirmation(runtime, a, "oke.action.invoke", actionArgs);
+    const toolConfirm = await runtime.callTool(b, "oke.action.confirm", {
+      confirmationId: toolId,
+      reason: CONFIRM_REASON,
+    });
+    expect(toolConfirm.ok).toBe(true);
+    if (!toolConfirm.ok) return;
+    const toolToken = stringField(toolConfirm.data.content, "confirmToken");
+    const wrongTool = await runtime.callTool(a, "oke.action.structural_propose", {
+      title: "rename",
+      relativePath: "src/bookings.ts",
+      contents: "export {}",
+      confirmation: MCP_CONFIRM_PHRASE,
+      confirmToken: toolToken,
+      reason: CONFIRM_REASON,
+    });
+    expect(wrongTool.ok).toBe(false);
+    if (!wrongTool.ok) expect(wrongTool.message).toContain("tool-mismatch");
+    expect(invoked).toBe(0);
+  });
+
+  test("a token issued on another runtime is unknown", async () => {
+    let invoked = 0;
+    const issuer = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const other = runtimeWithInvoke(() => {
+      invoked += 1;
+    });
+    const { a, b } = await twoSessionsOf("op1");
+    const actionArgs = { flowId: "bookings.create", body: { name: "Ada" } };
+    const confirmationId = await openConfirmation(issuer, a, "oke.action.invoke", actionArgs);
+    const confirm = await issuer.callTool(b, "oke.action.confirm", {
+      confirmationId,
+      reason: CONFIRM_REASON,
+    });
+    expect(confirm.ok).toBe(true);
+    if (!confirm.ok) return;
+    const token = stringField(confirm.data.content, "confirmToken");
+
+    const cross = await other.callTool(a, "oke.action.invoke", {
+      ...actionArgs,
+      confirmation: MCP_CONFIRM_PHRASE,
+      confirmToken: token,
+      reason: CONFIRM_REASON,
+    });
+    expect(cross.ok).toBe(false);
+    if (!cross.ok) expect(cross.message).toContain("unknown");
+    expect(invoked).toBe(0);
+  });
 });
 
 describe("MCP inert data envelope", () => {
@@ -293,6 +509,7 @@ describe("MCP HTTP server", () => {
       result: { tools: { name: string }[] };
     };
     expect(listBody.result.tools.some((t) => t.name === "oke.manifest.get")).toBe(true);
+    expect(listBody.result.tools.some((t) => t.name === "oke.action.invoke")).toBe(true);
 
     const call = await server.fetch(
       new Request("http://127.0.0.1:6535/mcp", {
@@ -316,6 +533,77 @@ describe("MCP HTTP server", () => {
     expect(callBody.result.structuredContent.content.manifest.app).toBe("skyport");
   });
 
+  test("read-only tools/list omits write tools and a hidden write call is 403", async () => {
+    let invoked = 0;
+    const store = createSessionStore();
+    const issued = await mintMcpSession({
+      store,
+      secret: SECRET,
+      principalId: "op-read",
+      scopes: ["mcp:manifest:read"],
+    });
+    const server = createMcpServer({
+      sessions: store,
+      secret: SECRET,
+      context: {
+        getManifest: () => SAMPLE_MANIFEST,
+        listRuns: async () => [],
+        invokeFlow: async () => {
+          invoked += 1;
+          return { ok: true };
+        },
+      },
+    });
+    const headers = {
+      host: "127.0.0.1:6535",
+      authorization: `Bearer ${issued.accessToken}`,
+      "content-type": "application/json",
+    };
+    const list = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 1,
+          method: "tools/list",
+        }),
+      }),
+    );
+    expect(list.status).toBe(200);
+    const listBody = (await list.json()) as {
+      result: {
+        tools: { name: string; annotations: { readOnlyHint: boolean; destructiveHint: boolean } }[];
+      };
+    };
+    expect(listBody.result.tools.some((t) => t.name === "oke.manifest.get")).toBe(true);
+    expect(listBody.result.tools.some((t) => t.name === "oke.action.invoke")).toBe(false);
+    expect(listBody.result.tools.some((t) => t.name === "oke.action.structural_propose")).toBe(
+      false,
+    );
+    expect(listBody.result.tools.every((t) => t.annotations.destructiveHint === false)).toBe(true);
+
+    const call = await server.fetch(
+      new Request("http://127.0.0.1:6535/mcp", {
+        method: "POST",
+        headers,
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          id: 2,
+          method: "tools/call",
+          params: {
+            name: "oke.action.invoke",
+            arguments: { flowId: "bookings.create", body: { name: "x" } },
+          },
+        }),
+      }),
+    );
+    expect(call.status).toBe(403);
+    const callBody = (await call.json()) as { error: { message: string } };
+    expect(callBody.error.message).toMatch(/missing one of/i);
+    expect(invoked).toBe(0);
+  });
+
   test("initialize advertises 2024-11-05 and rejects a version the server does not implement", async () => {
     const store = createSessionStore();
     const issued = await mintMcpSession({

package/src/mcp/server.ts

@@ -14,6 +14,7 @@ import {
   forbiddenResponse,
   resolveAllowedHosts,
 } from "../runtime/security.ts";
+import { HttpBodyRejected, parseBody } from "../compiler/http-parse.ts";
 import { MCP_PORT, type ServerHandle } from "../runtime/types.ts";
 import { SessionError, type SessionStore } from "../auth/sessions.ts";
 import { asData } from "./data.ts";
@@ -135,8 +136,11 @@ export function createMcpServer(options: CreateMcpServerOptions): McpServer {
 
     let body: unknown;
     try {
-      body = await request.json();
-    } catch {
+      body = await parseBody(request);
+    } catch (err) {
+      if (err instanceof HttpBodyRejected && err.code === "PayloadTooLarge") {
+        return respond(new Response("Payload Too Large", { status: 413 }));
+      }
       return respond(jsonRpcHttp(rpcError(null, RpcErrorCode.parse, "invalid JSON body"), 400));
     }
 
@@ -174,7 +178,7 @@ export function createMcpServer(options: CreateMcpServerOptions): McpServer {
       case "ping":
         return respond(jsonRpcHttp(rpcSuccess(id, { ok: true })));
       case "tools/list": {
-        const listed = tools.listTools().map((t) => ({
+        const listed = tools.listTools(requester).map((t) => ({
           name: t.name,
           description: t.description,
           inputSchema: t.inputSchema,
@@ -277,6 +281,7 @@ export async function serveMcp(options: ServeMcpOptions): Promise<McpServerHandl
   const server = Bun.serve({
     hostname,
     port,
+    maxRequestBodySize: 1_048_576,
     fetch: mcp.fetch,
   });
   const boundPort = server.port ?? port;

package/src/mcp/session.ts

@@ -29,6 +29,13 @@ export interface McpRequester {
   readonly principalId: string;
   readonly plane: AuthPlane;
   readonly scopes: readonly string[];
+  /**
+   * Auth session id (`claims.sid`).
+   *
+   * This is not the MCP transport session id minted at `initialize`
+   * ({@link newMcpTransportSessionId}). Confirmation binds this sid:
+   * the requester and the issuer must be different auth sessions.
+   */
   readonly sessionId: string;
 }
 

package/src/mcp/tools.ts

@@ -12,7 +12,9 @@ import { authorizeToolCall, MCP_TOOL_POLICIES, type McpToolPolicy } from "./auth
 import {
   createConfirmationGate,
   MCP_CONFIRM_PHRASE,
+  type ConfirmationGate,
   type ConfirmationGateOptions,
+  type ConfirmIssueResult,
 } from "./confirmation.ts";
 import { asData, freezeData, type McpDataEnvelope } from "./data.ts";
 import type { McpRequester } from "./session.ts";
@@ -68,6 +70,9 @@ export type ToolCallResult =
 /**
  * Create the tool runtime bound to a context + confirmation gate.
  *
+ * `listTools` receives the requester and omits tools their scopes cannot call.
+ * Confirmation is not required to appear in the list; `callTool` still enforces it.
+ *
  * @param ctx - Manifest / runs / action adapters
  * @param confirmOptions - Confirmation gate options
  */
@@ -75,7 +80,7 @@ export function createToolRuntime(
   ctx: McpContext,
   confirmOptions: ConfirmationGateOptions = {},
 ): {
-  readonly listTools: () => readonly McpToolPolicy[];
+  readonly listTools: (requester: McpRequester) => readonly McpToolPolicy[];
   readonly callTool: (
     requester: McpRequester,
     name: string,
@@ -87,7 +92,14 @@ export function createToolRuntime(
   const confirm = createConfirmationGate(confirmOptions);
 
   return {
-    listTools: () => MCP_TOOL_POLICIES,
+    listTools(requester) {
+      // Same scope check as authorizeToolCall. Listing ignores confirmation;
+      // a later call to a write tool still requires a token.
+      return MCP_TOOL_POLICIES.filter((policy) => {
+        const decision = authorizeToolCall(policy.name, {}, requester.scopes, { confirmed: true });
+        return decision.ok;
+      });
+    },
     confirmationSize: () => confirm.size(),
     async callTool(requester, name, args) {
       const policy = MCP_TOOL_POLICIES.find((p) => p.name === name);
@@ -113,15 +125,42 @@ export function createToolRuntime(
       }
 
       // Write path: consume a fresh per-call confirmation (no session cache).
+      // A call with no token is rejected and returns an opaque confirmationId
+      // bound to this requester — never the token.
       if (policy?.mutability === "write") {
         const token = typeof args.confirmToken === "string" ? args.confirmToken : "";
         const phrase = typeof args.confirmation === "string" ? args.confirmation : "";
         const reason = typeof args.reason === "string" ? args.reason : "";
         const boundArgs = stripConfirmFields(args);
+        if (token.length === 0) {
+          const opened = confirm.open({
+            tool: name,
+            args: boundArgs,
+            target: {
+              principalId: requester.principalId,
+              sid: requester.sessionId,
+            },
+          });
+          return {
+            ok: false,
+            code: "forbidden",
+            message: "write tool requires fresh human confirmation (missing)",
+            data: asData(
+              {
+                tool: name,
+                confirmationId: opened.confirmationId,
+                requiredPhrase: MCP_CONFIRM_PHRASE,
+                confirmVia: "oke.action.confirm",
+                reason: "missing",
+              },
+              "error",
+            ),
+          };
+        }
         const consumed = confirm.consume({
           tool: name,
           args: boundArgs,
-          principalId: requester.principalId,
+          consumerSid: requester.sessionId,
           token,
           phrase,
           reason,
@@ -412,28 +451,23 @@ async function decisionsList(
 }
 
 function actionConfirm(
-  confirm: ReturnType<typeof createConfirmationGate>,
+  confirm: ConfirmationGate,
   requester: McpRequester,
   args: Record<string, unknown>,
 ): ToolCallResult {
-  const tool = String(args.tool ?? "");
-  const reason = String(args.reason ?? "");
-  const toolArgs =
-    args.args !== null && typeof args.args === "object" && !Array.isArray(args.args)
-      ? (args.args as Record<string, unknown>)
-      : {};
-  const issued = confirm.request({
-    tool,
-    args: toolArgs,
-    principalId: requester.principalId,
+  const confirmationId = typeof args.confirmationId === "string" ? args.confirmationId : "";
+  const reason = typeof args.reason === "string" ? args.reason : "";
+  const issued = confirm.issue({
+    confirmationId,
     reason,
+    callerSid: requester.sessionId,
   });
-  if ("error" in issued) {
+  if (!issued.ok) {
     return {
       ok: false,
-      code: "invalid",
-      message: "reason must be at least 3 characters",
-      data: asData({ error: issued.error }, "error"),
+      code: issued.reason === "reason-short" ? "invalid" : "forbidden",
+      message: confirmIssueMessage(issued.reason),
+      data: asData({ error: issued.reason }, "error"),
     };
   }
   return okData(
@@ -443,12 +477,27 @@ function actionConfirm(
       phrase: MCP_CONFIRM_PHRASE,
       expiresAt: issued.expiresAt,
       notice:
-        "Present confirmToken + confirmation phrase on the write call. Tokens are single-use; there is no session consent cache.",
+        "Present confirmToken + confirmation phrase on the write call from the session that requested it. Tokens are single-use; the issuer session cannot consume them.",
     },
     "action-result",
   );
 }
 
+function confirmIssueMessage(reason: Extract<ConfirmIssueResult, { ok: false }>["reason"]): string {
+  switch (reason) {
+    case "reason-short":
+      return "reason must be at least 3 characters";
+    case "same-session":
+      return "confirmation must be issued by a different auth session";
+    case "unknown":
+      return "unknown confirmation";
+    case "expired":
+      return "confirmation expired";
+    case "already-issued":
+      return "confirmation already issued";
+  }
+}
+
 async function actionInvoke(
   ctx: McpContext,
   requester: McpRequester,

package/src/runtime/bun.ts

@@ -149,6 +149,7 @@ export function serveBunHttp(options: {
   readonly fetch: (request: Request) => Response | Promise<Response>;
   readonly routes?: Record<string, MethodHandlers>;
   readonly id?: string;
+  readonly maxRequestBodySize?: number;
 }): ReturnType<typeof Bun.serve> {
   const fetch = holdSseIdle(
     typeof options.fetch === "function"
@@ -158,6 +159,7 @@ export function serveBunHttp(options: {
   const base = {
     port: options.port,
     hostname: options.hostname,
+    maxRequestBodySize: options.maxRequestBodySize ?? 1_048_576,
     fetch,
     ...(options.id !== undefined ? { id: options.id } : {}),
   };
@@ -185,6 +187,9 @@ function listenBun(app: FetchApp, options?: ServeOptions): ServerHandle {
     fetch: fetchHandler,
     routes,
     ...(options?.id !== undefined ? { id: options.id } : {}),
+    ...(options?.maxRequestBodySize !== undefined
+      ? { maxRequestBodySize: options.maxRequestBodySize }
+      : {}),
   });
 
   const closeIdle = (

package/src/runtime/types.ts

@@ -72,6 +72,11 @@ export interface ServeOptions {
    * never replaces the mandatory check.
    */
   readonly allowedHosts?: readonly string[];
+  /**
+   * Bun.serve body backstop in bytes. Default 1 MiB. Raise it together with
+   * `maxRequestBodySize` when a route accepts a larger body.
+   */
+  readonly maxRequestBodySize?: number;
 }
 
 /** Handle returned by {@link Runtime.serve}. */