@better-auth/cimd 1.7.0-rc.2 → 1.7.0-rc.3

package/dist/node.d.mts

@@ -0,0 +1,14 @@
+import { ClientMetadataResourceFetch } from "@better-auth/oauth-provider";
+//#region src/node.d.ts
+/**
+ * Fetch a CIMD-owned HTTPS resource with resolve-once DNS validation and
+ * connection pinning.
+ *
+ * Every DNS answer must be public-routable. The selected answer is pinned for
+ * the connection while the original hostname remains the HTTP Host, TLS SNI,
+ * and certificate-verification identity. Redirect responses are returned to
+ * the caller and are never followed.
+ */
+declare const fetchClientMetadataResource: ClientMetadataResourceFetch;
+//#endregion
+export { fetchClientMetadataResource };

package/dist/node.mjs

@@ -0,0 +1,66 @@
+import { isPublicRoutableHost } from "@better-auth/core/utils/host";
+import { lookup } from "node:dns/promises";
+import { request } from "node:https";
+import { isIP } from "node:net";
+import { Readable } from "node:stream";
+//#region src/node.ts
+const BODY_FORBIDDEN_RESPONSE_STATUSES = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+function responseHeaders(headers) {
+	const result = new Headers();
+	for (const [name, value] of Object.entries(headers)) if (Array.isArray(value)) for (const item of value) result.append(name, item);
+	else if (value !== void 0) result.append(name, value);
+	return result;
+}
+/**
+* Fetch a CIMD-owned HTTPS resource with resolve-once DNS validation and
+* connection pinning.
+*
+* Every DNS answer must be public-routable. The selected answer is pinned for
+* the connection while the original hostname remains the HTTP Host, TLS SNI,
+* and certificate-verification identity. Redirect responses are returned to
+* the caller and are never followed.
+*/
+const fetchClientMetadataResource = async (input, init) => {
+	const webRequest = new Request(input, init);
+	const url = new URL(webRequest.url);
+	if (url.protocol !== "https:") throw new TypeError("CIMD Node transport requires an HTTPS URL");
+	if (webRequest.method !== "GET" && webRequest.method !== "HEAD") throw new TypeError("CIMD Node transport supports only GET and HEAD");
+	const addresses = await lookup(url.hostname, {
+		all: true,
+		verbatim: true
+	});
+	if (addresses.length === 0) throw new TypeError("metadata hostname returned no DNS addresses");
+	for (const result of addresses) if (!isPublicRoutableHost(result.address)) throw new TypeError("metadata hostname must resolve only to public-routable addresses");
+	const pinnedAddress = addresses[0];
+	const headers = Object.fromEntries(webRequest.headers.entries());
+	headers.host = url.host;
+	const signal = init?.signal ?? (input instanceof Request ? input.signal : webRequest.signal);
+	return new Promise((resolve, reject) => {
+		const request$1 = request(url, {
+			agent: false,
+			headers,
+			method: webRequest.method,
+			servername: isIP(url.hostname.replace(/^\[|\]$/g, "")) === 0 ? url.hostname : void 0,
+			signal,
+			lookup: (_hostname, _options, callback) => {
+				callback(null, pinnedAddress.address, pinnedAddress.family);
+			}
+		}, (response) => {
+			const status = response.statusCode ?? 500;
+			const body = webRequest.method === "HEAD" || BODY_FORBIDDEN_RESPONSE_STATUSES.has(status) ? null : Readable.toWeb(response);
+			resolve(new Response(body, {
+				headers: responseHeaders(response.headers),
+				status,
+				statusText: response.statusMessage
+			}));
+		});
+		request$1.once("error", reject);
+		request$1.end();
+	});
+};
+//#endregion
+export { fetchClientMetadataResource };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@better-auth/cimd",
-  "version": "1.7.0-rc.2",
+  "version": "1.7.0-rc.3",
   "description": "Client ID Metadata Document plugin for Better Auth",
   "type": "module",
   "license": "MIT",
@@ -36,27 +36,38 @@
       "dev-source": "./src/index.ts",
       "types": "./dist/index.d.mts",
       "default": "./dist/index.mjs"
+    },
+    "./node": {
+      "dev-source": "./src/node.ts",
+      "types": "./dist/node.d.mts",
+      "default": "./dist/node.mjs"
     }
   },
   "typesVersions": {
     "*": {
       "*": [
         "./dist/index.d.mts"
+      ],
+      "node": [
+        "./dist/node.d.mts"
       ]
     }
   },
   "devDependencies": {
+    "@modelcontextprotocol/client": "2.0.0",
+    "@modelcontextprotocol/server": "2.0.0",
     "listhen": "^1.9.0",
     "tsdown": "0.22.7",
-    "@better-auth/core": "1.7.0-rc.2",
-    "@better-auth/oauth-provider": "1.7.0-rc.2",
-    "better-auth": "1.7.0-rc.2"
+    "@better-auth/core": "1.7.0-rc.3",
+    "@better-auth/mcp": "1.7.0-rc.3",
+    "@better-auth/oauth-provider": "1.7.0-rc.3",
+    "better-auth": "1.7.0-rc.3"
   },
   "peerDependencies": {
     "better-call": "1.3.7",
-    "@better-auth/core": "^1.7.0-rc.2",
-    "@better-auth/oauth-provider": "^1.7.0-rc.2",
-    "better-auth": "^1.7.0-rc.2"
+    "@better-auth/core": "^1.7.0-rc.3",
+    "@better-auth/oauth-provider": "^1.7.0-rc.3",
+    "better-auth": "^1.7.0-rc.3"
   },
   "scripts": {
     "build": "tsdown",