@codelitdev/oauth-server-kit 0.1.0-alpha.2 → 0.3.0

package/README.md

@@ -50,6 +50,8 @@ application.
 
 - OAuth Dynamic Client Registration is disabled unless explicitly enabled.
 - Unauthenticated DCR requires a separate explicit opt-in.
+- MCP client metadata documents (CIMD) are configured through the product's
+  Better Auth plugins; see the integration guide for the secure fetch transport.
 - Issuer and audience/resource are verified for every bearer token.
 - Invalid explicit bearer tokens fail closed.
 - Ordinary-login redirects are restricted to configured origins.

package/dist/mcp.d.mts

@@ -4,7 +4,11 @@ import '@better-auth/oauth-provider/resource-client';
 
 interface BetterAuthMetadataApi {
     options: {
-        baseURL?: string;
+        /**
+         * Better Auth 1.7 also accepts a dynamic base URL config; discovery
+         * metadata needs one static origin, so only a string is accepted.
+         */
+        baseURL?: unknown;
         basePath?: string;
     };
     api: {

package/dist/mcp.d.ts

@@ -4,7 +4,11 @@ import '@better-auth/oauth-provider/resource-client';
 
 interface BetterAuthMetadataApi {
     options: {
-        baseURL?: string;
+        /**
+         * Better Auth 1.7 also accepts a dynamic base URL config; discovery
+         * metadata needs one static origin, so only a string is accepted.
+         */
+        baseURL?: unknown;
         basePath?: string;
     };
     api: {

package/dist/mcp.js

@@ -38,12 +38,16 @@ function normalizeOptions(options) {
   if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
     throw new Error("resourceUrl must use https in production");
   }
-  if (!options.auth.options.baseURL) {
+  const baseURL = options.auth.options.baseURL;
+  if (!baseURL) {
     throw new Error("auth.options.baseURL must be configured");
   }
+  if (typeof baseURL !== "string") {
+    throw new Error("auth.options.baseURL must be a static URL string");
+  }
   let authorizationServerBase;
   try {
-    authorizationServerBase = new URL(options.auth.options.baseURL);
+    authorizationServerBase = new URL(baseURL);
   } catch (e) {
     throw new Error("auth.options.baseURL must be an absolute URL");
   }

package/dist/mcp.mjs

@@ -18,12 +18,16 @@ function normalizeOptions(options) {
   if (process.env.NODE_ENV === "production" && resource.protocol !== "https:") {
     throw new Error("resourceUrl must use https in production");
   }
-  if (!options.auth.options.baseURL) {
+  const baseURL = options.auth.options.baseURL;
+  if (!baseURL) {
     throw new Error("auth.options.baseURL must be configured");
   }
+  if (typeof baseURL !== "string") {
+    throw new Error("auth.options.baseURL must be a static URL string");
+  }
   let authorizationServerBase;
   try {
-    authorizationServerBase = new URL(options.auth.options.baseURL);
+    authorizationServerBase = new URL(baseURL);
   } catch (e) {
     throw new Error("auth.options.baseURL must be an absolute URL");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codelitdev/oauth-server-kit",
-  "version": "0.1.0-alpha.2",
+  "version": "0.3.0",
   "description": "Lean Better Auth OAuth authentication framework for web, mobile, REST, and MCP surfaces.",
   "author": "CodeLit",
   "license": "MIT",