@decocms/mesh-sdk 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/mesh-sdk",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "SDK for building external apps that integrate with Mesh MCP servers",
   "type": "module",
   "scripts": {

package/src/lib/mcp-oauth.ts

@@ -600,12 +600,25 @@ export interface McpAuthStatus {
   isServerError?: boolean;
 }
 
+/**
+ * Get the current origin for URL resolution.
+ * Returns window.location.origin in browser, undefined on server.
+ */
+function getCurrentOrigin(): string | undefined {
+  if (typeof window !== "undefined" && window.location?.origin) {
+    return window.location.origin;
+  }
+  return undefined;
+}
+
 /**
  * Extract connection ID from MCP proxy URL
  */
 function extractConnectionIdFromUrl(url: string): string | null {
   try {
-    const urlObj = new URL(url);
+    // Use current origin as base for relative URLs (browser only)
+    const base = getCurrentOrigin();
+    const urlObj = base ? new URL(url, base) : new URL(url);
     const match = urlObj.pathname.match(/^\/mcp\/([^/]+)/);
     return match?.[1] ?? null;
   } catch {
@@ -682,8 +695,11 @@ export async function isConnectionAuthenticated({
 
     // Extract connection ID for OAuth token status check
     const connectionId = extractConnectionIdFromUrl(url);
-    // Determine base URL for API calls (meshUrl > URL origin > window.location.origin)
-    const apiBaseUrl = meshUrl ?? new URL(url).origin;
+    // Determine base URL for API calls (meshUrl > URL origin > current origin)
+    // Use current origin as base for relative URLs (browser only)
+    const base = getCurrentOrigin();
+    const apiBaseUrl =
+      meshUrl ?? (base ? new URL(url, base).origin : new URL(url).origin);
 
     if (response.ok) {
       // Check if we have an OAuth token stored for this connection