@opendatalabs/personal-server-ts-server 1.29.2 → 1.31.0

package/dist/ui/ps-lite-debug.js

@@ -114138,6 +114138,10 @@ function isExpired(expiresAt, nowMs2) {
 // ../core/dist/mcp/connection-api.js
 var TOKEN_BYTES = 32;
 var OAUTH_AUTHORIZATION_TTL_MS = 10 * 60 * 1e3;
+var MCP_SCOPE_REQUEST_TOKEN_HEADER = "X-Vana-Scope-Request-Token";
+var MCP_SCOPE_REQUEST_NOT_FOUND = "MCP_SCOPE_REQUEST_NOT_FOUND";
+var MCP_SCOPE_REQUEST_READ_TOKEN_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_READ_TOKEN_CHARS = 128;
 var CLEARED_REFRESH_FAMILY = {
   refreshTokenHash: void 0,
   previousRefreshTokenHash: void 0,
@@ -114214,6 +114218,7 @@ function buildMcpProtectedResourceMetadataUrl(publicOrigin) {
   const base = publicOrigin.endsWith("/") ? publicOrigin.slice(0, -1) : publicOrigin;
   return `${base}/.well-known/oauth-protected-resource/mcp`;
 }
+var MCP_CONNECTION_NOT_FOUND = "MCP_CONNECTION_NOT_FOUND";
 var McpConnectionNotFoundError = class extends Error {
   connectionId;
   constructor(connectionId) {
@@ -114248,7 +114253,10 @@ async function approveMcpConnection(input, options) {
       status: "approved",
       grants: input.grants,
       approvedAt,
-      scopeAccessRequest: pendingRequest && remainingRequestScopes && remainingRequestScopes.length > 0 ? { ...pendingRequest, scopes: remainingRequestScopes } : void 0
+      scopeAccessRequest: pendingRequest && remainingRequestScopes && remainingRequestScopes.length > 0 ? {
+        ...toMcpScopeAccessRequestView(pendingRequest),
+        scopes: remainingRequestScopes
+      } : void 0
     };
   });
   if (!updated)
@@ -114260,6 +114268,9 @@ function grantCoversScope(grant, scope) {
 }
 async function requestMcpScopeAccess(input, options) {
   const requestedAt = nowIso(options.now);
+  const readToken = randomToken();
+  const readTokenHash = await hashConnectionToken(readToken);
+  const readTokenExpiresAt = new Date(nowMs(options.now) + MCP_SCOPE_REQUEST_READ_TOKEN_TTL_MS).toISOString();
   const inputScopes = Array.from(new Set(input.scopes.map((scope) => scope.trim()).filter(Boolean))).sort();
   const updated = await options.store.mutate(input.connectionId, (existing) => {
     if (existing.status !== "approved") {
@@ -114274,7 +114285,9 @@ async function requestMcpScopeAccess(input, options) {
     const request2 = {
       scopes,
       ...reason ? { reason } : {},
-      requestedAt
+      requestedAt,
+      readTokenHash,
+      readTokenExpiresAt
     };
     return { ...existing, scopeAccessRequest: request2 };
   });
@@ -114283,9 +114296,227 @@ async function requestMcpScopeAccess(input, options) {
   const missingInputScopes = inputScopes.filter((scope) => !updated.grants.some((grant) => grantCoversScope(grant, scope)));
   return {
     connection: updated,
-    requestRecorded: missingInputScopes.length > 0 && missingInputScopes.every((scope) => updated.scopeAccessRequest?.scopes.includes(scope))
+    requestRecorded: missingInputScopes.length > 0 && missingInputScopes.every((scope) => updated.scopeAccessRequest?.scopes.includes(scope)),
+    ...updated.scopeAccessRequest?.readTokenHash === readTokenHash ? { readToken } : {}
   };
 }
+function digestsEqual(a10, b10) {
+  let diff = a10.length ^ b10.length;
+  const length = Math.max(a10.length, b10.length);
+  for (let i10 = 0; i10 < length; i10 += 1) {
+    diff |= (a10.charCodeAt(i10) | 0) ^ (b10.charCodeAt(i10) | 0);
+  }
+  return diff === 0;
+}
+async function readMcpScopeRequestWithToken(input, options) {
+  const token = input.token?.trim() ?? "";
+  if (!token || token.length > MAX_READ_TOKEN_CHARS || !input.connectionId) {
+    return null;
+  }
+  const presentedHash = await hashConnectionToken(token);
+  const record2 = await options.store.getById(input.connectionId);
+  const request2 = record2?.scopeAccessRequest;
+  if (!record2 || record2.status !== "approved" || !request2)
+    return null;
+  if (!request2.readTokenHash || !request2.readTokenExpiresAt)
+    return null;
+  if (!digestsEqual(presentedHash, request2.readTokenHash))
+    return null;
+  const expiresAt = Date.parse(request2.readTokenExpiresAt);
+  if (!Number.isFinite(expiresAt) || expiresAt <= nowMs(options.now)) {
+    return null;
+  }
+  if (request2.scopes.length === 0)
+    return null;
+  return {
+    id: record2.id,
+    displayName: record2.displayName,
+    scopeAccessRequest: toMcpScopeAccessRequestView(request2),
+    grantedScopes: sortedUnique(record2.grants.flatMap((grant) => grant.scopes))
+  };
+}
+var McpScopeRequestError = class extends Error {
+  code;
+  status;
+  body;
+  constructor(code, message, status2 = 400, body) {
+    super(message);
+    this.code = code;
+    this.status = status2;
+    this.body = body;
+    this.name = "McpScopeRequestError";
+  }
+};
+async function approveMcpScopeAccessRequest(input, options) {
+  const connection = await options.store.getById(input.connectionId);
+  if (!connection)
+    throw new McpConnectionNotFoundError(input.connectionId);
+  const pending = requirePendingScopeRequest(connection);
+  const approvedScopes = parseApprovedScopes(input.scopes, pending);
+  const live = await readLiveGrantState(connection, options.gateway);
+  const grantedScopes = sortedUnique([...live.scopes, ...approvedScopes]);
+  let grantResult;
+  try {
+    grantResult = await createGrantContract({
+      gateway: options.gateway,
+      serverOwner: options.serverOwner,
+      serverSigner: options.serverSigner,
+      body: {
+        granteeAddress: connection.granteeAddress,
+        scopes: grantedScopes,
+        grantVersion: live.nextGrantVersion,
+        ...live.expiresAt !== void 0 ? { expiresAt: live.expiresAt } : {}
+      }
+    });
+  } catch (err2) {
+    throw new McpScopeRequestError("GRANT_CREATION_FAILED", err2 instanceof Error ? err2.message : String(err2), 502);
+  }
+  if (!grantResult.ok) {
+    throw new McpScopeRequestError("GRANT_CREATION_FAILED", extractGrantErrorMessage(grantResult.body), grantResult.status >= 500 ? 502 : grantResult.status === 409 ? 409 : 400, grantResult.body);
+  }
+  const grantId = grantResult.body.grantId;
+  if (!grantId) {
+    throw new McpScopeRequestError("GRANT_CREATION_FAILED", "Gateway did not return a grant id.", 502, grantResult.body);
+  }
+  const decidedAt = nowIso(options.now);
+  const deniedScopes = pending.scopes.filter((scope) => !approvedScopes.includes(scope));
+  const updated = await options.store.mutate(input.connectionId, (latest) => {
+    requirePendingScopeRequest(latest);
+    if (JSON.stringify(latest.grants) !== JSON.stringify(connection.grants)) {
+      throw new McpScopeRequestError("CONCURRENT_UPDATE", "The connection's grants changed during approval; retry.", 409);
+    }
+    const decision = {
+      decision: "approved",
+      approvedScopes,
+      deniedScopes,
+      requestedAt: pending.requestedAt,
+      decidedAt
+    };
+    return {
+      ...latest,
+      grants: [{ grantId, scopes: grantedScopes }],
+      scopeAccessRequest: void 0,
+      scopeAccessDecision: decision
+    };
+  });
+  if (!updated)
+    throw new McpConnectionNotFoundError(input.connectionId);
+  return {
+    connection: updated,
+    grantId,
+    grantedScopes,
+    approvedScopes,
+    deniedScopes
+  };
+}
+async function denyMcpScopeAccessRequest(input, options) {
+  const decidedAt = nowIso(options.now);
+  const updated = await options.store.mutate(input.connectionId, (latest) => {
+    const pending = requirePendingScopeRequest(latest);
+    const decision = {
+      decision: "denied",
+      approvedScopes: [],
+      deniedScopes: pending.scopes,
+      requestedAt: pending.requestedAt,
+      decidedAt
+    };
+    return {
+      ...latest,
+      scopeAccessRequest: void 0,
+      scopeAccessDecision: decision
+    };
+  });
+  if (!updated)
+    throw new McpConnectionNotFoundError(input.connectionId);
+  return updated;
+}
+function requirePendingScopeRequest(connection) {
+  if (connection.status !== "approved") {
+    throw new McpConnectionStateError(connection.id, connection.status, "approved");
+  }
+  const pending = connection.scopeAccessRequest;
+  if (!pending || pending.scopes.length === 0) {
+    throw new McpScopeRequestError("NO_PENDING_REQUEST", `mcp connection ${connection.id} has no pending scope request`, 409);
+  }
+  return pending;
+}
+function parseApprovedScopes(value, pending) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new McpScopeRequestError("SCOPES_REQUIRED", "Approve requires a non-empty scopes array; use deny to decline all.");
+  }
+  const scopes = [];
+  for (const raw of value) {
+    const scope = typeof raw === "string" ? raw.trim() : "";
+    if (!ScopeSchema.safeParse(scope).success) {
+      throw new McpScopeRequestError("INVALID_SCOPE", `Invalid scope: ${JSON.stringify(raw)}`);
+    }
+    if (!pending.scopes.includes(scope)) {
+      throw new McpScopeRequestError("SCOPE_NOT_REQUESTED", `Scope ${scope} is not part of the pending request`);
+    }
+    if (!scopes.includes(scope))
+      scopes.push(scope);
+  }
+  return scopes.sort();
+}
+async function readLiveGrantState(connection, gateway) {
+  const grantIds = sortedUnique(connection.grants.map((grant) => grant.grantId));
+  const revoked = /* @__PURE__ */ new Set();
+  const scopes = /* @__PURE__ */ new Set();
+  let maxVersion = 0n;
+  let expiresAt;
+  for (const grantId of grantIds) {
+    let live;
+    try {
+      live = await gateway.getGrant(grantId);
+    } catch (err2) {
+      throw new McpScopeRequestError("GATEWAY_UNAVAILABLE", `Could not read grant ${grantId}: ${err2 instanceof Error ? err2.message : String(err2)}`, 502);
+    }
+    if (!live)
+      continue;
+    const version4 = parseUint(live.grantVersion);
+    if (version4 !== null && version4 > maxVersion)
+      maxVersion = version4;
+    if (live.revokedAt) {
+      revoked.add(grantId);
+      continue;
+    }
+    for (const scope of live.scopes)
+      scopes.add(scope);
+    const liveExpiry = parseExpirySeconds(live.expiresAt);
+    if (liveExpiry !== void 0) {
+      expiresAt = expiresAt === void 0 ? liveExpiry : Math.max(expiresAt, liveExpiry);
+    }
+  }
+  for (const grant of connection.grants) {
+    if (revoked.has(grant.grantId))
+      continue;
+    for (const scope of grant.scopes)
+      scopes.add(scope);
+  }
+  return {
+    scopes: sortedUnique(scopes),
+    nextGrantVersion: (maxVersion + 1n).toString(),
+    ...expiresAt !== void 0 ? { expiresAt } : {}
+  };
+}
+function parseUint(value) {
+  if (typeof value !== "string" || !/^\d+$/u.test(value))
+    return null;
+  return BigInt(value);
+}
+function parseExpirySeconds(value) {
+  if (!value)
+    return void 0;
+  if (/^\d+$/u.test(value)) {
+    const seconds = Number(value);
+    return seconds > 0 ? seconds : void 0;
+  }
+  const ms3 = Date.parse(value);
+  return Number.isFinite(ms3) ? Math.floor(ms3 / 1e3) : void 0;
+}
+function sortedUnique(values) {
+  return Array.from(new Set(values)).sort();
+}
 async function revokeMcpConnection(connectionId, options) {
   const existing = await options.store.getById(connectionId);
   if (!existing)
@@ -114302,6 +114533,13 @@ async function revokeMcpConnection(connectionId, options) {
     throw new McpConnectionNotFoundError(connectionId);
   return updated;
 }
+function toMcpScopeAccessRequestView(request2) {
+  return {
+    scopes: request2.scopes,
+    ...request2.reason !== void 0 ? { reason: request2.reason } : {},
+    requestedAt: request2.requestedAt
+  };
+}
 function toMcpConnectionView(record2) {
   return {
     id: record2.id,
@@ -114309,13 +114547,21 @@ function toMcpConnectionView(record2) {
     granteeAddress: record2.granteeAddress,
     status: record2.status,
     grants: record2.grants,
-    scopeAccessRequest: record2.scopeAccessRequest,
+    grantedScopes: sortedUnique(record2.grants.flatMap((grant) => grant.scopes)),
+    scopeAccessRequest: record2.scopeAccessRequest ? toMcpScopeAccessRequestView(record2.scopeAccessRequest) : void 0,
+    scopeAccessDecision: record2.scopeAccessDecision,
     createdAt: record2.createdAt,
     approvedAt: record2.approvedAt,
     revokedAt: record2.revokedAt,
     lastUsedAt: record2.lastUsedAt
   };
 }
+async function getMcpConnectionView(connectionId, store) {
+  const record2 = await store.getById(connectionId);
+  if (!record2)
+    throw new McpConnectionNotFoundError(connectionId);
+  return toMcpConnectionView(record2);
+}
 async function listMcpConnectionViews(store) {
   const records = await store.list();
   return records.map(toMcpConnectionView);
@@ -123333,7 +123579,13 @@ var listGrantedScopes = {
         reason
       };
     }));
-    return textResult({ scopes: scopeEntries });
+    return textResult({
+      scopes: scopeEntries,
+      ...connection.scopeAccessRequest ? {
+        pendingScopeRequest: toMcpScopeAccessRequestView(connection.scopeAccessRequest)
+      } : {},
+      ...connection.scopeAccessDecision ? { lastScopeDecision: connection.scopeAccessDecision } : {}
+    });
   }
 };
 var requestScopeAccess = {
@@ -123341,8 +123593,9 @@ var requestScopeAccess = {
   title: "Request scope access",
   description: "Record missing scopes on this MCP connection for explicit owner approval in Vana.",
   inputSchema: scopeAccessRequestInputShape,
-  async handler(args, { connection, requestScopeAccess: requestScopeAccess2 }) {
+  async handler(args, { connection, requestScopeAccess: requestScopeAccess2, scopeRequestApprovalUrl, serverOrigin }) {
     const requestedScopes = normalizeScopeListInput(args.scopes);
+    const previousDecision = connection.scopeAccessDecision;
     let effectiveConnection = connection;
     let grantedRequestedScopes = requestedScopes.filter((scope) => Boolean(resolveGrantForScope(effectiveConnection, scope)));
     let missingScopes = requestedScopes.filter((scope) => !resolveGrantForScope(connection, scope));
@@ -123350,6 +123603,7 @@ var requestScopeAccess = {
     const approvalRequired = missingScopes.length > 0;
     const alreadyRecorded = approvalRequired && missingScopes.every((scope) => connection.scopeAccessRequest?.scopes.includes(scope));
     let requestRecorded = alreadyRecorded;
+    let readToken;
     if (approvalRequired && requestScopeAccess2) {
       const outcome = await requestScopeAccess2({
         scopes: missingScopes,
@@ -123357,10 +123611,17 @@ var requestScopeAccess = {
       });
       effectiveConnection = outcome.connection;
       requestRecorded = outcome.requestRecorded;
+      readToken = outcome.readToken;
       grantedRequestedScopes = requestedScopes.filter((scope) => Boolean(resolveGrantForScope(effectiveConnection, scope)));
       missingScopes = requestedScopes.filter((scope) => !resolveGrantForScope(effectiveConnection, scope));
     }
     const finalApprovalRequired = missingScopes.length > 0;
+    const recorded = finalApprovalRequired && requestRecorded;
+    const approvalUrl = recorded ? resolveScopeRequestApprovalUrl(scopeRequestApprovalUrl, connection.id, {
+      serverOrigin,
+      ...readToken ? { readToken } : {}
+    }) : void 0;
+    const declinedScopes = previousDecision?.deniedScopes.filter((scope) => missingScopes.includes(scope)) ?? [];
     return textResult({
       approvalRequired: finalApprovalRequired,
       client: {
@@ -123373,11 +123634,41 @@ var requestScopeAccess = {
       missingScopes,
       grantedScopes: uniqueScopes(effectiveConnection),
       reason: reason || void 0,
-      requestRecorded: finalApprovalRequired && requestRecorded,
-      nextAction: finalApprovalRequired ? requestRecorded ? "The request is waiting for owner approval in Vana. Access remains unchanged until the owner approves it." : "Ask the user to open Vana's Personal Server page and add the missing scopes to this MCP client. This tool cannot grant access by itself." : "No new grant is needed for the requested scopes."
+      requestRecorded: recorded,
+      approvalUrl,
+      previousDecision,
+      nextAction: scopeRequestNextAction({
+        finalApprovalRequired,
+        recorded,
+        approvalUrl,
+        declinedScopes
+      })
     });
   }
 };
+function resolveScopeRequestApprovalUrl(hook, connectionId, context) {
+  if (!hook)
+    return void 0;
+  try {
+    const url2 = hook(connectionId, context);
+    return typeof url2 === "string" && url2.trim() ? url2.trim() : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function scopeRequestNextAction(input) {
+  if (!input.finalApprovalRequired) {
+    return "No new grant is needed for the requested scopes.";
+  }
+  const declined = input.declinedScopes.length > 0 ? `The owner previously declined ${input.declinedScopes.join(", ")}; only ask again if the user wants to. ` : "";
+  if (!input.recorded) {
+    return `${declined}Ask the user to open Vana's Personal Server page and add the missing scopes to this MCP client. This tool cannot grant access by itself.`;
+  }
+  if (input.approvalUrl) {
+    return `${declined}Show the user this link to review the request: ${input.approvalUrl} . Ask them to approve or decline it there and to tell you when they are done, then call list_granted_scopes to see what was granted. Access remains unchanged until the owner approves.`;
+  }
+  return `${declined}The request is waiting for owner approval in Vana. Access remains unchanged until the owner approves it.`;
+}
 var readScope = {
   name: READ_SCOPE_TOOL,
   title: "Read scope",
@@ -134557,7 +134848,9 @@ function createMcpServerForConnection(options) {
     connection: options.connection,
     readClient: options.readClient,
     activityRecorder: options.activityRecorder,
-    requestScopeAccess: options.requestScopeAccess
+    requestScopeAccess: options.requestScopeAccess,
+    scopeRequestApprovalUrl: options.scopeRequestApprovalUrl,
+    serverOrigin: options.serverOrigin
   };
   for (const tool of MCP_TOOLS) {
     server.registerTool(tool.name, toolConfig(tool), async (args) => {
@@ -135641,6 +135934,7 @@ function createPsLiteRuntime(options) {
             store: options.mcpConnectionStore,
             authorizationStore: mcpOAuthAuthorizationStore,
             approvalUrl: options.mcpOAuthApprovalUrl,
+            scopeRequestApprovalUrl: options.mcpScopeRequestApprovalUrl,
             auth,
             dataStorage,
             accessLogWriter,
@@ -135865,6 +136159,25 @@ async function handleMcpRoute(input) {
     }
     return errorResponse3(404, "NOT_FOUND", "Not found");
   }
+  const scopeRequestRead = /^\/v1\/mcp\/connections\/([^/]+)\/scope-request$/u.exec(pathname);
+  if (scopeRequestRead && input.request.method === "GET") {
+    let connectionId = "";
+    try {
+      connectionId = decodeURIComponent(scopeRequestRead[1] ?? "");
+    } catch {
+      connectionId = "";
+    }
+    const view = await readMcpScopeRequestWithToken({
+      connectionId,
+      token: input.request.headers.get(MCP_SCOPE_REQUEST_TOKEN_HEADER)
+    }, { store: input.store, now: input.now });
+    if (!view) {
+      const notFound2 = errorResponse3(404, MCP_SCOPE_REQUEST_NOT_FOUND, "Scope request not found");
+      notFound2.headers.set("Cache-Control", "no-store");
+      return notFound2;
+    }
+    return jsonResponse4(view, { headers: { "Cache-Control": "no-store" } });
+  }
   if (pathname === ownerPrefix || pathname.startsWith(`${ownerPrefix}/`)) {
     try {
       await input.auth.authorizeOwner(input.request);
@@ -135896,10 +136209,19 @@ async function handleMcpRoute(input) {
       return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
     }
     const tail = pathname.slice(ownerPrefix.length + 1);
-    const [id2, action] = tail.split("/");
+    const [id2, action, subAction, ...rest] = tail.split("/");
     if (!id2) {
       return errorResponse3(404, "NOT_FOUND", "Not found");
     }
+    if (action === "scope-request") {
+      if (rest.length > 0 || subAction !== "approve" && subAction !== "deny") {
+        return errorResponse3(404, "NOT_FOUND", "Not found");
+      }
+      if (input.request.method !== "POST") {
+        return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
+      }
+      return handleScopeRequestAnswer(id2, subAction);
+    }
     if (action === "approve") {
       if (input.request.method !== "POST") {
         return errorResponse3(405, "METHOD_NOT_ALLOWED", "Method not allowed");
@@ -135927,6 +136249,16 @@ async function handleMcpRoute(input) {
       }
     }
     if (!action) {
+      if (input.request.method === "GET") {
+        try {
+          return jsonResponse4(await getMcpConnectionView(id2, input.store));
+        } catch (err2) {
+          if (err2 instanceof McpConnectionNotFoundError) {
+            return errorResponse3(404, MCP_CONNECTION_NOT_FOUND, err2.message);
+          }
+          throw err2;
+        }
+      }
       if (input.request.method === "DELETE") {
         try {
           const updated = await revokeMcpConnection(id2, {
@@ -135945,6 +136277,71 @@ async function handleMcpRoute(input) {
     }
     return errorResponse3(404, "NOT_FOUND", "Not found");
   }
+  async function handleScopeRequestAnswer(id2, answer) {
+    let scopes;
+    if (answer === "approve") {
+      try {
+        scopes = (await input.request.json()).scopes;
+      } catch {
+        return errorResponse3(400, "INVALID_BODY", "Body must be JSON");
+      }
+    }
+    const gateway = input.gateway;
+    if (answer === "approve" && !gateway) {
+      return errorResponse3(500, "SERVER_NOT_CONFIGURED", "Gateway is not configured");
+    }
+    const activityId = input.activityRecorder?.start({
+      tool: `owner.scope_request.${answer}`,
+      ...Array.isArray(scopes) ? {
+        scopes: scopes.filter((scope) => typeof scope === "string")
+      } : {}
+    });
+    const finish = (status2, errorCode) => {
+      if (activityId) {
+        input.activityRecorder?.finish(activityId, {
+          status: status2,
+          ...errorCode ? { errorCode } : {}
+        });
+      }
+    };
+    try {
+      if (answer === "deny" || !gateway) {
+        const denied = await denyMcpScopeAccessRequest({ connectionId: id2 }, { store: input.store, now: input.now });
+        finish("succeeded");
+        return jsonResponse4({ connection: toMcpConnectionView(denied) });
+      }
+      const approved = await approveMcpScopeAccessRequest({ connectionId: id2, scopes }, {
+        store: input.store,
+        gateway,
+        serverOwner: input.serverOwner,
+        serverSigner: input.serverSigner,
+        now: input.now
+      });
+      finish("succeeded");
+      return jsonResponse4({
+        connection: toMcpConnectionView(approved.connection),
+        grantId: approved.grantId,
+        grantedScopes: approved.grantedScopes,
+        approvedScopes: approved.approvedScopes,
+        deniedScopes: approved.deniedScopes
+      });
+    } catch (err2) {
+      if (err2 instanceof McpConnectionNotFoundError) {
+        finish("failed", MCP_CONNECTION_NOT_FOUND);
+        return errorResponse3(404, MCP_CONNECTION_NOT_FOUND, err2.message);
+      }
+      if (err2 instanceof McpConnectionStateError) {
+        finish("failed", "INVALID_STATE");
+        return errorResponse3(409, "INVALID_STATE", err2.message);
+      }
+      if (err2 instanceof McpScopeRequestError) {
+        finish("failed", err2.code);
+        return errorResponse3(err2.status, err2.code, err2.message);
+      }
+      finish("failed", "INTERNAL");
+      throw err2;
+    }
+  }
   async function handleMcpToken(rawToken, options) {
     if (!rawToken) {
       if (!options.oauthChallenge) {
@@ -135984,7 +136381,9 @@ async function handleMcpRoute(input) {
       activityRecorder: input.activityRecorder,
       requestScopeAccess: async (request2) => {
         return requestMcpScopeAccess({ connectionId: record2.id, ...request2 }, { store: input.store, now: input.now });
-      }
+      },
+      scopeRequestApprovalUrl: input.scopeRequestApprovalUrl,
+      serverOrigin: input.serverOrigin
     });
     void input.store.update(record2.id, {
       lastUsedAt: input.now().toISOString()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opendatalabs/personal-server-ts-server",
-  "version": "1.29.2",
+  "version": "1.31.0",
   "description": "Hono HTTP server for the Vana Personal Server — routes, middleware, composition root",
   "license": "MIT",
   "repository": {
@@ -51,8 +51,8 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.19.17",
-    "@opendatalabs/personal-server-ts-core": "1.29.2",
-    "@opendatalabs/personal-server-ts-lite": "1.29.2",
+    "@opendatalabs/personal-server-ts-core": "1.31.0",
+    "@opendatalabs/personal-server-ts-lite": "1.31.0",
     "@opendatalabs/vana-sdk": "3.23.0-pr.211.36da1d8",
     "better-sqlite3": "^12.11.1",
     "hono": "^4.13.12",