@orchyn/mcp 1.3.4 → 1.4.0

package/README.md

@@ -1,8 +1,8 @@
 # @orchyn/mcp
 
 MCP (Model Context Protocol) server for [orchyn](https://orchyn.com) — fetch,
-discover and understand social posts (TikTok, Instagram, YouTube, X) with your
-orchyn account and orchyn credits.
+discover and understand social posts (TikTok, Instagram, YouTube, X/Twitter,
+Douyin, Xiaohongshu, Bilibili) with your orchyn account and orchyn credits.
 
 ## Install (one link)
 
@@ -38,9 +38,9 @@ npx @orchyn/mcp login   # one-time sign-in (Google)
 
 | Tool | Credits | Description |
 |------|---------|-------------|
-| `analyze_post` | first free* | **Preferred.** Analyze any post (video, image, carousel/slideshow) from a TikTok/Instagram/YouTube/X-Twitter URL — imports the media and runs AI analysis over the actual content (video frames, carousel images, caption). Returns a `jobId` to poll via `GET /ai/analyze-post`. *First analysis free per workspace via the dashboard free grant.* |
+| `analyze_post` | first free* | **Preferred.** Analyze any post (video, image, carousel/slideshow) from a TikTok/Instagram/YouTube/X-Twitter/Douyin/Xiaohongshu/Bilibili URL — imports the media and runs AI analysis over the actual content (video frames, carousel images, caption). Returns a `jobId` to poll via `GET /ai/analyze-post`. *First analysis free per workspace via the dashboard free grant.* |
 | `get_social_media` | 1 | Fetch a post's media from a URL: `contentType` (video/image/carousel/slideshow), title, caption, author, stats, direct media URLs **+ inline thumbnail image in chat**. |
-| `discover_social_posts` | 2 | **Preferred.** Find recent posts (video/image/carousel/slideshow) for a niche (YouTube via `yt-dlp` search; TikTok/Instagram via Apify). Each post includes title/caption, views/likes/comments, author, `externalUrl` + **inline thumbnails (4 at a time)** — see *Images in chat* below. Supports `limit`/`offset` pagination (“next”). |
+| `discover_social_posts` | 2 | **Preferred.** Find recent posts (video/image/carousel/slideshow) for a niche on YouTube, TikTok, Instagram, Douyin, Xiaohongshu, X/Twitter or Bilibili (via TikHub). Each post includes title/caption, views/likes/comments, author, `externalUrl` + **inline thumbnails (4 at a time)** — see *Images in chat* below. Supports `limit`/`offset` pagination (“next”). |
 | `understand_social_post` | 10 | Import a post URL **and** analyze it with multimodal AI over the actual video/images: factual `whatHappens` description, hook strength, viral triggers, format breakdown, variation ideas, suggested hook/hashtags. Includes inline thumbnails. |
 | `check_orchyn_credits` | free | Check your MCP credit balance, billing URL and pack size — no cost. |
 | `buy_orchyn_credits` | free | Get a Stripe Checkout URL to buy a credit pack — open it to pay; credits are added automatically. No cost to call. Also at `https://orchyn.com/settings?tab=billing`. |
@@ -245,6 +245,9 @@ per the MCP 2025-03-26 spec):
 - Instagram: `instagram.com/*` (reels, posts, carousels), `instagr.am/*`
 - YouTube: `youtube.com/*` (including `/shorts/`), `youtu.be/*`, `m.youtube.com/*`
 - X/Twitter: `x.com/*`, `twitter.com/*`
+- Douyin: `douyin.com/*`
+- Xiaohongshu: `xiaohongshu.com/*`, `xhslink.com/*`
+- Bilibili: `bilibili.com/*`, `b23.tv/*`
 
 All tools accept these hosts and handle **video, image, carousel and slideshow** posts.
 

package/dist/index.js

@@ -10,197 +10,19 @@
  */
 import http from "node:http";
 import { randomUUID } from "node:crypto";
-import { z } from "zod";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { getBaseUrl, getPublicUrl, getPort, getCredentialsFile, getTransportMode, DEFAULT_PORT, } from "./config.js";
 import { AuthManager, OrchynAuthError, createHttpTokenProvider, createStdioTokenProvider } from "./auth.js";
 import { OrchynClient, OrchynError } from "./orchyn.js";
 import { OAuthManager } from "./oauth.js";
-import { formatPaywallError, runVideoAnalysis, validatePostUrl } from "./video.js";
-function toToolResult(proxy) {
-    const images = proxy.contentBlocks
-        .filter((c) => c.type === "image")
-        .map((c) => ({
-        type: "image",
-        data: String(c.data ?? ""),
-        mimeType: String(c.mimeType ?? "image/jpeg"),
-    }));
-    const text = JSON.stringify(proxy.structured ?? {}, null, 2);
-    return { content: [...images, { type: "text", text }] };
-}
-function toolError(prefix, err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    return { content: [{ type: "text", text: `${prefix}: ${msg}` }], isError: true };
-}
-export function createServer(opts) {
-    const server = new McpServer({
-        name: "orchyn-mcp",
-        version: "1.1.0",
-    });
-    server.registerTool("analyze_post", {
-        title: "Analyze Post",
-        description: "Analyze a social post (video, image, carousel/slideshow) from its link — " +
-            "imports the media and runs AI analysis over the actual content (video frames, carousel images, caption). " +
-            "Supports TikTok, Instagram, YouTube and X/Twitter. Returns the full analysis once finished.",
-        inputSchema: z
-            .object({
-            url: z.string().describe("Public post URL (TikTok/Instagram/YouTube/X or shortlinks)."),
-        })
-            .strict(),
-    }, async (args, extra) => {
-        let session;
-        if (extra.authInfo?.token && opts.resolveSession) {
-            session = opts.resolveSession(extra.authInfo.token);
-        }
-        const client = opts.makeClient(session);
-        const validation = validatePostUrl(args.url);
-        if (!validation.ok) {
-            return {
-                content: [{ type: "text", text: `Invalid url: ${validation.error}` }],
-                isError: true,
-            };
-        }
-        try {
-            const result = await runVideoAnalysis(client, validation.url);
-            const images = (result._inlineImages ?? []).map((img) => ({
-                type: "image",
-                data: String(img.data),
-                mimeType: String(img.mimeType ?? "image/jpeg"),
-            }));
-            // Remove internal field from JSON shown to model
-            const { _inlineImages: _omit, ...rest } = result;
-            return {
-                content: [...images, { type: "text", text: JSON.stringify(rest, null, 2) }],
-            };
-        }
-        catch (err) {
-            if (err instanceof OrchynError && err.paywall) {
-                return {
-                    content: [{ type: "text", text: `Analysis blocked: ${formatPaywallError(err)}\n\nHTTP ${err.status}: ${err.message}` }],
-                    isError: true,
-                };
-            }
-            const msg = err instanceof Error ? err.message : String(err);
-            return { content: [{ type: "text", text: `Analysis failed: ${msg}` }], isError: true };
-        }
-    });
-    server.registerTool("get_social_media", {
-        title: "Get Social Media",
-        description: "Fetch a social post's media from a TikTok, Instagram, YouTube or X/Twitter URL: " +
-            "contentType (video/image/carousel/slideshow), title, caption, author, stats and direct media URLs. " +
-            "Returns an inline thumbnail image. Consumes 1 orchyn credit.",
-        inputSchema: z
-            .object({
-            url: z.string().describe("Full public post URL."),
-        })
-            .strict(),
-    }, async (args, extra) => {
-        const client = makeClientFor(extra, opts);
-        try {
-            return toToolResult(await client.callTool("get_social_media", { url: args.url }));
-        }
-        catch (err) {
-            return toolError("get_social_media failed", err);
-        }
-    });
-    server.registerTool("discover_social_posts", {
-        title: "Discover Social Posts",
-        description: "Discover recent posts (video, image, carousel, slideshow) for a niche. YouTube via search; TikTok & Instagram via Apify. " +
-            "Each post includes title/caption, thumbnailUrl, externalUrl, views/likes/comments and inline thumbnails (up to 4) so they show in chat. " +
-            "Say \"next\" to paginate (offset), or \"analyze the 2nd one\" / \"analyze all\" for batch analysis. Consumes 2 orchyn credits.",
-        inputSchema: z
-            .object({
-            niche: z.string().describe("Niche/topic, e.g. 'fitness'."),
-            keywords: z.string().optional().describe("Optional extra keywords."),
-            limit: z.number().int().optional().describe("Max results (default 6)."),
-            offset: z.number().int().optional().describe("Skip first N results — for 'next' pagination."),
-            platform: z
-                .enum(["youtube", "tiktok", "instagram", "any"])
-                .optional()
-                .describe("Platform to search (default youtube)."),
-        })
-            .strict(),
-    }, async (args, extra) => {
-        const client = makeClientFor(extra, opts);
-        try {
-            return toToolResult(await client.callTool("discover_social_posts", { ...args }));
-        }
-        catch (err) {
-            return toolError("discover_social_posts failed", err);
-        }
-    });
-    server.registerTool("check_orchyn_credits", {
-        title: "Check MCP Credits",
-        description: "Check your MCP credit balance, billing URL and pack size. No cost — call anytime to see remaining credits before running other tools.",
-        inputSchema: z.object({}).strict(),
-    }, async (_args, extra) => {
-        const client = makeClientFor(extra, opts);
-        try {
-            return toToolResult(await client.callTool("check_orchyn_credits", {}));
-        }
-        catch (err) {
-            return toolError("check_orchyn_credits failed", err);
-        }
-    });
-    server.registerTool("buy_orchyn_credits", {
-        title: "Buy MCP Credits",
-        description: "Buy an MCP credit pack via Stripe Checkout. Returns a secure checkout URL — open it in your browser to pay. Credits are added automatically after payment. No cost to call.",
-        inputSchema: z.object({}).strict(),
-    }, async (_args, extra) => {
-        const client = makeClientFor(extra, opts);
-        try {
-            return toToolResult(await client.callTool("buy_orchyn_credits", {}));
-        }
-        catch (err) {
-            return toolError("buy_orchyn_credits failed", err);
-        }
-    });
-    server.registerTool("understand_social_post", {
-        title: "Understand Social Post",
-        description: "Import a social post URL AND understand it with multimodal AI over the actual video/images: " +
-            "summary, hook strength, viral triggers, format breakdown and variation ideas. Includes the thumbnail. " +
-            "Consumes 10 orchyn credits.",
-        inputSchema: z
-            .object({
-            url: z.string().describe("Full public post URL (TikTok/Instagram/YouTube)."),
-            focus: z
-                .string()
-                .optional()
-                .describe("Extra instruction, e.g. 'focus on the CTA'."),
-        })
-            .strict(),
-    }, async (args, extra) => {
-        const client = makeClientFor(extra, opts);
-        try {
-            return toToolResult(await client.callTool("understand_social_post", { ...args }));
-        }
-        catch (err) {
-            return toolError("understand_social_post failed", err);
-        }
-    });
-    return server;
-}
-/**
- * Resolves the per-request OrchynClient: HTTP-mode MCP sessions carry their
- * own orchyn identity via authInfo; stdio uses the shared logged-in session.
- */
-function makeClientFor(extra, opts) {
-    let session;
-    if (extra.authInfo?.token && opts.resolveSession) {
-        session = opts.resolveSession(extra.authInfo.token);
-    }
-    return opts.makeClient(session);
-}
+import { createMcpServer } from "./shared/tools.js";
 // ---------------------------------------------------------------------------
 // stdio mode
 // ---------------------------------------------------------------------------
 export async function runStdio() {
     const auth = new AuthManager(getBaseUrl(), getCredentialsFile());
-    const server = createServer({
-        makeClient: (session) => new OrchynClient(getBaseUrl(), createStdioTokenProvider(auth)),
-    });
+    const server = createMcpServer(() => new OrchynClient(getBaseUrl(), createStdioTokenProvider(auth)));
     const transport = new StdioServerTransport();
     await server.connect(transport);
     // Keep the process alive until the transport closes (handled by the SDK).
@@ -388,14 +210,16 @@ export async function runHttp(port, publicUrl) {
         auth,
         transports: new Map(),
         connections: new Map(),
-        serverFactory: () => createServer({
-            makeClient: (session) => new OrchynClient(baseUrl, createHttpTokenProvider(auth, session
+        serverFactory: () => createMcpServer((extra) => {
+            const session = extra.authInfo?.token
+                ? oauth.verifyToken(extra.authInfo.token)
+                : undefined;
+            return new OrchynClient(baseUrl, createHttpTokenProvider(auth, session
                 ? {
                     accessToken: session.orchynAccessToken,
                     refreshToken: session.orchynRefreshToken,
                 }
-                : undefined)),
-            resolveSession: (mcpAccessToken) => oauth.verifyToken(mcpAccessToken),
+                : undefined));
         }),
     };
     const server = http.createServer((req, res) => {

package/dist/oauth.js

@@ -12,52 +12,13 @@
  * The MCP access tokens issued at /token are opaque random strings bound to
  * the orchyn JWT obtained through the Google sign-in flow.
  */
-import { createHash, randomBytes, randomUUID } from "node:crypto";
-export const SCOPE = "analyze:video";
-export const TOKEN_TTL_SECONDS = 3600;
-export function verifyPkce(codeVerifier, codeChallenge) {
-    if (!codeVerifier || !codeChallenge)
-        return false;
-    const digest = createHash("sha256").update(codeVerifier).digest("base64url");
-    return digest === codeChallenge;
-}
-export function isLoopbackUrl(url) {
-    let parsed;
-    try {
-        parsed = new URL(url);
-    }
-    catch {
-        return false;
-    }
-    if (parsed.protocol !== "http:")
-        return false;
-    const host = parsed.hostname;
-    return (host === "localhost" ||
-        host === "127.0.0.1" ||
-        host === "[::1]" ||
-        host === "::1");
-}
-/** redirect_uri must be loopback (http://localhost|127.0.0.1|[::1]) or any https URL. */
-export function isAllowedRedirectUri(uri) {
-    let parsed;
-    try {
-        parsed = new URL(uri);
-    }
-    catch {
-        return false;
-    }
-    if (parsed.protocol === "https:")
-        return true;
-    if (parsed.protocol === "http:" && isLoopbackUrl(uri))
-        return true;
-    return false;
-}
-function base64Url(bytes) {
-    return bytes.toString("base64url");
-}
-function newToken() {
-    return base64Url(randomBytes(32));
-}
+import { SCOPE, escapeHtml, isAllowedRedirectUri, randomToken, verifyPkce, } from "./shared/oauth.js";
+// Re-export the shared primitives so consumers and tests keep one import path.
+export { SCOPE, verifyPkce, isAllowedRedirectUri, isLoopbackUrl, escapeHtml, generateState, } from "./shared/oauth.js";
+// MCP session lifetime. Sessions self-renew their orchyn access token, so a
+// login lasts as long as the account's refresh token (30 days server-side)
+// rather than forcing a re-login every hour.
+export const TOKEN_TTL_SECONDS = 604800;
 function readBody(req) {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -155,8 +116,8 @@ export class OAuthManager {
         if (unsupported.length > 0) {
             return this.sendAuthorizeError(res, params, "invalid_scope", `Unsupported scope(s): ${unsupported.join(", ")}. Supported: ${SCOPE}.`);
         }
-        const orchynState = newToken();
-        const mcpAuthCode = newToken();
+        const orchynState = randomToken();
+        const mcpAuthCode = randomToken();
         const pending = {
             orchynState,
             clientId,
@@ -256,12 +217,12 @@ export class OAuthManager {
             return sendJson(res, 400, { error: "invalid_grant", error_description: "redirect_uri does not match the authorization request." });
         }
         const codeVerifier = params.get("code_verifier") ?? "";
-        if (!verifyPkce(codeVerifier, pending.codeChallenge)) {
+        if (!(await verifyPkce(codeVerifier, pending.codeChallenge))) {
             return sendJson(res, 400, { error: "invalid_grant", error_description: "PKCE verification failed." });
         }
         this.pendingByMcpCode.delete(code);
         this.pendingByOrchynState.delete(pending.orchynState);
-        const accessToken = newToken();
+        const accessToken = randomToken();
         this.sessions.set(accessToken, {
             orchynAccessToken: pending.orchynAccessToken ?? "",
             orchynRefreshToken: pending.orchynRefreshToken,
@@ -291,13 +252,3 @@ export class OAuthManager {
         return sendHtml(res, 400, "orchyn-mcp: bad request", `<p>${escapeHtml(description)}</p>`);
     }
 }
-function escapeHtml(input) {
-    return input
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;");
-}
-export function generateState() {
-    return randomUUID();
-}

package/dist/orchyn.js

@@ -1,164 +1,6 @@
 /**
- * Typed client for the orchyn REST API.
- *
- * All API errors are normalized to `OrchynError`. 402 responses are
- * detected specifically and exposed via the `paywall` property.
+ * The orchyn API client now lives in `shared/orchyn.ts` so the Node package
+ * and the Cloudflare Worker import one implementation. This file re-exports
+ * it for backward compatibility.
  */
-export class OrchynError extends Error {
-    status;
-    code;
-    paywall;
-    body;
-    constructor(status, message, opts = {}) {
-        super(message);
-        this.name = "OrchynError";
-        this.status = status;
-        this.code = opts.code;
-        this.paywall = opts.paywall;
-        this.body = opts.body;
-    }
-}
-export class OrchynClient {
-    baseUrl;
-    tokenProvider;
-    constructor(baseUrl, tokenProvider) {
-        this.baseUrl = baseUrl.replace(/\/+$/, "");
-        this.tokenProvider = tokenProvider;
-    }
-    async request(method, path, opts = {}) {
-        const doRequest = async (accessToken) => {
-            const headers = {};
-            if (opts.body !== undefined) {
-                headers["content-type"] = "application/json";
-            }
-            if (accessToken) {
-                headers.authorization = `Bearer ${accessToken}`;
-            }
-            return fetch(`${this.baseUrl}${path}`, {
-                method,
-                headers,
-                body: opts.body !== undefined ? JSON.stringify(opts.body) : undefined,
-            });
-        };
-        let token = opts.token;
-        if (opts.auth && !token) {
-            token = await this.tokenProvider.getAccessToken();
-        }
-        if (opts.auth && !token) {
-            throw new OrchynError(401, "No orchyn access token available.");
-        }
-        let res = await doRequest(token);
-        if (res.status === 401 &&
-            opts.auth &&
-            this.tokenProvider.onUnauthorized) {
-            const refreshed = await this.tokenProvider.onUnauthorized();
-            if (refreshed) {
-                token = await this.tokenProvider.getAccessToken();
-                res = await doRequest(token);
-            }
-        }
-        return this.normalizeResponse(res, path);
-    }
-    async normalizeResponse(res, path) {
-        const text = await res.text();
-        let body;
-        try {
-            body = text ? JSON.parse(text) : undefined;
-        }
-        catch {
-            body = undefined;
-        }
-        const json = (body ?? {});
-        const errorMessage = typeof json.error === "string" ? json.error : `orchyn API error (${res.status})`;
-        if (res.status >= 200 && res.status < 300) {
-            return body;
-        }
-        if (res.status === 402) {
-            throw new OrchynError(402, errorMessage, {
-                paywall: {
-                    reason: typeof json.reason === "string" ? json.reason : undefined,
-                    used: typeof json.used === "number" ? json.used : undefined,
-                    max: typeof json.max === "number" ? json.max : undefined,
-                    cost: typeof json.cost === "number" ? json.cost : undefined,
-                },
-                body,
-            });
-        }
-        throw new OrchynError(res.status, errorMessage, {
-            code: typeof json.code === "string" ? json.code : undefined,
-            body,
-        });
-    }
-    async startVideoAnalysis(url, appId) {
-        return this.request("POST", "/mcp/analyze-video", {
-            auth: true,
-            body: appId !== undefined ? { url, appId } : { url },
-        });
-    }
-    /**
-     * Proxies a generic orchyn backend MCP tool (`get_social_media`,
-     * `discover_social_videos`, `understand_social_post`, …) through
-     * `POST /mcp` JSON-RPC. The backend enforces per-user credit billing;
-     * tool-level failures surface as OrchynError with the backend message.
-     */
-    async callTool(name, args) {
-        const rpc = await this.request("POST", "/mcp", {
-            auth: true,
-            body: {
-                jsonrpc: "2.0",
-                id: Date.now(),
-                method: "tools/call",
-                params: { name, arguments: args },
-            },
-        });
-        if (rpc && typeof rpc === "object" && rpc.error !== undefined && rpc.error !== null) {
-            const err = rpc.error;
-            throw new OrchynError(err.code === -32002 ? 402 : 400, typeof err.message === "string" ? err.message : "orchyn MCP tool call failed");
-        }
-        const result = (rpc.result ?? {});
-        if (result.isError) {
-            const text = result.content
-                ?.filter((c) => c.type === "text")
-                .map((c) => String(c.text ?? ""))
-                .join("\n");
-            throw new OrchynError(400, text || "orchyn MCP tool call failed");
-        }
-        return {
-            contentBlocks: result.content ?? [],
-            structured: result.structuredContent,
-        };
-    }
-    async getJob(jobId) {
-        return this.request("GET", `/ai/analyze-post?jobId=${encodeURIComponent(jobId)}`, {
-            auth: true,
-        });
-    }
-    async me() {
-        return this.request("GET", "/auth/me", { auth: true });
-    }
-    async exchangeCompletionCode(code, workspaceId) {
-        return this.request("POST", "/auth/oauth/complete", {
-            auth: false,
-            body: workspaceId !== undefined ? { code, workspaceId } : { code },
-        });
-    }
-    /** Starts a Google sign-in for the given redirect URL; returns the Google redirectUrl. */
-    async startGoogleSignIn(redirect) {
-        return this.request("POST", "/auth/google/start", {
-            auth: false,
-            body: { redirect },
-        });
-    }
-    async login(email, password) {
-        return this.request("POST", "/auth/login", {
-            auth: false,
-            body: { email, password },
-        });
-    }
-    async refresh(refreshToken) {
-        return this.request("POST", "/auth/refresh", {
-            auth: false,
-            body: { refreshToken },
-        });
-    }
-}
+export * from "./shared/orchyn.js";

package/dist/shared/oauth.js

@@ -0,0 +1,86 @@
+/**
+ * Runtime-agnostic OAuth 2.0 / PKCE primitives shared by the Node package
+ * (`@orchyn/mcp`) and the Cloudflare Worker (mcp.orchyn.com). Web-standard
+ * APIs only (crypto, atob), so the worker's KV-backed OAuth flow and the
+ * node `OAuthManager` validate the same way by construction.
+ */
+export const SCOPE = "analyze:video";
+export function isLoopbackUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== "http:")
+        return false;
+    const host = parsed.hostname;
+    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+}
+/** redirect_uri must be loopback (http://localhost|127.0.0.1|[::1]) or any https URL. */
+export function isAllowedRedirectUri(uri) {
+    let parsed;
+    try {
+        parsed = new URL(uri);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol === "https:")
+        return true;
+    if (parsed.protocol === "http:" && isLoopbackUrl(uri))
+        return true;
+    return false;
+}
+/** RFC 7636 S256 PKCE check (SHA-256 + base64url compare). */
+export async function verifyPkce(codeVerifier, codeChallenge) {
+    if (!codeVerifier || !codeChallenge)
+        return false;
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(codeVerifier));
+    const bytes = new Uint8Array(digest);
+    let s = "";
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    const b64 = btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+    return b64 === codeChallenge;
+}
+export function randomToken(bytes = 32) {
+    const buf = new Uint8Array(bytes);
+    crypto.getRandomValues(buf);
+    let s = "";
+    for (const b of buf)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function authorizationServerMetadata(publicUrl, opts = {}) {
+    return {
+        issuer: publicUrl,
+        authorization_endpoint: `${publicUrl}/authorize`,
+        token_endpoint: `${publicUrl}/token`,
+        ...(opts.registration
+            ? { registration_endpoint: `${publicUrl}/register` }
+            : {}),
+        response_types_supported: ["code"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: [SCOPE],
+        grant_types_supported: ["authorization_code"],
+    };
+}
+export function protectedResourceMetadata(publicUrl) {
+    return {
+        resource: `${publicUrl}/mcp`,
+        authorization_servers: [publicUrl],
+    };
+}
+export function escapeHtml(input) {
+    return input
+        .replace(/&/g, "&")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/"/g, "&quot;");
+}
+export function generateState() {
+    return crypto.randomUUID();
+}