@plitzi/sdk-server 0.32.10 → 0.32.12

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # @plitzi/sdk-server
 
+## 0.32.12
+
+### Patch Changes
+
+- v0.32.12
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.12
+  - @plitzi/sdk-schema@0.32.12
+  - @plitzi/sdk-shared@0.32.12
+
+## 0.32.11
+
+### Patch Changes
+
+- v0.32.11
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.11
+  - @plitzi/sdk-schema@0.32.11
+  - @plitzi/sdk-shared@0.32.11
+
 ## 0.32.10
 
 ### Patch Changes

package/dist/core/http/dispatcher.js

@@ -1,22 +1,60 @@
 import { applySecurityHeaders } from "./securityHeaders.js";
 import { buildResponseHelpers } from "../../helpers/buildResponseHelpers.js";
-import { parseRequest } from "../requestParser.js";
+import { clientIp, parseRequest } from "../requestParser.js";
 //#region src/core/http/dispatcher.ts
-var runPipeline = async (raw, rawRes, buildContext, stages) => {
+var safePath = (url) => {
+	const [path = "/", query] = url.split("?");
+	if (!query) return path;
+	const keys = [...new Set(new URLSearchParams(query).keys())];
+	return keys.length > 0 ? `${path}?${keys.join("&")}` : path;
+};
+var errorText = (error) => error instanceof Error ? error.message : String(error);
+var statusOf = (rawRes, res) => rawRes.headersSent ? rawRes.statusCode : res.status;
+var runPipeline = async (raw, rawRes, buildContext, stages, server) => {
+	const startedAt = Date.now();
 	const req = parseRequest(raw);
 	const res = buildResponseHelpers(rawRes, req.headers["accept-encoding"]);
-	if (req.path === "\0") {
-		res.setStatus(400);
-		res.end();
-		return;
-	}
 	const ctx = buildContext(raw, rawRes, req, res);
-	applySecurityHeaders(res, ctx.config, ctx.port);
-	for (const stage of stages) if (await stage(ctx)) return;
+	const logger = ctx.config.logger;
+	const ip = logger ? clientIp(raw, req) : "";
+	const logRequest = (error) => {
+		if (!logger) return;
+		const status = statusOf(rawRes, res);
+		logger({
+			kind: "request",
+			server,
+			method: req.method,
+			path: safePath(req.url),
+			...ip ? { clientIp: ip } : {},
+			...ctx.operation === void 0 ? {} : { operation: ctx.operation },
+			status,
+			durationMs: Date.now() - startedAt,
+			ok: !error && status < 400,
+			...error ? { error: errorText(error) } : {},
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	};
+	try {
+		if (req.path === "\0") {
+			res.setStatus(400);
+			res.end();
+			logRequest();
+			return;
+		}
+		applySecurityHeaders(res, ctx.config, ctx.port);
+		for (const stage of stages) if (await stage(ctx)) {
+			logRequest();
+			return;
+		}
+		logRequest();
+	} catch (error) {
+		logRequest(error);
+		throw error;
+	}
 };
 var makeHandler = (label, buildContext, stages) => {
 	return (raw, rawRes) => {
-		runPipeline(raw, rawRes, buildContext, stages).catch((err) => {
+		runPipeline(raw, rawRes, buildContext, stages, label).catch((err) => {
 			console.error(`[${label}] Unhandled error:`, err);
 			try {
 				if (!rawRes.headersSent) rawRes.writeHead(500, { "Content-Type": "text/plain" });

package/dist/core/requestParser.js

@@ -30,6 +30,23 @@ var parseRequest = (raw) => {
 		ctx: {}
 	};
 };
+var AUTHORITY_RE = /^[a-zA-Z0-9.-]{1,253}(?::\d{1,5})?$/u;
+/** The public origin the request was addressed to (proxy-aware via x-forwarded-proto, port included), or an empty
+*  string when the request carries no usable authority. */
+var requestOrigin = (req) => {
+	const authority = req.headers[":authority"] ?? req.headers["host"] ?? "";
+	return AUTHORITY_RE.test(authority) ? `${req.protocol}://${authority}` : "";
+};
+var headerValue = (value) => (Array.isArray(value) ? value[0] : value)?.trim() ?? "";
+var unmapIpv4 = (address) => address.startsWith("::ffff:") && address.includes(".") ? address.slice(7) : address;
+/** The address the request came from, seen through the proxies a deployment sits behind: Cloudflare states the
+*  peer it accepted in `cf-connecting-ip`, the ingress in `x-real-ip`, and `x-forwarded-for` lists the chain with
+*  the original client first. All three are plain headers a direct client can forge, so this is log/diagnostic
+*  material — never an authorisation input. Falls back to the socket peer, which no client controls. */
+var clientIp = (raw, req) => {
+	const forwardedFor = headerValue(req.headers["x-forwarded-for"]).split(",")[0] ?? "";
+	return unmapIpv4(headerValue(req.headers["cf-connecting-ip"]) || headerValue(req.headers["x-real-ip"]) || forwardedFor.trim() || raw.socket.remoteAddress || "");
+};
 var MAX_BODY_BYTES = 1024 * 1024;
 var readRawBody = (raw) => new Promise((resolve, reject) => {
 	const chunks = [];
@@ -46,4 +63,4 @@ var readRawBody = (raw) => new Promise((resolve, reject) => {
 	raw.on("error", reject);
 });
 //#endregion
-export { parseRequest, readRawBody };
+export { clientIp, parseRequest, readRawBody, requestOrigin };

package/dist/core/services/mcp.js

@@ -3,12 +3,12 @@ import { createHttpPreviewClient } from "../../modules/mcp/previewClient.js";
 import { createHttpScreenshotClient } from "../../modules/mcp/screenshotClient.js";
 //#region src/core/services/mcp.ts
 var mcpPathOf = (config) => config.mcpAi?.path ?? config.mcp?.path ?? "/mcp";
-var serveMcp = (ctx) => {
-	const { previewClient, screenshot, adapters, mcpLogger } = ctx.config;
-	return handleMcp(ctx.raw, ctx.rawRes, ctx.req, adapters, {
+var serveMcp = async (ctx) => {
+	const { previewClient, screenshot, adapters, logger } = ctx.config;
+	ctx.operation = await handleMcp(ctx.raw, ctx.rawRes, ctx.req, adapters, {
 		preview: previewClient ? createHttpPreviewClient(previewClient) : void 0,
 		screenshot: screenshot ? createHttpScreenshotClient(screenshot) : void 0,
-		logger: mcpLogger
+		logger
 	});
 };
 var mcpStage = async (ctx) => {

package/dist/core/services/oauth.js

@@ -0,0 +1,71 @@
+import { readRawBody } from "../requestParser.js";
+import { authorizationServerMetadata, protectedResourceMetadata } from "../../modules/oauth/metadata.js";
+import { sendErrorJson, sendJson } from "../../modules/oauth/respond.js";
+import { handleAuthorizeStart, handleAuthorizeSubmit } from "../../modules/oauth/authorize.js";
+import { handleRegister } from "../../modules/oauth/register.js";
+import { handleToken } from "../../modules/oauth/token.js";
+//#region src/core/services/oauth.ts
+var matchesWellKnown = (path, wellKnown) => path === wellKnown || path.startsWith(`${wellKnown}/`);
+var isOAuthPath = (path) => matchesWellKnown(path, "/.well-known/oauth-protected-resource") || matchesWellKnown(path, "/.well-known/oauth-authorization-server") || path === "/register" || path === "/authorize" || path === "/token";
+var formParams = (req, body) => {
+	const params = { ...req.query };
+	for (const [key, value] of new URLSearchParams(body).entries()) params[key] = value;
+	return params;
+};
+var parseJson = (body) => {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+};
+/** OAuth 2.1 authorization for the MCP server, mounted ONLY when a deployment configures `oauth`. Without it the
+*  stage falls straight through and the server keeps its anonymous contract: discovery 404s, the public surface
+*  (handshake, listings, the guide, plitzi_render) answers without a token, and nothing below changes.
+*
+*  It sits before the MCP stage because that one answers every path on a dedicated MCP server — these endpoints
+*  would otherwise be swallowed by the JSON-RPC transport, which is exactly the 406 a host hits on /register. */
+var oauthStage = async (ctx) => {
+	const { oauth } = ctx.config;
+	const { path, method } = ctx.req;
+	if (!oauth || !isOAuthPath(path)) return false;
+	const { res } = ctx;
+	if (path !== "/authorize") {
+		res.setHeader("Access-Control-Allow-Origin", "*");
+		res.setHeader("Access-Control-Allow-Headers", "*");
+		res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
+	}
+	if (method === "OPTIONS") {
+		res.setStatus(204);
+		res.end();
+		return true;
+	}
+	if (method === "GET" && matchesWellKnown(path, "/.well-known/oauth-protected-resource")) {
+		sendJson(res, 200, protectedResourceMetadata(oauth, ctx.req));
+		return true;
+	}
+	if (method === "GET" && matchesWellKnown(path, "/.well-known/oauth-authorization-server")) {
+		sendJson(res, 200, authorizationServerMetadata(oauth, ctx.req));
+		return true;
+	}
+	if (path === "/authorize" && method === "GET") {
+		await handleAuthorizeStart(oauth, res, ctx.req.query);
+		return true;
+	}
+	if (path === "/authorize" && method === "POST") {
+		await handleAuthorizeSubmit(oauth, res, formParams(ctx.req, await readRawBody(ctx.raw)));
+		return true;
+	}
+	if (path === "/token" && method === "POST") {
+		await handleToken(oauth, res, formParams(ctx.req, await readRawBody(ctx.raw)));
+		return true;
+	}
+	if (path === "/register" && method === "POST") {
+		await handleRegister(oauth, res, parseJson(await readRawBody(ctx.raw)));
+		return true;
+	}
+	sendErrorJson(res, 405, "invalid_request", `${method} is not allowed on ${path}.`);
+	return true;
+};
+//#endregion
+export { oauthStage };

package/dist/core/services/registry.js

@@ -1,4 +1,5 @@
 import { mcpOnlyStage, mcpStage } from "./mcp.js";
+import { oauthStage } from "./oauth.js";
 import { previewStage } from "./preview.js";
 import { rscStage } from "./rsc.js";
 import { notFoundStage, ssrStage } from "./ssr.js";
@@ -28,6 +29,7 @@ var buildSSRPipeline = (services) => {
 var buildMCPPipeline = () => [
 	healthStage,
 	configStaticStage,
+	oauthStage,
 	mcpOnlyStage
 ];
 //#endregion

package/dist/core/services/rsc.js

@@ -4,6 +4,7 @@ var rscStage = async (ctx) => {
 	const { config, req } = ctx;
 	const rscPath = config.rsc?.path ?? "/_rsc";
 	if (!(config.rsc?.enabled ?? true) || req.method !== "GET" || req.path !== rscPath) return false;
+	ctx.operation = "rsc";
 	await handleRsc(req, ctx.res, config, ctx.pluginManager, ctx.caches.rsc);
 	return true;
 };

package/dist/helpers/serverLog.js

@@ -0,0 +1,34 @@
+//#region src/helpers/serverLog.ts
+var outcomeOf = (event) => event.ok ? "ok" : `ERROR ${event.error ?? ""}`.trim();
+var renderRequest = (event) => {
+	const client = event.clientIp ? `${event.clientIp} ` : "";
+	const operation = event.operation ? ` ${event.operation}` : "";
+	const timing = `${Math.round(event.durationMs)}ms`;
+	return `[${event.server}] ${client}${event.method} ${event.path}${operation} ${event.status} ${timing} ${outcomeOf(event)}`;
+};
+var renderTool = (event) => {
+	const args = event.argsSummary ? ` ${event.argsSummary}` : "";
+	return `[mcp] tools/call ${event.name}${args} ${Math.round(event.durationMs)}ms ${outcomeOf(event)}`;
+};
+var renderResource = (event) => `[mcp] resources/read ${event.name} ${Math.round(event.durationMs)}ms ${outcomeOf(event)}`;
+/** One line for any {@link ServerLogEvent}: an HTTP request reads as an access-log line
+*  (`[SSR] 203.0.113.7 GET /pricing 200 12ms ok`), the MCP events as what happened inside one
+*  (`[mcp] tools/call plitzi_apply {operations:[3]} 41ms ok`). Rendering is a pure format — the dispatcher
+*  already stripped query values, collected no headers, cookies or tokens and summarised tool args by shape;
+*  the client IP it does carry is personal data, so a sink that persists these lines must say so. */
+var renderLogEvent = (event) => {
+	switch (event.kind) {
+		case "request": return renderRequest(event);
+		case "tool": return renderTool(event);
+		case "resource": return renderResource(event);
+	}
+};
+/** A drop-in `SSRServerConfig.logger` for consumers that just want the log on the console. Consumers with their
+*  own logging stack should pass their own sink instead and read the structured event. */
+var consoleLogger = (event) => {
+	const line = renderLogEvent(event);
+	if (event.ok) console.log(line);
+	else console.error(line);
+};
+//#endregion
+export { consoleLogger, renderLogEvent };

package/dist/index.js

@@ -1,4 +1,5 @@
 import { buildAgentGuide } from "./modules/mcp/helpers/agentPrompt.js";
+import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
 import { operation } from "./modules/mcp/tools/operations/index.js";
 import { apply, applyShape } from "./modules/mcp/tools/apply/index.js";
 import { read, readShape } from "./modules/mcp/tools/read.js";
@@ -19,4 +20,4 @@ import { createSSRServer } from "./core/server/ssrServer.js";
 import { createServer } from "./core/createServer.js";
 import { createJsonAdapters } from "./adapters/jsonAdapters.js";
 import AIEngine from "./modules/ai/AIEngine.js";
-export { AIEngine, PREVIEW_TOKEN_PARAM, apply, applyShape, bindTools, buildAgentGuide, buildHealthPayload, createHttpPreviewClient, createHttpScreenshotClient, createJsonAdapters, createMCPServer, createMcpServer, createMemoryDraftStore, createPreview, createSSRServer, createServer, getAllowedModes, handleMcp, isCallToolResult, isToolActive, operation, read, readMcpBody, readShape, registerHealthCheck, resolveServices, resolveToolHandler, search, searchShape, serveMcp, toolResponseErr, toolResponseFromResult, toolResponseOk, tools, validate, validateShape, zodToJsonSchema };
+export { AIEngine, PREVIEW_TOKEN_PARAM, apply, applyShape, bindTools, buildAgentGuide, buildHealthPayload, consoleLogger, createHttpPreviewClient, createHttpScreenshotClient, createJsonAdapters, createMCPServer, createMcpServer, createMemoryDraftStore, createPreview, createSSRServer, createServer, getAllowedModes, handleMcp, isCallToolResult, isToolActive, operation, read, readMcpBody, readShape, registerHealthCheck, renderLogEvent, resolveServices, resolveToolHandler, search, searchShape, serveMcp, toolResponseErr, toolResponseFromResult, toolResponseOk, tools, validate, validateShape, zodToJsonSchema };

package/dist/mcp.js

@@ -1,6 +1,7 @@
+import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
 import { createMcpServer } from "./modules/mcp/server.js";
 import { handleMcp, readMcpBody, serveMcp } from "./modules/mcp/handler.js";
 import { createHttpPreviewClient } from "./modules/mcp/previewClient.js";
 import { createHttpScreenshotClient } from "./modules/mcp/screenshotClient.js";
 import { createMCPServer } from "./core/server/mcpServer.js";
-export { createHttpPreviewClient, createHttpScreenshotClient, createMCPServer, createMcpServer, handleMcp, readMcpBody, serveMcp };
+export { consoleLogger, createHttpPreviewClient, createHttpScreenshotClient, createMCPServer, createMcpServer, handleMcp, readMcpBody, renderLogEvent, serveMcp };

package/dist/modules/mcp/handler.js

@@ -15,6 +15,10 @@ var readMcpBody = (req) => new Promise((resolve, reject) => {
 	});
 	req.on("error", reject);
 });
+var operationOf = (body) => {
+	if (Array.isArray(body)) return `batch(${body.length})`;
+	if (typeof body === "object" && body !== null && "method" in body && typeof body.method === "string") return body.method;
+};
 var serveMcp = async (raw, res, server) => {
 	res.setHeader("Access-Control-Allow-Origin", "*");
 	res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
@@ -30,6 +34,11 @@ var serveMcp = async (raw, res, server) => {
 		res.end();
 		return;
 	}
+	if (raw.url === "/favicon.ico") {
+		res.writeHead(204);
+		res.end();
+		return;
+	}
 	if (raw.method !== "POST") {
 		res.writeHead(405, {
 			"Content-Type": "application/json",
@@ -60,6 +69,7 @@ var serveMcp = async (raw, res, server) => {
 			return;
 		}
 		await transport.handleRequest(raw, res, body);
+		return operationOf(body);
 	} finally {
 		await transport.close();
 	}

package/dist/modules/mcp/helpers/log.js

@@ -1,7 +1,19 @@
+import { renderLogEvent } from "../../../helpers/serverLog.js";
 //#region src/modules/mcp/helpers/log.ts
 var MCP_DEBUG = process.env.MCP_DEBUG === "1";
-var summarize = (value, max = 300) => {
-	if (value === void 0) return;
+var MCP_LOG_ARGS = process.env.MCP_LOG_ARGS === "1";
+var shapeOf = (value, depth = 0) => {
+	if (value === null) return "null";
+	if (Array.isArray(value)) return `[${value.length}]`;
+	if (typeof value === "object") {
+		if (depth >= 2) return "{…}";
+		const entries = Object.entries(value);
+		const shown = entries.slice(0, 8).map(([key, item]) => `${key}:${shapeOf(item, depth + 1)}`);
+		return `{${[...shown, ...entries.length > shown.length ? ["…"] : []].join(",")}}`;
+	}
+	return typeof value;
+};
+var rawSummary = (value, max = 300) => {
 	let json;
 	try {
 		json = JSON.stringify(value);
@@ -10,25 +22,23 @@ var summarize = (value, max = 300) => {
 	}
 	return json.length > max ? `${json.slice(0, max)}…` : json;
 };
-var errorText = (error) => error instanceof Error ? error.message : String(error);
-var consoleRender = (event) => {
-	const kind = event.kind === "tool" ? "tools/call" : "resources/read";
-	const detail = event.argsSummary ? ` ${event.argsSummary}` : "";
-	const status = event.ok ? "ok" : `ERROR ${event.error ?? ""}`;
-	console.log(`[mcp] ${kind} ${event.name}${detail} ${Math.round(event.durationMs)}ms ${status}`);
+var summarize = (value) => {
+	if (value === void 0) return;
+	return MCP_LOG_ARGS ? rawSummary(value) : shapeOf(value);
 };
+var errorText = (error) => error instanceof Error ? error.message : String(error);
 var noop = () => void 0;
 var inertLog = {
 	toolCall: noop,
 	resourceRead: noop
 };
-/** Build the request-log sink for one MCP server. Dispatches structured events to the consumer's `logger` when
+/** Build the protocol-log sink for one MCP server. Dispatches structured events to the consumer's `logger` when
 *  provided; otherwise renders to the console when MCP_DEBUG=1; otherwise a no-op. */
 var createMcpLog = (logger) => {
 	if (!logger && !MCP_DEBUG) return inertLog;
 	const emit = (event) => {
 		if (logger) logger(event);
-		else consoleRender(event);
+		else console.log(renderLogEvent(event));
 	};
 	return {
 		toolCall: (name, args, ms, error) => emit({

package/dist/modules/mcp/resources/register.js

@@ -21,19 +21,25 @@ var registerResources = (server, getSpace, env, log) => {
 			throw error;
 		}
 	};
+	const emitStatic = (uri, read) => {
+		const start = performance.now();
+		const result = read();
+		log.resourceRead(uri, performance.now() - start);
+		return result;
+	};
 	server.registerResource("Guide", "plitzi://guide", {
 		description: "How to read and write this space with mcp-ai",
 		mimeType: "text/markdown"
-	}, () => ({ contents: [{
+	}, () => emitStatic("plitzi://guide", () => ({ contents: [{
 		uri: "plitzi://guide",
 		mimeType: "text/markdown",
 		text: guideText
-	}] }));
+	}] })));
 	server.registerResource("CSS properties", "plitzi://css-properties", {
 		description: "Valid kebab-case CSS property keys",
 		mimeType: "application/json"
-	}, () => jsonContents("plitzi://css-properties", envelope(cssProperties)));
-	registerRenderResources(server);
+	}, () => emitStatic("plitzi://css-properties", () => jsonContents("plitzi://css-properties", envelope(cssProperties))));
+	registerRenderResources(server, log);
 	const fixed = [
 		[
 			"Primer",

package/dist/modules/mcp/resources/renderGuide.js

@@ -168,19 +168,29 @@ connects that source to a descendant's field.
 The tool returns \`rendered: false\` with \`errors: [{ path, message, hint }]\`. Read the hint, fix that one op, and
 retry — you never lose the rest of the batch.
 `;
-var registerRenderResources = (server) => {
+var registerRenderResources = (server, log) => {
 	server.registerResource("Render guide", RENDER_GUIDE_URI, {
 		description: "How to author a plitzi_render widget: operations, element types, styling, examples.",
 		mimeType: "text/markdown"
-	}, () => ({ contents: [{
-		uri: RENDER_GUIDE_URI,
-		mimeType: "text/markdown",
-		text: renderGuideText
-	}] }));
+	}, () => {
+		const start = performance.now();
+		const contents = { contents: [{
+			uri: RENDER_GUIDE_URI,
+			mimeType: "text/markdown",
+			text: renderGuideText
+		}] };
+		log.resourceRead(RENDER_GUIDE_URI, performance.now() - start);
+		return contents;
+	});
 	server.registerResource("Render element types", RENDER_TYPES_URI, {
 		description: "Built-in element types a plitzi_render widget can use, with descriptions.",
 		mimeType: "application/json"
-	}, () => jsonContents(RENDER_TYPES_URI, envelope(renderTypes())));
+	}, () => {
+		const start = performance.now();
+		const contents = jsonContents(RENDER_TYPES_URI, envelope(renderTypes()));
+		log.resourceRead(RENDER_TYPES_URI, performance.now() - start);
+		return contents;
+	});
 };
 //#endregion
 export { RENDER_GUIDE_URI, RENDER_TYPES_URI, registerRenderResources };

package/dist/modules/mcp/server.js

@@ -43,7 +43,7 @@ var createMcpServer = ({ adapters, getSpaceId, preview, screenshot, logger }) =>
 	const getSpace = () => spacePromise ??= loadSpace();
 	const server = new McpServer({
 		name: "plitzi-mcp",
-		version: "0.32.10"
+		version: "0.32.12"
 	}, { instructions: serverInstructions });
 	registerResources(server, getSpace, MCP_ENV, log);
 	registerApps(server);

package/dist/modules/oauth/authorize.js

@@ -0,0 +1,160 @@
+import { renderConsentPage } from "./consentPage.js";
+import { AUTHORIZE_PATH } from "./metadata.js";
+import { field, optionalField } from "./params.js";
+import { randomId } from "./pkce.js";
+import { dropPending, getClient, getPending, putCode, putPending } from "./records.js";
+import { redirectWithCode, redirectWithError, sendErrorPage, sendHtml } from "./respond.js";
+//#region src/modules/oauth/authorize.ts
+var DEFAULT_CODE_TTL_SECONDS = 60;
+var hiddenFieldsFor = (request, pendingId) => {
+	const hidden = {
+		client_id: request.clientId,
+		redirect_uri: request.redirectUri,
+		code_challenge: request.challenge,
+		code_challenge_method: "S256"
+	};
+	if (request.state !== void 0) hidden["state"] = request.state;
+	if (request.scope !== void 0) hidden["scope"] = request.scope;
+	if (pendingId !== void 0) hidden["pending"] = pendingId;
+	return hidden;
+};
+var renderConsent = async (config, res, view) => {
+	sendHtml(res, 200, await (config.renderConsent ?? renderConsentPage)(view));
+};
+/** Validates the parts of an authorization request that decide WHERE a failure may be reported. Until the client
+*  and its redirect target check out, nothing may be sent back to the client. */
+var resolveRequest = async (config, res, params) => {
+	const clientId = field(params, "client_id");
+	const redirectUri = field(params, "redirect_uri");
+	const client = clientId ? await getClient(config.adapters.store, clientId) : void 0;
+	if (!client) {
+		sendErrorPage(res, "Unknown client", "This application is not registered with the server, or its registration expired.");
+		return;
+	}
+	if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
+		sendErrorPage(res, "Invalid redirect", "The application asked to be sent back to an address it did not register.");
+		return;
+	}
+	const state = optionalField(params, "state");
+	const responseType = field(params, "response_type");
+	if (responseType && responseType !== "code") {
+		redirectWithError(res, redirectUri, "unsupported_response_type", "Only the authorization code flow is supported.", state);
+		return;
+	}
+	const challenge = field(params, "code_challenge");
+	const method = field(params, "code_challenge_method");
+	if (!challenge || method !== "S256") {
+		redirectWithError(res, redirectUri, "invalid_request", "PKCE with code_challenge_method=S256 is required.", state);
+		return;
+	}
+	return {
+		clientId,
+		redirectUri,
+		challenge,
+		state,
+		scope: optionalField(params, "scope")
+	};
+};
+/** Consent granted: mint the bearer now, park it behind a one-shot code and send the browser back. Minting here
+*  rather than at redemption keeps a failure the user can act on — no space, revoked access — on this screen. */
+var completeGrant = async (config, res, request, pending, target) => {
+	const issued = await config.adapters.issueToken(pending.user, target);
+	if (!issued) {
+		redirectWithError(res, request.redirectUri, "access_denied", "The account may not grant access to this resource.", request.state);
+		return;
+	}
+	const code = randomId();
+	await putCode(config.adapters.store, code, {
+		clientId: request.clientId,
+		redirectUri: request.redirectUri,
+		challenge: request.challenge,
+		token: issued.token,
+		expiresInSeconds: issued.expiresInSeconds,
+		scope: request.scope,
+		user: pending.user,
+		target
+	}, config.codeTtlSeconds ?? DEFAULT_CODE_TTL_SECONDS);
+	redirectWithCode(res, request.redirectUri, code, request.state);
+};
+/** GET /authorize — the entry point a host opens in the user's browser. */
+var handleAuthorizeStart = async (config, res, params) => {
+	const request = await resolveRequest(config, res, params);
+	if (!request) return;
+	await renderConsent(config, res, {
+		step: "credentials",
+		action: AUTHORIZE_PATH,
+		hidden: hiddenFieldsFor(request),
+		targets: [],
+		branding: config.branding ?? {}
+	});
+};
+/** POST /authorize — both steps of the form land here: the credentials submit, and the grant submit that carries
+*  the `pending` id proving the credentials step already passed. */
+var handleAuthorizeSubmit = async (config, res, params) => {
+	const request = await resolveRequest(config, res, params);
+	if (!request) return;
+	const pendingId = optionalField(params, "pending");
+	if (pendingId) {
+		const pending = await getPending(config.adapters.store, pendingId);
+		if (!pending || pending.clientId !== request.clientId) {
+			redirectWithError(res, request.redirectUri, "access_denied", "The sign-in expired. Try connecting again.", request.state);
+			return;
+		}
+		const targets = await config.adapters.grantTargets(pending.user);
+		const chosen = targets.find((target) => target.value === field(params, "target"));
+		if (!chosen) {
+			await renderConsent(config, res, {
+				step: "target",
+				action: AUTHORIZE_PATH,
+				hidden: hiddenFieldsFor(request, pendingId),
+				targets,
+				user: pending.user,
+				error: "Choose what to grant access to.",
+				branding: config.branding ?? {}
+			});
+			return;
+		}
+		await dropPending(config.adapters.store, pendingId);
+		await completeGrant(config, res, request, pending, chosen);
+		return;
+	}
+	const user = await config.adapters.authenticate({
+		username: field(params, "username"),
+		password: field(params, "password")
+	});
+	if (!user) {
+		await renderConsent(config, res, {
+			step: "credentials",
+			action: AUTHORIZE_PATH,
+			hidden: hiddenFieldsFor(request),
+			targets: [],
+			error: "Those credentials did not match an account.",
+			branding: config.branding ?? {}
+		});
+		return;
+	}
+	const targets = await config.adapters.grantTargets(user);
+	if (targets.length === 0) {
+		redirectWithError(res, request.redirectUri, "access_denied", "This account has nothing to grant access to.", request.state);
+		return;
+	}
+	const nextPendingId = randomId();
+	await putPending(config.adapters.store, nextPendingId, {
+		clientId: request.clientId,
+		redirectUri: request.redirectUri,
+		challenge: request.challenge,
+		state: request.state,
+		scope: request.scope,
+		user
+	});
+	await renderConsent(config, res, {
+		step: "target",
+		action: AUTHORIZE_PATH,
+		hidden: hiddenFieldsFor(request, nextPendingId),
+		targets,
+		user,
+		branding: config.branding ?? {}
+	});
+};
+//#endregion
+export { handleAuthorizeStart, handleAuthorizeSubmit };