@plitzi/sdk-server 0.32.10 → 0.32.12

package/dist/src/modules/oauth/records.d.ts

@@ -0,0 +1,49 @@
+import { OAuthGrantTarget, OAuthStore, OAuthUser } from '@plitzi/sdk-shared';
+/** A client that registered itself through RFC 7591. Public clients only — a desktop host cannot keep a secret,
+ *  so the token endpoint authenticates the exchange with PKCE instead. */
+export type ClientRecord = {
+    clientId: string;
+    clientName: string;
+    redirectUris: string[];
+};
+/** The authorization request, parked while the user logs in. `challenge` binds the eventual code to the client
+ *  that started the flow. */
+export type PendingRecord = {
+    clientId: string;
+    redirectUri: string;
+    challenge: string;
+    state?: string;
+    scope?: string;
+    user: OAuthUser;
+};
+/** A code, redeemable once, for the token it already resolves to. Minting the bearer at consent time (rather than
+ *  at redemption) means a failure the user could act on — no space, revoked access — surfaces on the consent
+ *  screen instead of as an opaque `invalid_grant` inside the host. */
+export type CodeRecord = {
+    clientId: string;
+    redirectUri: string;
+    challenge: string;
+    token: string;
+    expiresInSeconds?: number;
+    scope?: string;
+    user: OAuthUser;
+    target: OAuthGrantTarget;
+};
+/** A refresh grant: everything needed to mint a fresh bearer without asking the user again. */
+export type RefreshRecord = {
+    clientId: string;
+    scope?: string;
+    user: OAuthUser;
+    target: OAuthGrantTarget;
+};
+export declare const putClient: (store: OAuthStore, client: ClientRecord) => Promise<void>;
+export declare const getClient: (store: OAuthStore, clientId: string) => Promise<ClientRecord | undefined>;
+export declare const putPending: (store: OAuthStore, id: string, pending: PendingRecord) => Promise<void>;
+export declare const getPending: (store: OAuthStore, id: string) => Promise<PendingRecord | undefined>;
+export declare const dropPending: (store: OAuthStore, id: string) => Promise<void>;
+export declare const putCode: (store: OAuthStore, code: string, record: CodeRecord, ttlSeconds: number) => Promise<void>;
+export declare const getCode: (store: OAuthStore, code: string) => Promise<CodeRecord | undefined>;
+export declare const dropCode: (store: OAuthStore, code: string) => Promise<void>;
+export declare const putRefresh: (store: OAuthStore, token: string, record: RefreshRecord, ttlSeconds: number) => Promise<void>;
+export declare const getRefresh: (store: OAuthStore, token: string) => Promise<RefreshRecord | undefined>;
+export declare const dropRefresh: (store: OAuthStore, token: string) => Promise<void>;

package/dist/src/modules/oauth/register.d.ts

@@ -0,0 +1,5 @@
+import { OAuthConfig, SSRResponseHelpers } from '@plitzi/sdk-shared';
+/** RFC 7591 dynamic client registration. A remote host has no way to be configured into this server ahead of
+ *  time, so it registers itself on first connect; the record it gets back is only ever used to pin the redirect
+ *  target, since a public client authenticates with PKCE rather than with credentials. */
+export declare const handleRegister: (config: OAuthConfig, res: SSRResponseHelpers, body: unknown) => Promise<void>;

package/dist/src/modules/oauth/respond.d.ts

@@ -0,0 +1,13 @@
+import { SSRResponseHelpers } from '@plitzi/sdk-shared';
+/** The error codes RFC 6749 defines for the responses this server produces. */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_scope' | 'access_denied' | 'server_error';
+export declare const sendJson: (res: SSRResponseHelpers, status: number, body: unknown) => void;
+export declare const sendHtml: (res: SSRResponseHelpers, status: number, html: string) => void;
+export declare const sendErrorJson: (res: SSRResponseHelpers, status: number, error: OAuthErrorCode, description: string) => void;
+/** Shown when the authorization request itself is unusable — an unknown client, a `redirect_uri` that is not
+ *  registered. Redirecting those back would turn the endpoint into an open redirector. */
+export declare const sendErrorPage: (res: SSRResponseHelpers, title: string, detail: string) => void;
+/** The other half of RFC 6749 error handling: once the redirect target is known to be legitimate, failures go
+ *  back to the client so the host can report them, carrying `state` so it can match the response to its request. */
+export declare const redirectWithError: (res: SSRResponseHelpers, redirectUri: string, error: OAuthErrorCode, description: string, state?: string) => void;
+export declare const redirectWithCode: (res: SSRResponseHelpers, redirectUri: string, code: string, state?: string) => void;

package/dist/src/modules/oauth/token.d.ts

@@ -0,0 +1,5 @@
+import { OAuthParams } from './params';
+import { OAuthConfig, SSRResponseHelpers } from '@plitzi/sdk-shared';
+/** POST /token. Public clients only, so there is no client authentication to check — PKCE is what proves the
+ *  caller is the one that started the flow. */
+export declare const handleToken: (config: OAuthConfig, res: SSRResponseHelpers, params: OAuthParams) => Promise<void>;

package/dist/src/plugins/validate.d.ts

@@ -0,0 +1,9 @@
+import { PluginSource } from '@plitzi/sdk-shared';
+/** The file a plugin source needs on disk, or null when nothing local is involved — a remote URL (fetched and
+ *  cached at request time) or a component handed in directly. */
+export declare const localSourcePath: (source: PluginSource) => string | null;
+/** Fail at boot on a plugin whose entry file is missing. A plugin entry is a plain string path in the server
+ *  config, so nothing — not tsc, not eslint — notices when that file is moved or deleted; without this check the
+ *  server starts happily and only dies on the first render that needs the plugin, with an esbuild resolve error
+ *  far from its cause. */
+export declare const assertPluginSources: (plugins: Record<string, PluginSource>) => void;

package/dist/src/plugins/validate.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.10",
+  "version": "0.32.12",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -29,9 +29,9 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/plitzi-sdk": "0.32.10",
-    "@plitzi/sdk-schema": "0.32.10",
-    "@plitzi/sdk-shared": "0.32.10",
+    "@plitzi/plitzi-sdk": "0.32.12",
+    "@plitzi/sdk-schema": "0.32.12",
+    "@plitzi/sdk-shared": "0.32.12",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.1",
     "zod": "^4.4.3"