@plitzi/sdk-server 0.32.14 → 0.32.15

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @plitzi/sdk-server
 
+## 0.32.15
+
+### Patch Changes
+
+- v0.32.15
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.15
+  - @plitzi/sdk-schema@0.32.15
+  - @plitzi/sdk-shared@0.32.15
+
 ## 0.32.14
 
 ### Patch Changes

package/dist/modules/mcp/server.js

@@ -43,7 +43,7 @@ var createMcpServer = ({ adapters, getSpaceId, preview, screenshot, logger }) =>
 	const getSpace = () => spacePromise ??= loadSpace();
 	const server = new McpServer({
 		name: "plitzi-mcp",
-		version: "0.32.14"
+		version: "0.32.15"
 	}, { instructions: serverInstructions });
 	registerResources(server, getSpace, MCP_ENV, log);
 	registerApps(server);

package/dist/modules/oauth/records.js

@@ -16,6 +16,15 @@ var writeJson = async (store, kind, id, value, ttlSeconds) => {
 };
 var putClient = (store, client) => writeJson(store, "client", client.clientId, client, CLIENT_TTL_SECONDS);
 var getClient = (store, clientId) => readJson(store, "client", clientId);
+/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
+*  so the same request always resolves to the same client — see handleRegister for why that matters. */
+var getClientByFingerprint = async (store, fingerprint) => {
+	const clientId = await store.get(keyOf("clientfp", fingerprint));
+	return clientId ? getClient(store, clientId) : void 0;
+};
+var putClientFingerprint = async (store, fingerprint, clientId) => {
+	await store.put(keyOf("clientfp", fingerprint), clientId, CLIENT_TTL_SECONDS);
+};
 var putPending = (store, id, pending) => writeJson(store, "pending", id, pending, PENDING_TTL_SECONDS);
 var getPending = (store, id) => readJson(store, "pending", id);
 var dropPending = async (store, id) => {
@@ -34,4 +43,4 @@ var dropRefresh = async (store, token) => {
 var putAccess = (store, token, record, ttlSeconds) => writeJson(store, "access", token, record, ttlSeconds);
 var getAccess = (store, token) => readJson(store, "access", token);
 //#endregion
-export { dropCode, dropPending, dropRefresh, getAccess, getClient, getCode, getPending, getRefresh, putAccess, putClient, putCode, putPending, putRefresh };
+export { dropCode, dropPending, dropRefresh, getAccess, getClient, getClientByFingerprint, getCode, getPending, getRefresh, putAccess, putClient, putClientFingerprint, putCode, putPending, putRefresh };

package/dist/modules/oauth/register.js

@@ -1,6 +1,7 @@
 import { randomId } from "./pkce.js";
-import { putClient } from "./records.js";
+import { getClientByFingerprint, putClient, putClientFingerprint } from "./records.js";
 import { sendErrorJson, sendJson } from "./respond.js";
+import { createHash } from "node:crypto";
 //#region src/modules/oauth/register.ts
 var isUsableRedirectUri = (value) => {
 	let url;
@@ -13,6 +14,8 @@ var isUsableRedirectUri = (value) => {
 	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
 };
 var stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+var nowSeconds = () => Math.floor(Date.now() / 1e3);
+var fingerprintOf = (clientName, redirectUris) => createHash("sha256").update(JSON.stringify([clientName, [...redirectUris].sort()])).digest("base64url");
 /** RFC 7591 dynamic client registration. A remote host has no way to be configured into this server ahead of
 *  time, so it registers itself on first connect; the record it gets back is only ever used to pin the redirect
 *  target, since a public client authenticates with PKCE rather than with credentials. */
@@ -28,15 +31,19 @@ var handleRegister = async (config, res, body) => {
 		return;
 	}
 	const clientName = typeof metadata["client_name"] === "string" ? metadata["client_name"] : "MCP client";
-	const clientId = randomId();
-	await putClient(config.adapters.store, {
-		clientId,
+	const { store } = config.adapters;
+	const fingerprint = fingerprintOf(clientName, redirectUris);
+	const client = await getClientByFingerprint(store, fingerprint) ?? {
+		clientId: randomId(),
 		clientName,
-		redirectUris
-	});
+		redirectUris,
+		issuedAt: nowSeconds()
+	};
+	await putClient(store, client);
+	await putClientFingerprint(store, fingerprint, client.clientId);
 	sendJson(res, 201, {
-		client_id: clientId,
-		client_id_issued_at: Math.floor(Date.now() / 1e3),
+		client_id: client.clientId,
+		client_id_issued_at: client.issuedAt,
 		client_name: clientName,
 		redirect_uris: redirectUris,
 		grant_types: config.refreshTtlSeconds === 0 ? ["authorization_code"] : ["authorization_code", "refresh_token"],

package/dist/modules/oauth/respond.js

@@ -3,13 +3,13 @@ import { renderErrorPage } from "./consentPage.js";
 var sendJson = (res, status, body) => {
 	res.setStatus(status);
 	res.setHeader("Content-Type", "application/json");
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.send(JSON.stringify(body));
 };
 var sendHtml = (res, status, html) => {
 	res.setStatus(status);
 	res.setHeader("Content-Type", "text/html; charset=utf-8");
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.send(html);
 };
 var sendErrorJson = (res, status, error, description) => sendJson(res, status, {
@@ -28,7 +28,7 @@ var redirectWithError = (res, redirectUri, error, description, state) => {
 	if (state !== void 0) url.searchParams.set("state", state);
 	res.setStatus(302);
 	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.end();
 };
 var redirectWithCode = (res, redirectUri, code, state) => {
@@ -37,7 +37,7 @@ var redirectWithCode = (res, redirectUri, code, state) => {
 	if (state !== void 0) url.searchParams.set("state", state);
 	res.setStatus(302);
 	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store");
+	res.setHeader("Cache-Control", "no-store, no-transform");
 	res.end();
 };
 //#endregion

package/dist/src/modules/oauth/records.d.ts

@@ -5,6 +5,8 @@ export type ClientRecord = {
     clientId: string;
     clientName: string;
     redirectUris: string[];
+    /** When this registration was first handed out, so re-registering the same client keeps reporting its real age. */
+    issuedAt: number;
 };
 /** The authorization request, parked while the user logs in. `challenge` binds the eventual code to the client
  *  that started the flow. */
@@ -52,6 +54,10 @@ export type AccessRecord = {
 };
 export declare const putClient: (store: OAuthStore, client: ClientRecord) => Promise<void>;
 export declare const getClient: (store: OAuthStore, clientId: string) => Promise<ClientRecord | undefined>;
+/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
+ *  so the same request always resolves to the same client — see handleRegister for why that matters. */
+export declare const getClientByFingerprint: (store: OAuthStore, fingerprint: string) => Promise<ClientRecord | undefined>;
+export declare const putClientFingerprint: (store: OAuthStore, fingerprint: string, clientId: string) => Promise<void>;
 export declare const putPending: (store: OAuthStore, id: string, pending: PendingRecord) => Promise<void>;
 export declare const getPending: (store: OAuthStore, id: string) => Promise<PendingRecord | undefined>;
 export declare const dropPending: (store: OAuthStore, id: string) => Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.14",
+  "version": "0.32.15",
   "license": "AGPL-3.0",
   "files": [
     "dist"
@@ -29,9 +29,9 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/plitzi-sdk": "0.32.14",
-    "@plitzi/sdk-schema": "0.32.14",
-    "@plitzi/sdk-shared": "0.32.14",
+    "@plitzi/plitzi-sdk": "0.32.15",
+    "@plitzi/sdk-schema": "0.32.15",
+    "@plitzi/sdk-shared": "0.32.15",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.1",
     "zod": "^4.4.3"