@plitzi/sdk-server 0.32.24 → 0.33.0

package/dist/modules/oauth/authorize.js

@@ -1,177 +0,0 @@
-import { renderConsentPage } from "./consentPage.js";
-import { AUTHORIZE_PATH } from "./metadata.js";
-import { field, optionalField } from "./params.js";
-import { randomId } from "./pkce.js";
-import { dropPending, getClient, getPending, putCode, putPending } from "./records.js";
-import { redirectWithCode, redirectWithError, sendErrorPage, sendHtml } from "./respond.js";
-//#region src/modules/oauth/authorize.ts
-var DEFAULT_CODE_TTL_SECONDS = 60;
-var DEFAULT_GUEST_LABEL = "Continue without an account";
-var DEFAULT_GUEST_USER = {
-	id: "guest",
-	label: "Guest"
-};
-var guestView = (guest) => ({
-	label: guest.label ?? DEFAULT_GUEST_LABEL,
-	description: guest.target.description
-});
-var hiddenFieldsFor = (request, pendingId) => {
-	const hidden = {
-		client_id: request.clientId,
-		redirect_uri: request.redirectUri,
-		code_challenge: request.challenge,
-		code_challenge_method: "S256"
-	};
-	if (request.state !== void 0) hidden["state"] = request.state;
-	if (request.scope !== void 0) hidden["scope"] = request.scope;
-	if (pendingId !== void 0) hidden["pending"] = pendingId;
-	return hidden;
-};
-var renderConsent = async (config, res, view) => {
-	const html = await (config.renderConsent ?? renderConsentPage)(view);
-	sendHtml(res, 200, html);
-};
-/** Validates the parts of an authorization request that decide WHERE a failure may be reported. Until the client
-*  and its redirect target check out, nothing may be sent back to the client. */
-var resolveRequest = async (config, res, params) => {
-	const clientId = field(params, "client_id");
-	const redirectUri = field(params, "redirect_uri");
-	const client = clientId ? await getClient(config.adapters.store, clientId) : void 0;
-	if (!client) {
-		sendErrorPage(res, "Unknown client", "This application is not registered with the server, or its registration expired.");
-		return;
-	}
-	if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
-		sendErrorPage(res, "Invalid redirect", "The application asked to be sent back to an address it did not register.");
-		return;
-	}
-	const state = optionalField(params, "state");
-	const responseType = field(params, "response_type");
-	if (responseType && responseType !== "code") {
-		redirectWithError(res, redirectUri, "unsupported_response_type", "Only the authorization code flow is supported.", state);
-		return;
-	}
-	const challenge = field(params, "code_challenge");
-	const method = field(params, "code_challenge_method");
-	if (!challenge || method !== "S256") {
-		redirectWithError(res, redirectUri, "invalid_request", "PKCE with code_challenge_method=S256 is required.", state);
-		return;
-	}
-	return {
-		clientId,
-		redirectUri,
-		challenge,
-		state,
-		scope: optionalField(params, "scope")
-	};
-};
-/** Consent granted: mint the bearer now, park it behind a one-shot code and send the browser back. Minting here
-*  rather than at redemption keeps a failure the user can act on — no space, revoked access — on this screen. */
-var completeGrant = async (config, res, request, user, target) => {
-	const issued = await config.adapters.issueToken(user, target);
-	if (!issued) {
-		redirectWithError(res, request.redirectUri, "access_denied", "The account may not grant access to this resource.", request.state);
-		return;
-	}
-	const code = randomId();
-	await putCode(config.adapters.store, code, {
-		clientId: request.clientId,
-		redirectUri: request.redirectUri,
-		challenge: request.challenge,
-		token: issued.token,
-		expiresInSeconds: issued.expiresInSeconds,
-		scope: request.scope,
-		user,
-		target
-	}, config.codeTtlSeconds ?? DEFAULT_CODE_TTL_SECONDS);
-	redirectWithCode(res, request.redirectUri, code, request.state);
-};
-/** GET /authorize — the entry point a host opens in the user's browser. */
-var handleAuthorizeStart = async (config, res, params) => {
-	const request = await resolveRequest(config, res, params);
-	if (!request) return;
-	await renderConsent(config, res, {
-		step: "credentials",
-		action: AUTHORIZE_PATH,
-		hidden: hiddenFieldsFor(request),
-		targets: [],
-		guest: config.guest ? guestView(config.guest) : void 0,
-		branding: config.branding ?? {}
-	});
-};
-/** POST /authorize — both steps of the form land here: the credentials submit, and the grant submit that carries
-*  the `pending` id proving the credentials step already passed. */
-var handleAuthorizeSubmit = async (config, res, params) => {
-	const request = await resolveRequest(config, res, params);
-	if (!request) return;
-	const pendingId = optionalField(params, "pending");
-	if (pendingId) {
-		const pending = await getPending(config.adapters.store, pendingId);
-		if (!pending || pending.clientId !== request.clientId) {
-			redirectWithError(res, request.redirectUri, "access_denied", "The sign-in expired. Try connecting again.", request.state);
-			return;
-		}
-		const targets = await config.adapters.grantTargets(pending.user);
-		const chosen = targets.find((target) => target.value === field(params, "target"));
-		if (!chosen) {
-			await renderConsent(config, res, {
-				step: "target",
-				action: AUTHORIZE_PATH,
-				hidden: hiddenFieldsFor(request, pendingId),
-				targets,
-				user: pending.user,
-				error: "Choose what to grant access to.",
-				branding: config.branding ?? {}
-			});
-			return;
-		}
-		await dropPending(config.adapters.store, pendingId);
-		await completeGrant(config, res, request, pending.user, chosen);
-		return;
-	}
-	const { guest } = config;
-	if (guest && optionalField(params, "guest")) {
-		await completeGrant(config, res, request, guest.user ?? DEFAULT_GUEST_USER, guest.target);
-		return;
-	}
-	const user = await config.adapters.authenticate({
-		username: field(params, "username"),
-		password: field(params, "password")
-	});
-	if (!user) {
-		await renderConsent(config, res, {
-			step: "credentials",
-			action: AUTHORIZE_PATH,
-			hidden: hiddenFieldsFor(request),
-			targets: [],
-			guest: guest ? guestView(guest) : void 0,
-			error: "Those credentials did not match an account.",
-			branding: config.branding ?? {}
-		});
-		return;
-	}
-	const targets = await config.adapters.grantTargets(user);
-	if (targets.length === 0) {
-		redirectWithError(res, request.redirectUri, "access_denied", "This account has nothing to grant access to.", request.state);
-		return;
-	}
-	const nextPendingId = randomId();
-	await putPending(config.adapters.store, nextPendingId, {
-		clientId: request.clientId,
-		redirectUri: request.redirectUri,
-		challenge: request.challenge,
-		state: request.state,
-		scope: request.scope,
-		user
-	});
-	await renderConsent(config, res, {
-		step: "target",
-		action: AUTHORIZE_PATH,
-		hidden: hiddenFieldsFor(request, nextPendingId),
-		targets,
-		user,
-		branding: config.branding ?? {}
-	});
-};
-//#endregion
-export { handleAuthorizeStart, handleAuthorizeSubmit };

package/dist/modules/oauth/challenge.js

@@ -1,33 +0,0 @@
-import { resourceMetadataUrl, scopesOf } from "./metadata.js";
-import { sendJson } from "./respond.js";
-//#region src/modules/oauth/challenge.ts
-/** The credential on an MCP request. `Authorization: Bearer` is what RFC 6750 defines and what a remote host
-*  sends; `x-access-token` is the platform's own header, which the builder and the CLI already use — a request
-*  carrying either presents a credential, and the same verification decides whether it is a good one. */
-var bearerOf = (req) => {
-	const header = req.headers["x-access-token"] ?? req.headers.authorization ?? "";
-	return (Array.isArray(header) ? header[0] ?? "" : header).replace(/^Bearer\s+/i, "").trim();
-};
-var parameter = (name, value) => `${name}="${value.replace(/"/gu, "")}"`;
-/** RFC 6750 §3 — the answer to an MCP request that presents no usable credential, and the only thing that starts
-*  an authorization flow: a host runs OAuth off a 401 whose `WWW-Authenticate` names the resource metadata, and
-*  IGNORES the header on a 200. Answering such a request with the anonymous surface instead is what leaves a
-*  connector unable to attach the grant it just completed — the flow succeeds and the host still reports that
-*  authorization failed. `scope` states what to ask for, so consent is not widened to everything advertised. */
-var sendChallenge = (config, req, res, description) => {
-	const params = [
-		parameter("error", "invalid_token"),
-		parameter("error_description", description),
-		parameter("resource_metadata", resourceMetadataUrl(config, req)),
-		parameter("scope", scopesOf(config).join(" "))
-	];
-	res.setHeader("WWW-Authenticate", `Bearer ${params.join(", ")}`);
-	res.setHeader("Access-Control-Allow-Origin", "*");
-	res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
-	sendJson(res, 401, {
-		error: "invalid_token",
-		error_description: description
-	});
-};
-//#endregion
-export { bearerOf, sendChallenge };

package/dist/modules/oauth/consentPage.js

@@ -1,118 +0,0 @@
-//#region src/modules/oauth/consentPage.ts
-var escapeHtml = (value) => value.replace(/[&<>"']/gu, (character) => {
-	switch (character) {
-		case "&": return "&amp;";
-		case "<": return "&lt;";
-		case ">": return "&gt;";
-		case "\"": return "&quot;";
-		default: return "&#39;";
-	}
-});
-var STYLES = `
-  :root { color-scheme: light dark; --bg: #f6f7f9; --panel: #ffffff; --ink: #16181d; --muted: #6b7280;
-    --line: #e2e5ea; --accent: #2563eb; --danger: #b91c1c; }
-  @media (prefers-color-scheme: dark) {
-    :root { --bg: #0f1115; --panel: #171a21; --ink: #e8eaee; --muted: #9aa1ad; --line: #262b35;
-      --accent: #60a5fa; --danger: #f87171; }
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px;
-    background: var(--bg); color: var(--ink);
-    font: 15px/1.5 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-  main { width: 100%; max-width: 420px; background: var(--panel); border: 1px solid var(--line);
-    border-radius: 14px; padding: 32px; }
-  img.logo { display: block; height: 32px; margin-bottom: 20px; }
-  h1 { margin: 0 0 6px; font-size: 20px; font-weight: 600; }
-  p.lede { margin: 0 0 24px; color: var(--muted); font-size: 14px; }
-  label { display: block; margin-bottom: 6px; font-size: 13px; font-weight: 500; }
-  input[type="text"], input[type="password"] { width: 100%; margin-bottom: 16px; padding: 10px 12px;
-    border: 1px solid var(--line); border-radius: 8px; background: var(--bg); color: var(--ink); font: inherit; }
-  input:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
-  ul.targets { list-style: none; margin: 0 0 20px; padding: 0; display: grid; gap: 8px; }
-  ul.targets label { display: flex; gap: 10px; align-items: flex-start; margin: 0; padding: 12px;
-    border: 1px solid var(--line); border-radius: 8px; font-weight: 400; cursor: pointer; }
-  ul.targets strong { display: block; font-weight: 500; }
-  ul.targets span { color: var(--muted); font-size: 13px; }
-  button { width: 100%; padding: 11px 16px; border: 0; border-radius: 8px; background: var(--accent);
-    color: #fff; font: inherit; font-weight: 500; cursor: pointer; }
-  button.guest { margin-top: 10px; background: transparent; color: var(--accent);
-    border: 1px solid var(--line); }
-  p.error { margin: 0 0 16px; padding: 10px 12px; border-radius: 8px; color: var(--danger);
-    border: 1px solid currentColor; font-size: 14px; }
-  p.note { margin: 10px 0 0; color: var(--muted); font-size: 13px; text-align: center; }
-`;
-var hiddenFields = (hidden) => Object.entries(hidden).map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n      ");
-var guestButton = (guest) => {
-	const note = guest.description ? `\n      <p class="note">${escapeHtml(guest.description)}</p>` : "";
-	return `\n      <button class="guest" type="submit" name="guest" value="1" formnovalidate>${escapeHtml(guest.label)}</button>${note}`;
-};
-var credentialsFields = (view) => `<label for="username">Email or username</label>
-      <input id="username" name="username" type="text" autocomplete="username" autocapitalize="none"
-        spellcheck="false" required autofocus>
-      <label for="password">Password</label>
-      <input id="password" name="password" type="password" autocomplete="current-password" required>
-      <button type="submit">Sign in</button>${view.guest ? guestButton(view.guest) : ""}`;
-var targetFields = (view) => {
-	return `<ul class="targets">
-        ${view.targets.map((target, index) => {
-		const description = target.description ? `<span>${escapeHtml(target.description)}</span>` : "";
-		return `<li><label>
-          <input type="radio" name="target" value="${escapeHtml(target.value)}"${index === 0 ? " checked" : ""}>
-          <span><strong>${escapeHtml(target.label)}</strong>${description}</span>
-        </label></li>`;
-	}).join("\n        ")}
-      </ul>
-      <button type="submit">Allow access</button>`;
-};
-/** The built-in consent screen: a credentials step, then a step to pick what the client gets access to. Replace it
-*  wholesale via `oauth.renderConsent` — the field names read back here are the contract, not the markup. */
-var renderConsentPage = (view) => {
-	const productName = view.branding.productName ?? "Plitzi";
-	const logo = view.branding.logoUrl ? `<img class="logo" src="${escapeHtml(view.branding.logoUrl)}" alt="${escapeHtml(productName)}">` : "";
-	const error = view.error ? `<p class="error">${escapeHtml(view.error)}</p>` : "";
-	const lede = view.step === "credentials" ? `Sign in to connect ${escapeHtml(productName)}.` : `Signed in as ${escapeHtml(view.user?.label ?? "")}. Choose what to grant access to.`;
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="robots" content="noindex">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtml(productName)}</title>
-  <style>${STYLES}${view.branding.css ?? ""}</style>
-</head>
-<body>
-  <main>
-    ${logo}
-    <h1>${escapeHtml(productName)}</h1>
-    <p class="lede">${lede}</p>
-    ${error}
-    <form method="post" action="${escapeHtml(view.action)}">
-      ${hiddenFields(view.hidden)}
-      ${view.step === "credentials" ? credentialsFields(view) : targetFields(view)}
-    </form>
-  </main>
-</body>
-</html>`;
-};
-/** The dead end for a request that cannot be redirected back — a bad `redirect_uri` or an unknown client. Bouncing
-*  those to the client would make this server an open redirector, so the user is told here instead. */
-var renderErrorPage = (title, detail) => `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="robots" content="noindex">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtml(title)}</title>
-  <style>${STYLES}</style>
-</head>
-<body>
-  <main>
-    <h1>${escapeHtml(title)}</h1>
-    <p class="lede">${escapeHtml(detail)}</p>
-  </main>
-</body>
-</html>`;
-//#endregion
-export { renderConsentPage, renderErrorPage };

package/dist/modules/oauth/metadata.js

@@ -1,69 +0,0 @@
-import { requestOrigin } from "../../core/requestParser.js";
-//#region src/modules/oauth/metadata.ts
-var AUTHORIZE_PATH = "/authorize";
-var TOKEN_PATH = "/token";
-var REGISTER_PATH = "/register";
-var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
-var AUTHORIZATION_SERVER_PATH = "/.well-known/oauth-authorization-server";
-var DEFAULT_SCOPES = ["plitzi"];
-/** The identifier the two documents agree on. This server is both the protected resource and its own
-*  authorization server, so one origin names both. Derived from the request unless pinned, which keeps a
-*  deployment correct across its dev, staging and production hosts without per-environment config. */
-var issuerOf = (config, req) => config.issuer ?? requestOrigin(req);
-var scopesOf = (config) => config.scopes ?? DEFAULT_SCOPES;
-var canonicalPath = (path) => path.replace(/\/+$/, "");
-/** Where the challenge points a host, for an MCP endpoint served at `req.path`. RFC 9728 §3.1 appends the
-*  resource's own path to the well-known path, and a host that reads the document back expects its `resource` to
-*  name the URL it was configured with — so a server mounted at /mcp must be pointed at the suffixed document,
-*  not the bare one. */
-var resourceMetadataUrl = (config, req) => `${issuerOf(config, req)}${PROTECTED_RESOURCE_PATH}${canonicalPath(req.path)}`;
-/** RFC 9728. The document Claude Desktop asks for FIRST, and the one whose absence ends the flow before anything
-*  else is tried — a 404 here is what a host reports as `mcp_auth_start_failed`.
-*
-*  `resource` echoes the path the document was asked for: Claude requires it to match the server URL the user
-*  typed, path included, and a dedicated MCP server answers JSON-RPC on every path — so `/.well-known/…/mcp`
-*  describes `https://host/mcp` while the bare path describes the origin.
-*
-*  A server mounted at the ORIGIN is `https://host/`, WITH the trailing slash: a host parses the URL the user
-*  typed before it does anything with it, and an empty path renders as `/` — Claude's connector was observed
-*  asking for exactly `resource=https%3A%2F%2Fhost%2F`, so that is the form the document must claim.
-*
-*  It does NOT make a bare-origin connector work, and nothing here can. Claude's remote-connector service will
-*  not open a session against an MCP endpoint whose URL has no path: the whole grant succeeds — discovery,
-*  registration, consent, a 200 from /token with the scope it asked for — and then it reports
-*  `McpAuthorizationError` ("the integration rejected the credentials it just issued") without ever presenting
-*  the bearer. Verified against the same deployment, minutes apart: at /mcp the token is followed by
-*  `initialize`, at / nothing follows it, in the ingress log as well as this server's. Claiming `https://host/mcp`
-*  from the bare document would only fail sooner — a client checks that the resource it is handed is no MORE
-*  specific than the URL it holds. Publish the connector URL WITH its path. */
-var protectedResourceMetadata = (config, req) => {
-	const issuer = issuerOf(config, req);
-	return {
-		resource: `${issuer}${canonicalPath(req.path.slice(37)) || "/"}`,
-		authorization_servers: [issuer],
-		scopes_supported: scopesOf(config),
-		bearer_methods_supported: ["header"]
-	};
-};
-/** RFC 8414. Public clients with PKCE only: a desktop host stores no secret, so `none` is the sole endpoint auth
-*  method and S256 the sole challenge method. `offline_access` is advertised whenever refresh grants are issued,
-*  which is the signal a host looks for before asking for one. */
-var authorizationServerMetadata = (config, req) => {
-	const issuer = issuerOf(config, req);
-	const refreshes = config.refreshTtlSeconds !== 0;
-	const grantTypes = refreshes ? ["authorization_code", "refresh_token"] : ["authorization_code"];
-	const scopes = refreshes ? [...scopesOf(config), "offline_access"] : scopesOf(config);
-	return {
-		issuer,
-		authorization_endpoint: `${issuer}${AUTHORIZE_PATH}`,
-		token_endpoint: `${issuer}${TOKEN_PATH}`,
-		registration_endpoint: `${issuer}${REGISTER_PATH}`,
-		response_types_supported: ["code"],
-		grant_types_supported: grantTypes,
-		code_challenge_methods_supported: ["S256"],
-		token_endpoint_auth_methods_supported: ["none"],
-		scopes_supported: scopes
-	};
-};
-//#endregion
-export { AUTHORIZATION_SERVER_PATH, AUTHORIZE_PATH, PROTECTED_RESOURCE_PATH, REGISTER_PATH, TOKEN_PATH, authorizationServerMetadata, issuerOf, protectedResourceMetadata, resourceMetadataUrl, scopesOf };

package/dist/modules/oauth/params.js

@@ -1,5 +0,0 @@
-//#region src/modules/oauth/params.ts
-var field = (params, name) => params[name] ?? "";
-var optionalField = (params, name) => params[name] || void 0;
-//#endregion
-export { field, optionalField };

package/dist/modules/oauth/pkce.js

@@ -1,15 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-//#region src/modules/oauth/pkce.ts
-/** An unguessable, URL-safe identifier for the values this layer hands out (codes, refresh tokens, client ids).
-*  256 bits from the CSPRNG, so they are also unguessable by anyone who collects a few of them. */
-var randomId = () => randomBytes(32).toString("base64url");
-/** RFC 7636 S256, the only method this server accepts — `plain` puts the verifier on the wire, and a public
-*  client on a desktop host has no other proof it is the one that started the flow. */
-var verifyChallenge = (verifier, challenge) => {
-	if (!verifier || !challenge) return false;
-	const computed = Buffer.from(createHash("sha256").update(verifier).digest("base64url"));
-	const expected = Buffer.from(challenge);
-	return computed.length === expected.length && timingSafeEqual(computed, expected);
-};
-//#endregion
-export { randomId, verifyChallenge };

package/dist/modules/oauth/records.js

@@ -1,46 +0,0 @@
-//#region src/modules/oauth/records.ts
-var CLIENT_TTL_SECONDS = 7776e3;
-var PENDING_TTL_SECONDS = 600;
-var keyOf = (kind, id) => `oauth:${kind}:${id}`;
-var readJson = async (store, kind, id) => {
-	const raw = await store.get(keyOf(kind, id));
-	if (!raw) return;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return;
-	}
-};
-var writeJson = async (store, kind, id, value, ttlSeconds) => {
-	await store.put(keyOf(kind, id), JSON.stringify(value), ttlSeconds);
-};
-var putClient = (store, client) => writeJson(store, "client", client.clientId, client, CLIENT_TTL_SECONDS);
-var getClient = (store, clientId) => readJson(store, "client", clientId);
-/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
-*  so the same request always resolves to the same client — see handleRegister for why that matters. */
-var getClientByFingerprint = async (store, fingerprint) => {
-	const clientId = await store.get(keyOf("clientfp", fingerprint));
-	return clientId ? getClient(store, clientId) : void 0;
-};
-var putClientFingerprint = async (store, fingerprint, clientId) => {
-	await store.put(keyOf("clientfp", fingerprint), clientId, CLIENT_TTL_SECONDS);
-};
-var putPending = (store, id, pending) => writeJson(store, "pending", id, pending, PENDING_TTL_SECONDS);
-var getPending = (store, id) => readJson(store, "pending", id);
-var dropPending = async (store, id) => {
-	await store.drop(keyOf("pending", id));
-};
-var putCode = (store, code, record, ttlSeconds) => writeJson(store, "code", code, record, ttlSeconds);
-var getCode = (store, code) => readJson(store, "code", code);
-var dropCode = async (store, code) => {
-	await store.drop(keyOf("code", code));
-};
-var putRefresh = (store, token, record, ttlSeconds) => writeJson(store, "refresh", token, record, ttlSeconds);
-var getRefresh = (store, token) => readJson(store, "refresh", token);
-var dropRefresh = async (store, token) => {
-	await store.drop(keyOf("refresh", token));
-};
-var putAccess = (store, token, record, ttlSeconds) => writeJson(store, "access", token, record, ttlSeconds);
-var getAccess = (store, token) => readJson(store, "access", token);
-//#endregion
-export { dropCode, dropPending, dropRefresh, getAccess, getClient, getClientByFingerprint, getCode, getPending, getRefresh, putAccess, putClient, putClientFingerprint, putCode, putPending, putRefresh };

package/dist/modules/oauth/register.js

@@ -1,55 +0,0 @@
-import { randomId } from "./pkce.js";
-import { getClientByFingerprint, putClient, putClientFingerprint } from "./records.js";
-import { sendErrorJson, sendJson } from "./respond.js";
-import { createHash } from "node:crypto";
-//#region src/modules/oauth/register.ts
-var isUsableRedirectUri = (value) => {
-	let url;
-	try {
-		url = new URL(value);
-	} catch {
-		return false;
-	}
-	if (url.protocol === "https:") return true;
-	return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1");
-};
-var stringList = (value) => Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
-var nowSeconds = () => Math.floor(Date.now() / 1e3);
-var fingerprintOf = (clientName, redirectUris) => createHash("sha256").update(JSON.stringify([clientName, [...redirectUris].sort()])).digest("base64url");
-/** RFC 7591 dynamic client registration. A remote host has no way to be configured into this server ahead of
-*  time, so it registers itself on first connect; the record it gets back is only ever used to pin the redirect
-*  target, since a public client authenticates with PKCE rather than with credentials. */
-var handleRegister = async (config, res, body) => {
-	if (typeof body !== "object" || body === null) {
-		sendErrorJson(res, 400, "invalid_request", "Expected a JSON client metadata object.");
-		return;
-	}
-	const metadata = body;
-	const redirectUris = stringList(metadata["redirect_uris"]).filter(isUsableRedirectUri);
-	if (redirectUris.length === 0) {
-		sendErrorJson(res, 400, "invalid_request", "redirect_uris must list at least one https (or loopback) URI.");
-		return;
-	}
-	const clientName = typeof metadata["client_name"] === "string" ? metadata["client_name"] : "MCP client";
-	const { store } = config.adapters;
-	const fingerprint = fingerprintOf(clientName, redirectUris);
-	const client = await getClientByFingerprint(store, fingerprint) ?? {
-		clientId: randomId(),
-		clientName,
-		redirectUris,
-		issuedAt: nowSeconds()
-	};
-	await putClient(store, client);
-	await putClientFingerprint(store, fingerprint, client.clientId);
-	sendJson(res, 201, {
-		client_id: client.clientId,
-		client_id_issued_at: client.issuedAt,
-		client_name: clientName,
-		redirect_uris: redirectUris,
-		grant_types: config.refreshTtlSeconds === 0 ? ["authorization_code"] : ["authorization_code", "refresh_token"],
-		response_types: ["code"],
-		token_endpoint_auth_method: "none"
-	});
-};
-//#endregion
-export { handleRegister };

package/dist/modules/oauth/respond.js

@@ -1,44 +0,0 @@
-import { renderErrorPage } from "./consentPage.js";
-//#region src/modules/oauth/respond.ts
-var sendJson = (res, status, body) => {
-	res.setStatus(status);
-	res.setHeader("Content-Type", "application/json");
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.send(JSON.stringify(body));
-};
-var sendHtml = (res, status, html) => {
-	res.setStatus(status);
-	res.setHeader("Content-Type", "text/html; charset=utf-8");
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.send(html);
-};
-var sendErrorJson = (res, status, error, description) => sendJson(res, status, {
-	error,
-	error_description: description
-});
-/** Shown when the authorization request itself is unusable — an unknown client, a `redirect_uri` that is not
-*  registered. Redirecting those back would turn the endpoint into an open redirector. */
-var sendErrorPage = (res, title, detail) => sendHtml(res, 400, renderErrorPage(title, detail));
-/** The other half of RFC 6749 error handling: once the redirect target is known to be legitimate, failures go
-*  back to the client so the host can report them, carrying `state` so it can match the response to its request. */
-var redirectWithError = (res, redirectUri, error, description, state) => {
-	const url = new URL(redirectUri);
-	url.searchParams.set("error", error);
-	url.searchParams.set("error_description", description);
-	if (state !== void 0) url.searchParams.set("state", state);
-	res.setStatus(302);
-	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.end();
-};
-var redirectWithCode = (res, redirectUri, code, state) => {
-	const url = new URL(redirectUri);
-	url.searchParams.set("code", code);
-	if (state !== void 0) url.searchParams.set("state", state);
-	res.setStatus(302);
-	res.setHeader("Location", url.toString());
-	res.setHeader("Cache-Control", "no-store, no-transform");
-	res.end();
-};
-//#endregion
-export { redirectWithCode, redirectWithError, sendErrorJson, sendErrorPage, sendHtml, sendJson };