@plitzi/sdk-server 0.32.24 → 0.33.0

package/dist/core/auth/spaceTokens.js

@@ -0,0 +1,212 @@
+import { normalizeDomain } from "./domains.js";
+//#region src/core/auth/spaceTokens.ts
+var ROTATION_WARNING = "The previous token stopped working. Every site embedding it must be redeployed.";
+var DAY_SECONDS = 86400;
+var now = () => Math.floor(Date.now() / 1e3);
+var notFound = {
+	ok: false,
+	status: 404,
+	body: { error: "Token not found" }
+};
+/**
+* The lifecycle of a space's own credentials, over whatever stores them.
+*
+* Minting one is `tokens.generateSpaceToken`; everything around it is here, and it is all rule rather than storage:
+* a credential whose claims changed is a **different credential**, so every edit below re-mints and the previous one
+* stops working the instant it returns. Saying that once, in one place, is the point — a self-hoster who has to
+* rediscover it discovers it as a published site that went dark.
+*/
+var createSpaceTokenApi = ({ tokens, adapters }) => {
+	/** Never empty: a credential with no origins is one that works nowhere. */
+	const withFloor = (domains, defaults) => {
+		if (domains.includes("*")) return ["*"];
+		const merged = [.../* @__PURE__ */ new Set([...defaults, ...domains])];
+		return merged.length > 0 ? merged : ["*"];
+	};
+	const remint = async (record, context, changes = {}) => {
+		const origins = withFloor(changes.origins ?? record.origins, context.defaultDomains);
+		const expiresAt = changes.expiresAt === void 0 ? record.expiresAt : changes.expiresAt;
+		const token = tokens.generateSpaceToken(context.spaceId, origins, record.scope, { expiresAt });
+		await adapters.save(record.id, {
+			token,
+			origins,
+			expiresAt
+		});
+		return {
+			token,
+			origins,
+			expiresAt
+		};
+	};
+	return {
+		/**
+		* The space's public credential, rotated in place when it no longer verifies. Rotating on *outdated* and not only
+		* on expired is what this endpoint exists for: a site stranded on a credential from a previous token version would
+		* otherwise have no way back — nothing else can hand it a working one.
+		*/
+		async read(context) {
+			const record = await adapters.loadDefault(context.spaceId);
+			if (!record) return notFound;
+			if (!tokens.needsRotation(record.token)) return {
+				ok: true,
+				body: {
+					token: record.token,
+					domains: record.origins
+				}
+			};
+			const { token, origins } = await remint(record, context);
+			return {
+				ok: true,
+				body: {
+					token,
+					domains: origins
+				}
+			};
+		},
+		/**
+		* Replace the public credential with a fresh one, keeping everything it declared. This is the control that expiry
+		* is often mistaken for: a render credential is meant to outlive any deadline, so revoking a leaked one is an act,
+		* not a wait.
+		*/
+		async rotate(context) {
+			const record = await adapters.loadDefault(context.spaceId);
+			if (!record) return notFound;
+			const { token, origins } = await remint(record, context);
+			return {
+				ok: true,
+				body: {
+					token,
+					domains: origins,
+					warning: ROTATION_WARNING
+				}
+			};
+		},
+		async readDomains(context) {
+			const record = await adapters.loadDefault(context.spaceId);
+			return record ? {
+				ok: true,
+				body: { domains: record.origins }
+			} : notFound;
+		},
+		async setDomains(context, domains) {
+			if (!Array.isArray(domains) || domains.some((domain) => typeof domain !== "string")) return {
+				ok: false,
+				status: 400,
+				body: { error: "domains must be an array of strings" }
+			};
+			const normalized = [];
+			const rejected = [];
+			for (const domain of domains) {
+				const value = normalizeDomain(domain);
+				if (value) normalized.push(value);
+				else rejected.push(domain);
+			}
+			if (rejected.length > 0) return {
+				ok: false,
+				status: 400,
+				body: {
+					error: "Invalid domains",
+					domains: rejected
+				}
+			};
+			const record = await adapters.loadDefault(context.spaceId);
+			if (!record) return notFound;
+			const { token, origins } = await remint(record, context, { origins: normalized });
+			await adapters.onDomainsChanged?.(context.spaceId);
+			return {
+				ok: true,
+				body: {
+					token,
+					domains: origins,
+					...origins.includes("*") && { warning: "This token now works on any domain. Anyone who copies it from a page can use it elsewhere." }
+				}
+			};
+		},
+		async readExpiry(context) {
+			const record = await adapters.loadDefault(context.spaceId);
+			return record ? {
+				ok: true,
+				body: {
+					expiresAt: record.expiresAt,
+					neverExpires: record.expiresAt === null
+				}
+			} : notFound;
+		},
+		/**
+		* When the public credential should stop working — or never, which is the default. Both are legitimate: a site
+		* deployed once and left alone wants no deadline (an expiry there is a scheduled outage), while a campaign page
+		* meant to go quiet, or a credential handed to an agency for a fixed engagement, wants one.
+		*/
+		async setExpiry(context, expiresInDays) {
+			const forever = expiresInDays === null || expiresInDays === void 0;
+			if (!forever && (typeof expiresInDays !== "number" || !Number.isFinite(expiresInDays) || expiresInDays <= 0)) return {
+				ok: false,
+				status: 400,
+				body: { error: "expiresInDays must be a positive number, or null to never expire" }
+			};
+			const record = await adapters.loadDefault(context.spaceId);
+			if (!record) return notFound;
+			const expiry = forever ? null : now() + Math.round(expiresInDays * DAY_SECONDS);
+			const { token, expiresAt } = await remint(record, context, { expiresAt: expiry });
+			return {
+				ok: true,
+				body: {
+					token,
+					expiresAt,
+					neverExpires: expiresAt === null,
+					warning: ROTATION_WARNING
+				}
+			};
+		},
+		/**
+		* The space's credentials, so a leak can be seen and acted on. Never the secrets themselves: an `agent` grant
+		* writes, and listing it would turn permission to read into a way to obtain it. The public one is published by
+		* construction and has its own endpoint.
+		*/
+		async list(context) {
+			return {
+				ok: true,
+				body: { tokens: (await adapters.list(context.spaceId)).map(({ token, origins, ...rest }) => {
+					return {
+						...rest,
+						...rest.scope === "render" ? { domains: origins } : { label: origins.join(",") }
+					};
+				}) }
+			};
+		},
+		/**
+		* Revoke one credential. Dropping the record IS the revocation: every grant is looked up as it is verified, so it
+		* stops working at once whatever its claims still say.
+		*
+		* The public credential is deliberately not revocable this way — removing it leaves the published site with no
+		* credential at all, and replacing it is what a leak of that one calls for.
+		*/
+		async revoke(context, tokenId) {
+			if (!Number.isFinite(tokenId)) return {
+				ok: false,
+				status: 400,
+				body: { error: "tokenId must be a number" }
+			};
+			const record = await adapters.find(context.spaceId, tokenId);
+			if (!record) return notFound;
+			if (record.isDefault) return {
+				ok: false,
+				status: 400,
+				body: {
+					error: "The space’s public token cannot be deleted — rotate it instead",
+					rotate: `/spaces/${context.spaceId}/token/rotate`
+				}
+			};
+			await adapters.remove(record.id);
+			return {
+				ok: true,
+				body: {
+					message: "Token revoked",
+					tokenId
+				}
+			};
+		}
+	};
+};
+//#endregion
+export { createSpaceTokenApi };

package/dist/core/auth/tokens.d.ts

@@ -0,0 +1,151 @@
+import { Algorithm } from 'jsonwebtoken';
+/**
+ * Every credential this server mints is a JWT built from REGISTERED claims (RFC 7519) plus `scope` (RFC 6749). There
+ * are no bespoke `typ`/`data`/`version` claims: anyone who has read a JWT before can read one of these.
+ *
+ *   iss    which deployment minted it — the environment boundary
+ *   sub    who or what it is about: a user id, or a space id
+ *   aud    the API audiences it is meant for
+ *   scope  what it is and what it may do (below)
+ *   exp / iat / nbf / jti   lifetime and identity, as usual
+ *
+ * The one custom claim is `origins`, because JWT registers nothing for "the web origins this credential may be
+ * presented from" — it is what binds a public render token to its domains.
+ */
+export declare const SCOPES: {
+    readonly user: "user";
+    readonly refresh: "refresh";
+    readonly widget: "widget";
+    readonly spaceRender: "space:render";
+    readonly spaceAgent: "space:agent";
+};
+export type TokenScope = (typeof SCOPES)[keyof typeof SCOPES];
+export type SpaceScope = 'render' | 'agent';
+/** Why a credential was refused. A reason rather than a status, because each transport maps it onto its own. */
+export type AuthFailure = 'missing' | 'malformed' | 'expired' | 'outdated' | 'revoked' | 'wrong-type' | 'scope-mismatch' | 'issuer-not-allowed' | 'origin-not-allowed' | 'domain-not-allowed' | 'inactive';
+export declare const authFailureMessage: Record<AuthFailure, string>;
+/**
+ * How long each credential lives. One rule, applied by how much damage the credential can do and whether something
+ * can renew it:
+ *
+ * - The **public render token** is the only one that may live forever, and defaults to it: it is embedded in
+ *   published sites, where an expiry is a scheduled outage. A space may still give it a date.
+ * - **Everything else expires**, 30 days being the baseline.
+ * - **The most dangerous one is the shortest.** A session access token rides on every request and is the credential
+ *   an attacker most wants, so it lasts a day — which costs nobody anything, because the refresh token silently
+ *   renews it. That pairing is the whole reason it can be this short.
+ */
+export declare const DEFAULT_LIFETIMES: {
+    readonly access: 86400;
+    readonly refresh: number;
+    readonly agent: number;
+    readonly widget: number;
+};
+export type TokenLifetimes = Partial<typeof DEFAULT_LIFETIMES>;
+export type TokenConfig = {
+    secret: string;
+    /** What this deployment mints under. Also accepted on the way back in, along with `alsoAccept`. */
+    issuer: string;
+    /** Extra issuers to honour — a migration, or a sibling deployment whose credentials are meant to work here. */
+    alsoAccept?: string[];
+    /**
+     * The API audiences a credential is meant for. Defaults to the issuer, which is right for the common case of a
+     * deployment that is its own audience — and stops it being a required field that everyone fills in by copying
+     * `issuer` into it.
+     */
+    audience?: string[];
+    algorithms?: Algorithm[];
+    lifetimes?: TokenLifetimes;
+};
+interface BaseClaims {
+    iss: string;
+    aud: string[];
+    scope: TokenScope;
+    /** Absent on a credential that is revoked rather than expired — see `generateSpaceToken`. */
+    exp?: number;
+    iat: number;
+    nbf: number;
+    jti: string;
+}
+export interface UserTokenPayload extends BaseClaims {
+    scope: typeof SCOPES.user;
+    sub: string;
+}
+export interface RefreshTokenPayload extends BaseClaims {
+    scope: typeof SCOPES.refresh;
+    sub: string;
+}
+export interface SpaceTokenPayload extends BaseClaims {
+    scope: typeof SCOPES.spaceRender | typeof SCOPES.spaceAgent;
+    sub: string;
+    /** Web origins the space may be embedded on. No registered claim covers this. */
+    origins: string[];
+}
+/** The grant that deliberately reaches no space, so it carries no subject either. */
+export interface WidgetTokenPayload extends BaseClaims {
+    scope: typeof SCOPES.widget;
+}
+export type TokenPayload = UserTokenPayload | RefreshTokenPayload | SpaceTokenPayload | WidgetTokenPayload;
+export type VerifyResult<T> = {
+    ok: true;
+    payload: T;
+} | {
+    ok: false;
+    reason: AuthFailure;
+};
+export interface SpaceTokenOptions {
+    /**
+     * When the token should stop working, as a unix timestamp. `null`/omitted on a `render` token means never — the
+     * space's choice, not a rule. An `agent` grant always gets a lifetime; only the public token may forgo one.
+     */
+    expiresAt?: number | null;
+}
+/**
+ * The credential mint and its verifier, bound to one deployment's signing key and issuer.
+ *
+ * A factory rather than a module of functions because the configuration is the deployment's: its secret, the issuer
+ * that separates its universe of credentials from every other, and how long each kind lives. A customer running this
+ * server issues under their own and nothing they mint is worth anything here, or the other way round.
+ */
+export declare const createTokens: (config: TokenConfig) => {
+    lifetimes: {
+        access: 86400;
+        refresh: number;
+        agent: number;
+        widget: number;
+    };
+    generateUserToken: (userId: number | string) => string;
+    generateRefreshToken: (userId: number | string) => string;
+    generateWidgetToken: () => string;
+    /**
+     * A `render` token may live forever, and defaults to it, because it is embedded in a published site — often a
+     * SPA deployed once and left alone — where an expiry is a scheduled outage: the site breaks weeks later with
+     * nobody having touched anything. The deadline also buys little there, since the token is public by
+     * construction. What limits it is what it may do (read published content), where it may be presented (its
+     * declared domains), and the row behind it, which the owner can rotate or delete at any moment — revocation,
+     * not expiry, is the control.
+     *
+     * An `agent` grant is the opposite default and always carries a lifetime: it writes, and it is held by a
+     * third-party host.
+     */
+    generateSpaceToken: (spaceId: number | string, origins: string[], scope?: SpaceScope, { expiresAt }?: SpaceTokenOptions) => string;
+    verifyUserToken: (token: string) => VerifyResult<UserTokenPayload>;
+    verifyRefreshToken: (token: string) => VerifyResult<RefreshTokenPayload>;
+    verifyWidgetToken: (token: string) => VerifyResult<WidgetTokenPayload>;
+    verifySpaceToken: (token: string) => VerifyResult<SpaceTokenPayload & {
+        spaceId: number;
+        spaceScope: SpaceScope;
+    }>;
+    /**
+     * A token that no longer verifies for any reason the issuer can fix by re-minting — expiry, a pre-registered-
+     * claims shape, or an issuer from a deployment this one is not. Used by the endpoints that hand tokens back
+     * out, so a caller never has to know why.
+     */
+    needsRotation: (token: string) => boolean;
+    /** Undefined for a credential that never expires, which is what a host should read as "no renewal needed". */
+    expiresInSeconds: (token: string) => number | undefined;
+};
+export type Tokens = ReturnType<typeof createTokens>;
+/** The user id a session or refresh token is about. */
+export declare const userIdOf: (payload: UserTokenPayload | RefreshTokenPayload) => number;
+export {};

package/dist/core/auth/tokens.js

@@ -0,0 +1,221 @@
+import { randomBytes } from "node:crypto";
+import jwt from "jsonwebtoken";
+//#region src/core/auth/tokens.ts
+/**
+* Every credential this server mints is a JWT built from REGISTERED claims (RFC 7519) plus `scope` (RFC 6749). There
+* are no bespoke `typ`/`data`/`version` claims: anyone who has read a JWT before can read one of these.
+*
+*   iss    which deployment minted it — the environment boundary
+*   sub    who or what it is about: a user id, or a space id
+*   aud    the API audiences it is meant for
+*   scope  what it is and what it may do (below)
+*   exp / iat / nbf / jti   lifetime and identity, as usual
+*
+* The one custom claim is `origins`, because JWT registers nothing for "the web origins this credential may be
+* presented from" — it is what binds a public render token to its domains.
+*/
+var SCOPES = {
+	user: "user",
+	refresh: "refresh",
+	widget: "widget",
+	spaceRender: "space:render",
+	spaceAgent: "space:agent"
+};
+var authFailureMessage = {
+	missing: "Authentication required",
+	malformed: "Token Invalid",
+	expired: "Token expired",
+	outdated: "Token outdated",
+	revoked: "Token Invalid",
+	"wrong-type": "Token Invalid",
+	"scope-mismatch": "Token Invalid",
+	"issuer-not-allowed": "Token was issued by another environment",
+	"origin-not-allowed": "Access Not Authorized",
+	"domain-not-allowed": "This token is not allowed on this domain",
+	inactive: "Account is not active"
+};
+var DAY = 86400;
+/**
+* How long each credential lives. One rule, applied by how much damage the credential can do and whether something
+* can renew it:
+*
+* - The **public render token** is the only one that may live forever, and defaults to it: it is embedded in
+*   published sites, where an expiry is a scheduled outage. A space may still give it a date.
+* - **Everything else expires**, 30 days being the baseline.
+* - **The most dangerous one is the shortest.** A session access token rides on every request and is the credential
+*   an attacker most wants, so it lasts a day — which costs nobody anything, because the refresh token silently
+*   renews it. That pairing is the whole reason it can be this short.
+*/
+var DEFAULT_LIFETIMES = {
+	access: DAY,
+	refresh: 30 * DAY,
+	agent: 30 * DAY,
+	widget: 30 * DAY
+};
+var spaceScopeToClaim = {
+	render: SCOPES.spaceRender,
+	agent: SCOPES.spaceAgent
+};
+var claimToSpaceScope = {
+	[SCOPES.spaceRender]: "render",
+	[SCOPES.spaceAgent]: "agent"
+};
+var isLegacyShape = (payload) => "data" in payload || "version" in payload;
+var subjectId = (payload) => {
+	if (typeof payload.sub !== "string") return;
+	const id = Number(payload.sub);
+	return Number.isInteger(id) ? id : void 0;
+};
+/**
+* The credential mint and its verifier, bound to one deployment's signing key and issuer.
+*
+* A factory rather than a module of functions because the configuration is the deployment's: its secret, the issuer
+* that separates its universe of credentials from every other, and how long each kind lives. A customer running this
+* server issues under their own and nothing they mint is worth anything here, or the other way round.
+*/
+var createTokens = (config) => {
+	const lifetimes = {
+		...DEFAULT_LIFETIMES,
+		...config.lifetimes
+	};
+	const allowedIssuers = [config.issuer, ...config.alsoAccept ?? []];
+	const algorithms = config.algorithms ?? ["HS256"];
+	const baseClaims = (scope, ttlSeconds) => {
+		const now = Math.floor(Date.now() / 1e3);
+		return {
+			iss: config.issuer,
+			aud: config.audience ?? [config.issuer],
+			scope,
+			...ttlSeconds === void 0 ? {} : { exp: now + ttlSeconds },
+			iat: now,
+			jti: randomBytes(8).toString("hex"),
+			nbf: now
+		};
+	};
+	const sign = (payload) => jwt.sign(payload, config.secret, { algorithm: algorithms[0] });
+	const verify = (token) => {
+		if (!token) return {
+			ok: false,
+			reason: "missing"
+		};
+		let decoded;
+		try {
+			decoded = jwt.verify(token, config.secret, { algorithms });
+		} catch (e) {
+			return {
+				ok: false,
+				reason: e.name === "TokenExpiredError" ? "expired" : "malformed"
+			};
+		}
+		const payload = decoded;
+		if (isLegacyShape(payload)) return {
+			ok: false,
+			reason: "outdated"
+		};
+		if (typeof payload.scope !== "string") return {
+			ok: false,
+			reason: "malformed"
+		};
+		if (typeof payload.iss !== "string" || !allowedIssuers.includes(payload.iss)) return {
+			ok: false,
+			reason: "issuer-not-allowed"
+		};
+		return {
+			ok: true,
+			payload
+		};
+	};
+	const verifyScoped = (token, scopes) => {
+		const result = verify(token);
+		if (!result.ok) return result;
+		if (!scopes.includes(result.payload.scope)) return {
+			ok: false,
+			reason: "wrong-type"
+		};
+		return {
+			ok: true,
+			payload: result.payload
+		};
+	};
+	const withSubject = (result) => {
+		if (!result.ok) return result;
+		return subjectId(result.payload) === void 0 ? {
+			ok: false,
+			reason: "malformed"
+		} : result;
+	};
+	return {
+		lifetimes,
+		generateUserToken: (userId) => sign({
+			sub: String(userId),
+			...baseClaims(SCOPES.user, lifetimes.access)
+		}),
+		generateRefreshToken: (userId) => sign({
+			sub: String(userId),
+			...baseClaims(SCOPES.refresh, lifetimes.refresh)
+		}),
+		generateWidgetToken: () => sign(baseClaims(SCOPES.widget, lifetimes.widget)),
+		/**
+		* A `render` token may live forever, and defaults to it, because it is embedded in a published site — often a
+		* SPA deployed once and left alone — where an expiry is a scheduled outage: the site breaks weeks later with
+		* nobody having touched anything. The deadline also buys little there, since the token is public by
+		* construction. What limits it is what it may do (read published content), where it may be presented (its
+		* declared domains), and the row behind it, which the owner can rotate or delete at any moment — revocation,
+		* not expiry, is the control.
+		*
+		* An `agent` grant is the opposite default and always carries a lifetime: it writes, and it is held by a
+		* third-party host.
+		*/
+		generateSpaceToken: (spaceId, origins, scope = "render", { expiresAt } = {}) => {
+			const defaultTtl = scope === "agent" ? lifetimes.agent : void 0;
+			const ttlSeconds = expiresAt == null ? defaultTtl : Math.max(0, expiresAt - Math.floor(Date.now() / 1e3));
+			return sign({
+				sub: String(spaceId),
+				origins,
+				...baseClaims(spaceScopeToClaim[scope], ttlSeconds)
+			});
+		},
+		verifyUserToken: (token) => withSubject(verifyScoped(token, [SCOPES.user])),
+		verifyRefreshToken: (token) => withSubject(verifyScoped(token, [SCOPES.refresh])),
+		verifyWidgetToken: (token) => verifyScoped(token, [SCOPES.widget]),
+		verifySpaceToken: (token) => {
+			const result = withSubject(verifyScoped(token, [SCOPES.spaceRender, SCOPES.spaceAgent]));
+			if (!result.ok) return result;
+			const spaceId = subjectId(result.payload);
+			const spaceScope = claimToSpaceScope[result.payload.scope];
+			if (spaceId === void 0 || !spaceScope) return {
+				ok: false,
+				reason: "malformed"
+			};
+			const origins = result.payload.origins;
+			return {
+				ok: true,
+				payload: {
+					...result.payload,
+					origins: Array.isArray(origins) ? origins : [],
+					spaceId,
+					spaceScope
+				}
+			};
+		},
+		/**
+		* A token that no longer verifies for any reason the issuer can fix by re-minting — expiry, a pre-registered-
+		* claims shape, or an issuer from a deployment this one is not. Used by the endpoints that hand tokens back
+		* out, so a caller never has to know why.
+		*/
+		needsRotation: (token) => {
+			const result = verify(token);
+			return !result.ok && result.reason !== "malformed";
+		},
+		/** Undefined for a credential that never expires, which is what a host should read as "no renewal needed". */
+		expiresInSeconds: (token) => {
+			const result = verify(token);
+			if (!result.ok || result.payload.exp === void 0) return;
+			return Math.max(0, result.payload.exp - Math.floor(Date.now() / 1e3));
+		}
+	};
+};
+/** The user id a session or refresh token is about. */
+var userIdOf = (payload) => Number(payload.sub);
+//#endregion
+export { DEFAULT_LIFETIMES, SCOPES, authFailureMessage, createTokens, userIdOf };

package/dist/core/createServer.d.ts

@@ -0,0 +1,29 @@
+import { Auth } from './auth/createAuth';
+import { PipelineExtensions } from './http/types';
+import { SSRPageAdapters, SSRServer, SSRServerConfig } from '@plitzi/sdk-shared';
+export { resolveServices } from './services/resolve';
+export type { PipelineExtensions } from './http/types';
+export type { ResolvedServices } from './services/resolve';
+export type ServerConfig = Omit<SSRServerConfig, 'adapters'> & {
+    /** A page server resolves and renders a space on every request, so the two adapters that do it are required
+     *  here — see {@link SSRPageAdapters}. They are optional on the shared type because a server that renders no
+     *  page (a dedicated MCP one) has nothing to answer them with. */
+    adapters: SSRPageAdapters;
+    /**
+     * A `createAuth(...)` result, and the whole of wiring sessions into a page server: the three adapters it answers
+     * for get filled in, and the cookie naming comes with them.
+     *
+     * That last part is the reason this takes the object rather than leaving a deployment to spread `ssrAdapters`
+     * itself. The naming would then be declared twice — here and in `createAuth` — and the two halves would write and
+     * read a session under different names the first time one of them was edited alone. Anything set explicitly on
+     * `adapters` or `authCookie` still wins, so a deployment can override one piece without giving up the rest.
+     */
+    auth?: Auth;
+};
+/** The server this package makes: pages and RSC, mounting whatever the config enables, plus any stages a
+ *  companion package contributes through `extensions`. The MCP endpoint, the widget proxy and draft-preview
+ *  arrive that way from `@plitzi/sdk-mcp`, which a page-only deployment never installs.
+ *
+ *  A dedicated MCP server is `createServer` from `@plitzi/sdk-mcp` — it builds none of the render template,
+ *  caches or plugin manager this one does. */
+export declare const createServer: ({ auth, ...config }: ServerConfig, extensions?: PipelineExtensions) => SSRServer;

package/dist/core/createServer.js

@@ -1,19 +1,33 @@
-import { createMCPServer } from "./server/mcpServer.js";
+import { createAuthApiStage } from "./http/stages/authApi.js";
 import { resolveServices } from "./services/resolve.js";
-import { createPageServer, createSSRServer } from "./server/pageServer.js";
+import { createPageServer } from "./server/pageServer.js";
 //#region src/core/createServer.ts
-/** The general server: mounts whatever the config asks for — SSR, RSC and MCP together, if that is what it
-*  enables — and is what a deployment reaches for when it serves more than one surface from a single port (the
-*  package's own standalone harness does exactly that).
+/** The server this package makes: pages and RSC, mounting whatever the config enables, plus any stages a
+*  companion package contributes through `extensions`. The MCP endpoint, the widget proxy and draft-preview
+*  arrive that way from `@plitzi/sdk-mcp`, which a page-only deployment never installs.
 *
-*  Prefer the surface-specific factories whenever the surface IS known, so the process states what it serves by
-*  the name it calls: createSSRServer for pages + RSC, createMCPServer for a dedicated MCP server. An MCP-only
-*  config is handed to the latter here, since the lean pipeline builds none of the render template, caches or
-*  plugin manager a page server would carry unused. */
-var createServer = (config) => {
-	const services = resolveServices(config);
-	if (services.mcp && !services.ssr && !services.rsc && !services.ai) return createMCPServer(config);
-	return createPageServer(config, services);
+*  A dedicated MCP server is `createServer` from `@plitzi/sdk-mcp` — it builds none of the render template,
+*  caches or plugin manager this one does. */
+var createServer = ({ auth, ...config }, extensions) => {
+	if (!auth) return createPageServer(config, resolveServices(config), extensions);
+	const entries = Object.entries(config.adapters);
+	const supplied = Object.fromEntries(entries.filter(([, value]) => value !== void 0));
+	const resolved = {
+		loginPath: false,
+		logoutPath: false,
+		exchangePath: false,
+		...config,
+		authCookie: config.authCookie ?? auth.cookieConfig,
+		adapters: {
+			...auth.ssrAdapters,
+			...supplied
+		}
+	};
+	const withAuthRoutes = {
+		...extensions,
+		preAuth: [...extensions?.preAuth ?? [], createAuthApiStage(auth, auth.basePath)]
+	};
+	return createPageServer(resolved, resolveServices(resolved), withAuthRoutes);
 };
 //#endregion
-export { createMCPServer, createSSRServer, createServer, resolveServices };
+export { createServer, resolveServices };