@plitzi/sdk-server 0.32.25 → 0.33.0

package/dist/modules/mcp/tools/shared/validator/interactions.js

@@ -1,103 +0,0 @@
-import { hiddenParams, invalidParams, missingRequiredParams, reconcileParams } from "../../../catalogs/paramSpec.js";
-import { getGlobalCallback } from "../../../catalogs/builtinCallbacks.js";
-import { getElementCallback } from "../../../catalogs/builtinElementCallbacks.js";
-import { getUtility } from "../../../catalogs/builtinUtilities.js";
-import { NULLISH_ELEMENT_IDS } from "../../../helpers/interactions.js";
-import { checkObservedName, warnOnce } from "./context.js";
-//#region src/modules/mcp/tools/shared/validator/interactions.ts
-var describeType = (type) => {
-	switch (type) {
-		case "boolean": return "a boolean";
-		case "number": return "a number";
-		case "select": return "one of its allowed values";
-		case "scalar": return "a string, number or boolean";
-		default: return "a string";
-	}
-};
-var checkParams = (label, action, params, spec, base, ctx) => {
-	const unknown = Object.keys(params).filter((key) => !(key in spec));
-	if (unknown.length > 0) warnOnce(ctx, `${label} "${action}" at ${base} got unknown param(s) ${unknown.map((k) => `"${k}"`).join(", ")} — these are dropped on apply. Valid params: ${Object.keys(spec).join(", ")}.`);
-	const effective = reconcileParams(params, spec, true);
-	const missing = missingRequiredParams(params, effective, spec);
-	if (missing.length > 0) warnOnce(ctx, `${label} "${action}" at ${base} is missing required param(s) ${missing.map((k) => `"${k}"`).join(", ")} — the step is malformed without them (see plitzi://interactions for what each does).`);
-	const hidden = hiddenParams(params, effective, spec);
-	if (hidden.length > 0) warnOnce(ctx, `${label} "${action}" at ${base}: param(s) ${hidden.map((k) => `"${k}"`).join(", ")} are ignored under the current params (they only apply when a companion param is set — see plitzi://interactions). Set the companion param or drop them.`);
-	for (const { key, expected, got, options } of invalidParams(params, effective, spec)) {
-		const detail = options ? ` Allowed values: ${options.join(", ")}.` : "";
-		ctx.errors.push({
-			path: `${base}.params.${key}`,
-			message: `${label} "${action}" at ${base}: param "${key}" must be ${describeType(expected)} but got ${got}.${detail}`,
-			hint: `Set "${key}" to ${describeType(expected)}.`,
-			...options ? { validValues: options } : {}
-		});
-	}
-};
-var checkGlobalCallback = (node, base, ctx) => {
-	const builtin = getGlobalCallback(node.action);
-	if (!builtin) {
-		if (getUtility(node.action)) warnOnce(ctx, `"${node.action}" at ${base} is a utility, not a global callback — use nodeType "utility".`);
-		else if (getElementCallback(node.action)) warnOnce(ctx, `"${node.action}" at ${base} is an element callback, not a global callback — use nodeType "callback" and set elementId to the element it acts on.`);
-		return;
-	}
-	if (node.elementId !== void 0 && node.elementId !== builtin.source) warnOnce(ctx, `Global callback "${node.action}" at ${base} is registered on "${builtin.source}", not on "${node.elementId}". Omit elementId (the MCP sets "${builtin.source}") or set it to "${builtin.source}".`);
-	if (node.params && builtin.strictParams) checkParams("Global callback", node.action, node.params, builtin.params, base, ctx);
-};
-var checkSetStateKey = (node, base, ctx, hostRef) => {
-	const key = node.params?.key;
-	if (typeof key !== "string" || key === "") return;
-	const targetRef = typeof node.elementId === "string" && node.elementId !== "" ? node.elementId : hostRef;
-	const type = ctx.elementType(targetRef);
-	const meta = type ? ctx.typeMeta.get(type) : void 0;
-	if (!meta) return;
-	const state = node.params?.category === "state";
-	const validKeys = state ? /* @__PURE__ */ new Set(["visibility", ...[...meta.styleSelectors].map((selector) => `styleSelectors.${selector}`)]) : meta.attributes;
-	if (validKeys.size === 0 || validKeys.has(key)) return;
-	const kind = state ? "state" : "attribute";
-	const valid = [...validKeys].sort();
-	const detail = `Element setState at ${base} sets ${kind} "${key}" on type "${type}", which has no such ${kind} key`;
-	if (!meta.custom) ctx.errors.push({
-		path: base,
-		message: detail,
-		hint: `Use one of: ${valid.join(", ")}`,
-		validValues: valid
-	});
-	else warnOnce(ctx, `${detail} (${valid.join(", ")}). It may still be valid — verify against plitzi://types.`);
-};
-var checkElementCallback = (node, base, ctx, hostRef) => {
-	const builtin = getElementCallback(node.action);
-	if (!builtin) {
-		if (getUtility(node.action)) warnOnce(ctx, `"${node.action}" at ${base} is a utility, not an element callback — use nodeType "utility".`);
-		else {
-			const global = getGlobalCallback(node.action);
-			if (global) warnOnce(ctx, `"${node.action}" at ${base} is a global callback (source "${global.source}"), not an element callback — use nodeType "globalCallback" and omit elementId.`);
-		}
-		return;
-	}
-	if (node.params && builtin.strictParams) checkParams("Element callback", node.action, node.params, builtin.params, base, ctx);
-	if (node.action === "setState") checkSetStateKey(node, base, ctx, hostRef);
-};
-var checkUtility = (node, base, ctx) => {
-	if (node.elementId && !NULLISH_ELEMENT_IDS.has(node.elementId)) warnOnce(ctx, `Utility "${node.action}" at ${base} has elementId "${node.elementId}" — a utility takes NO element (it is resolved by its action alone). Omit elementId; the MCP stores null. Pointing it at an element is a no-op.`);
-	const utility = getUtility(node.action);
-	if (!utility) {
-		if (getGlobalCallback(node.action)) warnOnce(ctx, `"${node.action}" at ${base} is a global callback, not a utility — use nodeType "globalCallback".`);
-		else if (getElementCallback(node.action)) warnOnce(ctx, `"${node.action}" at ${base} is an element callback, not a utility — use nodeType "callback".`);
-		return;
-	}
-	if (node.params && utility.strictParams) checkParams("Utility", node.action, node.params, utility.params, base, ctx);
-};
-var checkInteractionNode = (node, base, ctx, hostRef) => {
-	checkObservedName(node.action, ctx.observedActions, "Interaction action", "plitzi://interactions", `${base}.action`, ctx);
-	if (node.elementId === "undefined" || node.elementId === "null") warnOnce(ctx, `Node "${node.action}" at ${base} has the literal string elementId "${node.elementId}" — a stringified nullish value. Re-save the step: elementId must be a real element ref, a source module, or empty for a utility.`);
-	switch (node.nodeType) {
-		case "globalCallback":
-			checkGlobalCallback(node, base, ctx);
-			break;
-		case "callback":
-			checkElementCallback(node, base, ctx, hostRef);
-			break;
-		case "utility": checkUtility(node, base, ctx);
-	}
-};
-//#endregion
-export { checkInteractionNode };

package/dist/modules/mcp/tools/shared/validator/refs.js

@@ -1,28 +0,0 @@
-import { isValidIdRef } from "@plitzi/sdk-schema/helpers/idRef";
-//#region src/modules/mcp/tools/shared/validator/refs.ts
-var REF_RE = /^[a-zA-Z0-9._-]+$/;
-var checkRef = (ref, path, ctx) => {
-	if (!ref || ref.trim().length === 0) {
-		ctx.errors.push({
-			path,
-			message: "Ref must not be empty",
-			hint: "Use a semantic name like \"hero.title\""
-		});
-		return;
-	}
-	if (!REF_RE.test(ref)) ctx.errors.push({
-		path,
-		message: `Ref "${ref}" has invalid characters`,
-		hint: "Allowed characters: letters, numbers, dot, hyphen, underscore"
-	});
-};
-var checkIdRef = (ref, path, ctx) => {
-	checkRef(ref, path, ctx);
-	if (ref && REF_RE.test(ref) && !isValidIdRef(ref)) ctx.errors.push({
-		path,
-		message: `Ref "${ref}" is not a valid idRef`,
-		hint: "Use only letters, numbers, hyphens and underscores (e.g. \"hero-cta\" or \"my_list_card\"). This ref becomes the element idRef, which the runtime embeds in source names like `apiContainer_<idRef>.field` and in interaction targets — a dot would break those paths."
-	});
-};
-//#endregion
-export { REF_RE, checkIdRef, checkRef };

package/dist/modules/mcp/tools/validate.js

@@ -1,47 +0,0 @@
-import { cloneSpace } from "../helpers/space.js";
-import { environment, operations } from "./operations/index.js";
-import { applyOperations } from "./apply/dispatch.js";
-import { expandOperations } from "./shared/expandOperations.js";
-import { defineTool } from "./shared/tool.js";
-import { validateOperations } from "./shared/validator/index.js";
-import { auditResources } from "./shared/validator/audit.js";
-//#region src/modules/mcp/tools/validate.ts
-var validateShape = {
-	environment,
-	operations
-};
-var validate = (input, space) => {
-	const expansion = expandOperations(input.operations);
-	if (expansion.errors.length > 0) return {
-		valid: false,
-		errors: expansion.errors,
-		warnings: []
-	};
-	const ops = expansion.operations;
-	const validation = validateOperations(space, ops);
-	if (!validation.valid) return validation;
-	const env = input.environment ?? "main";
-	const draft = cloneSpace(space);
-	const outcome = applyOperations(draft, env, ops);
-	if (outcome.errors.length > 0) return {
-		valid: false,
-		errors: outcome.errors,
-		warnings: validation.warnings
-	};
-	const audit = auditResources(draft, ops);
-	return {
-		valid: audit.errors.length === 0,
-		errors: audit.errors,
-		warnings: [...validation.warnings, ...audit.warnings]
-	};
-};
-var validateTool = defineTool({
-	name: "plitzi_validate",
-	title: "Validate",
-	description: "Check a batch of operations without executing them. Returns teachable errors and warnings — including any PRE-EXISTING malformation in a resource the batch touches (which blocks a save until fixed).",
-	inputShape: validateShape,
-	access: "read",
-	run: (input, ctx) => validate(input, ctx.space)
-});
-//#endregion
-export { validate, validateShape, validateTool };

package/dist/modules/oauth/authorize.js

@@ -1,177 +0,0 @@
-import { renderConsentPage } from "./consentPage.js";
-import { AUTHORIZE_PATH } from "./metadata.js";
-import { field, optionalField } from "./params.js";
-import { randomId } from "./pkce.js";
-import { dropPending, getClient, getPending, putCode, putPending } from "./records.js";
-import { redirectWithCode, redirectWithError, sendErrorPage, sendHtml } from "./respond.js";
-//#region src/modules/oauth/authorize.ts
-var DEFAULT_CODE_TTL_SECONDS = 60;
-var DEFAULT_GUEST_LABEL = "Continue without an account";
-var DEFAULT_GUEST_USER = {
-	id: "guest",
-	label: "Guest"
-};
-var guestView = (guest) => ({
-	label: guest.label ?? DEFAULT_GUEST_LABEL,
-	description: guest.target.description
-});
-var hiddenFieldsFor = (request, pendingId) => {
-	const hidden = {
-		client_id: request.clientId,
-		redirect_uri: request.redirectUri,
-		code_challenge: request.challenge,
-		code_challenge_method: "S256"
-	};
-	if (request.state !== void 0) hidden["state"] = request.state;
-	if (request.scope !== void 0) hidden["scope"] = request.scope;
-	if (pendingId !== void 0) hidden["pending"] = pendingId;
-	return hidden;
-};
-var renderConsent = async (config, res, view) => {
-	const html = await (config.renderConsent ?? renderConsentPage)(view);
-	sendHtml(res, 200, html);
-};
-/** Validates the parts of an authorization request that decide WHERE a failure may be reported. Until the client
-*  and its redirect target check out, nothing may be sent back to the client. */
-var resolveRequest = async (config, res, params) => {
-	const clientId = field(params, "client_id");
-	const redirectUri = field(params, "redirect_uri");
-	const client = clientId ? await getClient(config.adapters.store, clientId) : void 0;
-	if (!client) {
-		sendErrorPage(res, "Unknown client", "This application is not registered with the server, or its registration expired.");
-		return;
-	}
-	if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
-		sendErrorPage(res, "Invalid redirect", "The application asked to be sent back to an address it did not register.");
-		return;
-	}
-	const state = optionalField(params, "state");
-	const responseType = field(params, "response_type");
-	if (responseType && responseType !== "code") {
-		redirectWithError(res, redirectUri, "unsupported_response_type", "Only the authorization code flow is supported.", state);
-		return;
-	}
-	const challenge = field(params, "code_challenge");
-	const method = field(params, "code_challenge_method");
-	if (!challenge || method !== "S256") {
-		redirectWithError(res, redirectUri, "invalid_request", "PKCE with code_challenge_method=S256 is required.", state);
-		return;
-	}
-	return {
-		clientId,
-		redirectUri,
-		challenge,
-		state,
-		scope: optionalField(params, "scope")
-	};
-};
-/** Consent granted: mint the bearer now, park it behind a one-shot code and send the browser back. Minting here
-*  rather than at redemption keeps a failure the user can act on — no space, revoked access — on this screen. */
-var completeGrant = async (config, res, request, user, target) => {
-	const issued = await config.adapters.issueToken(user, target);
-	if (!issued) {
-		redirectWithError(res, request.redirectUri, "access_denied", "The account may not grant access to this resource.", request.state);
-		return;
-	}
-	const code = randomId();
-	await putCode(config.adapters.store, code, {
-		clientId: request.clientId,
-		redirectUri: request.redirectUri,
-		challenge: request.challenge,
-		token: issued.token,
-		expiresInSeconds: issued.expiresInSeconds,
-		scope: request.scope,
-		user,
-		target
-	}, config.codeTtlSeconds ?? DEFAULT_CODE_TTL_SECONDS);
-	redirectWithCode(res, request.redirectUri, code, request.state);
-};
-/** GET /authorize — the entry point a host opens in the user's browser. */
-var handleAuthorizeStart = async (config, res, params) => {
-	const request = await resolveRequest(config, res, params);
-	if (!request) return;
-	await renderConsent(config, res, {
-		step: "credentials",
-		action: AUTHORIZE_PATH,
-		hidden: hiddenFieldsFor(request),
-		targets: [],
-		guest: config.guest ? guestView(config.guest) : void 0,
-		branding: config.branding ?? {}
-	});
-};
-/** POST /authorize — both steps of the form land here: the credentials submit, and the grant submit that carries
-*  the `pending` id proving the credentials step already passed. */
-var handleAuthorizeSubmit = async (config, res, params) => {
-	const request = await resolveRequest(config, res, params);
-	if (!request) return;
-	const pendingId = optionalField(params, "pending");
-	if (pendingId) {
-		const pending = await getPending(config.adapters.store, pendingId);
-		if (!pending || pending.clientId !== request.clientId) {
-			redirectWithError(res, request.redirectUri, "access_denied", "The sign-in expired. Try connecting again.", request.state);
-			return;
-		}
-		const targets = await config.adapters.grantTargets(pending.user);
-		const chosen = targets.find((target) => target.value === field(params, "target"));
-		if (!chosen) {
-			await renderConsent(config, res, {
-				step: "target",
-				action: AUTHORIZE_PATH,
-				hidden: hiddenFieldsFor(request, pendingId),
-				targets,
-				user: pending.user,
-				error: "Choose what to grant access to.",
-				branding: config.branding ?? {}
-			});
-			return;
-		}
-		await dropPending(config.adapters.store, pendingId);
-		await completeGrant(config, res, request, pending.user, chosen);
-		return;
-	}
-	const { guest } = config;
-	if (guest && optionalField(params, "guest")) {
-		await completeGrant(config, res, request, guest.user ?? DEFAULT_GUEST_USER, guest.target);
-		return;
-	}
-	const user = await config.adapters.authenticate({
-		username: field(params, "username"),
-		password: field(params, "password")
-	});
-	if (!user) {
-		await renderConsent(config, res, {
-			step: "credentials",
-			action: AUTHORIZE_PATH,
-			hidden: hiddenFieldsFor(request),
-			targets: [],
-			guest: guest ? guestView(guest) : void 0,
-			error: "Those credentials did not match an account.",
-			branding: config.branding ?? {}
-		});
-		return;
-	}
-	const targets = await config.adapters.grantTargets(user);
-	if (targets.length === 0) {
-		redirectWithError(res, request.redirectUri, "access_denied", "This account has nothing to grant access to.", request.state);
-		return;
-	}
-	const nextPendingId = randomId();
-	await putPending(config.adapters.store, nextPendingId, {
-		clientId: request.clientId,
-		redirectUri: request.redirectUri,
-		challenge: request.challenge,
-		state: request.state,
-		scope: request.scope,
-		user
-	});
-	await renderConsent(config, res, {
-		step: "target",
-		action: AUTHORIZE_PATH,
-		hidden: hiddenFieldsFor(request, nextPendingId),
-		targets,
-		user,
-		branding: config.branding ?? {}
-	});
-};
-//#endregion
-export { handleAuthorizeStart, handleAuthorizeSubmit };

package/dist/modules/oauth/challenge.js

@@ -1,33 +0,0 @@
-import { resourceMetadataUrl, scopesOf } from "./metadata.js";
-import { sendJson } from "./respond.js";
-//#region src/modules/oauth/challenge.ts
-/** The credential on an MCP request. `Authorization: Bearer` is what RFC 6750 defines and what a remote host
-*  sends; `x-access-token` is the platform's own header, which the builder and the CLI already use — a request
-*  carrying either presents a credential, and the same verification decides whether it is a good one. */
-var bearerOf = (req) => {
-	const header = req.headers["x-access-token"] ?? req.headers.authorization ?? "";
-	return (Array.isArray(header) ? header[0] ?? "" : header).replace(/^Bearer\s+/i, "").trim();
-};
-var parameter = (name, value) => `${name}="${value.replace(/"/gu, "")}"`;
-/** RFC 6750 §3 — the answer to an MCP request that presents no usable credential, and the only thing that starts
-*  an authorization flow: a host runs OAuth off a 401 whose `WWW-Authenticate` names the resource metadata, and
-*  IGNORES the header on a 200. Answering such a request with the anonymous surface instead is what leaves a
-*  connector unable to attach the grant it just completed — the flow succeeds and the host still reports that
-*  authorization failed. `scope` states what to ask for, so consent is not widened to everything advertised. */
-var sendChallenge = (config, req, res, description) => {
-	const params = [
-		parameter("error", "invalid_token"),
-		parameter("error_description", description),
-		parameter("resource_metadata", resourceMetadataUrl(config, req)),
-		parameter("scope", scopesOf(config).join(" "))
-	];
-	res.setHeader("WWW-Authenticate", `Bearer ${params.join(", ")}`);
-	res.setHeader("Access-Control-Allow-Origin", "*");
-	res.setHeader("Access-Control-Expose-Headers", "WWW-Authenticate");
-	sendJson(res, 401, {
-		error: "invalid_token",
-		error_description: description
-	});
-};
-//#endregion
-export { bearerOf, sendChallenge };

package/dist/modules/oauth/consentPage.js

@@ -1,118 +0,0 @@
-//#region src/modules/oauth/consentPage.ts
-var escapeHtml = (value) => value.replace(/[&<>"']/gu, (character) => {
-	switch (character) {
-		case "&": return "&amp;";
-		case "<": return "&lt;";
-		case ">": return "&gt;";
-		case "\"": return "&quot;";
-		default: return "&#39;";
-	}
-});
-var STYLES = `
-  :root { color-scheme: light dark; --bg: #f6f7f9; --panel: #ffffff; --ink: #16181d; --muted: #6b7280;
-    --line: #e2e5ea; --accent: #2563eb; --danger: #b91c1c; }
-  @media (prefers-color-scheme: dark) {
-    :root { --bg: #0f1115; --panel: #171a21; --ink: #e8eaee; --muted: #9aa1ad; --line: #262b35;
-      --accent: #60a5fa; --danger: #f87171; }
-  }
-  * { box-sizing: border-box; }
-  body { margin: 0; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 24px;
-    background: var(--bg); color: var(--ink);
-    font: 15px/1.5 ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif; }
-  main { width: 100%; max-width: 420px; background: var(--panel); border: 1px solid var(--line);
-    border-radius: 14px; padding: 32px; }
-  img.logo { display: block; height: 32px; margin-bottom: 20px; }
-  h1 { margin: 0 0 6px; font-size: 20px; font-weight: 600; }
-  p.lede { margin: 0 0 24px; color: var(--muted); font-size: 14px; }
-  label { display: block; margin-bottom: 6px; font-size: 13px; font-weight: 500; }
-  input[type="text"], input[type="password"] { width: 100%; margin-bottom: 16px; padding: 10px 12px;
-    border: 1px solid var(--line); border-radius: 8px; background: var(--bg); color: var(--ink); font: inherit; }
-  input:focus-visible, button:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }
-  ul.targets { list-style: none; margin: 0 0 20px; padding: 0; display: grid; gap: 8px; }
-  ul.targets label { display: flex; gap: 10px; align-items: flex-start; margin: 0; padding: 12px;
-    border: 1px solid var(--line); border-radius: 8px; font-weight: 400; cursor: pointer; }
-  ul.targets strong { display: block; font-weight: 500; }
-  ul.targets span { color: var(--muted); font-size: 13px; }
-  button { width: 100%; padding: 11px 16px; border: 0; border-radius: 8px; background: var(--accent);
-    color: #fff; font: inherit; font-weight: 500; cursor: pointer; }
-  button.guest { margin-top: 10px; background: transparent; color: var(--accent);
-    border: 1px solid var(--line); }
-  p.error { margin: 0 0 16px; padding: 10px 12px; border-radius: 8px; color: var(--danger);
-    border: 1px solid currentColor; font-size: 14px; }
-  p.note { margin: 10px 0 0; color: var(--muted); font-size: 13px; text-align: center; }
-`;
-var hiddenFields = (hidden) => Object.entries(hidden).map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("\n      ");
-var guestButton = (guest) => {
-	const note = guest.description ? `\n      <p class="note">${escapeHtml(guest.description)}</p>` : "";
-	return `\n      <button class="guest" type="submit" name="guest" value="1" formnovalidate>${escapeHtml(guest.label)}</button>${note}`;
-};
-var credentialsFields = (view) => `<label for="username">Email or username</label>
-      <input id="username" name="username" type="text" autocomplete="username" autocapitalize="none"
-        spellcheck="false" required autofocus>
-      <label for="password">Password</label>
-      <input id="password" name="password" type="password" autocomplete="current-password" required>
-      <button type="submit">Sign in</button>${view.guest ? guestButton(view.guest) : ""}`;
-var targetFields = (view) => {
-	return `<ul class="targets">
-        ${view.targets.map((target, index) => {
-		const description = target.description ? `<span>${escapeHtml(target.description)}</span>` : "";
-		return `<li><label>
-          <input type="radio" name="target" value="${escapeHtml(target.value)}"${index === 0 ? " checked" : ""}>
-          <span><strong>${escapeHtml(target.label)}</strong>${description}</span>
-        </label></li>`;
-	}).join("\n        ")}
-      </ul>
-      <button type="submit">Allow access</button>`;
-};
-/** The built-in consent screen: a credentials step, then a step to pick what the client gets access to. Replace it
-*  wholesale via `oauth.renderConsent` — the field names read back here are the contract, not the markup. */
-var renderConsentPage = (view) => {
-	const productName = view.branding.productName ?? "Plitzi";
-	const logo = view.branding.logoUrl ? `<img class="logo" src="${escapeHtml(view.branding.logoUrl)}" alt="${escapeHtml(productName)}">` : "";
-	const error = view.error ? `<p class="error">${escapeHtml(view.error)}</p>` : "";
-	const lede = view.step === "credentials" ? `Sign in to connect ${escapeHtml(productName)}.` : `Signed in as ${escapeHtml(view.user?.label ?? "")}. Choose what to grant access to.`;
-	return `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="robots" content="noindex">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtml(productName)}</title>
-  <style>${STYLES}${view.branding.css ?? ""}</style>
-</head>
-<body>
-  <main>
-    ${logo}
-    <h1>${escapeHtml(productName)}</h1>
-    <p class="lede">${lede}</p>
-    ${error}
-    <form method="post" action="${escapeHtml(view.action)}">
-      ${hiddenFields(view.hidden)}
-      ${view.step === "credentials" ? credentialsFields(view) : targetFields(view)}
-    </form>
-  </main>
-</body>
-</html>`;
-};
-/** The dead end for a request that cannot be redirected back — a bad `redirect_uri` or an unknown client. Bouncing
-*  those to the client would make this server an open redirector, so the user is told here instead. */
-var renderErrorPage = (title, detail) => `<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="robots" content="noindex">
-  <link rel="icon" href="data:,">
-  <title>${escapeHtml(title)}</title>
-  <style>${STYLES}</style>
-</head>
-<body>
-  <main>
-    <h1>${escapeHtml(title)}</h1>
-    <p class="lede">${escapeHtml(detail)}</p>
-  </main>
-</body>
-</html>`;
-//#endregion
-export { renderConsentPage, renderErrorPage };

package/dist/modules/oauth/metadata.js

@@ -1,69 +0,0 @@
-import { requestOrigin } from "../../core/requestParser.js";
-//#region src/modules/oauth/metadata.ts
-var AUTHORIZE_PATH = "/authorize";
-var TOKEN_PATH = "/token";
-var REGISTER_PATH = "/register";
-var PROTECTED_RESOURCE_PATH = "/.well-known/oauth-protected-resource";
-var AUTHORIZATION_SERVER_PATH = "/.well-known/oauth-authorization-server";
-var DEFAULT_SCOPES = ["plitzi"];
-/** The identifier the two documents agree on. This server is both the protected resource and its own
-*  authorization server, so one origin names both. Derived from the request unless pinned, which keeps a
-*  deployment correct across its dev, staging and production hosts without per-environment config. */
-var issuerOf = (config, req) => config.issuer ?? requestOrigin(req);
-var scopesOf = (config) => config.scopes ?? DEFAULT_SCOPES;
-var canonicalPath = (path) => path.replace(/\/+$/, "");
-/** Where the challenge points a host, for an MCP endpoint served at `req.path`. RFC 9728 §3.1 appends the
-*  resource's own path to the well-known path, and a host that reads the document back expects its `resource` to
-*  name the URL it was configured with — so a server mounted at /mcp must be pointed at the suffixed document,
-*  not the bare one. */
-var resourceMetadataUrl = (config, req) => `${issuerOf(config, req)}${PROTECTED_RESOURCE_PATH}${canonicalPath(req.path)}`;
-/** RFC 9728. The document Claude Desktop asks for FIRST, and the one whose absence ends the flow before anything
-*  else is tried — a 404 here is what a host reports as `mcp_auth_start_failed`.
-*
-*  `resource` echoes the path the document was asked for: Claude requires it to match the server URL the user
-*  typed, path included, and a dedicated MCP server answers JSON-RPC on every path — so `/.well-known/…/mcp`
-*  describes `https://host/mcp` while the bare path describes the origin.
-*
-*  A server mounted at the ORIGIN is `https://host/`, WITH the trailing slash: a host parses the URL the user
-*  typed before it does anything with it, and an empty path renders as `/` — Claude's connector was observed
-*  asking for exactly `resource=https%3A%2F%2Fhost%2F`, so that is the form the document must claim.
-*
-*  It does NOT make a bare-origin connector work, and nothing here can. Claude's remote-connector service will
-*  not open a session against an MCP endpoint whose URL has no path: the whole grant succeeds — discovery,
-*  registration, consent, a 200 from /token with the scope it asked for — and then it reports
-*  `McpAuthorizationError` ("the integration rejected the credentials it just issued") without ever presenting
-*  the bearer. Verified against the same deployment, minutes apart: at /mcp the token is followed by
-*  `initialize`, at / nothing follows it, in the ingress log as well as this server's. Claiming `https://host/mcp`
-*  from the bare document would only fail sooner — a client checks that the resource it is handed is no MORE
-*  specific than the URL it holds. Publish the connector URL WITH its path. */
-var protectedResourceMetadata = (config, req) => {
-	const issuer = issuerOf(config, req);
-	return {
-		resource: `${issuer}${canonicalPath(req.path.slice(37)) || "/"}`,
-		authorization_servers: [issuer],
-		scopes_supported: scopesOf(config),
-		bearer_methods_supported: ["header"]
-	};
-};
-/** RFC 8414. Public clients with PKCE only: a desktop host stores no secret, so `none` is the sole endpoint auth
-*  method and S256 the sole challenge method. `offline_access` is advertised whenever refresh grants are issued,
-*  which is the signal a host looks for before asking for one. */
-var authorizationServerMetadata = (config, req) => {
-	const issuer = issuerOf(config, req);
-	const refreshes = config.refreshTtlSeconds !== 0;
-	const grantTypes = refreshes ? ["authorization_code", "refresh_token"] : ["authorization_code"];
-	const scopes = refreshes ? [...scopesOf(config), "offline_access"] : scopesOf(config);
-	return {
-		issuer,
-		authorization_endpoint: `${issuer}${AUTHORIZE_PATH}`,
-		token_endpoint: `${issuer}${TOKEN_PATH}`,
-		registration_endpoint: `${issuer}${REGISTER_PATH}`,
-		response_types_supported: ["code"],
-		grant_types_supported: grantTypes,
-		code_challenge_methods_supported: ["S256"],
-		token_endpoint_auth_methods_supported: ["none"],
-		scopes_supported: scopes
-	};
-};
-//#endregion
-export { AUTHORIZATION_SERVER_PATH, AUTHORIZE_PATH, PROTECTED_RESOURCE_PATH, REGISTER_PATH, TOKEN_PATH, authorizationServerMetadata, issuerOf, protectedResourceMetadata, resourceMetadataUrl, scopesOf };

package/dist/modules/oauth/params.js

@@ -1,5 +0,0 @@
-//#region src/modules/oauth/params.ts
-var field = (params, name) => params[name] ?? "";
-var optionalField = (params, name) => params[name] || void 0;
-//#endregion
-export { field, optionalField };

package/dist/modules/oauth/pkce.js

@@ -1,15 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
-//#region src/modules/oauth/pkce.ts
-/** An unguessable, URL-safe identifier for the values this layer hands out (codes, refresh tokens, client ids).
-*  256 bits from the CSPRNG, so they are also unguessable by anyone who collects a few of them. */
-var randomId = () => randomBytes(32).toString("base64url");
-/** RFC 7636 S256, the only method this server accepts — `plain` puts the verifier on the wire, and a public
-*  client on a desktop host has no other proof it is the one that started the flow. */
-var verifyChallenge = (verifier, challenge) => {
-	if (!verifier || !challenge) return false;
-	const computed = Buffer.from(createHash("sha256").update(verifier).digest("base64url"));
-	const expected = Buffer.from(challenge);
-	return computed.length === expected.length && timingSafeEqual(computed, expected);
-};
-//#endregion
-export { randomId, verifyChallenge };

package/dist/modules/oauth/records.js

@@ -1,46 +0,0 @@
-//#region src/modules/oauth/records.ts
-var CLIENT_TTL_SECONDS = 7776e3;
-var PENDING_TTL_SECONDS = 600;
-var keyOf = (kind, id) => `oauth:${kind}:${id}`;
-var readJson = async (store, kind, id) => {
-	const raw = await store.get(keyOf(kind, id));
-	if (!raw) return;
-	try {
-		return JSON.parse(raw);
-	} catch {
-		return;
-	}
-};
-var writeJson = async (store, kind, id, value, ttlSeconds) => {
-	await store.put(keyOf(kind, id), JSON.stringify(value), ttlSeconds);
-};
-var putClient = (store, client) => writeJson(store, "client", client.clientId, client, CLIENT_TTL_SECONDS);
-var getClient = (store, clientId) => readJson(store, "client", clientId);
-/** The id already handed out for an identical registration. Keyed by what the client asked to be registered AS,
-*  so the same request always resolves to the same client — see handleRegister for why that matters. */
-var getClientByFingerprint = async (store, fingerprint) => {
-	const clientId = await store.get(keyOf("clientfp", fingerprint));
-	return clientId ? getClient(store, clientId) : void 0;
-};
-var putClientFingerprint = async (store, fingerprint, clientId) => {
-	await store.put(keyOf("clientfp", fingerprint), clientId, CLIENT_TTL_SECONDS);
-};
-var putPending = (store, id, pending) => writeJson(store, "pending", id, pending, PENDING_TTL_SECONDS);
-var getPending = (store, id) => readJson(store, "pending", id);
-var dropPending = async (store, id) => {
-	await store.drop(keyOf("pending", id));
-};
-var putCode = (store, code, record, ttlSeconds) => writeJson(store, "code", code, record, ttlSeconds);
-var getCode = (store, code) => readJson(store, "code", code);
-var dropCode = async (store, code) => {
-	await store.drop(keyOf("code", code));
-};
-var putRefresh = (store, token, record, ttlSeconds) => writeJson(store, "refresh", token, record, ttlSeconds);
-var getRefresh = (store, token) => readJson(store, "refresh", token);
-var dropRefresh = async (store, token) => {
-	await store.drop(keyOf("refresh", token));
-};
-var putAccess = (store, token, record, ttlSeconds) => writeJson(store, "access", token, record, ttlSeconds);
-var getAccess = (store, token) => readJson(store, "access", token);
-//#endregion
-export { dropCode, dropPending, dropRefresh, getAccess, getClient, getClientByFingerprint, getCode, getPending, getRefresh, putAccess, putClient, putClientFingerprint, putCode, putPending, putRefresh };