@plitzi/sdk-server 0.32.25 → 0.33.1

package/dist/modules/ssr/prepareRender.js

@@ -1,27 +1,43 @@
+import { buildOfflineDataCacheKey } from "../../helpers/cache/keys.js";
 import { loadPluginComponents } from "./loadPluginComponents.js";
+import { createOfflineDataLoader } from "../../helpers/offlineDataLoader.js";
 import { registerExternalPlugins } from "./registerExternalPlugins.js";
+import { sdkAssetVersion } from "../../core/sdkAssets.js";
 import { buildServerInfo } from "../../helpers/buildServerInfo.js";
-import { buildOfflineDataCacheKey } from "../../helpers/cache/keys.js";
 import { escapeJson } from "../../helpers/escapeJson.js";
 import { readCookie } from "../../helpers/readCookie.js";
+import { resolveDebugMode } from "../../helpers/resolveDebugMode.js";
 //#region src/modules/ssr/prepareRender.tsx
 var prepareRender = async (req, config, spaceId, environment, revision, pluginManager, offlineDataCache, metrics, offlineDataOverride) => {
 	const m = (name, fn) => metrics ? metrics.measure(name, fn) : Promise.resolve(fn());
 	const offlineCacheKey = environment !== "main" ? buildOfflineDataCacheKey(spaceId, environment, revision) : void 0;
 	const cachedOfflineStr = offlineDataOverride === void 0 && offlineCacheKey ? offlineDataCache?.get(offlineCacheKey) : void 0;
-	const [offlineData, server] = await Promise.all([offlineDataOverride !== void 0 ? Promise.resolve(offlineDataOverride) : cachedOfflineStr ? JSON.parse(cachedOfflineStr) : m("schema", () => config.adapters.getOfflineData(spaceId, environment, revision)), m("rsc", () => buildServerInfo(req, config))]);
+	const loadOfflineData = createOfflineDataLoader(() => {
+		if (offlineDataOverride !== void 0) return Promise.resolve(offlineDataOverride);
+		if (cachedOfflineStr) return Promise.resolve(JSON.parse(cachedOfflineStr));
+		return m("schema", () => config.adapters.getOfflineData(spaceId, environment, revision));
+	});
+	const [offlineData, server] = await Promise.all([loadOfflineData(), m("rsc", () => buildServerInfo(req, config, loadOfflineData))]);
 	if (offlineDataOverride === void 0 && !cachedOfflineStr && offlineCacheKey && offlineData !== void 0) offlineDataCache?.set(offlineCacheKey, JSON.stringify(offlineData));
-	const v = config.assetVersion ? `?v=${config.assetVersion}` : "";
+	const version = config.assetVersion ?? sdkAssetVersion();
+	const v = version ? `?v=${version}` : "";
 	const sdkDevToolsStylePath = `/sdk-assets/plitzi-sdk-devtools.css${v}`;
-	const debugCookie = readCookie(req.headers.cookie, "plitzi_debug");
-	const debugMode = debugCookie === void 0 ? config.devMode : debugCookie === "true";
+	const debugMode = resolveDebugMode(config.debugMode ?? config.devMode, readCookie(req.headers.cookie, "plitzi_debug"));
+	const { degrade, analytics } = req.ctx.meter ?? {};
+	const clientAnalytics = analytics ? {
+		...analytics,
+		firstViewCounted: true
+	} : void 0;
+	const branding = degrade ? true : void 0;
 	const offlineDataStr = escapeJson(JSON.stringify({
 		offlineData,
 		offlineMode: true,
 		environment,
 		renderMode: "raw",
 		server,
-		sdkDevToolsStylePath
+		sdkDevToolsStylePath,
+		...clientAnalytics ? { analytics: clientAnalytics } : {},
+		...branding ? { branding } : {}
 	}));
 	const pluginNames = req.ctx.spaceDeployment?.pluginNames ?? [];
 	const pluginSources = req.ctx.spaceDeployment?.pluginSources;
@@ -48,7 +64,8 @@ var prepareRender = async (req, config, spaceId, environment, revision, pluginMa
 			server,
 			environment: req.ctx.spaceDeployment?.environment ?? environment,
 			debugMode,
-			sdkDevToolsStylePath
+			sdkDevToolsStylePath,
+			branding
 		},
 		entries,
 		templateParams: {

package/dist/modules/ssr/preview.d.ts

@@ -0,0 +1,10 @@
+import { DraftStore, OfflineDataRaw, SSRRequest, SSRServerConfig } from '@plitzi/sdk-shared';
+/** The READ side of draft-preview: a render resolving a stashed draft from its one-shot token. The write side —
+ *  applying unsaved operations and rendering the result — lives in `@plitzi/sdk-mcp`, which is what knows how to
+ *  interpret an operation; a page-only deployment keeps this much and never loads that. */
+/** In-memory one-shot draft store — the default when the consumer injects none. Fine for a single replica;
+ *  a multi-replica deployment must inject a shared store so a preview URL resolves on any replica. */
+export declare const createMemoryDraftStore: () => DraftStore;
+/** Consume the draft override for a render, if the request carries a valid preview token. Returns undefined on
+ *  a normal request (renders persisted state) or when the token is unknown/expired (one-shot / TTL). */
+export declare const takeDraftOverride: (req: SSRRequest, config: SSRServerConfig) => Promise<OfflineDataRaw | undefined>;

package/dist/modules/ssr/preview.js

@@ -1,11 +1,8 @@
-import { computeVersion } from "../mcp/helpers/computeVersion.js";
-import { cloneSpace, findPageByRef, getPageElements } from "../mcp/helpers/space.js";
-import { applyOperations } from "../mcp/tools/apply/dispatch.js";
-import { validateOperations } from "../mcp/tools/shared/validator/index.js";
-import { PREVIEW_TOKEN_PARAM } from "../mcp/constants.js";
-import { buildBody } from "./buildBody.js";
-import { randomUUID } from "node:crypto";
+import { PREVIEW_TOKEN_PARAM } from "../../core/previewToken.js";
 //#region src/modules/ssr/preview.ts
+/** The READ side of draft-preview: a render resolving a stashed draft from its one-shot token. The write side —
+*  applying unsaved operations and rendering the result — lives in `@plitzi/sdk-mcp`, which is what knows how to
+*  interpret an operation; a page-only deployment keeps this much and never loads that. */
 /** In-memory one-shot draft store — the default when the consumer injects none. Fine for a single replica;
 *  a multi-replica deployment must inject a shared store so a preview URL resolves on any replica. */
 var createMemoryDraftStore = () => {
@@ -32,75 +29,5 @@ var takeDraftOverride = async (req, config) => {
 	if (!token || !config.draftStore) return;
 	return config.draftStore.take(token);
 };
-var resolvePagePath = (schema, pageRef) => {
-	const pages = getPageElements(schema);
-	const page = pageRef ? findPageByRef(schema, pageRef) : pages.find((p) => p.attributes.default) ?? pages[0];
-	const slug = page && typeof page.attributes.slug === "string" ? page.attributes.slug : "";
-	return slug.startsWith("/") ? slug : `/${slug}`;
-};
-var syntheticRequest = (pagePath) => ({
-	method: "GET",
-	path: pagePath,
-	search: "",
-	url: pagePath,
-	hostname: "localhost",
-	protocol: "https",
-	headers: {},
-	query: {},
-	ctx: {}
-});
-/** Build a preview of a page: apply any unsaved `operations` to a clone (never persisted), render the resulting
-*  draft to full HTML via the SSR pipeline, and stash the draft under a one-shot token so a browser can fetch
-*  the exact same render at `?__pt=<token>` (for screenshots). With no operations it previews persisted state. */
-var createPreview = async (body, config, renderFn, pluginManager, caches) => {
-	const env = body.env ?? "main";
-	const revision = 0;
-	const offlineData = await config.adapters.getOfflineData(body.spaceId, env, revision);
-	if (!offlineData) return {
-		ok: false,
-		error: "NO_DATA",
-		message: `No offline data for space ${body.spaceId} (${env}).`
-	};
-	let draftOffline = offlineData;
-	if (body.operations && body.operations.length > 0) {
-		const draft = cloneSpace({
-			schema: offlineData.schema,
-			style: offlineData.style
-		});
-		const validation = validateOperations(draft, body.operations);
-		if (!validation.valid) return {
-			ok: false,
-			error: "INVALID_OPERATIONS",
-			message: "The operations did not validate.",
-			errors: validation.errors
-		};
-		const outcome = applyOperations(draft, env, body.operations);
-		if (outcome.errors.length > 0) return {
-			ok: false,
-			error: "APPLY_FAILED",
-			message: "The operations could not be applied.",
-			errors: outcome.errors
-		};
-		draftOffline = {
-			...offlineData,
-			schema: draft.schema,
-			style: draft.style
-		};
-	}
-	const pagePath = resolvePagePath(draftOffline.schema, body.pageRef);
-	const { body: html } = await buildBody(syntheticRequest(pagePath), config, body.spaceId, env, revision, renderFn, pluginManager, caches.offlineData, void 0, draftOffline);
-	let token;
-	if (config.draftStore) {
-		token = randomUUID();
-		await config.draftStore.put(token, draftOffline, config.preview?.ttlMs ?? 6e4);
-	}
-	return {
-		ok: true,
-		token,
-		pagePath,
-		html: html ?? "",
-		stateVersion: computeVersion(draftOffline)
-	};
-};
 //#endregion
-export { PREVIEW_TOKEN_PARAM, createMemoryDraftStore, createPreview, takeDraftOverride };
+export { createMemoryDraftStore, takeDraftOverride };

package/dist/modules/ssr/registerExternalPlugins.js

@@ -1,6 +1,6 @@
 import path from "node:path";
-import crypto from "node:crypto";
 import fs from "node:fs/promises";
+import crypto from "node:crypto";
 //#region src/modules/ssr/registerExternalPlugins.ts
 var MANIFEST_TTL_MS = 6e5;
 var manifestCache = /* @__PURE__ */ new Map();

package/dist/modules/ssr/streamBody.d.ts

@@ -0,0 +1,5 @@
+import { TtlCache } from '../../helpers/cache';
+import { RequestMetrics } from '../../helpers/metrics';
+import { PluginManager } from '../../plugins/manager';
+import { Environment, OfflineDataRaw, SSRPageServerConfig, SSRRequest, SSRResponseHelpers, SSRTemplateFn } from '@plitzi/sdk-shared';
+export declare const streamBody: (req: SSRRequest, res: SSRResponseHelpers, config: SSRPageServerConfig, spaceId: number, environment: Environment, revision: number, renderFn: SSRTemplateFn, pluginManager: PluginManager, offlineDataCache?: TtlCache<string>, htmlCache?: TtlCache<string>, cacheKey?: string, metrics?: RequestMetrics, offlineDataOverride?: OfflineDataRaw) => Promise<void>;

package/dist/modules/ssr/streamBody.js

@@ -1,6 +1,6 @@
+import { applySSRResult } from "./applySSRResult.js";
 import Component from "./Component.js";
 import { prepareRender } from "./prepareRender.js";
-import { applySSRResult } from "./applySSRResult.js";
 import { renderToPipeableStream } from "react-dom/server";
 import { jsx } from "react/jsx-runtime";
 import { Writable } from "node:stream";

package/dist/modules/ssr/template.d.ts

@@ -0,0 +1,2 @@
+import { SSRTemplateFn } from '@plitzi/sdk-shared';
+export declare const compileTemplate: () => SSRTemplateFn;

package/dist/modules/ssr/template.js

@@ -1,6 +1,6 @@
-import path from "node:path";
 import { fileURLToPath } from "node:url";
 import fs from "node:fs";
+import path from "node:path";
 import ejs from "ejs";
 //#region src/modules/ssr/template.ts
 var __dirname = path.dirname(fileURLToPath(import.meta.url));

package/dist/plugins/compile.js

@@ -1,6 +1,6 @@
 import path from "node:path";
-import esbuild from "esbuild";
 import fs from "node:fs/promises";
+import esbuild from "esbuild";
 //#region src/plugins/compile.ts
 var EXTERNAL = [
 	"react",

package/dist/plugins/manager.js

@@ -136,10 +136,12 @@ var PluginManager = class {
 			if (action === "compile") {
 				const { hasCSS } = await compilePlugin(jsPath, dir, this.devMode);
 				if (hasCSS) cssUrl = `${this.urlPrefix}/${name}/index.css`;
-				else if (cssPath) if (this.isWebUrl(cssPath)) cssUrl = cssPath;
-				else {
-					await copyPlugin(cssPath, dir, "index.css");
-					cssUrl = `${this.urlPrefix}/${name}/index.css`;
+				else if (cssPath) {
+					if (this.isWebUrl(cssPath)) cssUrl = cssPath;
+					else {
+						await copyPlugin(cssPath, dir, "index.css");
+						cssUrl = `${this.urlPrefix}/${name}/index.css`;
+					}
 				}
 			} else if (action === "download") {
 				const jsRes = await fetch(jsPath);
@@ -156,10 +158,12 @@ var PluginManager = class {
 				}
 			} else {
 				await copyPlugin(jsPath, dir, "index.js");
-				if (cssPath) if (this.isWebUrl(cssPath)) cssUrl = cssPath;
-				else {
-					await copyPlugin(cssPath, dir, "index.css");
-					cssUrl = `${this.urlPrefix}/${name}/index.css`;
+				if (cssPath) {
+					if (this.isWebUrl(cssPath)) cssUrl = cssPath;
+					else {
+						await copyPlugin(cssPath, dir, "index.css");
+						cssUrl = `${this.urlPrefix}/${name}/index.css`;
+					}
 				}
 			}
 			const compiledAt = Date.now();

package/dist/ssr.d.ts

@@ -0,0 +1,15 @@
+/** The render primitives a stage needs to produce a page, for packages that extend the page pipeline.
+ *
+ *  Import it as `@plitzi/sdk-server/ssr`. A stage injected into a page server receives `SSRContext` and so
+ *  already holds the render singletons; this entry is what lets it USE them — `buildBody` renders offline data
+ *  to HTML, `takeDraftOverride` is the read side of the draft store. `@plitzi/sdk-mcp`'s draft-preview endpoint
+ *  is the in-tree consumer.
+ *
+ *  Separate from the root barrel on purpose: that one also pulls RSC, connectors and the adapters, none of which
+ *  an injected render stage needs. */
+export { buildBody } from './modules/ssr/buildBody';
+export { createMemoryDraftStore, takeDraftOverride } from './modules/ssr/preview';
+export { PREVIEW_TOKEN_PARAM } from './core/previewToken';
+export type { PluginManager } from './plugins/manager';
+export type { ServerCaches } from './helpers/cache';
+export type { BaseContext, PipelineExtensions, SSRContext, Stage } from './core/http/types';

package/dist/ssr.js

@@ -0,0 +1,4 @@
+import { PREVIEW_TOKEN_PARAM } from "./core/previewToken.js";
+import { createMemoryDraftStore, takeDraftOverride } from "./modules/ssr/preview.js";
+import { buildBody } from "./modules/ssr/buildBody.js";
+export { PREVIEW_TOKEN_PARAM, buildBody, createMemoryDraftStore, takeDraftOverride };

package/package.json

@@ -1,10 +1,9 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.25",
+  "version": "0.33.1",
   "license": "AGPL-3.0",
   "files": [
-    "dist",
-    "skills"
+    "dist"
   ],
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -15,10 +14,20 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
-    "./mcp": {
-      "types": "./dist/mcp.d.ts",
-      "import": "./dist/mcp.js",
-      "default": "./dist/mcp.js"
+    "./kernel": {
+      "types": "./dist/kernel.d.ts",
+      "import": "./dist/kernel.js",
+      "default": "./dist/kernel.js"
+    },
+    "./handlers": {
+      "types": "./dist/handlers.d.ts",
+      "import": "./dist/handlers.js",
+      "default": "./dist/handlers.js"
+    },
+    "./ssr": {
+      "types": "./dist/ssr.d.ts",
+      "import": "./dist/ssr.js",
+      "default": "./dist/ssr.js"
     }
   },
   "repository": {
@@ -28,14 +37,11 @@
   "type": "module",
   "sideEffects": false,
   "dependencies": {
-    "@modelcontextprotocol/ext-apps": "^1.7.5",
-    "@modelcontextprotocol/sdk": "^1.30.0",
-    "@plitzi/plitzi-sdk": "0.32.25",
-    "@plitzi/sdk-schema": "0.32.25",
-    "@plitzi/sdk-shared": "0.32.25",
+    "@plitzi/plitzi-sdk": "0.33.1",
+    "@plitzi/sdk-shared": "0.33.1",
     "ejs": "^6.0.1",
-    "esbuild": "^0.28.1",
-    "zod": "^4.4.3"
+    "esbuild": "^0.28.2",
+    "jsonwebtoken": "^9.0.3"
   },
   "peerDependencies": {
     "react": "^19",
@@ -43,33 +49,31 @@
   },
   "devDependencies": {
     "@types/ejs": "^3.1.5",
-    "@types/jsdom": "^28.0.3",
-    "@types/node": "^26.1.2",
+    "@types/jsonwebtoken": "^9.0.10",
+    "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@vitejs/plugin-react": "^6.0.5",
     "@vitest/coverage-v8": "^4.1.10",
     "eslint": "^9.39.5",
     "eslint-plugin-import": "^2.32.0",
-    "jsdom": "^30.0.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^6.0.3",
-    "vite": "^8.2.0",
+    "vite": "^8.2.1",
     "vite-plugin-dts": "^5.0.3",
     "vitest": "^4.1.10"
   },
   "scripts": {
-    "start:dev": "node --import ./src/standalone/register-alias.mjs --watch src/standalone/server.ts",
-    "start": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx src/standalone/server.ts",
-    "start:watch": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx --watch src/standalone/server.ts",
-    "start:inspect": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx --inspect src/standalone/server.ts",
+    "start:dev": "node --import ./dev/register-alias.mjs --watch dev/main.ts",
+    "start": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx dev/main.ts",
+    "start:watch": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx --watch dev/main.ts",
+    "start:inspect": "TSX_TSCONFIG_PATH=tsconfig.app.json node --import tsx --inspect dev/main.ts",
     "build:dev": "vite build --mode development",
     "build:prod": "vite build",
-    "lint": "TIMING=1 eslint ./src",
+    "lint": "TIMING=1 eslint ./src ./dev",
     "typecheck": "tsc -p tsconfig.app.json --noEmit",
     "test": "vitest run",
-    "test:e2e": "vitest run src/modules/mcp/e2e",
     "test:coverage": "vitest run --coverage",
     "bench": "vitest bench --run"
   }

package/dist/core/server/mcpServer.js

@@ -1,29 +0,0 @@
-import { createHttpServer } from "./baseServer.js";
-import { makeHandler } from "../http/dispatcher.js";
-import { buildMCPPipeline } from "../services/registry.js";
-//#region src/core/server/mcpServer.ts
-var noPlugins = {
-	register: () => void 0,
-	invalidate: () => Promise.resolve()
-};
-var createMCPServer = (config) => {
-	const stages = buildMCPPipeline();
-	const makeHandlerForPort = (port) => {
-		const buildContext = (raw, rawRes, req, res) => ({
-			raw,
-			rawRes,
-			req,
-			res,
-			config,
-			port
-		});
-		return makeHandler("MCP", buildContext, stages);
-	};
-	return createHttpServer(config, makeHandlerForPort, {
-		label: "MCP",
-		cache: null,
-		plugins: noPlugins
-	});
-};
-//#endregion
-export { createMCPServer };

package/dist/core/services/mcp.js

@@ -1,27 +0,0 @@
-import { requestProxy } from "../../modules/mcp/proxy/config.js";
-import { handleMcp } from "../../modules/mcp/handler.js";
-import { createHttpPreviewClient } from "../../modules/mcp/previewClient.js";
-import { createHttpScreenshotClient } from "../../modules/mcp/screenshotClient.js";
-//#region src/core/services/mcp.ts
-var mcpPathOf = (config) => config.mcpAi?.path ?? config.mcp?.path ?? "/mcp";
-var serveMcp = async (ctx) => {
-	const { previewClient, screenshot, adapters, logger } = ctx.config;
-	ctx.operation = await handleMcp(ctx.raw, ctx.rawRes, ctx.req, adapters, {
-		preview: previewClient ? createHttpPreviewClient(previewClient) : void 0,
-		screenshot: screenshot ? createHttpScreenshotClient(screenshot) : void 0,
-		logger,
-		renderStreaming: ctx.config.mcpAi?.renderStreaming,
-		proxy: requestProxy(ctx.config, ctx.req)
-	});
-};
-var mcpStage = async (ctx) => {
-	if (!ctx.req.path.startsWith(mcpPathOf(ctx.config))) return false;
-	await serveMcp(ctx);
-	return true;
-};
-var mcpOnlyStage = async (ctx) => {
-	await serveMcp(ctx);
-	return true;
-};
-//#endregion
-export { mcpOnlyStage, mcpStage };

package/dist/core/services/oauth.js

@@ -1,116 +0,0 @@
-import { readRawBody } from "../requestParser.js";
-import { authorizationServerMetadata, protectedResourceMetadata } from "../../modules/oauth/metadata.js";
-import { getAccess } from "../../modules/oauth/records.js";
-import { sendErrorJson, sendJson } from "../../modules/oauth/respond.js";
-import { handleAuthorizeStart, handleAuthorizeSubmit } from "../../modules/oauth/authorize.js";
-import { bearerOf, sendChallenge } from "../../modules/oauth/challenge.js";
-import { handleRegister } from "../../modules/oauth/register.js";
-import { handleToken } from "../../modules/oauth/token.js";
-//#region src/core/services/oauth.ts
-var matchesWellKnown = (path, wellKnown) => path === wellKnown || path.startsWith(`${wellKnown}/`);
-var isOAuthPath = (path) => matchesWellKnown(path, "/.well-known/oauth-protected-resource") || matchesWellKnown(path, "/.well-known/oauth-authorization-server") || path === "/register" || path === "/authorize" || path === "/token";
-var formParams = (req, body) => {
-	const params = { ...req.query };
-	for (const [key, value] of new URLSearchParams(body).entries()) params[key] = value;
-	return params;
-};
-var parseJson = (body) => {
-	try {
-		return JSON.parse(body);
-	} catch {
-		return;
-	}
-};
-/** OAuth 2.1 authorization for the MCP server, mounted ONLY when a deployment configures `oauth`. Without it the
-*  stage falls straight through and the server keeps its anonymous contract: discovery 404s, the public surface
-*  (handshake, listings, the guide, plitzi_render) answers without a token, and nothing below changes.
-*
-*  It sits before the MCP stage because that one answers every path on a dedicated MCP server — these endpoints
-*  would otherwise be swallowed by the JSON-RPC transport, which is exactly the 406 a host hits on /register. */
-var oauthStage = async (ctx) => {
-	const { oauth } = ctx.config;
-	const { path, method } = ctx.req;
-	if (!oauth || !isOAuthPath(path)) return false;
-	const { res } = ctx;
-	if (path !== "/authorize") {
-		res.setHeader("Access-Control-Allow-Origin", "*");
-		res.setHeader("Access-Control-Allow-Headers", "*");
-		res.setHeader("Access-Control-Allow-Methods", "GET, POST, OPTIONS");
-	}
-	if (method === "OPTIONS") {
-		res.setStatus(204);
-		res.end();
-		return true;
-	}
-	if (method === "GET" && matchesWellKnown(path, "/.well-known/oauth-protected-resource")) {
-		sendJson(res, 200, protectedResourceMetadata(oauth, ctx.req));
-		return true;
-	}
-	if (method === "GET" && matchesWellKnown(path, "/.well-known/oauth-authorization-server")) {
-		sendJson(res, 200, authorizationServerMetadata(oauth, ctx.req));
-		return true;
-	}
-	if (path === "/authorize" && method === "GET") {
-		await handleAuthorizeStart(oauth, res, ctx.req.query);
-		return true;
-	}
-	if (path === "/authorize" && method === "POST") {
-		await handleAuthorizeSubmit(oauth, res, formParams(ctx.req, await readRawBody(ctx.raw)));
-		return true;
-	}
-	if (path === "/token" && method === "POST") {
-		await handleToken(oauth, res, formParams(ctx.req, await readRawBody(ctx.raw)));
-		return true;
-	}
-	if (path === "/register" && method === "POST") {
-		await handleRegister(oauth, res, parseJson(await readRawBody(ctx.raw)));
-		return true;
-	}
-	sendErrorJson(res, 405, "invalid_request", `${method} is not allowed on ${path}.`);
-	return true;
-};
-var CHALLENGE_DESCRIPTIONS = {
-	"no-credential": "Authorization is required to use this server.",
-	"unknown-credential": "The access token is invalid, expired or revoked.",
-	"store-unreachable": "The access token could not be verified right now.",
-	"adapter-failed": "The access token could not be verified right now."
-};
-var challengeReason = async (oauth, ctx, token) => {
-	if (!token) return "no-credential";
-	try {
-		const record = await getAccess(oauth.adapters.store, token);
-		if (record) {
-			const credential = record.credential ?? token;
-			ctx.req.headers["x-access-token"] = credential;
-			ctx.req.headers.authorization = `Bearer ${credential}`;
-			return;
-		}
-	} catch {
-		return "store-unreachable";
-	}
-	try {
-		return await ctx.config.adapters.getSpaceId?.(ctx.req) === void 0 ? "unknown-credential" : void 0;
-	} catch {
-		return "adapter-failed";
-	}
-};
-/** The protected-resource half of OAuth: an MCP call that presents no bearer this server can verify is refused
-*  with RFC 6750's challenge instead of being served the anonymous surface. That 401 is the whole handshake — it
-*  is how a host learns the server needs authorization, where its metadata lives and which scopes to ask for, and
-*  a 200 tells it none of that. Only the JSON-RPC POST is guarded: the CORS preflight, the GET 405 and the
-*  discovery probes carry no credential and must keep answering as they do.
-*
-*  Mounted only when `oauth` is configured. A deployment that configures none keeps the open server it had, where
-*  the whole public surface — handshake, listings, the guide, plitzi_render — answers without a token; with OAuth
-*  on, the grant that carries no space is what covers that same ground. */
-var oauthGuardStage = async (ctx) => {
-	const { oauth } = ctx.config;
-	if (!oauth || ctx.req.method !== "POST") return false;
-	const reason = await challengeReason(oauth, ctx, bearerOf(ctx.req));
-	if (!reason) return false;
-	ctx.operation = `oauth-challenge:${reason}`;
-	sendChallenge(oauth, ctx.req, ctx.res, CHALLENGE_DESCRIPTIONS[reason]);
-	return true;
-};
-//#endregion
-export { oauthGuardStage, oauthStage };

package/dist/core/services/preview.js

@@ -1,37 +0,0 @@
-import { readRawBody } from "../requestParser.js";
-import { createPreview } from "../../modules/ssr/preview.js";
-//#region src/core/services/preview.ts
-var PREVIEW_PATH_DEFAULT = "/__preview";
-var json = (ctx, status, payload) => {
-	ctx.res.setHeader("Content-Type", "application/json");
-	ctx.res.setStatus(status);
-	ctx.res.send(JSON.stringify(payload));
-	return true;
-};
-var previewStage = async (ctx) => {
-	const preview = ctx.config.preview;
-	const path = preview?.path ?? PREVIEW_PATH_DEFAULT;
-	if (!preview?.enabled || ctx.req.method !== "POST" || ctx.req.path !== path) return false;
-	if (preview.secret && ctx.req.headers["x-preview-secret"] !== preview.secret) return json(ctx, 403, {
-		error: "FORBIDDEN",
-		message: "Invalid or missing preview secret."
-	});
-	ctx.req.body = await readRawBody(ctx.raw);
-	let body;
-	try {
-		body = JSON.parse(ctx.req.body || "{}");
-	} catch {
-		return json(ctx, 400, {
-			error: "BAD_REQUEST",
-			message: "Request body must be JSON."
-		});
-	}
-	if (typeof body.spaceId !== "number") return json(ctx, 400, {
-		error: "BAD_REQUEST",
-		message: "spaceId (number) is required."
-	});
-	const result = await createPreview(body, ctx.config, ctx.renderFn, ctx.pluginManager, ctx.caches);
-	return json(ctx, result.ok ? 200 : 422, result);
-};
-//#endregion
-export { previewStage };

package/dist/core/services/proxy.js

@@ -1,12 +0,0 @@
-import { proxySettings } from "../../modules/mcp/proxy/config.js";
-import { handleProxyRequest } from "../../modules/mcp/proxy/handler.js";
-//#region src/core/services/proxy.ts
-var widgetProxyStage = async (ctx) => {
-	const settings = proxySettings(ctx.config);
-	if (!settings || ctx.req.path !== settings.path) return false;
-	ctx.operation = "proxy";
-	await handleProxyRequest(ctx.req, ctx.res, settings);
-	return true;
-};
-//#endregion
-export { widgetProxyStage };

package/dist/mcp.d.ts

@@ -1,2 +0,0 @@
-export * from './src/mcp.js'
-export {}

package/dist/mcp.js

@@ -1,7 +0,0 @@
-import { consoleLogger, renderLogEvent } from "./helpers/serverLog.js";
-import { createMcpServer } from "./modules/mcp/server.js";
-import { handleMcp, readMcpBody, serveMcp } from "./modules/mcp/handler.js";
-import { createHttpPreviewClient } from "./modules/mcp/previewClient.js";
-import { createHttpScreenshotClient } from "./modules/mcp/screenshotClient.js";
-import { createMCPServer } from "./core/server/mcpServer.js";
-export { consoleLogger, createHttpPreviewClient, createHttpScreenshotClient, createMCPServer, createMcpServer, handleMcp, readMcpBody, renderLogEvent, serveMcp };