@plitzi/sdk-shared 0.32.12 → 0.32.14

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @plitzi/sdk-shared
 
+## 0.32.14
+
+### Patch Changes
+
+- v0.32.14
+- Updated dependencies
+  - @plitzi/nexus@0.32.14
+
+## 0.32.13
+
+### Patch Changes
+
+- v0.32.13
+- Updated dependencies
+  - @plitzi/nexus@0.32.13
+
 ## 0.32.12
 
 ### Patch Changes

package/dist/types/ServerTypes.d.ts

@@ -412,6 +412,18 @@ export type OAuthAdapters = {
     } | undefined>;
     store: OAuthStore;
 };
+/** A connection a visitor may take WITHOUT signing in, for a server whose public surface needs no identity — the
+ *  MCP App, the tool and resource listings, the guide. The consent screen offers it as a second button beside the
+ *  sign-in, and the grant is whatever `target` grants: point it at a target that carries no space, never at one
+ *  that does, since nobody proved who they are. */
+export type OAuthGuestConfig = {
+    /** Handed straight to {@link OAuthAdapters.issueToken} when a visitor takes the guest connection. */
+    target: OAuthGrantTarget;
+    /** Button text. Defaults to 'Continue without an account'. */
+    label?: string;
+    /** Who the grant is issued as. Defaults to `{ id: 'guest', label: 'Guest' }`. */
+    user?: OAuthUser;
+};
 /** What the built-in consent screen shows around the form. Ignored when `renderConsent` replaces the page. */
 export type OAuthBranding = {
     /** Shown as the heading, e.g. 'Plitzi'. Defaults to 'Plitzi'. */
@@ -432,6 +444,12 @@ export type OAuthConsentView = {
     hidden: Record<string, string>;
     /** Offered on the 'target' step only. */
     targets: OAuthGrantTarget[];
+    /** Offered on the 'credentials' step when the deployment allows a guest connection. The form must submit a
+     *  `guest` field for it (any non-empty value), which is what tells the server to skip authentication. */
+    guest?: {
+        label: string;
+        description?: string;
+    };
     /** Who logged in, on the 'target' step. */
     user?: OAuthUser;
     /** A message to show the user, e.g. after a failed login. */
@@ -442,7 +460,13 @@ export type OAuthConsentView = {
  *  authorization code with PKCE). ENTIRELY OPTIONAL: without this config no endpoint is mounted, discovery keeps
  *  answering 404 and the server stays anonymous, which is a working setup — the public surface (handshake, tool
  *  and resource listing, the guide, plitzi_render) never needed a token. Configure it only to let a remote host
- *  that cannot send custom headers — Claude Desktop, ChatGPT — obtain a space-scoped one. */
+ *  that cannot send custom headers — Claude Desktop, ChatGPT — obtain a space-scoped one.
+ *
+ *  Configuring it also protects the MCP endpoint: a JSON-RPC call that presents no verifiable bearer is answered
+ *  with RFC 6750's 401 challenge rather than the anonymous surface, because that 401 is the only thing a host runs
+ *  its flow off — it ignores a `WWW-Authenticate` header on a 200, and a server that never sends one is treated as
+ *  needing no authorization at all, leaving a completed grant with nowhere to attach. Offer a grant target that
+ *  carries no space ({@link OAuthGrantTarget}) so the public surface stays one consent away. */
 export type OAuthConfig = {
     adapters: OAuthAdapters;
     /** The issuer/resource identifier published in the metadata documents. Defaults to the origin the request came
@@ -455,6 +479,8 @@ export type OAuthConfig = {
     codeTtlSeconds?: number;
     /** How long a refresh grant lives, in seconds. Default 30 days. Set 0 to issue no refresh tokens. */
     refreshTtlSeconds?: number;
+    /** Offer a connection that needs no account — see {@link OAuthGuestConfig}. Omit to require sign-in. */
+    guest?: OAuthGuestConfig;
     branding?: OAuthBranding;
     /** Replaces the built-in consent screen — return a full HTML document for the given step. */
     renderConsent?: (view: OAuthConsentView) => string | Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-shared",
-  "version": "0.32.12",
+  "version": "0.32.14",
   "license": "AGPL-3.0",
   "files": [
     "dist",
@@ -1230,7 +1230,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/nexus": "0.32.12",
+    "@plitzi/nexus": "0.32.14",
     "@plitzi/plitzi-ui": "^1.6.18",
     "date-fns": "^4.4.0",
     "date-fns-tz": "^3.2.0",