@plitzi/sdk-shared 0.32.13 → 0.32.15

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @plitzi/sdk-shared
 
+## 0.32.15
+
+### Patch Changes
+
+- v0.32.15
+- Updated dependencies
+  - @plitzi/nexus@0.32.15
+
+## 0.32.14
+
+### Patch Changes
+
+- v0.32.14
+- Updated dependencies
+  - @plitzi/nexus@0.32.14
+
 ## 0.32.13
 
 ### Patch Changes

package/dist/types/ServerTypes.d.ts

@@ -412,6 +412,18 @@ export type OAuthAdapters = {
     } | undefined>;
     store: OAuthStore;
 };
+/** A connection a visitor may take WITHOUT signing in, for a server whose public surface needs no identity — the
+ *  MCP App, the tool and resource listings, the guide. The consent screen offers it as a second button beside the
+ *  sign-in, and the grant is whatever `target` grants: point it at a target that carries no space, never at one
+ *  that does, since nobody proved who they are. */
+export type OAuthGuestConfig = {
+    /** Handed straight to {@link OAuthAdapters.issueToken} when a visitor takes the guest connection. */
+    target: OAuthGrantTarget;
+    /** Button text. Defaults to 'Continue without an account'. */
+    label?: string;
+    /** Who the grant is issued as. Defaults to `{ id: 'guest', label: 'Guest' }`. */
+    user?: OAuthUser;
+};
 /** What the built-in consent screen shows around the form. Ignored when `renderConsent` replaces the page. */
 export type OAuthBranding = {
     /** Shown as the heading, e.g. 'Plitzi'. Defaults to 'Plitzi'. */
@@ -432,6 +444,12 @@ export type OAuthConsentView = {
     hidden: Record<string, string>;
     /** Offered on the 'target' step only. */
     targets: OAuthGrantTarget[];
+    /** Offered on the 'credentials' step when the deployment allows a guest connection. The form must submit a
+     *  `guest` field for it (any non-empty value), which is what tells the server to skip authentication. */
+    guest?: {
+        label: string;
+        description?: string;
+    };
     /** Who logged in, on the 'target' step. */
     user?: OAuthUser;
     /** A message to show the user, e.g. after a failed login. */
@@ -461,6 +479,8 @@ export type OAuthConfig = {
     codeTtlSeconds?: number;
     /** How long a refresh grant lives, in seconds. Default 30 days. Set 0 to issue no refresh tokens. */
     refreshTtlSeconds?: number;
+    /** Offer a connection that needs no account — see {@link OAuthGuestConfig}. Omit to require sign-in. */
+    guest?: OAuthGuestConfig;
     branding?: OAuthBranding;
     /** Replaces the built-in consent screen — return a full HTML document for the given step. */
     renderConsent?: (view: OAuthConsentView) => string | Promise<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-shared",
-  "version": "0.32.13",
+  "version": "0.32.15",
   "license": "AGPL-3.0",
   "files": [
     "dist",
@@ -1230,7 +1230,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@plitzi/nexus": "0.32.13",
+    "@plitzi/nexus": "0.32.15",
     "@plitzi/plitzi-ui": "^1.6.18",
     "date-fns": "^4.4.0",
     "date-fns-tz": "^3.2.0",