@protobase/server 0.48.0 → 0.49.0

package/dist/better-auth/mcp/mcp-auth-plugins.js

@@ -0,0 +1,68 @@
+import { mcpConsentCheck } from "./consent-check.js";
+import { mcpGrantRevocation } from "./revoke-grants.js";
+import { pluginNames } from "../snake-case-names.js";
+import { mcpConnectedApps } from "./connected-apps.js";
+import { consentReference } from "./consent-reference.js";
+import { mcpTokenClaims } from "./mcp-token-claims.js";
+import { mcpRefreshReuse } from "./refresh-reuse.js";
+import { mcpRequestDefaults } from "./request-defaults.js";
+import { mcpSetupGate } from "./setup-gate.js";
+import { mcpSignedQueryGuard } from "./signed-query-guard.js";
+import { cimd } from "@better-auth/cimd";
+import { fetchClientMetadataResource } from "@better-auth/cimd/node";
+import { mcp } from "@better-auth/mcp";
+//#region src/better-auth/mcp/mcp-auth-plugins.ts
+/**
+* The Better Auth plugins of an OAuth provider for MCP clients, after the `jwt` plugin, in this order: the guard on
+* signed queries, the request defaults, the setup gate, the provider (`mcp()`), and client metadata documents
+* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`) or a refresh token is reused
+* (`mcpRefreshReuse`), and the person's list of connected
+* apps, where they disconnect one (`mcpConnectedApps`). A client registers itself, the person signs in on the app's own pages and allows it on the connect
+* page, and the client gets 15-minute access tokens for the MCP resource only, with refresh tokens, carrying the role
+* and organization the person worked in when they allowed it.
+*/
+const mcpAuthPlugins = ({ mcp: resolved, organizations, mail, defaultPolicy, definitions, context }) => [
+	mcpSignedQueryGuard(),
+	mcpRequestDefaults(resolved.resource),
+	mcpSetupGate({
+		mail,
+		defaultPolicy,
+		connectPage: resolved.connectPage
+	}),
+	mcp({
+		resource: resolved.resource,
+		loginPage: resolved.connectPage,
+		consentPage: resolved.connectPage,
+		scopes: ["mcp", "offline_access"],
+		clientRegistrationDefaultScopes: ["mcp", "offline_access"],
+		grantTypes: ["authorization_code", "refresh_token"],
+		allowDynamicClientRegistration: true,
+		allowUnauthenticatedClientRegistration: true,
+		clientRegistrationDefaultApplicationType: "infer",
+		postLogin: {
+			page: resolved.connectPage,
+			shouldRedirect: () => false,
+			consentReferenceId: async ({ user, session }) => consentReference(await context(), {
+				user,
+				session
+			})
+		},
+		customAccessTokenClaims: async ({ user, referenceId }) => mcpTokenClaims(await context(), {
+			organizations,
+			mail,
+			defaultPolicy
+		}, user, referenceId),
+		accessTokenExpiresIn: 900,
+		extensions: [mcpConsentCheck()],
+		schema: pluginNames.mcp
+	}),
+	cimd({
+		fetchClientMetadataResource: resolved.fetchClientMetadata ?? fetchClientMetadataResource,
+		metadataProfile: "mcp-2026-07-28"
+	}),
+	mcpGrantRevocation(),
+	mcpRefreshReuse(),
+	mcpConnectedApps({ definitions })
+];
+//#endregion
+export { mcpAuthPlugins };

package/dist/better-auth/mcp/mcp-plugins.d.ts

@@ -1,5 +1,3 @@
-import "../organizations/store.js";
-import "./connected-apps.js";
 import { ClientMetadataResourceFetch } from "@better-auth/oauth-provider";
 //#region src/better-auth/mcp/mcp-plugins.d.ts
 export type McpAuthOptions = {
@@ -10,4 +8,11 @@ export type McpAuthOptions = {
   /** Fetches a client's metadata document (a URL client id); default the CIMD plugin's Node transport, which refuses non-public addresses. */
   fetchClientMetadata?: ClientMetadataResourceFetch;
 };
+/** `McpAuthOptions` with the defaults filled in and the resource worked out. */
+export type ResolvedMcp = {
+  path: string;
+  connectPage: string;
+  resource: string;
+  fetchClientMetadata?: ClientMetadataResourceFetch;
+};
 //#endregion

package/dist/better-auth/mcp/mcp-plugins.js

@@ -1,17 +1,4 @@
-import { mcpConsentCheck } from "./consent-check.js";
-import { mcpGrantRevocation } from "./revoke-grants.js";
-import { pluginNames } from "../snake-case-names.js";
-import { mcpConnectedApps } from "./connected-apps.js";
-import { consentReference } from "./consent-reference.js";
-import { mcpTokenClaims } from "./mcp-token-claims.js";
-import { mcpRefreshReuse } from "./refresh-reuse.js";
-import { mcpRequestDefaults } from "./request-defaults.js";
-import { mcpSetupGate } from "./setup-gate.js";
-import { mcpSignedQueryGuard } from "./signed-query-guard.js";
 import { connectRoute } from "@protobase/schema";
-import { cimd } from "@better-auth/cimd";
-import { fetchClientMetadataResource } from "@better-auth/cimd/node";
-import { mcp } from "@better-auth/mcp";
 //#region src/better-auth/mcp/mcp-plugins.ts
 /** The path of the app's MCP endpoint, below its origin, unless `mcp.path` names another. */
 const defaultMcpPath = "/api/mcp";
@@ -22,14 +9,14 @@ const mcpResource = (baseURL, path) => `${new URL(baseURL).origin}${path}`;
 * resource is never the issuer, in either of its forms, whose tokens the app's own API takes.
 */
 const resolveMcp = (baseURL, options) => {
-	const { path = defaultMcpPath, connectPage = connectRoute, fetchClientMetadata = fetchClientMetadataResource } = options === true ? {} : options;
+	const { path = defaultMcpPath, connectPage = connectRoute, fetchClientMetadata } = options === true ? {} : options;
 	if (!path.startsWith("/") || path.length < 2) throw new Error(`mcp.path "${path}" must be a path below the app's origin, such as ${defaultMcpPath}`);
 	if (!connectPage.startsWith("/")) throw new Error(`mcp.connectPage "${connectPage}" must be a path on the app's origin, such as ${connectRoute}`);
 	return {
 		path,
 		connectPage,
 		resource: mcpResource(baseURL, path),
-		fetchClientMetadata
+		...fetchClientMetadata && { fetchClientMetadata }
 	};
 };
 /**
@@ -54,57 +41,5 @@ const mcpUnusedPaths = [
 	"/oauth2/update-consent",
 	"/oauth2/delete-consent"
 ];
-/**
-* The Better Auth plugins of an OAuth provider for MCP clients, after the `jwt` plugin, in this order: the guard on
-* signed queries, the request defaults, the setup gate, the provider (`mcp()`), and client metadata documents
-* (`cimd()`), the revocation when the account is secured (`mcpGrantRevocation`) or a refresh token is reused
-* (`mcpRefreshReuse`), and the person's list of connected
-* apps, where they disconnect one (`mcpConnectedApps`). A client registers itself, the person signs in on the app's own pages and allows it on the connect
-* page, and the client gets 15-minute access tokens for the MCP resource only, with refresh tokens, carrying the role
-* and organization the person worked in when they allowed it.
-*/
-const mcpAuthPlugins = ({ mcp: resolved, organizations, mail, defaultPolicy, definitions, context }) => [
-	mcpSignedQueryGuard(),
-	mcpRequestDefaults(resolved.resource),
-	mcpSetupGate({
-		mail,
-		defaultPolicy,
-		connectPage: resolved.connectPage
-	}),
-	mcp({
-		resource: resolved.resource,
-		loginPage: resolved.connectPage,
-		consentPage: resolved.connectPage,
-		scopes: ["mcp", "offline_access"],
-		clientRegistrationDefaultScopes: ["mcp", "offline_access"],
-		grantTypes: ["authorization_code", "refresh_token"],
-		allowDynamicClientRegistration: true,
-		allowUnauthenticatedClientRegistration: true,
-		clientRegistrationDefaultApplicationType: "infer",
-		postLogin: {
-			page: resolved.connectPage,
-			shouldRedirect: () => false,
-			consentReferenceId: async ({ user, session }) => consentReference(await context(), {
-				user,
-				session
-			})
-		},
-		customAccessTokenClaims: async ({ user, referenceId }) => mcpTokenClaims(await context(), {
-			organizations,
-			mail,
-			defaultPolicy
-		}, user, referenceId),
-		accessTokenExpiresIn: 900,
-		extensions: [mcpConsentCheck()],
-		schema: pluginNames.mcp
-	}),
-	cimd({
-		fetchClientMetadataResource: resolved.fetchClientMetadata,
-		metadataProfile: "mcp-2026-07-28"
-	}),
-	mcpGrantRevocation(),
-	mcpRefreshReuse(),
-	mcpConnectedApps({ definitions })
-];
 //#endregion
-export { defaultMcpPath, mcpAuthPlugins, mcpResource, mcpUnusedPaths, resolveMcp };
+export { defaultMcpPath, mcpResource, mcpUnusedPaths, resolveMcp };

package/dist/better-auth/mcp/mcp-token-claims.js

@@ -1,8 +1,8 @@
 import { missingSetup } from "../sign-in-setup.js";
 import { heldRoles } from "../roles/session-role.js";
-import { readGrantReference } from "./grant-reference.js";
 import { mayEnter } from "../organizations/session-organization.js";
 import { tokenClaims } from "../token-claims.js";
+import { readGrantReference } from "./grant-reference.js";
 import { APIError } from "better-auth/api";
 //#region src/better-auth/mcp/mcp-token-claims.ts
 const refused = (description) => new APIError("BAD_REQUEST", {

package/dist/better-auth/organizations/store.d.ts

@@ -1,5 +1,6 @@
 import { createAuthMiddleware } from "better-auth/api";
 //#region src/better-auth/organizations/store.d.ts
+export type AuthContext = Parameters<Parameters<typeof createAuthMiddleware>[0]>[0]['context'];
 export type OrganizationRole = 'owner' | 'admin' | 'member';
 export type StoredMember = {
   id: string;