bsv-mcp 0.3.2 → 0.3.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # BSV MCP Server Changelog
 
+## [0.3.3] - 2026-09-06
+
+### Fixed
+- Honor `DROPLIT_SITE_URL` for sponsor approval links so staging requests reach the correct owner UI.
+- Build approval links from the configured sponsor and verified wallet identity; reject unsafe site origins.
+
 ## [0.3.2] - 2026-09-06
 
 ### Added

package/README.md

@@ -884,6 +884,8 @@ BRC100_WALLET_URL=http://127.0.0.1:3321
 BRC100_WALLET_ORIGINATOR=bsv-mcp.local
 DROPLIT_API_URL=https://api.droplit.dev/droplit
 DROPLIT_FAUCET_NAME=your-sponsor-slug
+# Optional: set explicitly when the owner approval UI is hosted elsewhere.
+DROPLIT_SITE_URL=https://droplit.dev
 ```
 
 Set both sponsor values explicitly. The URL includes the server's configured
@@ -893,8 +895,15 @@ BRC-100 wallet contexts also support this sponsor pair. `1sat serve` exposes a
 wallet stack service; it is not itself a BRC-100 signer RPC endpoint.
 
 Call `droplit_getAccess` to inspect your own authorization and quotas. An
-`approval_required` response includes a `https://droplit.dev` link for manual
+`approval_required` response includes a link to `DROPLIT_SITE_URL` (default
+`https://droplit.dev`) for manual
 owner review. Do not automatically open, approve, or register to obtain access.
+The site URL must be an HTTPS origin (HTTP is allowed only for loopback),
+without credentials, a path, query, or fragment. For staging, set it to the
+trusted staging frontend origin independently of `DROPLIT_API_URL`. Approval
+links use the configured sponsor and authenticated wallet identity; a server
+response cannot redirect them to another site.
+
 Public status and public-key registration do not prove sponsor approval, and
 creating your own faucet requires funding rather than providing free credit.
 Missing quota kinds are unrestricted for authorized users; a configured zero

package/dist/index.js

@@ -256042,7 +256042,7 @@ var package_default = {
   name: "bsv-mcp",
   module: "dist/index.js",
   type: "module",
-  version: "0.3.2",
+  version: "0.3.3",
   license: "MIT",
   author: "satchmo",
   description: "A collection of Bitcoin SV (BSV) tools for the Model Context Protocol (MCP) framework",
@@ -284877,6 +284877,15 @@ function registerUtilsTools(server) {
 
 // utils/droplit.ts
 init_mod2();
+function approvalSiteOrigin(value2 = "https://droplit.dev") {
+  const url3 = new URL(value2);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url3.hostname);
+  if (url3.username || url3.password || url3.pathname !== "/" || url3.href.includes("?") || url3.href.includes("#") || value2.includes("\\") || !(url3.protocol === "https:" || url3.protocol === "http:" && loopback)) {
+    throw new Error("DROPLIT_SITE_URL requires an HTTPS or HTTP loopback origin without credentials, path, query or fragment");
+  }
+  return url3.origin;
+}
+
 class DroplitError extends Error {
   code;
   status;
@@ -284926,9 +284935,11 @@ function httpFailure(status, details = {}) {
 class DroplitClient {
   config;
   authFetch;
+  siteOrigin;
   wallet;
   constructor(config2) {
     this.config = config2;
+    this.siteOrigin = approvalSiteOrigin(config2.siteUrl);
     if (config2.wallet && config2.authKey)
       throw new Error("Configure Droplit wallet or authKey, not both");
     const url3 = new URL(config2.apiUrl);
@@ -285023,6 +285034,7 @@ class DroplitClient {
       throw new DroplitError("invalid_response", "Sponsor access response did not match the authenticated wallet.");
     }
     access.approval_path = `/droplit/${encodeURIComponent(this.config.faucetName)}?tab=api&request_key=${encodeURIComponent(identity6)}`;
+    access.approval_url = new URL(access.approval_path, this.siteOrigin).href;
     return access;
   }
   async fund(rawtx) {
@@ -285093,7 +285105,7 @@ function registerDroplitTools(server, client, disableBroadcasting = false) {
         ...!access.authorized ? {
           error: "approval_required",
           message: "Ask the sponsor owner to approve this wallet. Copy the approval URL for manual review; do not auto-open or submit approval.",
-          approval_url: `https://droplit.dev${access.approval_path}`
+          approval_url: access.approval_url
         } : {}
       };
       return {
@@ -295163,7 +295175,7 @@ var package_default2 = {
   name: "bsv-mcp",
   module: "dist/index.js",
   type: "module",
-  version: "0.3.2",
+  version: "0.3.3",
   license: "MIT",
   author: "satchmo",
   description: "A collection of Bitcoin SV (BSV) tools for the Model Context Protocol (MCP) framework",
@@ -298351,12 +298363,25 @@ init_mod2();
 function readDroplitSponsorConfig(env = process.env) {
   const apiUrl = env.DROPLIT_API_URL;
   const faucetName = env.DROPLIT_FAUCET_NAME;
-  if (apiUrl === undefined && faucetName === undefined)
+  const siteUrl = env.DROPLIT_SITE_URL;
+  if (apiUrl === undefined && faucetName === undefined && siteUrl === undefined)
     return;
   if (!apiUrl?.trim() || !faucetName?.trim()) {
     throw new Error("DROPLIT_API_URL and DROPLIT_FAUCET_NAME must both be explicitly configured");
   }
-  return { apiUrl, faucetName };
+  return {
+    apiUrl,
+    faucetName,
+    ...siteUrl === undefined ? {} : { siteUrl: approvalSiteOrigin2(siteUrl) }
+  };
+}
+function approvalSiteOrigin2(value2 = "https://droplit.dev") {
+  const url3 = new URL(value2);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url3.hostname);
+  if (url3.username || url3.password || url3.pathname !== "/" || url3.href.includes("?") || url3.href.includes("#") || value2.includes("\\") || !(url3.protocol === "https:" || url3.protocol === "http:" && loopback)) {
+    throw new Error("DROPLIT_SITE_URL requires an HTTPS or HTTP loopback origin without credentials, path, query or fragment");
+  }
+  return url3.origin;
 }
 
 class DroplitError2 extends Error {
@@ -298408,9 +298433,11 @@ function httpFailure2(status, details = {}) {
 class DroplitClient2 {
   config;
   authFetch;
+  siteOrigin;
   wallet;
   constructor(config2) {
     this.config = config2;
+    this.siteOrigin = approvalSiteOrigin2(config2.siteUrl);
     if (config2.wallet && config2.authKey)
       throw new Error("Configure Droplit wallet or authKey, not both");
     const url3 = new URL(config2.apiUrl);
@@ -298505,6 +298532,7 @@ class DroplitClient2 {
       throw new DroplitError2("invalid_response", "Sponsor access response did not match the authenticated wallet.");
     }
     access.approval_path = `/droplit/${encodeURIComponent(this.config.faucetName)}?tab=api&request_key=${encodeURIComponent(identity6)}`;
+    access.approval_url = new URL(access.approval_path, this.siteOrigin).href;
     return access;
   }
   async fund(rawtx) {

package/package.json

@@ -2,7 +2,7 @@
 	"name": "bsv-mcp",
 	"module": "dist/index.js",
 	"type": "module",
-	"version": "0.3.2",
+	"version": "0.3.3",
 	"license": "MIT",
 	"author": "satchmo",
 	"description": "A collection of Bitcoin SV (BSV) tools for the Model Context Protocol (MCP) framework",

package/tools/wallet/droplit.ts

@@ -53,7 +53,7 @@ export function registerDroplitTools(
 								error: "approval_required",
 								message:
 									"Ask the sponsor owner to approve this wallet. Copy the approval URL for manual review; do not auto-open or submit approval.",
-								approval_url: `https://droplit.dev${access.approval_path}`,
+								approval_url: access.approval_url,
 							}
 						: {}),
 				};