modality-ai 0.8.1 → 0.8.2

package/dist/types/__tests__/createHostedOAuth.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/types/index.d.ts

@@ -4,4 +4,5 @@ export { setupStdioToHttpTools, createStdioClient, } from "./setupStdioToHttpToo
 export type { ModalityClientInstance } from "./ModalityClient";
 export type { ModelMessage } from "ai";
 export type { StdioClientOptions } from "./setupStdioToHttpTools";
-export { CLIBrowserOAuthProvider } from "./mcp-oauth-provider";
+export { CLIBrowserOAuthProvider, createHostedOAuth } from "./mcp-oauth-provider";
+export type { HostedOAuth, HostedOAuthOptions, HostedOAuthResult, OAuthCallbackInput } from "./mcp-oauth-provider";

package/dist/types/mcp-oauth-provider.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthClientProvider, OAuthDiscoveryState, AddClientAuthentication } from "@modelcontextprotocol/sdk/client/auth.js";
+import { type OAuthClientProvider, type OAuthDiscoveryState, type AddClientAuthentication } from "@modelcontextprotocol/sdk/client/auth.js";
 import type { OAuthClientInformationMixed, OAuthClientMetadata, OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
 interface CLIBrowserOAuthProviderOptions {
     /** Display name registered with the OAuth server. Default: "mcp-cli" */
@@ -149,4 +149,79 @@ export declare class CLIBrowserOAuthProvider implements OAuthClientProvider {
     private _persistCache;
     private _handleCallback;
 }
+/** Options for {@link createHostedOAuth}. */
+export interface HostedOAuthOptions {
+    /**
+     * Path the host server exposes for the OAuth redirect, e.g. "/oauth/callback".
+     * Wire your route to forward requests to the returned `handleCallback`.
+     */
+    callbackPath: string;
+    /**
+     * Returns the port the host server is bound to. Called per flow, so it can
+     * reflect the live runtime port (e.g. parsed from a getHonoUrl() helper)
+     * instead of a hardcoded guess.
+     */
+    getPort: () => number | Promise<number>;
+    /** Host used in the redirect_uri. Default "127.0.0.1". */
+    host?: string;
+    /** OAuth client display name registered with the server. Default "mcp-cli". */
+    clientName?: string;
+}
+/** Outcome of a hosted OAuth flow. */
+export interface HostedOAuthResult {
+    status: "authorized" | "already_authorized";
+    message: string;
+}
+/**
+ * Input accepted by {@link HostedOAuth.handleCallback}: either a raw web
+ * `Request` (e.g. from `Bun.serve`) or any object exposing one at `req.raw`,
+ * which a Hono `Context` satisfies structurally. This lets the handler be
+ * passed directly to `app.get(path, oauth.handleCallback)` with no wrapper,
+ * while staying framework-agnostic (no `hono` dependency).
+ */
+export type OAuthCallbackInput = Request | {
+    req: {
+        raw: Request;
+    };
+};
+/** The two functions a host server wires in to enable hosted OAuth. */
+export interface HostedOAuth {
+    /**
+     * Handle a browser redirect forwarded from the host's callback route.
+     * Correlates the request to the awaiting provider by its `state`, resolves
+     * that flow, and returns the page to render in the tab. Returns a 400 when no
+     * matching flow is pending (unknown/expired state).
+     *
+     * Accepts a raw `Request` or a Hono `Context` — pass it straight to a route:
+     *   app.get("/oauth/callback", oauth.handleCallback)   // Hono
+     *   Bun.serve({ fetch: oauth.handleCallback })         // raw Request
+     */
+    handleCallback(input: OAuthCallbackInput): Response;
+    /**
+     * Run — or short-circuit if already authorized — the OAuth flow for an MCP
+     * server URL. Shape-compatible with modality-mcp-kit's OAuthAllowAccessFn, so
+     * it can be passed straight to `mcpProxyHandler`.
+     */
+    allowAccess(serverUrl: string, mcpName: string): Promise<HostedOAuthResult>;
+}
+/**
+ * Build a reusable server-side OAuth integration around
+ * {@link CLIBrowserOAuthProvider}'s externalCallback mode: the OAuth redirect
+ * rides on the host's own HTTP server instead of a separate local port, so
+ * there is no extra port to collide with and the redirect_uri stays stable.
+ *
+ * The returned object owns a private `state → provider` map that correlates
+ * each inbound callback to the flow awaiting it, so concurrent flows (e.g.
+ * multiple MCP servers) never cross wires.
+ *
+ * Usage (Hono):
+ *   const oauth = createHostedOAuth({
+ *     callbackPath: "/oauth/callback",
+ *     clientName: "mcp-proxy",
+ *     getPort: async () => Number(new URL(getHonoUrl()).port),
+ *   });
+ *   app.get("/oauth/callback", oauth.handleCallback);
+ *   app.use("/proxy/:mcpName", mcpProxyHandler(SERVERS, oauth.allowAccess));
+ */
+export declare function createHostedOAuth(options: HostedOAuthOptions): HostedOAuth;
 export {};

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.8.1",
+  "version": "0.8.2",
   "name": "modality-ai",
   "repository": {
     "type": "git",
@@ -12,15 +12,15 @@
   "license": "ISC",
   "peerDependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "modality-mcp-kit": "^2.0.2"
+    "modality-mcp-kit": "^2.1.0"
   },
   "dependencies": {
-    "@ai-sdk/google": "^4.0.10",
-    "ai": "^7.0.18"
+    "@ai-sdk/google": "^4.0.24",
+    "ai": "^7.0.37"
   },
   "devDependencies": {
     "@types/bun": "^1.3.14",
-    "modality-bun-kit": "^1.3.14",
+    "modality-bun-kit": "^1.3.14-2",
     "typescript": "^7.0.2"
   },
   "exports": {