stitchkit 0.22.0 → 0.24.0

package/dist/server/index.js

@@ -398,6 +398,8 @@ function generateOpenApiDocument(config) {
     for (const [key, method] of Object.entries(service.methods)) {
       if (method.expose && !method.expose.includes("HTTP"))
         continue;
+      if (config.includeMethod && !config.includeMethod(method))
+        continue;
       const servicePath = joinPath("/", service.prefix, method.path === "/" ? "" : method.path);
       const fullPath = toOpenApiPath(pathPrefix ? joinPath(pathPrefix, servicePath) : servicePath);
       const parameters = [];

package/dist/server/openapi.d.ts

@@ -10,7 +10,7 @@
  * emits — not a divergent code path. Schemas are inlined (valid OpenAPI);
  * `$ref` de-duplication can come later if a spec grows unwieldy.
  */
-import type { RawRoute, ServiceDef } from './types';
+import type { MethodDef, RawRoute, ServiceDef } from './types';
 export interface OpenApiInfo {
     title: string;
     version: string;
@@ -31,6 +31,19 @@ export interface OpenApiConfig {
     }>;
     /** `servers` block for the spec. */
     servers?: OpenApiServer[];
+    /**
+     * Emit only the methods this predicate keeps — a curated public spec instead
+     * of the whole HTTP surface. The predicate decides the policy (the core stays
+     * generic): filter on `method.scope`, `method.meta` (the recommended
+     * declarative allowlist — mark endpoints `meta: { public: true }` and keep
+     * `(m) => m.meta?.public === true`), `method.key`, anything on the method.
+     * Omit to include every HTTP method (the default).
+     *
+     * This controls what the spec **advertises**, not access — a hidden endpoint
+     * is still callable; the auth `scope` gate is the actual guard. Build a
+     * separate filtered document for a public route (see the guide).
+     */
+    includeMethod?: (method: Readonly<MethodDef>) => boolean;
 }
 export interface OpenApiDocument {
     openapi: '3.1.0';
@@ -41,7 +54,9 @@ export interface OpenApiDocument {
 /**
  * Generate an OpenAPI 3.1 document from contract services. Only methods exposed
  * on HTTP are included — a method whose `expose` omits `'HTTP'` (an MCP/agent
- * only tool) is skipped, matching the router's own route-building rule.
+ * only tool) is skipped, matching the router's own route-building rule. Pass
+ * `includeMethod` to emit a curated subset (a public spec) instead of the whole
+ * surface.
  */
 export declare function generateOpenApiDocument(config: OpenApiConfig): OpenApiDocument;
 /**

package/dist/server/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/server/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEpD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC,CAAC;IAChE,oCAAoC;IACpC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChD;AAsED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAgH9E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAM9E"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/server/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE/D,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC;IACxB,iFAAiF;IACjF,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC,CAAC;IAChE,oCAAoC;IACpC,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC;CAC1D;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAChD;AAsED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,CAuH9E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,QAAQ,CAM9E"}

package/dist/tools/oauth-provider.d.ts

@@ -1,15 +1,25 @@
 import type { RawRoute } from '../server/types';
+/**
+ * OpenID Connect DCR `application_type` (SEP-837). A `native` client (desktop /
+ * CLI) may register an `http` loopback redirect; a `web` client may not — the
+ * mismatch is the usual cause of a `redirect_uri` rejection for CLI clients.
+ */
+export type ApplicationType = 'native' | 'web';
 /** A client as registered via DCR. Public clients (PKCE) carry no secret. */
 export interface RegisteredClient {
     clientId: string;
     redirectUris: string[];
     clientName?: string;
+    /** The `application_type` the client declared, when it declared one. */
+    applicationType?: ApplicationType;
 }
 /** Metadata posted to `/register` (RFC 7591) before a client id is assigned. */
 export interface ClientMetadata {
     redirectUris: string[];
     clientName?: string;
     tokenEndpointAuthMethod?: string;
+    /** `native` (desktop / CLI, loopback allowed) or `web` (https only). */
+    applicationType?: ApplicationType;
 }
 /** State persisted between `/authorize` and `/token`, keyed by the auth code. */
 export interface AuthCodeData {

package/dist/tools/oauth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/tools/oauth-provider.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6BAA6B;IAC7B,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;IACF,+EAA+E;IAC/E,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IACF,uEAAuE;IACvE,aAAa,CAAC,EAAE;QACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IAEF;;;;OAIG;IACH,aAAa,CACX,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,QAAQ,CAAC,CAAC;CAC3C;AAoED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CAkR1E"}
+{"version":3,"file":"oauth-provider.d.ts","sourceRoot":"","sources":["../../src/tools/oauth-provider.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,gFAAgF;AAChF,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,wFAAwF;IACxF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,aAAa,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4CAA4C;IAC5C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,6BAA6B;IAC7B,OAAO,EAAE;QACP,QAAQ,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC9D,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;KACzD,CAAC;IACF,+EAA+E;IAC/E,KAAK,EAAE;QACL,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IACF,uEAAuE;IACvE,aAAa,CAAC,EAAE;QACd,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;KAClD,CAAC;IAEF;;;;OAIG;IACH,aAAa,CACX,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,QAAQ,CAAC,CAAC;CAC3C;AA2ED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CAmT1E"}

package/dist/tools.d.ts

@@ -17,7 +17,7 @@ export { type DownloadToolConfig, mountDownload } from './tools/mount-download';
 export { mountUpload, type UploadToolConfig } from './tools/mount-upload';
 export { mountWait, type WaitToolConfig } from './tools/mount-wait';
 export { oauthProtectedResourceRoute, PROTECTED_RESOURCE_PATH, type ProtectedResourceConfig, protectedResourceMetadataUrl, wwwAuthenticateHeader, } from './tools/oauth-metadata';
-export { type AuthCodeData, type AuthRequest, type ClientMetadata, mountOAuthProvider, type OAuthProviderConfig, type RefreshData, type RegisteredClient, } from './tools/oauth-provider';
+export { type ApplicationType, type AuthCodeData, type AuthRequest, type ClientMetadata, mountOAuthProvider, type OAuthProviderConfig, type RefreshData, type RegisteredClient, } from './tools/oauth-provider';
 export { type ImplementRemoteOptions, implementRemote } from './tools/remote';
 export { createToolLogger, type ToolCallRecord, type ToolLoggerConfig, } from './tools/tool-logger';
 export { createToolkit, type Toolkit } from './tools/toolkit';

package/dist/tools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,KAAK,kBAAkB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../src/tools.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,KAAK,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EACL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,KAAK,kBAAkB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,sBAAsB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,KAAK,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,KAAK,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/tools.js

@@ -615,13 +615,15 @@ function json(body, status = 200, extraHeaders) {
 function oauthError(error, description, status = 400) {
   return json({ error, error_description: description }, status);
 }
-function isHttpUri(value) {
+function isRegistrableRedirectUri(value, applicationType) {
   try {
     const url = new URL(value);
     if (url.protocol === "https:")
       return true;
     if (url.protocol !== "http:")
       return false;
+    if (applicationType === "web")
+      return false;
     const host = url.hostname.replace(/^\[|\]$/g, "");
     return host === "127.0.0.1" || host === "::1" || host === "localhost";
   } catch {
@@ -655,6 +657,7 @@ function mountOAuthProvider(config) {
   const registerPath = `${base}/register`;
   const authorizePath = `${base}/authorize`;
   const tokenPath = `${base}/token`;
+  const redirectToClient = (uri, params) => redirectWith(uri, { ...params, iss: config.issuer });
   const metadataRoute = {
     method: "ALL",
     path: AS_METADATA_PATH,
@@ -670,6 +673,7 @@ function mountOAuthProvider(config) {
         grant_types_supported: config.refreshTokens ? ["authorization_code", "refresh_token"] : ["authorization_code"],
         code_challenge_methods_supported: ["S256"],
         token_endpoint_auth_methods_supported: ["none"],
+        authorization_response_iss_parameter_supported: true,
         ...config.scopesSupported && { scopes_supported: config.scopesSupported }
       });
     }
@@ -686,14 +690,20 @@ function mountOAuthProvider(config) {
       if (!isRecord(meta)) {
         return oauthError("invalid_client_metadata", "Body must be a JSON object");
       }
+      const rawAppType = meta.application_type;
+      if (rawAppType !== undefined && rawAppType !== "native" && rawAppType !== "web") {
+        return oauthError("invalid_client_metadata", "application_type must be 'native' or 'web'");
+      }
+      const applicationType = rawAppType;
       const redirectUris = meta.redirect_uris;
-      if (!Array.isArray(redirectUris) || redirectUris.length === 0 || !redirectUris.every((u) => typeof u === "string" && isHttpUri(u))) {
-        return oauthError("invalid_redirect_uri", "redirect_uris must be a non-empty array of absolute https URLs (http is allowed only on a loopback host)");
+      if (!Array.isArray(redirectUris) || redirectUris.length === 0 || !redirectUris.every((u) => typeof u === "string" && isRegistrableRedirectUri(u, applicationType))) {
+        return oauthError("invalid_redirect_uri", applicationType === "web" ? "redirect_uris must be a non-empty array of absolute https URLs (a web client cannot register an http loopback URI)" : "redirect_uris must be a non-empty array of absolute https URLs (http is allowed only on a loopback host)");
       }
       const client = await config.clients.register({
         redirectUris,
         clientName: typeof meta.client_name === "string" ? meta.client_name : undefined,
-        tokenEndpointAuthMethod: typeof meta.token_endpoint_auth_method === "string" ? meta.token_endpoint_auth_method : undefined
+        tokenEndpointAuthMethod: typeof meta.token_endpoint_auth_method === "string" ? meta.token_endpoint_auth_method : undefined,
+        ...applicationType && { applicationType }
       });
       return json({
         client_id: client.clientId,
@@ -701,7 +711,8 @@ function mountOAuthProvider(config) {
         token_endpoint_auth_method: "none",
         grant_types: config.refreshTokens ? ["authorization_code", "refresh_token"] : ["authorization_code"],
         response_types: ["code"],
-        ...client.clientName && { client_name: client.clientName }
+        ...client.clientName && { client_name: client.clientName },
+        ...client.applicationType && { application_type: client.applicationType }
       }, 201);
     }
   };
@@ -731,27 +742,27 @@ function mountOAuthProvider(config) {
         return oauthError("invalid_request", "redirect_uri does not match a registered URI");
       }
       if (responseType !== "code") {
-        return redirectWith(redirectUri, {
+        return redirectToClient(redirectUri, {
           error: "unsupported_response_type",
           ...state && { state }
         });
       }
       if (!codeChallenge || codeChallengeMethod !== "S256") {
-        return redirectWith(redirectUri, {
+        return redirectToClient(redirectUri, {
           error: "invalid_request",
           error_description: "PKCE S256 code_challenge is required",
           ...state && { state }
         });
       }
       if (!resource) {
-        return redirectWith(redirectUri, {
+        return redirectToClient(redirectUri, {
           error: "invalid_target",
           error_description: "resource parameter is required",
           ...state && { state }
         });
       }
       if (resource !== config.resource) {
-        return redirectWith(redirectUri, {
+        return redirectToClient(redirectUri, {
           error: "invalid_target",
           error_description: "resource is not served by this authorization server",
           ...state && { state }
@@ -772,7 +783,7 @@ function mountOAuthProvider(config) {
         userId: result.userId,
         expiresAt: Date.now() + AUTH_CODE_TTL_MS
       });
-      return redirectWith(redirectUri, { code, ...state && { state } });
+      return redirectToClient(redirectUri, { code, ...state && { state } });
     }
   };
   const issueAccessToken = (userId, audience, clientId, scope) => signJwt({ scope, client_id: clientId }, config.signingSecret, {

package/llms-full.txt

@@ -355,7 +355,10 @@ beforeHandle: (ctx, endpoint) => {
 }
 ```
 
-`meta` is **app-private** — it is never serialized into the OpenAPI document.
+`meta` is **app-private** — it is never serialized into the OpenAPI document. It
+can still *drive* generation: `generateOpenApiDocument`'s `includeMethod` reads
+it to curate a public spec (e.g. `meta: { public: true }`), without ever emitting
+`meta` itself — see [Curating the spec](./server.md#curating-the-spec--includemethod).
 
 > **Declare a meta type as a `type`, an inline literal, or with `satisfies` — not
 > an `interface`.** A TS `interface` has no implicit index signature (it can be
@@ -856,6 +859,60 @@ bus.emit('user.created', { id: '1' })
 A typed in-process pub/sub — decouple a handler from the side effects of its
 write without reaching for an external queue.
 
+## OpenAPI
+
+`generateOpenApiDocument` builds an OpenAPI 3.1 document straight from the
+contracts — the contract *is* the spec, no decorators or hand-maintained
+annotations (→ ADR 0018). `openApiRoute` serves it as a raw route:
+
+```ts
+import { generateOpenApiDocument, openApiRoute } from 'stitchkit/server'
+
+const doc = generateOpenApiDocument({
+  info: { title: 'My API', version: '1.0.0' },
+  services: [users, orders],
+})
+createServer({ services: [users, orders], rawRoutes: [openApiRoute('/openapi.json', doc)] })
+```
+
+Only HTTP-exposed methods appear (an MCP/agent-only tool is skipped).
+
+### Curating the spec — `includeMethod`
+
+To publish a **subset** — a public spec that advertises only some methods
+without revealing the rest — pass `includeMethod`. It keeps the core generic:
+*you* decide the policy, filtering on anything the method carries. The
+recommended declarative allowlist marks endpoints with the existing `meta`
+passthrough and keeps those:
+
+```ts
+// contract — declarative, one source of truth
+getBalance: { method: 'GET', path: '/balance', desc: '…', scope: 'account',
+              meta: { public: true }, output: BalanceSchema }
+
+// generation — the app's policy
+const publicDoc = generateOpenApiDocument({
+  info: { title: 'Public API', version: '1.0.0' },
+  services: [account],
+  includeMethod: (m) => m.meta?.public === true,
+})
+```
+
+An excluded method's whole entry — path *and* every schema inlined within it —
+is simply never emitted, so nothing about a hidden endpoint leaks.
+
+> **The filter advertises; it does not authorize.** Hiding a method from the
+> spec does **not** protect it — it is still callable, and the auth `scope` gate
+> is the only thing guarding it. And because `openApiRoute` closes over the
+> document you hand it, the filter only matters if you feed it a filtered one:
+> serve **two** documents — a full internal spec and a filtered public spec on
+> separate routes — never one unfiltered `openApiRoute` on a public path.
+
+```ts
+const internal = openApiRoute('/internal/openapi.json', fullDoc)   // behind auth
+const publicSpec = openApiRoute('/openapi.json', publicDoc)         // curated
+```
+
 
 ==============================================================================
 # Guide: Typed client  (docs/guide/client.md)
@@ -1336,14 +1393,36 @@ createServer({
 })
 ```
 
-Access tokens are signed HS256 JWTs (`signJwt`) whose `aud` is the resource —
-validate them in `auth` with `verifyJwt(token, secret, { audience: resource })`.
-`authorizeUser` is where the app authenticates the user (reuse an existing
-session) and records consent; return `{ userId }` to issue a code, or a
-`Response` to redirect the browser to a login page first. The AS and resource
-server can co-locate or live on separate origins. See
+Access tokens are signed HS256 JWTs (`signJwt`) whose `aud` is the resource and
+whose `iss` is the issuer — validate both in `auth` with
+`verifyJwt(token, secret, { audience: resource, issuer })`. `authorizeUser` is
+where the app authenticates the user (reuse an existing session) and records
+consent; return `{ userId }` to issue a code, or a `Response` to redirect the
+browser to a login page first. The AS and resource server can co-locate or live
+on separate origins. See
 [ADR 0015](../decisions/0015-oauth-resource-server.md).
 
+### Authorization hardening (MCP 2026-07-28)
+
+- **`iss` on every authorization response (RFC 9207, SEP-2468).** Success *and*
+  error redirects carry `iss`, and the AS metadata advertises
+  `authorization_response_iss_parameter_supported: true`. A client that talks to
+  several authorization servers validates `iss` before redeeming the code, which
+  closes the **mix-up attack** — an attacker's server cannot pass its response
+  off as this issuer's. Additive on the wire: a client that ignores `iss` is
+  unaffected.
+- **`application_type` on registration (SEP-837).** A client may declare
+  `"native"` (desktop / CLI) or `"web"` in its DCR body. A **native** client may
+  register an `http` loopback redirect (`http://127.0.0.1:…`, RFC 8252 §7.3); a
+  **web** client is held to `https` only — that mismatch is the usual cause of
+  the `redirect_uri` rejection CLI clients hit. Omit the field and registration
+  behaves exactly as before (loopback allowed); an unknown value is rejected
+  rather than silently defaulted.
+
+> Dynamic Client Registration is **deprecated** in the 2026-07-28 spec in favour
+> of Client ID Metadata Documents (CIMD), with a ≥12-month window. DCR keeps
+> working and stays supported here; CIMD support is tracked separately.
+
 ## Proxying a remote API — `implementRemote`
 
 `implement` binds a contract to local handlers. `implementRemote` binds it to a
@@ -3286,7 +3365,7 @@ Also re-exports the error helpers from `stitchkit/contract`.
 |--------|------|---------|
 | `generateOpenApiDocument` | function | an OpenAPI 3.1 document from contract services — [ADR 0018](../decisions/0018-openapi-generation.md) |
 | `openApiRoute` | function | a `RawRoute` that serves the document as JSON |
-| `OpenApiConfig` | _type_ | config for `generateOpenApiDocument` |
+| `OpenApiConfig` | _type_ | config for `generateOpenApiDocument` (incl. `includeMethod` — curate a public subset) — [guide](../guide/server.md#curating-the-spec--includemethod) |
 | `OpenApiDocument` | _type_ | the generated document |
 | `OpenApiInfo` | _type_ | the spec `info` block |
 | `OpenApiServer` | _type_ | a spec `servers` entry |
@@ -3413,6 +3492,7 @@ A native remote-connector auth surface for MCP — [guide](../guide/mcp-and-agen
 | `PROTECTED_RESOURCE_PATH` | const | the well-known metadata path |
 | `OAuthProviderConfig` | _type_ | config for `mountOAuthProvider` |
 | `ProtectedResourceConfig` | _type_ | config for `oauthProtectedResourceRoute` |
+| `ApplicationType` | _type_ | DCR `application_type` — `'native'` (loopback allowed) \| `'web'` (https only) |
 | `AuthCodeData` | _type_ | a stored authorization-code record |
 | `AuthRequest` | _type_ | a parsed authorization request |
 | `ClientMetadata` | _type_ | dynamic-client-registration metadata |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stitchkit",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "description": "Contract-first backend framework — one defineContract() into an HTTP API, MCP tools, AI-agent tools and a typed client. Bun and Node.",
   "keywords": [
     "bun",