* refactor: Pass both building and getRequestEvent from outside of library
- Removes the need for importing from virtual modules at the expense of more user boilerplate
* chore: add Svelte and related dependencies to externals
* chore: lint
* refactor(docs): update SvelteKit integration docs with new building and getRequestEvent usage
* feat: add an option to encrypt tokens by default
* feat(auth): add OAuth token encryption support
* refactor(auth): streamline token handling in OAuth callback by utilizing setTokenUtil
* refactor(auth): replace direct token handling with setTokenUtil for improved clarity and maintainability
* refactor(auth): unify token handling by utilizing setTokenUtil for access and refresh tokens
* docs(auth): enhance documentation for OAuth token encryption, clarifying security risks and benefits
* chore: cleanup
* update test
Refactors
- Updated all imports and type references to use zod/v4.
- Replaced deprecated or changed Zod APIs and options across the codebase.
- Adjusted validation schemas and error messages to match Zod v4 requirements.
- Updated dependencies and lockfiles to use Zod v4.
* feat: add LLM copy button and view options components
- update routing for LLM text generation, adding .mdx to a route now generates its .md repsresentation
- add rewrite from /docs/:path*mdx to /llms.txt/:path so ai can traverse the llms.txt as routes
* chore: lint
* chore: cubic
* feat(mcp): add support for public clients with PKCE authentication
- Add conditional client authentication based on client type
- Support public clients using PKCE without client_secret requirement
- Add "none" to supported token endpoint authentication methods
- Make clientSecret optional in database schema for public clients
- Update client registration to handle public clients automatically
- Maintain backward compatibility with confidential clients
Fixes authentication issues with Claude.ai and other public OAuth clients
that use PKCE (Proof Key for Code Exchange) without client secrets.
Resolves#2813
* style: format code with prettier and fix trailing commas
* fix: resolve TypeScript errors in MCP plugin and tests
- Fix missing loginPage in oidcConfig for MCP tests
- Add type assertions for unknown response data types
- Handle optional clientSecret with null coalescing operators
- Update OIDC provider to support "none" auth method in metadata
- Fix type compatibility issues between public and confidential clients
* fix: resolve TypeScript, Vitest, and CI compatibility issues
- Fix missing loginPage in oidcConfig for MCP tests
- Add type assertions for unknown response data types
- Handle optional clientSecret with null coalescing operators
- Update OIDC provider to support "none" auth method in metadata
- Fix async describe callback to use synchronous setup with beforeAll
- Use ephemeral port allocation to prevent CI port conflicts
- Add explicit type annotations to avoid implicit any errors
* OpenAPI Schema Contract Fixed
* fix: resolve lint
* fix: ensure OAuth 2.0 spec compliance for public client registration
- Fix public client registration to omit client_secret field entirely
- Public clients now receive no client_secret property (was empty string)
- Maintains backward compatibility with confidential clients
- Addresses OAuth 2.0 Dynamic Client Registration (RFC 7591) requirements
* update docs
* remove any
* dont return secret on public client oidc
* remove any
* conditionally verify client secret
* update test
---------
Co-authored-by: Bereket Engida <Bekacru@gmail.com>
* fix(api-key): API Keys with expiresAt not null
The `deleteAllExpiredApiKeys` function in the apiKey plugin deletes API keys where `expiresAt` is `null`, despite these keys being intended as non-expiring.
This occurs because the deleteMany query does not explicitly exclude null values in the expiresAt condition.
This leads to unexpected key deletions, affecting keys like
`{ "_id": "6876ba254c23e91c05c9e95b", "expiresAt": null }`.
* Update index.ts
* chore: lint
---------
Co-authored-by: ping-maxwell <maxwell.multinite@gmail.com>
* feat(oidc): add refresh token support to discovery document and token endpoint
* types(oidc): ensure grant_types_supported is non-empty tuple
* fix(oidc): format grant_types_supported array for better readability
* fix(auth): implement standard Base64 encoding for HTTP Basic Auth in token refresh and validation
- Updated `refreshAccessToken` and `validateAuthorizationCode` functions to use standard Base64 encoding instead of URL-safe encoding for HTTP Basic Authentication.
- Ensured compatibility with providers like Notion and Twitter by adhering to OAuth2 specifications (RFC 7617).
- Set default authentication method to "basic" in the generic OAuth plugin for better consistency.
* fix(auth): utilize utility function for standard Base64 encoding in token refresh and validation
- Refactored `refreshAccessToken` and `validateAuthorizationCode` functions to use `encodeBasicAuthHeader` utility for standard Base64 encoding of HTTP Basic Authentication.
- This change enhances compatibility with providers like Notion and Twitter, adhering to OAuth2 specifications (RFC 7617).
- Simplifies the code by removing direct Buffer usage for encoding.
* use better auth utils
* fix base 64 code api
---------
Co-authored-by: Bereket Engida <Bekacru@gmail.com>
MaxwellandGitHub
PantotoneandGitHub
RobiandGitHub
Bereket EngidaandGitHub
Mohamad MohebifarandGitHub
KinfeMichael TarikuandGitHub
Fraol LemechaandGitHub
Dagmawi BabiandGitHub
Kinfe123
LamiandGitHub
AbdallahandGitHub
Thalles PassosandGitHub
ShubhamandGitHub
