Function renderAuthError

packages/hosts/mcp/src/envelope.ts:186–207

(
  auth: McpAuthProvider["Service"],
  request: Request,
  outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
)

 * session, 404 means the session id is dead and the client must reconnect.
 */
const renderAuthError = (
  auth: McpAuthProvider["Service"],
  request: Request,
  outcome: Exclude<AuthOutcome, { readonly _tag: "Authenticated" }>,
): Response =>
  Match.value(outcome).pipe(
    Match.tag("Unauthorized", (u) =>
      jsonRpcResponse(
        401,
        -32001,
        "Unauthorized",
        u.challenge ?? `Bearer resource_metadata="${auth.resourceMetadataUrl(request)}"`,
      ),
    ),
    Match.tag("Forbidden", (f) => jsonRpcResponse(403, f.code ?? -32001, f.message)),
    Match.tag("Unavailable", (u) =>
      jsonRpcErrorBody(503, -32001, u.message, {
        retryAfterSeconds: UNAVAILABLE_RETRY_AFTER_SECONDS,
      }),
    ),
    Match.exhaustive,
  );

/** Render a non-`Response` {@link McpDispatchResult} discriminant. */
const renderDispatchError = (lookup: "not-found" | "forbidden"): Response =>