refactor(server): dedupe decodeBase64 into a shared module

The same runtime-agnostic base64 decoder was defined identically in both
app.ts and mcpHttp.ts. Extract it to server/base64.ts and import it in
both, so a future fix (error handling, etc.) lives in one place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: benvinegar

.changeset/grumpy-spies-sing.md

@@ -0,0 +1,2 @@
+---
+---

server/app.ts

@@ -1,6 +1,7 @@
 import { Hono, type Context } from "hono";
 import { getCookie, setCookie } from "hono/cookie";
 import { streamSSE } from "hono/streaming";
+import { decodeBase64 } from "./base64.ts";
 import { EventBus } from "./events.ts";
 import { kitSummaries } from "./kits.ts";
 import { registerMcp } from "./mcpHttp.ts";
@@ -72,19 +73,6 @@ function inferAssetKind(contentType: string): AssetKind {
 const isAssetKind = (v: unknown): v is AssetKind => v === "image" || v === "trace" || v === "file";
 
 // base64 -> bytes, runtime-agnostic (atob is a global in Node and Workers).
-// atob throws on malformed input; rethrow as a clean error the callers turn
-// into a 400 instead of letting a raw DOMException surface as a 500.
-function decodeBase64(b64: string): Uint8Array {
-  let bin: string;
-  try {
-    bin = atob(b64);
-  } catch {
-    throw new Error("invalid base64 in `data`");
-  }
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
 // Docs and onboarding snippets are written against the local default; serve
 // them with the real origin so a deployed instance shows copy-pasteable URLs.
 const LOCAL_ORIGIN = "http://localhost:8228";

server/base64.ts

@@ -0,0 +1,14 @@
+// base64 -> bytes, runtime-agnostic (atob is a global in Node and Workers).
+// atob throws on malformed input; rethrow as a clean error so callers turn it
+// into a 400 instead of letting a raw DOMException surface as a 500.
+export function decodeBase64(b64: string): Uint8Array {
+  let bin: string;
+  try {
+    bin = atob(b64);
+  } catch {
+    throw new Error("invalid base64 in `data`");
+  }
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return bytes;
+}

server/mcpHttp.ts

@@ -1,5 +1,6 @@
 import type { Hono } from "hono";
 import type { CommentWait, Feedback } from "./app.ts";
+import { decodeBase64 } from "./base64.ts";
 import {
   type Asset,
   type AssetKind,
@@ -47,20 +48,6 @@ export interface McpDeps {
   guide: string;
 }
 
-// base64 -> bytes, runtime-agnostic (atob is a global in Node and Workers).
-// atob throws on malformed input; rethrow as a clean error the tool surfaces.
-function decodeBase64(b64: string): Uint8Array {
-  let bin: string;
-  try {
-    bin = atob(b64);
-  } catch {
-    throw new Error("invalid base64 in `data`");
-  }
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-}
-
 // Coerce loosely-typed tool args into validated SurfacePart[]. Unknown kinds
 // and empty parts are dropped rather than rejected, so a slightly-off call
 // still publishes what it can.