@extrovert.dev/mcp 0.1.0-pre.3 → 0.1.0-pre.4

package/README.md

@@ -10,9 +10,8 @@ persistent inbox on a domain Extrovert owns: created in one tool call, sends and
 **scoped key that expires and revokes on its own**. The key is bound to a fixed org + project (call
 `whoami` to see them) — there is no project selector to manage.
 
-> **Prerelease status:** the package is published on npm under the `next` dist-tag. Extrovert does
-> not currently operate a hosted MCP endpoint; use the packaged stdio server or an HTTP deployment
-> you operate yourself.
+> **Prerelease status:** the package is published on npm under the `next` dist-tag. Extrovert also
+> operates `https://mcp.extrovert.dev/mcp` as a stateless Streamable HTTP endpoint with browser OAuth.
 
 The standout tool is **`wait_for_email`** — a blocking call that returns the next matching message
 with the **OTP code and verification link already extracted**. Trigger a sign-in elsewhere, then act
@@ -66,6 +65,21 @@ ever reaches the model host. Keep every model host on the narrowest scoped key i
 
 ---
 
+## Connect with hosted OAuth
+
+Give an OAuth-capable MCP client this URL:
+
+```text
+https://mcp.extrovert.dev/mcp
+```
+
+The endpoint publishes RFC 9728 protected-resource metadata and Clerk authorization-server
+discovery. Compatible clients open the browser sign-in and consent flow, then store and refresh the
+grant. Existing scoped `pk_agent_…` bearer keys also work when a client is configured explicitly.
+
+The hosted service runs MCP SDK v2's fresh-server-per-request handler: no process-local session map,
+sticky routing, or session teardown is required.
+
 ## Install and run the prerelease
 
 Use the explicit prerelease tag:
@@ -78,12 +92,12 @@ npx -y @extrovert.dev/mcp@next
 npx -y @extrovert.dev/mcp@next --help
 ```
 
-Pin `@extrovert.dev/mcp@0.1.0-pre.3` for a reproducible dogfood environment. The package installs the
+Pin `@extrovert.dev/mcp@0.1.0-pre.4` for a reproducible dogfood environment. The package installs the
 `extrovert-mcp` binary; this is the only Extrovert CLI currently shipped.
 
 ## Build and run from source
 
-Requires Node ≥ 18.18. From this directory:
+Requires Node ≥ 20. From this directory:
 
 ```bash
 pnpm install --frozen-lockfile
@@ -96,7 +110,7 @@ Two transports, one binary:
 # stdio — for local hosts (Claude Desktop, Claude Code, Cursor)
 node /absolute/path/to/extrovert/mcp/dist/bin.js
 
-# self-hosted Streamable HTTP at POST /mcp (default :8787)
+# self-hosted stateless Streamable HTTP at /mcp (default :8787)
 node /absolute/path/to/extrovert/mcp/dist/bin.js --http --port 8787
 ```
 
@@ -116,6 +130,9 @@ pnpm run dev -- --http  # tsx watch, HTTP
 | `EXTROVERT_MOCK` | *(off)* | Set `1` to force offline fixtures. |
 | `EXTROVERT_REQUEST_TIMEOUT_MS` | `30000` | Per-request timeout for non-blocking calls. |
 | `EXTROVERT_MAX_WAIT_MS` | `300000` | Upper bound the server allows `wait_for_email` to block. |
+| `EXTROVERT_MCP_OAUTH_ENABLED` | *(off)* | Require Clerk OAuth or an introspected agent key on HTTP. |
+| `EXTROVERT_MCP_OAUTH_ISSUER` | `https://clerk.extrovert.dev` | Clerk OAuth authorization-server issuer. |
+| `EXTROVERT_MCP_PUBLIC_URL` | `https://mcp.extrovert.dev/mcp` | Public RFC 9728 resource identifier. |
 | `PORT` / `HOST` | `8787` / `0.0.0.0` | `--http` bind. |
 
 > **Offline fixtures are opt-in.** With no `EXTROVERT_API_KEY`, the server still talks to the live
@@ -225,23 +242,23 @@ continue. No polling, no separate "check the inbox" round-trips.
 
 ---
 
-## Self-hosted HTTP notes
+## Stateless HTTP notes
 
 `extrovert-mcp --http` speaks MCP Streamable HTTP:
 
-- `POST /mcp` — client→server messages (the first must be `initialize`); the SDK assigns an
-  `mcp-session-id` returned on the response.
-- `GET /mcp` — server→client SSE stream for an established session.
-- `DELETE /mcp` — tear a session down.
-- `GET /healthz` — liveness + mode (`mock`/`live`) + active session count.
+- `POST /mcp` — one authenticated client→server request, served by a fresh MCP server instance.
+- `GET /mcp` and `DELETE /mcp` — legacy stateless compatibility responses; no session is retained.
+- `GET /healthz` — liveness, version, transport, and authentication mode.
+- `GET /.well-known/oauth-protected-resource/mcp` — RFC 9728 protected-resource metadata when
+  OAuth is enabled.
 
-Each session gets an isolated server + client. A **per-request scoped key** may be supplied via
-`Authorization: Bearer …` (or `x-extrovert-api-key`), so one hosted deployment can serve many agents,
-each with their own scoped key — falling back to `EXTROVERT_API_KEY` when no header is present. This
-is how a single hosted endpoint stays multi-tenant without ever holding an org-wide key.
+Each request gets an isolated server + client and emits no `mcp-session-id`, so requests can land on
+any cluster node. Production requires `Authorization: Bearer …` with either a Clerk OAuth access
+token or an existing scoped `pk_agent_…` key. The OAuth principal and its fixed safe capabilities
+are enforced again by the Extrovert API; the raw bearer token is never persisted by MCP or API.
 
-Extrovert does not operate this transport as a public hosted endpoint. These notes apply only to a
-deployment you control.
+`EXTROVERT_API_KEY` and unauthenticated fixture mode remain local/self-hosting conveniences only;
+the production service refuses to start without OAuth enabled.
 
 ---
 
@@ -252,7 +269,8 @@ src/
   bin.ts        CLI entrypoint (--http | stdio)
   server.ts     McpServer factory + instructions
   stdio.ts      stdio transport
-  http.ts       Streamable HTTP transport (Express, per-session, bearer key)
+  http.ts       stateless Streamable HTTP transport (Express, OAuth + scoped keys)
+  auth.ts       Clerk OAuth verification, RFC discovery, and agent-key introspection
   tools.ts      manifest-driven tools — zod schemas, annotations, handlers, registration
   client.ts     thin typed Extrovert REST client (one method per /v1 endpoint)
   config.ts     env-driven configuration

package/dist/auth.d.ts

@@ -0,0 +1,39 @@
+import { type AuthInfo, type OAuthMetadata, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+interface ClerkRequestState {
+    isAuthenticated: boolean;
+    toAuth(): unknown;
+}
+interface ClerkOAuthClient {
+    authenticateRequest(request: Request, options: {
+        acceptsToken: "oauth_token";
+    }): Promise<ClerkRequestState>;
+}
+export interface HostedAuthConfig {
+    issuer: URL;
+    resourceUrl: URL;
+    serviceDocumentationUrl: URL;
+    scopesSupported: string[];
+    clerkSecretKey: string;
+    clerkPublishableKey: string;
+}
+export interface ExtrovertTokenVerifierOptions {
+    clerk: ClerkOAuthClient;
+    resourceUrl: URL;
+    apiBaseUrl: string;
+    fetch?: typeof fetch;
+}
+/** Verify Clerk OAuth tokens and existing scoped Extrovert agent keys. */
+export declare class ExtrovertTokenVerifier implements OAuthTokenVerifier {
+    private readonly clerk;
+    private readonly resourceUrl;
+    private readonly apiBaseUrl;
+    private readonly doFetch;
+    constructor(options: ExtrovertTokenVerifierOptions);
+    verifyAccessToken(token: string): Promise<AuthInfo>;
+    private verifyAgentKey;
+}
+export declare function loadHostedAuthConfig(env?: NodeJS.ProcessEnv): HostedAuthConfig;
+export declare function createHostedTokenVerifier(config: HostedAuthConfig, apiBaseUrl: string): ExtrovertTokenVerifier;
+export declare function discoverOAuthMetadata(issuer: URL, doFetch?: typeof fetch): Promise<OAuthMetadata>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAkBtC,UAAU,iBAAiB;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB,MAAM,IAAI,OAAO,CAAC;CACnB;AAED,UAAU,gBAAgB;IACxB,mBAAmB,CACjB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;QAAE,YAAY,EAAE,aAAa,CAAA;KAAE,GACvC,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,GAAG,CAAC;IACZ,WAAW,EAAE,GAAG,CAAC;IACjB,uBAAuB,EAAE,GAAG,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,6BAA6B;IAC5C,KAAK,EAAE,gBAAgB,CAAC;IACxB,WAAW,EAAE,GAAG,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,0EAA0E;AAC1E,qBAAa,sBAAuB,YAAW,kBAAkB;IAC/D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAM;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;gBAE3B,OAAO,EAAE,6BAA6B;IAO5C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;YA0C3C,cAAc;CAiC7B;AAED,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CA8B3F;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,GACjB,sBAAsB,CASxB;AAED,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,GAAG,EACX,OAAO,GAAE,OAAO,KAAa,GAC5B,OAAO,CAAC,aAAa,CAAC,CAwBxB"}

package/dist/auth.js

@@ -0,0 +1,201 @@
+import { createClerkClient } from "@clerk/backend";
+import { OAuthError, OAuthErrorCode, } from "@modelcontextprotocol/server";
+const DEFAULT_ISSUER = "https://clerk.extrovert.dev";
+const DEFAULT_PUBLIC_URL = "https://mcp.extrovert.dev/mcp";
+const DISCOVERY_TIMEOUT_MS = 10_000;
+const AGENT_KEY_ATTESTATION_SECONDS = 300;
+/** Verify Clerk OAuth tokens and existing scoped Extrovert agent keys. */
+export class ExtrovertTokenVerifier {
+    clerk;
+    resourceUrl;
+    apiBaseUrl;
+    doFetch;
+    constructor(options) {
+        this.clerk = options.clerk;
+        this.resourceUrl = options.resourceUrl;
+        this.apiBaseUrl = options.apiBaseUrl.replace(/\/+$/, "");
+        this.doFetch = options.fetch ?? fetch;
+    }
+    async verifyAccessToken(token) {
+        if (token.startsWith("pk_agent_"))
+            return this.verifyAgentKey(token);
+        if (token.startsWith("pk_enroll_")) {
+            throw invalidToken("Enrollment tokens cannot authenticate the hosted MCP endpoint");
+        }
+        const request = new Request(this.resourceUrl, {
+            headers: { authorization: `Bearer ${token}` },
+        });
+        let state;
+        try {
+            state = await this.clerk.authenticateRequest(request, {
+                acceptsToken: "oauth_token",
+            });
+        }
+        catch {
+            throw invalidToken("OAuth access token verification failed");
+        }
+        if (!state.isAuthenticated)
+            throw invalidToken("OAuth access token is invalid or expired");
+        const auth = state.toAuth();
+        if (!isClerkOAuthAuth(auth)) {
+            throw invalidToken("Bearer token is not a Clerk OAuth access token");
+        }
+        const expiresAt = jwtExpiry(token);
+        if (expiresAt === undefined) {
+            // Production is deliberately configured for Clerk JWT access tokens. The
+            // MCP bearer gate requires a concrete expiry and must not invent one.
+            throw invalidToken("OAuth access token has no verifiable expiration");
+        }
+        return {
+            token,
+            clientId: auth.oauth_token.clientId,
+            scopes: auth.scopes,
+            expiresAt,
+            resource: this.resourceUrl,
+            extra: {
+                tokenType: "oauth_token",
+                userId: auth.oauth_token.userId,
+                subject: auth.subject,
+            },
+        };
+    }
+    async verifyAgentKey(token) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+        try {
+            const response = await this.doFetch(`${this.apiBaseUrl}/v1/auth/me`, {
+                headers: { authorization: `Bearer ${token}` },
+                signal: controller.signal,
+            });
+            if (!response.ok)
+                throw invalidToken("Extrovert agent key is invalid or revoked");
+            const body = (await response.json());
+            const keyId = requiredString(body.key_id);
+            const agentId = requiredString(body.agent_id);
+            const scopes = stringArray(body.scopes);
+            if (!keyId || !agentId) {
+                throw invalidToken("Extrovert agent-key introspection returned an invalid principal");
+            }
+            return {
+                token,
+                clientId: `extrovert-agent:${agentId}`,
+                scopes,
+                // This is the lifetime of the successful introspection result. Because
+                // HTTP is stateless, every later request validates the key again.
+                expiresAt: Math.floor(Date.now() / 1000) + AGENT_KEY_ATTESTATION_SECONDS,
+                resource: this.resourceUrl,
+                extra: { tokenType: "agent_key", keyId, agentId },
+            };
+        }
+        catch (error) {
+            if (OAuthError.isInstance(error))
+                throw error;
+            throw invalidToken("Extrovert agent-key verification failed");
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+export function loadHostedAuthConfig(env = process.env) {
+    const issuer = new URL((env.EXTROVERT_MCP_OAUTH_ISSUER ?? DEFAULT_ISSUER).trim());
+    const resourceUrl = new URL((env.EXTROVERT_MCP_PUBLIC_URL ?? DEFAULT_PUBLIC_URL).trim());
+    const serviceDocumentationUrl = new URL((env.EXTROVERT_MCP_DOCUMENTATION_URL ?? "https://docs.extrovert.dev/mcp/overview/").trim());
+    const clerkSecretKey = (env.CLERK_SECRET_KEY ?? "").trim();
+    const clerkPublishableKey = (env.CLERK_PUBLISHABLE_KEY ??
+        env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY ??
+        "").trim();
+    if (!clerkSecretKey || !clerkPublishableKey) {
+        throw new Error("hosted MCP OAuth requires CLERK_SECRET_KEY and CLERK_PUBLISHABLE_KEY");
+    }
+    if (issuer.protocol !== "https:" || resourceUrl.protocol !== "https:") {
+        throw new Error("hosted MCP OAuth issuer and resource URL must use HTTPS");
+    }
+    const scopesSupported = (env.EXTROVERT_MCP_OAUTH_SCOPES ?? "openid profile email")
+        .split(/[\s,]+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    return {
+        issuer,
+        resourceUrl,
+        serviceDocumentationUrl,
+        scopesSupported,
+        clerkSecretKey,
+        clerkPublishableKey,
+    };
+}
+export function createHostedTokenVerifier(config, apiBaseUrl) {
+    return new ExtrovertTokenVerifier({
+        clerk: createClerkClient({
+            secretKey: config.clerkSecretKey,
+            publishableKey: config.clerkPublishableKey,
+        }),
+        resourceUrl: config.resourceUrl,
+        apiBaseUrl,
+    });
+}
+export async function discoverOAuthMetadata(issuer, doFetch = fetch) {
+    const url = new URL("/.well-known/oauth-authorization-server", issuer);
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+    try {
+        const response = await doFetch(url, {
+            headers: { accept: "application/json" },
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            throw new Error(`OAuth discovery returned HTTP ${response.status}`);
+        const metadata = (await response.json());
+        if (metadata.issuer !== issuer.toString().replace(/\/$/, "")) {
+            throw new Error("OAuth discovery issuer does not match EXTROVERT_MCP_OAUTH_ISSUER");
+        }
+        for (const field of ["authorization_endpoint", "token_endpoint"]) {
+            const value = metadata[field];
+            if (typeof value !== "string" || new URL(value).protocol !== "https:") {
+                throw new Error(`OAuth discovery is missing a secure ${field}`);
+            }
+        }
+        return metadata;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+function isClerkOAuthAuth(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const candidate = value;
+    return (candidate.isAuthenticated === true &&
+        candidate.tokenType === "oauth_token" &&
+        typeof candidate.subject === "string" &&
+        Array.isArray(candidate.scopes) &&
+        !!candidate.oauth_token &&
+        typeof candidate.oauth_token.userId === "string" &&
+        typeof candidate.oauth_token.clientId === "string");
+}
+function jwtExpiry(token) {
+    const payload = token.split(".")[1];
+    if (!payload)
+        return undefined;
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.exp === "number" && Number.isSafeInteger(decoded.exp)
+            ? decoded.exp
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function requiredString(value) {
+    return typeof value === "string" ? value.trim() : "";
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string" && item.trim() !== "")
+        : [];
+}
+function invalidToken(message) {
+    return new OAuthError(OAuthErrorCode.InvalidToken, message);
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,UAAU,EACV,cAAc,GAIf,MAAM,8BAA8B,CAAC;AAEtC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAC3D,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,6BAA6B,GAAG,GAAG,CAAC;AAyC1C,0EAA0E;AAC1E,MAAM,OAAO,sBAAsB;IAChB,KAAK,CAAmB;IACxB,WAAW,CAAM;IACjB,UAAU,CAAS;IACnB,OAAO,CAAe;IAEvC,YAAY,OAAsC;QAChD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YACnC,MAAM,YAAY,CAAC,+DAA+D,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE;YAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,IAAI,KAAwB,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;gBACpD,YAAY,EAAE,aAAa;aAC5B,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,wCAAwC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,eAAe;YAAE,MAAM,YAAY,CAAC,0CAA0C,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,YAAY,CAAC,gDAAgD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,sEAAsE;YACtE,MAAM,YAAY,CAAC,iDAAiD,CAAC,CAAC;QACxE,CAAC;QACD,OAAO;YACL,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;YACT,QAAQ,EAAE,IAAI,CAAC,WAAW;YAC1B,KAAK,EAAE;gBACL,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,KAAa;QACxC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,aAAa,EAAE;gBACnE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,MAAM,YAAY,CAAC,2CAA2C,CAAC,CAAC;YAClF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAChE,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;gBACvB,MAAM,YAAY,CAAC,iEAAiE,CAAC,CAAC;YACxF,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,QAAQ,EAAE,mBAAmB,OAAO,EAAE;gBACtC,MAAM;gBACN,uEAAuE;gBACvE,kEAAkE;gBAClE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,6BAA6B;gBACxE,QAAQ,EAAE,IAAI,CAAC,WAAW;gBAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE;aAClD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;QAChE,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,0BAA0B,IAAI,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,MAAM,uBAAuB,GAAG,IAAI,GAAG,CACrC,CAAC,GAAG,CAAC,+BAA+B,IAAI,0CAA0C,CAAC,CAAC,IAAI,EAAE,CAC3F,CAAC;IACF,MAAM,cAAc,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,mBAAmB,GAAG,CAC1B,GAAG,CAAC,qBAAqB;QACzB,GAAG,CAAC,iCAAiC;QACrC,EAAE,CACH,CAAC,IAAI,EAAE,CAAC;IACT,IAAI,CAAC,cAAc,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,GAAG,CAAC,0BAA0B,IAAI,sBAAsB,CAAC;SAC/E,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,MAAM;QACN,WAAW;QACX,uBAAuB;QACvB,eAAe;QACf,cAAc;QACd,mBAAmB;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAwB,EACxB,UAAkB;IAElB,OAAO,IAAI,sBAAsB,CAAC;QAChC,KAAK,EAAE,iBAAiB,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC,cAAc;YAChC,cAAc,EAAE,MAAM,CAAC,mBAAmB;SAC3C,CAAC;QACF,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAW,EACX,UAAwB,KAAK;IAE7B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAClC,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;YACvC,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QACpE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,wBAAwB,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,uCAAuC,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,QAAyB,CAAC;IACnC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,OAAO,CACL,SAAS,CAAC,eAAe,KAAK,IAAI;QAClC,SAAS,CAAC,SAAS,KAAK,aAAa;QACrC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,SAAS,CAAC,WAAW;QACvB,OAAO,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,QAAQ;QAChD,OAAO,SAAS,CAAC,WAAW,CAAC,QAAQ,KAAK,QAAQ,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;YACzE,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACxF,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,UAAU,CAAC,cAAc,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC"}

package/dist/bin.js

@@ -59,7 +59,9 @@ Environment:
   EXTROVERT_API_BASE_URL   Base URL of the Extrovert REST API (default https://api.extrovert.dev)
   EXTROVERT_API_KEY        Scoped agent key (pk_agent_…) or enrollment key (pk_enroll_…)
   EXTROVERT_MOCK           Set to 1 to force offline fixture mode
-  PORT / HOST            Override --http bind (also honored by hosting platforms)
+  EXTROVERT_MCP_OAUTH_ENABLED  Set to 1 to protect HTTP with Clerk OAuth + scoped agent keys
+  EXTROVERT_MCP_PUBLIC_URL     Public OAuth resource URL (default https://mcp.extrovert.dev/mcp)
+  PORT / HOST                 Override --http bind (also honored by hosting platforms)
 
 Tools: redeem_enrollment, create_inbox, list_inboxes, get_inbox, update_inbox, delete_inbox,
        send_email, reply_email, read_messages, list_threads, search, wait_for_email

package/dist/bin.js.map

@@ -1 +1 @@
-{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAStC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR;gBACE,gEAAgE;gBAChE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;CAiBZ,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAqC,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAStC,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,MAAM;YACR,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAChD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;gBACvB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBAC3B,MAAM;YACR,CAAC;YACD,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;gBACjB,MAAM;YACR;gBACE,gEAAgE;gBAChE,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;CAmBZ,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,GAAqC,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.d.ts

@@ -46,6 +46,6 @@ type ReviewPolicy = "require_review" | "auto_send_graduated" | "allow_direct";
  */
 export declare function loadConfig(env?: NodeJS.ProcessEnv): ExtrovertConfig;
 export declare const SERVER_NAME = "extrovert";
-export declare const SERVER_VERSION = "0.1.0-pre.3";
+export declare const SERVER_VERSION = "0.1.0-pre.4";
 export {};
 //# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -49,5 +49,5 @@ export function loadConfig(env = process.env) {
     };
 }
 export const SERVER_NAME = "extrovert";
-export const SERVER_VERSION = "0.1.0-pre.3";
+export const SERVER_VERSION = "0.1.0-pre.4";
 //# sourceMappingURL=config.js.map

package/dist/contract.d.ts

@@ -36,10 +36,10 @@ export interface DiffJson {
 export type { ReviewIntent, ReviewFeedback, Rule, ReviewEvent } from "./types.js";
 /**
  * The published version of the Extrovert Review-Loop open contract (D14).
- * `0.1.0-pre.3` — PROVISIONAL, pre-1.0; aligned to the SDK package version + the MCP
+ * `0.1.0-pre.4` — PROVISIONAL, pre-1.0; aligned to the SDK package version + the MCP
  * `SERVER_VERSION` + the openapi `info.version`.
  */
-export declare const CONTRACT_VERSION: "0.1.0-pre.3";
+export declare const CONTRACT_VERSION: "0.1.0-pre.4";
 /** The stability posture of a published contract version. */
 export type ContractStability = "provisional" | "stable";
 /** The machine-readable manifest of the open contract (D14) — mirrors the SDK. */

package/dist/contract.js

@@ -15,10 +15,10 @@
  */
 /**
  * The published version of the Extrovert Review-Loop open contract (D14).
- * `0.1.0-pre.3` — PROVISIONAL, pre-1.0; aligned to the SDK package version + the MCP
+ * `0.1.0-pre.4` — PROVISIONAL, pre-1.0; aligned to the SDK package version + the MCP
  * `SERVER_VERSION` + the openapi `info.version`.
  */
-export const CONTRACT_VERSION = "0.1.0-pre.3";
+export const CONTRACT_VERSION = "0.1.0-pre.4";
 /**
  * The published manifest. Mirrors the SDK `CONTRACT_MANIFEST` (the MCP surface is
  * a subset of the SDK's, so `shapes` lists the agent-plane shapes the MCP server

package/dist/http.d.ts

@@ -1,18 +1,32 @@
 /**
- * Hosted HTTP transport — MCP Streamable HTTP over Express.
+ * Hosted MCP Streamable HTTP transport.
  *
- * Serves the same toolset as stdio at `POST /mcp` (plus `GET`/`DELETE /mcp` for
- * the SSE stream and session teardown). A scoped agent key may be supplied per
- * request via `Authorization: Bearer …` (or `x-extrovert-api-key`) so one hosted
- * deployment can serve many agents, each with their own scoped key — never an
- * org-wide key (spec §14). Falls back to the env key when no header is present.
- *
- * Sessions are tracked by the `mcp-session-id` header the SDK assigns on
- * initialize, so each agent gets an isolated server + client instance.
+ * MCP SDK v2 constructs a fresh server for every request. There is no in-memory
+ * session map, so any cluster node can serve any request and a rolling deploy
+ * cannot strand client sessions. Clerk remains the OAuth authorization server;
+ * this process is only a protected resource server.
  */
+import { type McpHttpHandler, type OAuthMetadata, type OAuthTokenVerifier } from "@modelcontextprotocol/server";
+import type { Express } from "express";
+import { type HostedAuthConfig } from "./auth.js";
+import { type ExtrovertConfig } from "./config.js";
 export interface HttpServerOptions {
     port?: number;
     host?: string;
+    env?: NodeJS.ProcessEnv;
+}
+export interface CreateHttpAppOptions extends HttpServerOptions {
+    verifier?: OAuthTokenVerifier;
+    oauthMetadata?: OAuthMetadata;
+    authConfig?: HostedAuthConfig;
+    baseConfig?: ExtrovertConfig;
+}
+export interface HttpApp {
+    app: Express;
+    handler: McpHttpHandler;
+    authEnabled: boolean;
+    close(): Promise<void>;
 }
+export declare function createHttpApp(options?: CreateHttpAppOptions): Promise<HttpApp>;
 export declare function runHttp(options?: HttpServerOptions): Promise<void>;
 //# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAqBD,wBAAsB,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+F5E"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACxB,MAAM,8BAA8B,CAAC;AAQtC,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AAE1D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAG5F,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAED,MAAM,WAAW,OAAO;IACtB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,EAAE,OAAO,CAAC;IACrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAsB,aAAa,CAAC,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwFxF;AAED,wBAAsB,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB5E"}