@n24q02m/hull 0.4.0-beta.9 → 0.5.0-beta.1

package/build/transport/streamable-http.d.ts

@@ -3,14 +3,14 @@
  *
  * Thin convenience wrapper around `@modelcontextprotocol/sdk`'s
  * `StreamableHTTPServerTransport` that pairs it with an `McpServer`
- * instance and an optional OAuth Bearer validation middleware.
+ * instance and an optional Bearer validation middleware.
  *
  * The SDK already implements the full 2025-11-25 transport spec
  * (session management, SSE streaming, stateful / stateless modes),
  * so this wrapper focuses on the mcp-core ergonomics:
  *
  *  - one-call `connect()` that wires server <-> transport
- *  - `handleRequest(req, res)` that applies the OAuth middleware
+ *  - `handleRequest(req, res)` that applies the auth middleware
  *    first and short-circuits with 401 on missing / invalid token
  *  - explicit `host` / `port` properties for lifecycle management
  *    (the actual port bind is left to the caller's http.Server)
@@ -18,7 +18,6 @@
 import type { IncomingMessage, ServerResponse } from 'node:http';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StreamableHTTPServerTransport, type StreamableHTTPServerTransportOptions } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import type { OAuthMiddleware } from './oauth-middleware.js';
 export interface StreamableHTTPServerOptions {
     /** MCP server instance that handles requests */
     server: McpServer;
@@ -26,8 +25,8 @@ export interface StreamableHTTPServerOptions {
     host?: string;
     /** Port to advertise (used for logging / display only) */
     port: number;
-    /** Optional OAuth middleware for Bearer token validation */
-    oauthMiddleware?: OAuthMiddleware;
+    /** Optional middleware for request authorization */
+    authMiddleware?: (req: IncomingMessage, res: ServerResponse) => Promise<boolean> | boolean;
     /** Transport options forwarded to StreamableHTTPServerTransport */
     transportOptions?: StreamableHTTPServerTransportOptions;
 }
@@ -35,14 +34,14 @@ export declare class StreamableHTTPServer {
     readonly host: string;
     readonly port: number;
     private readonly _server;
-    private readonly _oauth?;
+    private readonly _auth?;
     private readonly _transport;
     private _connected;
     constructor(options: StreamableHTTPServerOptions);
     /** Connect the MCP server to the transport. Call once before handleRequest. */
     connect(): Promise<void>;
     /**
-     * Handle an incoming HTTP request. Applies OAuth validation first if
+     * Handle an incoming HTTP request. Applies auth validation first if
      * configured, then delegates to the SDK transport.
      */
     handleRequest(req: IncomingMessage, res: ServerResponse, parsedBody?: unknown): Promise<void>;

package/build/transport/streamable-http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"streamable-http.d.ts","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,EAC1C,MAAM,oDAAoD,CAAA;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,MAAM,EAAE,SAAS,CAAA;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,eAAe,CAAC,EAAE,eAAe,CAAA;IACjC,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,oCAAoC,CAAA;CACxD;AAED,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,UAAU,CAAQ;IAE1B,YAAY,OAAO,EAAE,2BAA2B,EAM/C;IAED,+EAA+E;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7B;IAED;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlG;IAED,8DAA8D;IAC9D,IAAI,SAAS,IAAI,6BAA6B,CAE7C;IAED,yDAAyD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;CACF"}
+{"version":3,"file":"streamable-http.d.ts","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AACxE,OAAO,EACL,6BAA6B,EAC7B,KAAK,oCAAoC,EAC1C,MAAM,oDAAoD,CAAA;AAE3D,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,MAAM,EAAE,SAAS,CAAA;IACjB,0DAA0D;IAC1D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,oDAAoD;IACpD,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC1F,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,oCAAoC,CAAA;CACxD;AAED,qBAAa,oBAAoB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAW;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAA2E;IAClG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA+B;IAC1D,OAAO,CAAC,UAAU,CAAQ;IAE1B,YAAY,OAAO,EAAE,2BAA2B,EAM/C;IAED,+EAA+E;IACzE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAI7B;IAED;;;OAGG;IACG,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAMlG;IAED,8DAA8D;IAC9D,IAAI,SAAS,IAAI,6BAA6B,CAE7C;IAED,yDAAyD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;CACF"}

package/build/transport/streamable-http.js

@@ -3,14 +3,14 @@
  *
  * Thin convenience wrapper around `@modelcontextprotocol/sdk`'s
  * `StreamableHTTPServerTransport` that pairs it with an `McpServer`
- * instance and an optional OAuth Bearer validation middleware.
+ * instance and an optional Bearer validation middleware.
  *
  * The SDK already implements the full 2025-11-25 transport spec
  * (session management, SSE streaming, stateful / stateless modes),
  * so this wrapper focuses on the mcp-core ergonomics:
  *
  *  - one-call `connect()` that wires server <-> transport
- *  - `handleRequest(req, res)` that applies the OAuth middleware
+ *  - `handleRequest(req, res)` that applies the auth middleware
  *    first and short-circuits with 401 on missing / invalid token
  *  - explicit `host` / `port` properties for lifecycle management
  *    (the actual port bind is left to the caller's http.Server)
@@ -22,7 +22,7 @@ export class StreamableHTTPServer {
         this._server = options.server;
         this.host = options.host ?? '127.0.0.1';
         this.port = options.port;
-        this._oauth = options.oauthMiddleware;
+        this._auth = options.authMiddleware;
         this._transport = new StreamableHTTPServerTransport(options.transportOptions ?? { sessionIdGenerator: undefined });
     }
     /** Connect the MCP server to the transport. Call once before handleRequest. */
@@ -33,12 +33,12 @@ export class StreamableHTTPServer {
         this._connected = true;
     }
     /**
-     * Handle an incoming HTTP request. Applies OAuth validation first if
+     * Handle an incoming HTTP request. Applies auth validation first if
      * configured, then delegates to the SDK transport.
      */
     async handleRequest(req, res, parsedBody) {
-        if (this._oauth) {
-            const allowed = await this._oauth.validate(req, res);
+        if (this._auth) {
+            const allowed = await this._auth(req, res);
             if (!allowed)
                 return;
         }

package/build/transport/streamable-http.js.map

@@ -1 +1 @@
-{"version":3,"file":"streamable-http.js","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EACL,6BAA6B,EAE9B,MAAM,oDAAoD,CAAA;AAiB3D,MAAM,OAAO,oBAAoB;IAQ/B,YAAY,OAAoC;QAFxC,eAAU,GAAG,KAAK,CAAA;QAGxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,eAAe,CAAA;QACrC,IAAI,CAAC,UAAU,GAAG,IAAI,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAA;IACpH,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,UAAU;YAAE,OAAM;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAE,UAAoB;QACjF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACpD,IAAI,CAAC,OAAO;gBAAE,OAAM;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;IACzB,CAAC;CACF"}
+{"version":3,"file":"streamable-http.js","sourceRoot":"","sources":["../../src/transport/streamable-http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EACL,6BAA6B,EAE9B,MAAM,oDAAoD,CAAA;AAe3D,MAAM,OAAO,oBAAoB;IAQ/B,YAAY,OAAoC;QAFxC,eAAU,GAAG,KAAK,CAAA;QAGxB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;QACvC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACxB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,cAAc,CAAA;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,6BAA6B,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAA;IACpH,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,UAAU;YAAE,OAAM;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB,EAAE,UAAoB;QACjF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC1C,IAAI,CAAC,OAAO;gBAAE,OAAM;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;IAC3D,CAAC;IAED,8DAA8D;IAC9D,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAA;QAC7B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAA;IACzB,CAAC;CACF"}

package/build/util/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../src/util/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AA2EH;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA6ClE"}

package/build/{relay → util}/browser.js

@@ -80,8 +80,8 @@ async function openInWsl(url) {
 export async function tryOpenBrowser(url) {
     try {
         // Env-guard: suppress auto-open in headless / CI / autonomous-test contexts so a
-        // relay/clean-state server never hijacks the user's real browser with /authorize?nonce
-        // or 127.0.0.1 tabs. Set MCP_NO_BROWSER=1 or NO_BROWSER=1 to disable it explicitly;
+        // server never hijacks the user's real browser with sign-in or 127.0.0.1 tabs.
+        // Set MCP_NO_BROWSER=1 or NO_BROWSER=1 to disable it explicitly;
         // `CI` counts too because every CI provider sets it (GitHub Actions: CI=true) and a
         // build agent has no browser to hijack.
         if (envFlag('MCP_NO_BROWSER') || envFlag('NO_BROWSER') || envFlag('CI')) {

package/build/util/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/util/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC,4EAA4E;AAC5E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAEpD;;;;;;;;;;;GAWG;AACH,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,CAAA;AAClF,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACnC,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAe;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC3D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC7D,MAAM,OAAO,GAAG,qFAAqF,SAAS,yBAAyB,CAAA;QACvI,MAAM,cAAc,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;QACvD,MAAM,aAAa,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAA;QACxF,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,iFAAiF;QACjF,+EAA+E;QAC/E,iEAAiE;QACjE,oFAAoF;QACpF,wCAAwC;QACxC,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxE,OAAO,KAAK,CAAA;QACd,CAAC;QAED,eAAe;QACf,IAAI,CAAC,iDAAiD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,6BAA6B,EAAE,CAAC;YACxF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAA;QAC9B,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,QAAQ;QACR,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,2BAA2B;QAC7B,CAAC;QAED,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@n24q02m/hull",
-  "version": "0.4.0-beta.9",
-  "description": "hull TypeScript core: MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install",
+  "version": "0.5.0-beta.1",
+  "description": "hull TypeScript core: MCP Streamable HTTP 2025-11-25 transport, token-table HTTP auth, credential storage, CLI builder",
   "keywords": [
     "mcp",
     "model-context-protocol",
     "streamable-http",
-    "oauth21",
+    "token-auth",
     "transport",
     "claude",
     "cursor",
@@ -52,22 +52,6 @@
       "import": "./build/storage/index.js",
       "types": "./build/storage/index.d.ts"
     },
-    "./relay": {
-      "import": "./build/relay/client.js",
-      "types": "./build/relay/client.d.ts"
-    },
-    "./schema": {
-      "import": "./build/schema/types.js",
-      "types": "./build/schema/types.d.ts"
-    },
-    "./oauth": {
-      "import": "./build/oauth/index.js",
-      "types": "./build/oauth/index.d.ts"
-    },
-    "./auth": {
-      "import": "./build/auth/index.js",
-      "types": "./build/auth/index.d.ts"
-    },
     "./transport": {
       "import": "./build/transport/index.js",
       "types": "./build/transport/index.d.ts"
@@ -88,7 +72,6 @@
     "@modelcontextprotocol/sdk": "^1.30.1",
     "better-sqlite3": "^13.0.3",
     "env-paths": "^4.0.0",
-    "jose": "^6.2.12",
     "smol-toml": "^1.9.0"
   },
   "trustedDependencies": [
@@ -105,5 +88,5 @@
   "engines": {
     "node": ">=24.21.0"
   },
-  "packageManager": "bun@1.4.3"
+  "packageManager": "bun@1.4.4"
 }

package/build/auth/credential-form.d.ts

@@ -1,163 +0,0 @@
-/**
- * Credential form HTML renderer.
- *
- * Renders a dark-themed HTML form from a RelayConfigSchema.
- * Used as the OAuth authorization page presented to the user during relay config.
- *
- * This is a TypeScript port of core-py's `credential_form.py`. CSS and embedded JS
- * are kept verbatim so the rendered form has visual + behavioral parity between
- * Python and TS servers.
- */
-export interface ConfigField {
-    key: string;
-    label: string;
-    type: string;
-    placeholder?: string;
-    helpText?: string;
-    helpUrl?: string;
-    required?: boolean;
-    /** Regex string for client-side validation; rendered as the input's `pattern` attribute. */
-    validation?: string;
-}
-/**
- * Return true iff every required field in `schema` has a non-empty value in
- * `config`. For schemas whose fields are all optional, requires the explicit
- * `_setup_complete: "true"` flag — see core-py `is_schema_complete` docstring.
- *
- * Strict equality on the flag: only the literal string `"true"` counts. This
- * guards against legacy / partial bootstrap entries (e.g. peer-shared cloud
- * keys) tricking the auto-open gate into thinking the user has configured.
- */
-export declare function isSchemaComplete(config: Record<string, string> | null | undefined, schema: RelayConfigSchema): boolean;
-export interface CapabilityInfo {
-    label: string;
-    priority?: string;
-    description?: string;
-}
-/**
- * A credential-form tab (schema-level `tabs` capability). Each tab is a
- * mutually-exclusive credential mode; only the active tab's fields submit.
- */
-export interface TabGroup {
-    id: string;
-    label: string;
-    fields: ConfigField[];
-}
-/**
- * A repeatable field group (schema-level `cardGroup` capability). Renders
- * Add/Remove cards, each cloning `fields`; submitted as a JSON array under
- * `key` (e.g. `{ accounts: [{...}, {...}] }`).
- */
-export interface CardGroup {
-    key: string;
-    fields: ConfigField[];
-    itemLabel?: string;
-    heading?: string;
-    addButtonLabel?: string;
-    minItems?: number;
-    titleField?: string;
-}
-export interface RelayConfigSchema {
-    server: string;
-    displayName?: string;
-    description?: string;
-    fields?: ConfigField[];
-    capabilityInfo?: CapabilityInfo[];
-    /** Mutually-exclusive credential modes; see the tabbed render path. */
-    tabs?: TabGroup[];
-    /** One repeatable field group; see the card-group render path. */
-    cardGroup?: CardGroup;
-}
-export interface RenderOptions {
-    submitUrl: string;
-    pageTitle?: string;
-    /**
-     * Optional ``{KEY: VALUE}`` map populated by the OAuth AS from
-     * ``?prefill_<KEY>=<VALUE>`` query params on GET /authorize. Each matching
-     * field renders with an HTML-escaped ``value="..."`` attr so users only
-     * type what skret cannot supply (OTP / 2FA / one-time codes). Non-matching
-     * keys are ignored.
-     */
-    prefill?: Record<string, string>;
-    /**
-     * For a `tabs` schema, the id of the tab to render active on load (defaults
-     * to the first tab). Ignored for non-tabbed schemas.
-     */
-    initialTab?: string;
-    /**
-     * Opt-in workspace-username field (multi-user stable-sub). Honoured by the
-     * flat, `tabs`, and `cardGroup` render paths.
-     */
-    includeUsernameField?: boolean;
-}
-/**
- * Wrap `bodyHtml` in the shared dark-theme HTML shell.
- *
- * The shell provides `<!DOCTYPE html>`, `<head>` (charset, viewport, a
- * Content-Security-Policy meta, escaped `<title>`, embedded `FORM_SHELL_CSS`)
- * and a `<body>` whose only child is `bodyHtml`. `bodyHtml` is inserted
- * verbatim, so callers MUST pre-escape any untrusted values they interpolate.
- *
- * The CSP (`default-src 'none'; style-src 'unsafe-inline'; script-src
- * 'unsafe-inline'; connect-src 'self'`) permits the page's own inline
- * `<style>`/`<script>` and same-origin `fetch` submits while blocking any
- * external resource load.
- *
- * `title` is HTML-escaped before being placed in `<title>`.
- *
- * Used by `renderCredentialForm` (relay credential form) and by
- * `loginGetHandler` in `relay-login.ts` (the `/login` password gate) so both
- * pages share identical typography, palette, card layout, and input styling.
- * Parity with Python `render_form_shell` in
- * `packages/core-py/src/mcp_core/auth/credential_form.py`.
- */
-export declare function renderFormShell(title: string, bodyHtml: string): string;
-/**
- * Render a dark-themed HTML credential form from a RelayConfigSchema.
- *
- * @param schema RelayConfigSchema with server metadata and field definitions.
- * @param options.submitUrl URL the form POSTs to as JSON via fetch().
- * @param options.pageTitle Optional browser tab title. Defaults to displayName.
- * @param options.prefill Optional ``{KEY: VALUE}`` map for input ``value=`` attrs.
- * @returns Complete HTML document string, XSS-safe with all dynamic content escaped.
- */
-export declare function renderCredentialForm(schema: RelayConfigSchema, options: RenderOptions): string;
-/**
- * Relay config field schema (D7).
- *
- * Each field supports:
- *   name (string, required): config.enc key
- *   label (string, required): UI label
- *   required (boolean, required): server gate
- *   secret (boolean, optional, default false): true = never re-render value to HTML
- *   oauthField (boolean, optional, default false): true = managed by OAuth flow,
- *     render as Re-authorize button instead of input
- *   type (string, optional, default "text"): UI input type
- *   description (string, optional): help text
- *   default (unknown, optional): default value if user submits empty
- *   pattern (string, optional): client-side regex validation
- *
- * Parity with core-py `RelayConfigField` (snake_case `oauth_field` -> camelCase
- * `oauthField` per TS convention).
- */
-export interface RelayConfigField {
-    name: string;
-    label: string;
-    required: boolean;
-    secret?: boolean;
-    oauthField?: boolean;
-    type?: 'text' | 'password' | 'url' | 'email';
-    description?: string;
-    default?: unknown;
-    pattern?: string;
-}
-/** Return true if field stores a credential that must not be re-rendered to HTML. */
-export declare function isSecretField(field: RelayConfigField): boolean;
-/**
- * Return true if field represents an OAuth-managed credential.
- *
- * OAuth fields render as "Re-authorize" buttons, not raw input boxes.
- * Examples: refresh_token, access_token, id_token.
- */
-export declare function isOAuthField(field: RelayConfigField): boolean;
-//# sourceMappingURL=credential-form.d.ts.map

package/build/auth/credential-form.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-form.d.ts","sourceRoot":"","sources":["../../src/auth/credential-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,EACjD,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAqBT;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,WAAW,EAAE,CAAA;CACtB;AAED;;;;GAIG;AACH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;IACtB,cAAc,CAAC,EAAE,cAAc,EAAE,CAAA;IACjC,uEAAuE;IACvE,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAA;IACjB,kEAAkE;IAClE,SAAS,CAAC,EAAE,SAAS,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAC/B;AAwaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAgBvE;AAg8BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAob9F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,OAAO,CAAA;IACjB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,CAAA;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAE7D"}