@n24q02m/mcp-core 1.0.0-beta.3 → 1.0.0

package/build/relay/browser.js

@@ -5,6 +5,11 @@ import { execFile } from 'node:child_process';
 import { readFile } from 'node:fs/promises';
 import { promisify } from 'node:util';
 const execFileAsync = promisify(execFile);
+// Dedupe repeated tryOpenBrowser calls for the same URL. OAuth verification
+// URLs are stable so a retry loop would otherwise spawn a new tab per attempt.
+// Keep a 5-minute window per URL.
+const BROWSER_OPEN_DEDUPE_WINDOW_MS = 5 * 60 * 1000;
+const recentBrowserOpens = new Map();
 async function isWsl() {
     try {
         const version = await readFile('/proc/version', 'utf-8');
@@ -50,6 +55,11 @@ export async function tryOpenBrowser(url) {
         if (!/^https?:\/\//i.test(url)) {
             return false;
         }
+        const lastOpened = recentBrowserOpens.get(url);
+        if (lastOpened !== undefined && Date.now() - lastOpened < BROWSER_OPEN_DEDUPE_WINDOW_MS) {
+            return true;
+        }
+        recentBrowserOpens.set(url, Date.now());
         const platform = process.platform;
         if (platform === 'win32') {
             await execFileAsync('rundll32.exe', ['url.dll,FileProtocolHandler', url]);

package/build/relay/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/relay/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACnC,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAA;QACzE,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,eAAe;QACf,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAA;YACzE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,QAAQ;QACR,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,2BAA2B;QAC7B,CAAC;QAED,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../src/relay/browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;AAEzC,4EAA4E;AAC5E,+EAA+E;AAC/E,kCAAkC;AAClC,MAAM,6BAA6B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;AACnD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAA;AAEpD,KAAK,UAAU,KAAK;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;QACnC,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW;IAClC,4DAA4D;IAC5D,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAA;QACzE,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAW;IAC9C,IAAI,CAAC;QACH,eAAe;QACf,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QAED,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,6BAA6B,EAAE,CAAC;YACxF,OAAO,IAAI,CAAA;QACb,CAAC;QACD,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;QAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAEjC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,aAAa,CAAC,cAAc,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAA;YACzE,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,QAAQ;QACR,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,IAAI,MAAM;gBAAE,OAAO,IAAI,CAAA;YACvB,2BAA2B;QAC7B,CAAC;QAED,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC"}

package/build/storage/config-file.d.ts

@@ -1,4 +1,14 @@
 export declare function setConfigPath(path: string | null): void;
+export declare function clearKeyCacheForTesting(): void;
+/**
+ * Schedule a process exit so an MCP client can respawn the server and pick up
+ * fresh credentials from disk. Only relevant for stdio-mode servers whose
+ * client supervises restart. HTTP-mode servers update credentials in-process
+ * and MUST NOT call this — an exit mid-OAuth-device-code flow kills the user's
+ * verification window. Skipped under vitest (NODE_ENV=test) and when
+ * MCP_NO_RELOAD is set.
+ */
+export declare function scheduleReloadExit(): void;
 export declare function readConfig(serverName: string): Promise<Record<string, string> | null>;
 export declare function writeConfig(serverName: string, config: Record<string, string>): Promise<void>;
 export declare function deleteConfig(serverName: string): Promise<void>;

package/build/storage/config-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAyBA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEvD;AAwED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAG3F;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAKnG;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAapE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGrD;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAItE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBlF"}
+{"version":3,"file":"config-file.d.ts","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAyBA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAEvD;AA0BD,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AA+CD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAIzC;AAED,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAG3F;AAED,wBAAsB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYpE;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGrD;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAItE;AAED,wBAAsB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBlF"}

package/build/storage/config-file.js

@@ -30,9 +30,18 @@ async function withRetry(fn) {
     }
     throw new Error('Unreachable');
 }
+// Cache the derived file key to avoid expensive PBKDF2 iterations on every config read/write.
+// This significantly speeds up successive configuration accesses within the same process.
+let cachedKey = null;
+export function clearKeyCacheForTesting() {
+    cachedKey = null;
+}
 async function getKey() {
+    if (cachedKey)
+        return cachedKey;
     const [machineId, username] = await Promise.all([getMachineId(), getUsername()]);
-    return deriveFileKey(machineId, username);
+    cachedKey = await deriveFileKey(machineId, username);
+    return cachedKey;
 }
 async function loadStore() {
     const configPath = getConfigPath();
@@ -42,7 +51,7 @@ async function loadStore() {
     const [machineId, username] = await Promise.all([getMachineId(), getUsername()]);
     const data = await readFile(configPath);
     try {
-        const key = await deriveFileKey(machineId, username, PBKDF2_ITERATIONS);
+        const key = await getKey();
         const json = await decryptData(key, data);
         return JSON.parse(json);
     }
@@ -70,9 +79,16 @@ async function saveStore(store) {
     const encrypted = await encryptData(key, JSON.stringify(store));
     await withRetry(() => writeFile(configPath, encrypted));
 }
-function scheduleRestart() {
+/**
+ * Schedule a process exit so an MCP client can respawn the server and pick up
+ * fresh credentials from disk. Only relevant for stdio-mode servers whose
+ * client supervises restart. HTTP-mode servers update credentials in-process
+ * and MUST NOT call this — an exit mid-OAuth-device-code flow kills the user's
+ * verification window. Skipped under vitest (NODE_ENV=test) and when
+ * MCP_NO_RELOAD is set.
+ */
+export function scheduleReloadExit() {
     if (process.env.NODE_ENV !== 'test' && !process.env.MCP_NO_RELOAD) {
-        // Schedule process exit to reload config via MCP client
         setTimeout(() => process.exit(0), 1000).unref();
     }
 }
@@ -84,7 +100,6 @@ export async function writeConfig(serverName, config) {
     const store = await loadStore();
     store.servers[serverName] = config;
     await saveStore(store);
-    scheduleRestart();
 }
 export async function deleteConfig(serverName) {
     const store = await loadStore();
@@ -98,7 +113,6 @@ export async function deleteConfig(serverName) {
     else {
         await saveStore(store);
     }
-    scheduleRestart();
 }
 export async function listConfigs() {
     const store = await loadStore();
@@ -131,6 +145,5 @@ export async function importConfig(passphrase, data) {
         store.servers[name] = config;
     }
     await saveStore(store);
-    scheduleRestart();
 }
 //# sourceMappingURL=config-file.js.map

package/build/storage/config-file.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAO5D,2CAA2C;AAC3C,IAAI,kBAAkB,GAAkB,IAAI,CAAA;AAE5C,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,kBAAkB,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,IAAI,mBAAmB,CAAA;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAA;YACzG,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAA;YACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,OAAO,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAC3C,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAA;QACvE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;YAC7C,qCAAqC;YACrC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAClE,wDAAwD;QACxD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAA8B;IAClF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;IAClC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACtB,eAAe,EAAE,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,eAAe,EAAE,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAY;IACjE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACpE,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACjF,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;IAEhD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC9B,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACtB,eAAe,EAAE,CAAA;AACnB,CAAC"}
+{"version":3,"file":"config-file.js","sourceRoot":"","sources":["../../src/storage/config-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,QAAQ,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAE3D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,mBAAmB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;AAO5D,2CAA2C;AAC3C,IAAI,kBAAkB,GAAkB,IAAI,CAAA;AAE5C,MAAM,UAAU,aAAa,CAAC,IAAmB;IAC/C,kBAAkB,GAAG,IAAI,CAAA;AAC3B,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,kBAAkB,IAAI,mBAAmB,CAAA;AAClD,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,KAAK,UAAU,SAAS,CAAI,EAAoB;IAC9C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAA;QACnB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAA;YACzG,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,WAAW,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAA;YACvD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,8FAA8F;AAC9F,0FAA0F;AAC1F,IAAI,SAAS,GAAqB,IAAI,CAAA;AAEtC,MAAM,UAAU,uBAAuB;IACrC,SAAS,GAAG,IAAI,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,MAAM;IACnB,IAAI,SAAS;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IACpD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACpC,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;IAChF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IAEvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;QAC1B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,wBAAwB,CAAC,CAAA;YACpF,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;YAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;YAC7C,qCAAqC;YACrC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAO,KAAK,CAAA;QACd,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAkB;IACzC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACvC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAA;IAC1B,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IAC/D,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAClE,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;IACjD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB;IACjD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,IAAI,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,MAA8B;IAClF,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAA;IAClC,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAA;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB;IACnD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAAkB,EAAE,IAAY;IACjE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAA;QACpE,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAAA;YACjF,IAAI,GAAG,MAAM,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAA;IAEhD,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAA;IAC/B,2CAA2C;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAA;IAC9B,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;AACxB,CAAC"}

package/build/transport/local-server.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Local MCP server entry point combining OAuth 2.1 AS + Streamable HTTP transport.
+ *
+ * Composes:
+ *  1. OAuth 2.1 AS (credential form + token exchange) -- serves /authorize,
+ *     /token, /otp, /setup-status, /.well-known/*
+ *  2. MCP Streamable HTTP transport -- serves /mcp with optional Bearer auth
+ *  3. /health endpoint -- liveness probe
+ *
+ * For servers without credential input (e.g. godot) ``relaySchema`` may be
+ * omitted: only /mcp (unauthenticated) and /health are served.
+ *
+ * This is a TypeScript port of ``core-py``'s ``local_server.py``. Route layout,
+ * Bearer enforcement, and lifecycle semantics are kept identical.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { RelayConfigSchema } from '../auth/credential-form.js';
+import { type CredentialsCallback, type StepCallback } from '../auth/local-oauth-app.js';
+export interface RunLocalServerOptions {
+    /** Identifier used for JWT iss/aud and credential storage. */
+    serverName: string;
+    /** If undefined, server has NO auth (e.g., godot). */
+    relaySchema?: RelayConfigSchema;
+    /** 0 = auto-find a free port. Default: 0. */
+    port?: number;
+    /** Host to bind. Default '127.0.0.1'. */
+    host?: string;
+    /** Optional callback invoked with credentials after POST /authorize. */
+    onCredentialsSaved?: CredentialsCallback;
+    /** Optional callback invoked with step data after POST /otp. */
+    onStepSubmitted?: StepCallback;
+    /**
+     * Called with ``markSetupComplete`` function after server ready. Callers use
+     * this to wire their credential_state module so background tasks can update
+     * the form's status.
+     */
+    setupCompleteHook?: (markComplete: (key?: string) => void) => void;
+    /**
+     * Optional renderer used in place of the default credential form on GET
+     * /authorize. Passed through to ``createLocalOAuthApp``.
+     */
+    customCredentialFormHtml?: (schema: RelayConfigSchema, options: {
+        submitUrl: string;
+    }) => string;
+}
+export interface LocalServerHandle {
+    /** Actual TCP port bound. Non-zero even when ``options.port`` was 0. */
+    port: number;
+    /** Host bound. */
+    host: string;
+    /** Cleanly close transport + http server. */
+    close: () => Promise<void>;
+}
+/**
+ * Start an HTTP server with optional local OAuth AS + MCP Streamable HTTP transport.
+ *
+ * Behavior:
+ *  - If ``relaySchema`` is provided, serves OAuth routes (/authorize, /token,
+ *    /otp, /setup-status, /.well-known/*) AND /mcp with Bearer auth.
+ *  - If ``relaySchema`` is undefined (e.g., godot), serves ONLY /mcp without
+ *    auth (plus /health).
+ *  - Binds to ``host:port``. Port 0 auto-assigns via the OS.
+ *  - Returns a handle for lifecycle management; the server runs in the
+ *    background until ``close()`` is called.
+ */
+export declare function runLocalServer(serverFactory: () => McpServer, options: RunLocalServerOptions): Promise<LocalServerHandle>;
+//# sourceMappingURL=local-server.d.ts.map

package/build/transport/local-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.d.ts","sourceRoot":"","sources":["../../src/transport/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAA;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,EACL,KAAK,mBAAmB,EAGxB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAA;AAInC,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,mBAAmB,CAAA;IACxC,gEAAgE;IAChE,eAAe,CAAC,EAAE,YAAY,CAAA;IAC9B;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,KAAK,IAAI,CAAA;IAClE;;;OAGG;IACH,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,KAAK,MAAM,CAAA;CACjG;AAED,MAAM,WAAW,iBAAiB;IAChC,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,6CAA6C;IAC7C,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,aAAa,EAAE,MAAM,SAAS,EAC9B,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CAgH5B"}

package/build/transport/local-server.js

@@ -0,0 +1,131 @@
+/**
+ * Local MCP server entry point combining OAuth 2.1 AS + Streamable HTTP transport.
+ *
+ * Composes:
+ *  1. OAuth 2.1 AS (credential form + token exchange) -- serves /authorize,
+ *     /token, /otp, /setup-status, /.well-known/*
+ *  2. MCP Streamable HTTP transport -- serves /mcp with optional Bearer auth
+ *  3. /health endpoint -- liveness probe
+ *
+ * For servers without credential input (e.g. godot) ``relaySchema`` may be
+ * omitted: only /mcp (unauthenticated) and /health are served.
+ *
+ * This is a TypeScript port of ``core-py``'s ``local_server.py``. Route layout,
+ * Bearer enforcement, and lifecycle semantics are kept identical.
+ */
+import { createServer } from 'node:http';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { createLocalOAuthApp } from '../auth/local-oauth-app.js';
+import { jsonResponse } from '../auth/router.js';
+/**
+ * Start an HTTP server with optional local OAuth AS + MCP Streamable HTTP transport.
+ *
+ * Behavior:
+ *  - If ``relaySchema`` is provided, serves OAuth routes (/authorize, /token,
+ *    /otp, /setup-status, /.well-known/*) AND /mcp with Bearer auth.
+ *  - If ``relaySchema`` is undefined (e.g., godot), serves ONLY /mcp without
+ *    auth (plus /health).
+ *  - Binds to ``host:port``. Port 0 auto-assigns via the OS.
+ *  - Returns a handle for lifecycle management; the server runs in the
+ *    background until ``close()`` is called.
+ */
+export async function runLocalServer(serverFactory, options) {
+    const host = options.host ?? '127.0.0.1';
+    const wantedPort = options.port ?? 0;
+    let oauthApp = null;
+    let jwtIssuer = null;
+    if (options.relaySchema) {
+        oauthApp = await createLocalOAuthApp({
+            serverName: options.serverName,
+            relaySchema: options.relaySchema,
+            onCredentialsSaved: options.onCredentialsSaved,
+            onStepSubmitted: options.onStepSubmitted,
+            customCredentialFormHtml: options.customCredentialFormHtml
+        });
+        jwtIssuer = oauthApp.jwtIssuer;
+    }
+    // MCP server + transport. Stateless mode (sessionIdGenerator undefined) to
+    // match the Python StreamableHTTPSessionManager default.
+    const mcpServer = serverFactory();
+    const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+    await mcpServer.connect(transport);
+    async function mcpHandler(req, res) {
+        // Bearer auth if configured.
+        if (jwtIssuer) {
+            const authHeader = req.headers.authorization;
+            const match = authHeader?.match(/^Bearer\s+(.+)$/i);
+            const token = match?.[1]?.trim();
+            if (!token) {
+                res.writeHead(401, { 'WWW-Authenticate': 'Bearer' });
+                res.end();
+                return;
+            }
+            try {
+                await jwtIssuer.verifyAccessToken(token);
+            }
+            catch {
+                res.writeHead(401, { 'WWW-Authenticate': 'Bearer error="invalid_token"' });
+                res.end();
+                return;
+            }
+        }
+        // Delegate to MCP transport.
+        await transport.handleRequest(req, res);
+    }
+    const handler = async (req, res) => {
+        const url = new URL(req.url ?? '/', `http://${req.headers.host ?? 'localhost'}`);
+        const pathname = url.pathname;
+        // Route /mcp to MCP transport (with optional Bearer auth).
+        if (pathname === '/mcp') {
+            await mcpHandler(req, res);
+            return;
+        }
+        // Liveness probe. Always available.
+        if (pathname === '/health') {
+            jsonResponse(res, 200, { status: 'ok', server: options.serverName });
+            return;
+        }
+        // Route everything else to OAuth app if present.
+        if (oauthApp) {
+            await oauthApp.handler(req, res);
+            return;
+        }
+        // No OAuth app and no match -- 404.
+        jsonResponse(res, 404, { error: 'not_found' });
+    };
+    const httpServer = createServer((req, res) => {
+        handler(req, res).catch(() => {
+            if (!res.headersSent) {
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'internal_error' }));
+            }
+        });
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(wantedPort, host, () => {
+            httpServer.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const addr = httpServer.address();
+    const actualPort = addr.port;
+    // Invoke setup hook with markSetupComplete so caller can wire background
+    // tasks (e.g., GDrive token poll) to update the form status.
+    if (options.setupCompleteHook && oauthApp) {
+        options.setupCompleteHook(oauthApp.markSetupComplete);
+    }
+    return {
+        port: actualPort,
+        host,
+        close: () => new Promise((resolve, reject) => {
+            transport
+                .close()
+                .then(() => {
+                httpServer.close((err) => (err ? reject(err) : resolve()));
+            })
+                .catch(reject);
+        })
+    };
+}
+//# sourceMappingURL=local-server.js.map

package/build/transport/local-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-server.js","sourceRoot":"","sources":["../../src/transport/local-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAA;AAIhG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAElG,OAAO,EAEL,mBAAmB,EAGpB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAsChD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,aAA8B,EAC9B,OAA8B;IAE9B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAA;IAEpC,IAAI,QAAQ,GAA+B,IAAI,CAAA;IAC/C,IAAI,SAAS,GAAqB,IAAI,CAAA;IAEtC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACnC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,wBAAwB,EAAE,OAAO,CAAC,wBAAwB;SAC3D,CAAC,CAAA;QACF,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAChC,CAAC;IAED,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,SAAS,GAAG,aAAa,EAAE,CAAA;IACjC,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAA;IACtF,MAAM,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAElC,KAAK,UAAU,UAAU,CAAC,GAAoB,EAAE,GAAmB;QACjE,6BAA6B;QAC7B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAA;YAC5C,MAAM,KAAK,GAAG,UAAU,EAAE,KAAK,CAAC,kBAAkB,CAAC,CAAA;YACnD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;YAChC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAA;gBACpD,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAA;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,CAAC,CAAA;gBAC1E,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;QACH,CAAC;QACD,6BAA6B;QAC7B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAiB,EAAE;QACjF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAA;QAChF,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAA;QAE7B,2DAA2D;QAC3D,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC1B,OAAM;QACR,CAAC;QAED,oCAAoC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;YACpE,OAAM;QACR,CAAC;QAED,iDAAiD;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QAED,oCAAoC;QACpC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAChD,CAAC,CAAA;IAED,MAAM,UAAU,GAAW,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3B,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;YACtD,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE;YACvC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC1C,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAiB,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAA;IAE5B,yEAAyE;IACzE,6DAA6D;IAC7D,IAAI,OAAO,CAAC,iBAAiB,IAAI,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAA;IACvD,CAAC;IAED,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpC,SAAS;iBACN,KAAK,EAAE;iBACP,IAAI,CAAC,GAAG,EAAE;gBACT,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;YAC5D,CAAC,CAAC;iBACD,KAAK,CAAC,MAAM,CAAC,CAAA;QAClB,CAAC,CAAC;KACL,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@n24q02m/mcp-core",
-  "version": "1.0.0-beta.3",
+  "version": "1.0.0",
   "description": "Unified MCP Streamable HTTP 2025-11-25 transport, OAuth 2.1 AS, lifecycle, install",
   "keywords": [
     "mcp",
@@ -58,6 +58,10 @@
     "./oauth": {
       "import": "./build/oauth/index.js",
       "types": "./build/oauth/index.d.ts"
+    },
+    "./auth": {
+      "import": "./build/auth/index.js",
+      "types": "./build/auth/index.d.ts"
     }
   },
   "scripts": {