@nitrostack/cli 1.0.10 → 1.0.13

package/dist/commands/upgrade.js

@@ -2,22 +2,57 @@ import chalk from 'chalk';
 import { execSync } from 'child_process';
 import path from 'path';
 import fs from 'fs-extra';
+import https from 'https';
 import { createHeader, createBox, createSuccessBox, createErrorBox, NitroSpinner, log, spacer, nextSteps, NITRO_BANNER_FULL, showFooter } from '../ui/branding.js';
 import { trackEvent, shutdownAnalytics } from '../analytics/posthog.js';
 /**
- * Get the latest version of a package from npm registry
+ * Fetch a package's latest published version from NPM using standard https module.
  */
-function getLatestVersion(packageName = '@nitrostack/core') {
-    try {
-        const result = execSync(`npm view ${packageName} version`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return result;
-    }
-    catch {
-        throw new Error(`Failed to fetch latest version for ${packageName} from npm`);
-    }
+export function fetchLatestNpmVersion(packageName) {
+    return new Promise((resolve, reject) => {
+        const url = `https://registry.npmjs.org/${packageName}/latest`;
+        const req = https.get(url, {
+            headers: {
+                'Accept': 'application/json',
+                'User-Agent': 'nitrostack-cli-upgrade'
+            },
+            timeout: 5000
+        }, (res) => {
+            if (res.statusCode !== 200) {
+                reject(new Error(`Registry responded with HTTP ${res.statusCode}`));
+                return;
+            }
+            let data = '';
+            res.on('data', (chunk) => {
+                data += chunk;
+            });
+            // Handle stream errors
+            res.on('error', (err) => {
+                reject(new Error(`Response stream error: ${err.message}`));
+            });
+            res.on('end', () => {
+                try {
+                    const parsed = JSON.parse(data);
+                    if (parsed.version) {
+                        resolve(parsed.version);
+                    }
+                    else {
+                        reject(new Error('Invalid response structure from NPM registry'));
+                    }
+                }
+                catch (e) {
+                    reject(new Error(`Failed to parse response: ${e.message}`));
+                }
+            });
+        });
+        req.on('error', (err) => {
+            reject(err);
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            reject(new Error('Request timed out'));
+        });
+    });
 }
 /**
  * Get the current installed version of @nitrostack/core from package.json
@@ -32,15 +67,19 @@ function getCoreVersion(packageJsonPath) {
         null;
 }
 /**
- * Parse version string to extract the actual version number
+ * Parse version string to extract the actual numeric version.
+ *
+ * Strips any leading range operator (^ ~ >= <= > <) and drops the pre-release
+ * suffix (e.g. `-beta.1`) so the dot-separated segments always parse to numbers
+ * instead of producing `NaN` in `compareVersions`.
  */
 function parseVersion(versionString) {
-    return versionString.replace(/^[\^~>=<]+/, '');
+    return versionString.replace(/^[\^~>=<]+/, '').split('-')[0];
 }
 /**
  * Compare two version strings
  */
-function compareVersions(v1, v2) {
+export function compareVersions(v1, v2) {
     const parts1 = parseVersion(v1).split('.').map(Number);
     const parts2 = parseVersion(v2).split('.').map(Number);
     for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
@@ -54,37 +93,58 @@ function compareVersions(v1, v2) {
     return 0;
 }
 /**
- * Update all @nitrostack/* versions in package.json
+ * Determine if a dependency refers to a local file or workspace link.
  */
-function updatePackageJson(packageJsonPath, newVersion, dryRun) {
+export function isLocalDependency(version) {
+    return version.startsWith('file:') ||
+        version.startsWith('link:') ||
+        version.startsWith('workspace:') ||
+        version.startsWith('.') ||
+        version.startsWith('/');
+}
+/**
+ * Update all @nitrostack/* versions in package.json using dynamic npm registry fetch
+ */
+async function updatePackageJson(packageJsonPath, dryRun) {
     if (!fs.existsSync(packageJsonPath)) {
         return [];
     }
     const packageJson = fs.readJSONSync(packageJsonPath);
     const results = [];
     let hasChanges = false;
-    const updateDeps = (deps) => {
+    const updateDeps = async (deps) => {
         if (!deps)
             return;
-        for (const pkg of Object.keys(deps)) {
+        const promises = Object.keys(deps).map(async (pkg) => {
             if (pkg.startsWith('@nitrostack/')) {
                 const currentVersion = deps[pkg];
-                if (compareVersions(currentVersion, newVersion) < 0) {
-                    results.push({
-                        location: path.basename(path.dirname(packageJsonPath)),
-                        packageName: pkg,
-                        previousVersion: currentVersion,
-                        newVersion: `^${newVersion}`,
-                        upgraded: true,
-                    });
-                    deps[pkg] = `^${newVersion}`;
-                    hasChanges = true;
+                // Skip local dependencies entirely
+                if (isLocalDependency(currentVersion)) {
+                    return;
+                }
+                try {
+                    const latestVersion = await fetchLatestNpmVersion(pkg);
+                    if (compareVersions(currentVersion, latestVersion) < 0) {
+                        results.push({
+                            location: path.basename(path.dirname(packageJsonPath)),
+                            packageName: pkg,
+                            previousVersion: currentVersion,
+                            newVersion: `^${latestVersion}`,
+                            upgraded: true,
+                        });
+                        deps[pkg] = `^${latestVersion}`;
+                        hasChanges = true;
+                    }
+                }
+                catch (error) {
+                    console.warn(`\n⚠️  Skipped upgrade check for ${pkg}: ${error.message}`);
                 }
             }
-        }
+        });
+        await Promise.all(promises);
     };
-    updateDeps(packageJson.dependencies);
-    updateDeps(packageJson.devDependencies);
+    await updateDeps(packageJson.dependencies);
+    await updateDeps(packageJson.devDependencies);
     if (hasChanges && !dryRun) {
         fs.writeJSONSync(packageJsonPath, packageJson, { spaces: 2 });
     }
@@ -123,51 +183,22 @@ export async function upgradeCommand(options) {
         console.log(createErrorBox('Not a NitroStack Project', '@nitrostack/core is not a dependency'));
         process.exit(1);
     }
-    // Fetch latest version
-    const spinner = new NitroSpinner('Checking for updates...').start();
-    let latestVersion;
-    try {
-        latestVersion = getLatestVersion('@nitrostack/core');
-        spinner.succeed(`Latest version: ${chalk.cyan(latestVersion)}`);
-    }
-    catch (error) {
-        spinner.fail('Failed to fetch latest version');
-        process.exit(1);
-    }
-    // Check if already on latest
-    const currentParsedVersion = parseVersion(coreVersion);
-    if (compareVersions(currentParsedVersion, latestVersion) >= 0) {
-        spacer();
-        console.log(createSuccessBox('Already Up to Date', [
-            `Current version: ${currentParsedVersion}`,
-            `Latest version:  ${latestVersion}`,
-        ]));
-        trackEvent('cli_upgrade_completed', {
-            packages_upgraded: 0,
-            from_version: currentParsedVersion,
-            to_version: latestVersion,
-            dry_run: !!options.dryRun,
-            already_current: true,
-        });
-        await shutdownAnalytics();
-        return;
-    }
-    const allResults = [];
     const dryRun = options.dryRun ?? false;
     if (dryRun) {
         spacer();
         log('Dry run mode - no changes will be made', 'warning');
     }
     spacer();
-    log('Upgrading dependencies...', 'info');
+    log('Checking for package updates...', 'info');
     spacer();
+    const allResults = [];
     // Upgrade root
-    const rootSpinner = new NitroSpinner('Updating root package.json...').start();
+    const rootSpinner = new NitroSpinner('Checking root package.json...').start();
     try {
-        const results = updatePackageJson(rootPackageJsonPath, latestVersion, dryRun);
+        const results = await updatePackageJson(rootPackageJsonPath, dryRun);
         if (results.length > 0) {
             allResults.push(...results);
-            rootSpinner.succeed(`Root: Updated ${results.length} @nitrostack packages`);
+            rootSpinner.succeed(`Root: Found ${results.length} package update(s)`);
             if (!dryRun) {
                 const installSpinner = new NitroSpinner('Installing dependencies...').start();
                 runNpmInstall(projectRoot);
@@ -175,7 +206,7 @@ export async function upgradeCommand(options) {
             }
         }
         else {
-            rootSpinner.info('Root: All @nitrostack packages are up to date');
+            rootSpinner.info('Root: All @nitrostack packages are up to date (or local references)');
         }
     }
     catch (error) {
@@ -184,12 +215,12 @@ export async function upgradeCommand(options) {
     }
     // Upgrade widgets if they exist
     if (fs.existsSync(widgetsPackageJsonPath)) {
-        const widgetsSpinner = new NitroSpinner('Updating widgets package.json...').start();
+        const widgetsSpinner = new NitroSpinner('Checking widgets package.json...').start();
         try {
-            const results = updatePackageJson(widgetsPackageJsonPath, latestVersion, dryRun);
+            const results = await updatePackageJson(widgetsPackageJsonPath, dryRun);
             if (results.length > 0) {
                 allResults.push(...results);
-                widgetsSpinner.succeed(`Widgets: Updated ${results.length} @nitrostack packages`);
+                widgetsSpinner.succeed(`Widgets: Found ${results.length} package update(s)`);
                 if (!dryRun) {
                     const installSpinner = new NitroSpinner('Installing widget dependencies...').start();
                     runNpmInstall(widgetsPath);
@@ -197,54 +228,61 @@ export async function upgradeCommand(options) {
                 }
             }
             else {
-                widgetsSpinner.info('Widgets: All @nitrostack packages are up to date');
+                widgetsSpinner.info('Widgets: All @nitrostack packages are up to date (or local references)');
             }
         }
         catch (error) {
             widgetsSpinner.fail('Failed to upgrade widgets');
+            console.error(error);
         }
     }
     // Summary
     spacer();
     if (allResults.length === 0) {
-        log('No packages were upgraded', 'warning');
-    }
-    else {
-        // Unique packages upgraded
-        const uniquePackages = Array.from(new Set(allResults.map(r => r.packageName)));
-        const summaryItems = uniquePackages.map(pkg => {
-            const result = allResults.find(r => r.packageName === pkg);
-            return `${pkg}: ${parseVersion(result.previousVersion)} → ${parseVersion(result.newVersion)}`;
-        });
-        if (dryRun) {
-            spacer();
-            console.log(createBox([
-                chalk.yellow.bold('Dry run complete'),
-                '',
-                chalk.dim('No changes were made to your project.'),
-                chalk.dim('Run without --dry-run to apply the upgrade.'),
-            ], 'warning'));
-        }
-        else {
-            console.log(createSuccessBox('Upgrade Complete', [
-                ...summaryItems,
-                '',
-                chalk.dim(`Total updates across all packages: ${allResults.length}`)
-            ]));
-            nextSteps([
-                'Review the changes in package.json',
-                'Restart your development server',
-                'Check docs.nitrostack.ai for migration guides',
-            ]);
-        }
-        showFooter();
+        console.log(createSuccessBox('Already Up to Date', [
+            'All @nitrostack packages are already running their latest versions.',
+        ]));
         trackEvent('cli_upgrade_completed', {
-            packages_upgraded: allResults.length,
-            from_version: currentParsedVersion,
-            to_version: latestVersion,
+            packages_upgraded: 0,
             dry_run: dryRun,
-            already_current: false,
+            already_current: true,
         });
         await shutdownAnalytics();
+        return;
     }
+    // Unique packages upgraded
+    const uniquePackages = Array.from(new Set(allResults.map(r => r.packageName)));
+    const summaryItems = uniquePackages.map(pkg => {
+        const result = allResults.find(r => r.packageName === pkg);
+        return `${pkg}: ${parseVersion(result.previousVersion)} → ${parseVersion(result.newVersion)}`;
+    });
+    if (dryRun) {
+        spacer();
+        console.log(createBox([
+            chalk.yellow.bold('Dry Run - Proposed Upgrades:'),
+            ...summaryItems.map(item => `  • ${item}`),
+            '',
+            chalk.dim('No changes were made to your project.'),
+            chalk.dim('Run without --dry-run to apply the upgrade.'),
+        ], 'warning'));
+    }
+    else {
+        console.log(createSuccessBox('Upgrade Complete', [
+            ...summaryItems,
+            '',
+            chalk.dim(`Total updates across all packages: ${allResults.length}`)
+        ]));
+        nextSteps([
+            'Review the changes in package.json',
+            'Restart your development server',
+            'Check docs.nitrostack.ai for migration guides',
+        ]);
+    }
+    showFooter();
+    trackEvent('cli_upgrade_completed', {
+        packages_upgraded: allResults.length,
+        dry_run: dryRun,
+        already_current: false,
+    });
+    await shutdownAnalytics();
 }

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export { startCommand } from './commands/start.js';
 export { generate } from './commands/generate.js';
 export { upgradeCommand } from './commands/upgrade.js';
 export { installCommand } from './commands/install.js';
+export { cursorCommand } from './commands/cursor.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,wBAAgB,aAAa,YAgE5B;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,aAAa,YA4E5B;AAGD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -8,6 +8,7 @@ import { startCommand } from './commands/start.js';
 import { generate } from './commands/generate.js';
 import { upgradeCommand } from './commands/upgrade.js';
 import { installCommand } from './commands/install.js';
+import { cursorCommand } from './commands/cursor.js';
 const require = createRequire(import.meta.url);
 const packageJson = require('../package.json');
 export function createProgram() {
@@ -64,6 +65,17 @@ export function createProgram() {
         .option('--skip-widgets', 'Skip installing widget dependencies')
         .option('--production', 'Install production dependencies only')
         .action(installCommand);
+    program
+        .command('cursor')
+        .alias('c')
+        .description('Integrate this MCP server with Cursor')
+        .option('-g, --global', 'Install globally to ~/.cursor/mcp.json')
+        .option('-l, --local', 'Install locally to .cursor/mcp.json')
+        .option('-t, --type <type>', 'Connection type: "command", "legacy-sse", or "streamable-http" (alias: "sse" → legacy-sse)')
+        .option('-u, --url <url>', 'HTTP connection URL (for legacy-sse or streamable-http)')
+        .option('-p, --port <port>', 'Port for default HTTP URL (for legacy-sse or streamable-http)')
+        .option('--force', 'Force overwrite of existing configuration')
+        .action(cursorCommand);
     return program;
 }
 // Re-export commands for programmatic use
@@ -74,6 +86,7 @@ export { startCommand } from './commands/start.js';
 export { generate } from './commands/generate.js';
 export { upgradeCommand } from './commands/upgrade.js';
 export { installCommand } from './commands/install.js';
+export { cursorCommand } from './commands/cursor.js';
 // Run the CLI when this module is the entry point
 import { fileURLToPath } from 'url';
 import { realpathSync } from 'fs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitrostack/cli",
-  "version": "1.0.10",
+  "version": "1.0.13",
   "description": "CLI for NitroStack - Create and manage MCP server projects",
   "type": "module",
   "main": "dist/index.js",
@@ -11,9 +11,9 @@
   },
   "exports": {
     ".": {
+      "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
-      "require": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "require": "./dist/index.js"
     }
   },
   "files": [
@@ -68,4 +68,4 @@
     "url": "https://github.com/nitrocloudofficial/nitrostack/issues"
   },
   "homepage": "https://nitrostack.ai"
-}
+}

package/templates/typescript-oauth/.env.example

@@ -1,27 +1,88 @@
-# OAuth 2.1 MCP Server Configuration
+# NitroStack Configuration
+NITRO_LOG_LEVEL=info
+NITROSTACK_APP_MODE=openai
+
+# Server Transport Configuration (Optional)
 # =============================================================================
-# TRANSPORT MODE (AUTO-CONFIGURED)
+# MCP_TRANSPORT_TYPE: Toggles transport mode. Values: stdio | http | dual.
+# Defaults to 'stdio' in development and 'dual' in production/NODE_ENV=production.
 # =============================================================================
-# When OAuth is configured, the server automatically runs in DUAL mode:
-# - STDIO: For MCP proto¯col communication with Studio/Claude
-# - HTTP: For OAuth metadata endpoints (/.well-known/oauth-protected-resource)
-# Both transports run simultaneously on different channels.
+# MCP_TRANSPORT_TYPE=dual
+# PORT=3000
+# HOST=localhost
+# ENABLE_CORS=true
+
+# Streamable HTTP Session Limits (Optional)
 # =============================================================================
-# REQUIRED: Server Configuration
+# Bounds memory against unauthenticated initialize floods. Defaults: 1000 sessions,
+# 30-minute idle timeout. Only applies when running in http or dual transport mode.
+# =============================================================================
+# MCP_MAX_SESSIONS=1000
+# MCP_SESSION_TIMEOUT_MS=1800000
+
+# OAuth 2.1 MCP Server Configuration
 # =============================================================================
+# Enforcement Gate (Optional)
 # =============================================================================
-# Auth0 Configuration
+# OAUTH_REQUIRED controls whether authentication is enforced.
+#   - Unset / false (default): auth is NOT enforced. The server runs out-of-the-box
+#     and protected endpoints are reachable without a token. Best for local dev.
+#   - true: auth is enforced (fail-closed). If neither JWKS_URI nor
+#     INTROSPECTION_ENDPOINT is configured, the server STILL starts and logs a
+#     clear warning, but rejects all protected requests until a verifier is set.
+# Set this to true (and configure a verifier below) before deploying.
+# =============================================================================
+# OAUTH_REQUIRED=true
+
+# =============================================================================
+# REQUIRED: Server Configuration
 # =============================================================================
-# After creating your API and Application in Auth0, fill in these values:
 # Your Auth0 API Identifier (from APIs → MCP Server → Identifier)
 # This MUST match exactly what you set when creating the API
-# This MUST match exactly what you set when creating the API
 RESOURCE_URI=https://mcplocal
-# Your Auth0 tenant domain (authorization server)
+
+# Your Auth0 tenant domain (authorization server URL)
 AUTH_SERVER_URL=https://dev-5dt0utuk315713tjm.us.auth0.com
-# Expected token audience (should match RESOURCE_URI)
+
+# Cryptographic JWKS Signature Verification (Recommended)
+# =============================================================================
+# If configured, the SDK cryptographically verifies token signatures using JWKS keys.
+# Token validation is SECURE BY DEFAULT (fail-closed): if neither JWKS_URI nor an
+# introspection endpoint (below) is configured, ALL tokens are rejected. Configure
+# one of them for a working server.
+# NOTE: Unsigned/signature-less token decoding is disabled by default and is only
+# available via the in-code `allowInsecureTokenDecode: true` option in
+# OAuthModule.forRoot(...) — intended for local development only, never production.
+# =============================================================================
+# JWKS_URI=https://dev-5dt0utuk315713tjm.us.auth0.com/.well-known/jwks.json
+
+# Expected token validation audience (should match RESOURCE_URI)
 TOKEN_AUDIENCE=https://mcplocal
-# Expected token issuer (your Auth0 tenant domain with trailing slash)
+
+# Expected token validation issuer (your authorization server tenant domain)
 TOKEN_ISSUER=https://dev-5dt0utuk315713tjm.us.auth0.com
 
-DUFFEL_API_KEY=duffel_test_-w0wGDHB0M3DU9k-sBeUbxLqwcibUQqfEbjWDTKNnly
+# Token Introspection Configuration (Alternative to JWKS signature verification)
+# =============================================================================
+# INTROSPECTION_ENDPOINT=https://dev-5dt0utuk315713tjm.us.auth0.com/oauth/introspect
+# INTROSPECTION_CLIENT_ID=your-introspection-client-id
+# INTROSPECTION_CLIENT_SECRET=your-introspection-client-secret
+
+# OAuth Discovery Settings (Optional)
+# =============================================================================
+# OAUTH_DISCOVERY_PORT=3005
+# OAUTH_DISCOVERY_AUTO_RETRY=true
+# MCP_SERVER_PORT=3000
+
+# Dynamic Client Registration (Optional / disabled by default)
+# =============================================================================
+# Set to 'true' to expose the /oauth/v2/register endpoint. It only serves the
+# statically configured client below; without OAUTH_CLIENT_ID it stays disabled.
+# =============================================================================
+# OAUTH_ENABLE_CLIENT_REGISTRATION=true
+# OAUTH_CLIENT_ID=your-client-id
+# OAUTH_CLIENT_SECRET=your-client-secret
+
+# Duffel API Integration (Required for Flight Search & Booking)
+# =============================================================================
+DUFFEL_API_KEY=your-duffel-api-key

package/templates/typescript-oauth/README.md

@@ -1,70 +1,56 @@
-# ✈️ NitroStack Flight Booking
+# NitroStack OAuth Template
 
-A production-ready template showcasing real-time flight search and booking with **Duffel API** integration. Learn how to build complex, authenticated MCP servers with high-impact visual widgets.
+Template for OAuth 2.1-enabled MCP servers, including auth-aware tool patterns
+and a production-style project structure.
 
-## ✨ Features
+## What This Template Includes
 
-- **Real-time Search** — Powered by the Duffel API (300+ airlines).
-- **Seat Selection** — Interactive visual cabin maps with seat pickers.
-- **Secure Payments** — Simulated secure booking and confirmation flows.
-- **Advanced Auth** — Optional OAuth 2.1 support for protected MCP servers.
+- OAuth 2.1 oriented project setup
+- Tool and module structure for protected workflows
+- Environment-based configuration (`.env`)
+- Widget-ready frontend integration
 
----
-
-## 🚀 Quick Start
-
-### 1. Initialize Your Project
-
-```bash
-npx nitrostack init my-flight-app --template typescript-oauth
-cd my-flight-app
-```
-
-### 2. Install Dependencies
+## Quick Start
 
 ```bash
-npm run install:all
+npx @nitrostack/cli init my-oauth-app --template typescript-oauth
+cd my-oauth-app
+npm run dev
 ```
 
-### 3. Get NitroStudio
+## Configuration
 
-Experience the visual seat selection and flight search as your users would see it.
+1. Copy `.env.example` to `.env`
+2. Configure OAuth provider values
+3. (Optional) Configure provider-specific API keys
 
-![NitroStudio](../../../../assets/gif/nitrostudio-main.gif)
+For detailed setup, see `OAUTH_SETUP.md`.
 
-1. **Download NitroStudio**: [nitrostack.ai/studio](https://nitrostack.ai/studio)
-2. **Open Project**: Launch NitroStudio and select your project folder.
+## Common Commands
 
----
-
-## ⚙️ Configuration
-
-### 1. Duffel API Key
-
-You need a free Duffel API key to see live flight data:
+```bash
+npm run dev
+npm run build
+npm start
+```
 
-1. Sign up at [duffel.com](https://duffel.com/).
-2. Copy your **Test Token** from the dashboard.
-3. Create `.env` from the example:
-   ```bash
-   cp .env.example .env
-   ```
-4. Update `DUFFEL_API_KEY` in your `.env`.
+## NitroStudio
 
-### 2. OAuth (Optional)
+Use NitroStudio to test auth flows, inspect tool requests, and validate behavior.
 
-For production scenarios requiring user authentication, refer to [OAUTH_SETUP.md](./OAUTH_SETUP.md).
+- Download: <https://nitrostack.ai/studio>
+- Studio: <https://nitrostack.ai/studio>
 
----
+## Links
 
-## 🛠️ Commands
+- Docs: <https://docs.nitrostack.ai>
+- OAuth docs: <https://docs.nitrostack.ai/sdk/typescript/11-oauth-authentication>
+- Main repository: <https://github.com/nitrocloudofficial/nitrostack>
 
-- `npm run dev` — Start the development ecosystem.
-- `npm run build` — Bundle TypeScript and widgets for deployment.
-- `npm run upgrade` — Keep NitroStack core up to date.
+## Community
 
----
-**Official Resources**
-- [Website](https://nitrostack.ai)
-- [Docs](https://docs.nitrostack.ai)
-- [Duffel API](https://duffel.com/docs)
+- Discord: <https://discord.gg/uVWey6UhuD>
+- X: <https://x.com/nitrostackai>
+- YouTube: <https://www.youtube.com/@nitrostackai>
+- LinkedIn: <https://linkedin.com/company/nitrostack-ai/>
+- GitHub: <https://github.com/nitrostackai>

package/templates/typescript-oauth/package.json

@@ -19,7 +19,8 @@
     "dotenv": "^16.3.1",
     "@duffel/api": "^4.21.0",
     "axios": "^1.7.9",
-    "date-fns": "^4.1.0"
+    "date-fns": "^4.1.0",
+    "@modelcontextprotocol/ext-apps": ">=0.1.0"
   },
   "devDependencies": {
     "@nitrostack/cli": "^1",

package/templates/typescript-oauth/src/app.module.ts

@@ -36,6 +36,13 @@ import { SystemHealthCheck } from './health/system.health.js';
 
     // Enable OAuth 2.1 authentication
     OAuthModule.forRoot({
+      // Whether OAuth is enforced. Defaults to false (dev-friendly): the server
+      // runs out-of-the-box and protected endpoints are reachable without a token.
+      // Set OAUTH_REQUIRED=true to enforce auth (fail-closed). When enforced but no
+      // verifier (JWKS_URI / INTROSPECTION_ENDPOINT) is configured, the server still
+      // starts and warns, but rejects protected requests until one is configured.
+      required: process.env.OAUTH_REQUIRED === 'true',
+
       // Resource URI - YOUR MCP server's public URL
       // This is used for token audience binding (RFC 8707)
       // CRITICAL: Tokens must be issued specifically for this URI