@ractive-ch/tab-mcp 0.6.0 → 0.6.1

package/README.md

@@ -10,7 +10,7 @@ and gets an MCP address. The user adds that address to an AI app and pairs it by
 a code from the page on the relay's sign-in page. The relay then forwards the AI app's
 requests to the page. It knows nothing about the tools themselves.
 
-**Status: 0.6.0.** Until 1.0, a new minor version can still change settings and the API.
+**Status: 0.6.1.** Until 1.0, a new minor version can still change settings and the API.
 The relay speaks MCP revision 2026-07-28 only and accepts AI apps that register through
 OAuth Client ID Metadata Documents; see [compatibility](https://github.com/ractive/tab-mcp/blob/main/docs/compatibility.md)
 for which apps work.
@@ -32,7 +32,7 @@ Or with Docker (linux/amd64 and linux/arm64):
 docker run -d -p 127.0.0.1:8080:8080 -v tab-mcp-data:/data \
   -e TAB_MCP_PUBLIC_URL=https://relay.example.com \
   -e TAB_MCP_ALLOWED_ORIGINS=https://app.example.com \
-  ractive/tab-mcp:0.6.0
+  ractive/tab-mcp:0.6.1
 ```
 
 The image is also on `ghcr.io/ractive/tab-mcp`. Put the relay behind a reverse proxy
@@ -112,6 +112,25 @@ tokenStoreConformance("MyTokenStore", () => new MyTokenStore());
 [Token store](https://github.com/ractive/tab-mcp/blob/main/docs/token-store.md) explains
 the interface, its guarantees and a Redis example.
 
+### Testing a page's tools
+
+For end-to-end tests under `bun test`, `startTestRelay()` runs a relay in the test
+process (127.0.0.1, a free port, development mode, every page origin allowed, a memory
+store, no log output unless `logger` or `logLevel` is given; options override any of that), and `tokenFor()` writes a token for
+a page's MCP address into its store, as if an AI app had paired:
+
+```ts
+import { startTestRelay, tokenFor } from "@ractive-ch/tab-mcp/testing";
+
+const relay = startTestRelay();
+// The page connects with `relay: relay.url`; its address is `session.address`.
+const token = await tokenFor(relay.store, address);
+// Any MCP client, with the header `Authorization: Bearer ${token}`.
+await relay.stop();
+```
+
+It is for tests only: it accepts every origin and skips pairing.
+
 ## Security
 
 Connecting an AI app to a page means trusting that page, as with any MCP server. The

package/index.js

@@ -1218,7 +1218,7 @@ function parseTabMessage(text) {
   }
 }
 // package.json
-var version = "0.6.0";
+var version = "0.6.1";
 
 // src/exchange.ts
 var RelayErrorCode = {
@@ -1848,6 +1848,26 @@ function newId(prefix) {
 function hashToken(token) {
   return new Bun.CryptoHasher("sha256").update(token).digest().toBase64({ alphabet: "base64url", omitPadding: true });
 }
+async function issueAccessToken(store, grant, options) {
+  const now = options.now ?? Date.now();
+  const token = newToken("access");
+  const record = {
+    hash: hashToken(token),
+    kind: "access",
+    grantId: grant.grantId ?? newId("g"),
+    addressId: grant.addressId,
+    clientId: grant.clientId,
+    clientName: grant.clientName,
+    scopes: grant.scopes ?? ["tools"],
+    grantCreatedAt: grant.grantCreatedAt ?? now,
+    issuedAt: now,
+    expiresAt: now + options.ttlMs
+  };
+  if (grant.subject !== undefined)
+    record.subject = grant.subject;
+  await store.put(record);
+  return { token, record };
+}
 async function issueTokenPair(store, grant, options) {
   const now = options.now ?? Date.now();
   const accessToken = newToken("access");
@@ -4845,6 +4865,13 @@ var FORWARDED_HEADERS = new Set([
   "traceparent",
   "tracestate"
 ]);
+function developmentUrl(host, port) {
+  if (host === "127.0.0.1")
+    return `http://127.0.0.1:${port}`;
+  if (host === "::1" || host === "[::1]")
+    return `http://[::1]:${port}`;
+  return `http://localhost:${port}`;
+}
 var HEALTH_STORE_TIMEOUT_MS = 1000;
 var HEALTH_REUSE_MS = 1000;
 var HEALTH_HUNG_RETRY_MS = 30000;
@@ -5711,7 +5738,7 @@ function startRelay(options, hooks) {
   let closing = false;
   const port = server.port ?? config.port;
   if (publicUrl === "")
-    publicUrl = `http://localhost:${port}`;
+    publicUrl = developmentUrl(config.host, port);
   const sweep = setInterval(() => {
     auth.sweep();
     store.deleteExpired(Date.now()).then((n) => {
@@ -5784,5 +5811,5 @@ export {
   resolveConfig
 };
 
-//# debugId=61513056506259C164756E2164756E21
+//# debugId=F0E5B49004089DE664756E2164756E21
 //# sourceMappingURL=index.js.map