From 1ddeac25c8eab0d1c39dd6f5f15d6dd63363d371 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Sun, 25 Oct 2026 23:19:40 -0700 Subject: [PATCH 1/5] chore(deps): bump credential-http to 0.1.3 and oauth-core to 0.3.3 Bump @corbits/credential-http 0.1.3 and @corbits/oauth-core 0.3.3 (peer ^0.3.3). The package e2e now installs @corbits/oauth-core@0.3.3. --- bun.lock | 68 ++++++--------------------------------------- e2e/package.test.ts | 4 +-- package.json | 12 ++++---- 3 files changed, 16 insertions(+), 68 deletions(-) diff --git a/bun.lock b/bun.lock index 3ad002d..e92a3a0 100644 --- a/bun.lock +++ b/bun.lock @@ -11,8 +11,8 @@ "yaml": "2.8.1", }, "devDependencies": { - "@corbits/credential-http": "0.1.0", - "@corbits/oauth-core": "0.3.0", + "@corbits/credential-http": "0.1.3", + "@corbits/oauth-core": "0.3.3", "@intx/agent": "0.5.0", "@intx/authz": "0.5.0", "@intx/db": "0.5.0", @@ -28,11 +28,11 @@ "zod": "4.6.5", }, "peerDependencies": { - "@corbits/credential-http": "^0.1.0", - "@corbits/oauth-core": "^0.3.0", + "@corbits/credential-http": "^0.1.3", + "@corbits/oauth-core": "^0.3.3", "@intx/agent": "^0.5.0", "@intx/db": "^0.5.0", - "@intx/harness": "^0.4.0 || ^0.5.0", + "@intx/harness": "^0.5.0", "@intx/hub-api": "^0.5.0", "drizzle-orm": "^0.45.2", "hono": "^4.11.9", @@ -72,9 +72,9 @@ "@better-fetch/fetch": ["@better-fetch/fetch@1.3.2", "", {}, "sha512-Gs7n99b5tqUC6cQAPbV0uED3IraHB6xQbHLQ/C3l7ZFafHScOx9pQ+DYmP5blbLFShVWLqxNUlI9wi4xU/X+ow=="], - "@corbits/credential-http": ["@corbits/credential-http@0.1.0", "", { "peerDependencies": { "@intx/harness": "^0.4.0", "@intx/types": "^0.4.0" } }, "sha512-/I4lKk9u3DhPhrBvMNRHFdpzHTwbfGwt/P6yGELby8YQ1qPxmhCQoZYyOqMWl4ONbiShMUHJrkAFi0EtzzgpyQ=="], + "@corbits/credential-http": ["@corbits/credential-http@0.1.3", "", { "peerDependencies": { "@intx/harness": "^0.4.0 || ^0.5.0", "@intx/types": "^0.4.0 || ^0.5.0" } }, "sha512-WFQYskrGOW1essbW/IqSo+yF2aALbs8VpvOIrirFtzfzdEoZ/hrTrULNgrBn06zcZEjih3NQdwHyNS+uOGz5ug=="], - "@corbits/oauth-core": ["@corbits/oauth-core@0.3.0", "", { "dependencies": { "@intx/db": "^0.4.0", "@intx/hub-api": "^0.4.0", "@intx/hub-common": "^0.4.0", "@intx/types": "^0.4.0", "arktype": "^2.2.3", "drizzle-orm": "^0.45.2", "hono": "^4.11.9" } }, "sha512-Al6l7FXCSDVboMCujr8piMmudQ6W+7wVRZKsZZ8Elpy5BbW4+gRGjrXSdplGILiEl/YedoWi66hGF/DpLUjVoA=="], + "@corbits/oauth-core": ["@corbits/oauth-core@0.3.3", "", { "dependencies": { "@intx/db": "^0.5.0", "@intx/hub-api": "^0.5.0", "@intx/hub-common": "^0.5.0", "@intx/types": "^0.5.0", "arktype": "^2.2.3", "drizzle-orm": "^0.45.2", "hono": "^4.11.9" } }, "sha512-scHRRjyP8rQAn9qxTr2z/fQjzfp8pe6ygMXkvli36dPjaa9t8dLJc3jsaRd9YEZdDvmnMdYva65kK2cmKEau8w=="], "@gar/promise-retry": ["@gar/promise-retry@1.0.3", "", {}, "sha512-GmzA9ckNokPypTg10pgpeHNQe7ph+iIKKmhKu3Ob9ANkswreCx7R3cKmY781K8QK3AqVL3xVh9A42JvIAbkkSA=="], @@ -94,7 +94,7 @@ "@intx/hub-api": ["@intx/hub-api@0.5.0", "", { "dependencies": { "@hono/standard-validator": "^0.2.2", "@intx/agent": "0.5.0", "@intx/authz": "0.5.0", "@intx/crypto": "0.5.0", "@intx/db": "0.5.0", "@intx/hub-common": "0.5.0", "@intx/hub-sessions": "0.5.0", "@intx/log": "0.5.0", "@intx/mime": "0.5.0", "@intx/storage-isogit": "0.5.0", "@intx/types": "0.5.0", "@intx/workflow-deploy": "0.5.0", "arktype": "^2.1.29", "better-auth": "^1.4.18", "drizzle-orm": "^0.45.1", "hono": "^4.11.9", "hono-openapi": "^1.2.0", "isomorphic-git": "^1.27.2", "ssri": "^12.0.0" } }, "sha512-ObyGu0YV9w8g93LA6+a0tjGiI4saM1fwUi7JGiVGRJlQ2imD+iaIE8dyxzUdkeQN/ZmrGIQCdHt1Dg4+c0dQNA=="], - "@intx/hub-common": ["@intx/hub-common@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-4dcRX3kamqduf1Yil85GVsjXKnAnu6uqSYrAsl4vGpuV6R2DCy7z/PHd+DtIqk6TJrRdW7DtfkNXwSEc3dn2VQ=="], + "@intx/hub-common": ["@intx/hub-common@0.5.0", "", { "dependencies": { "@intx/types": "0.5.0" } }, "sha512-riLxc8a9ZkCaEDUxr3DWlrIaZ/WeLZ9HJmXU9MbcM9TEUfMR68F/EiuSGKwQRFDVH9WwRZB82WN6vuGWbAHksA=="], "@intx/hub-sessions": ["@intx/hub-sessions@0.5.0", "", { "dependencies": { "@intx/agent": "0.5.0", "@intx/crypto": "0.5.0", "@intx/db": "0.5.0", "@intx/hub-common": "0.5.0", "@intx/log": "0.5.0", "@intx/mime": "0.5.0", "@intx/pack-transport": "0.5.0", "@intx/storage-isogit": "0.5.0", "@intx/tool-packaging": "0.5.0", "@intx/types": "0.5.0", "@intx/workflow": "0.5.0", "@intx/workflow-deploy": "0.5.0", "arktype": "^2.1.29", "drizzle-orm": "^0.45.1", "isomorphic-git": "^1.27.2", "tar": "^7.5.1" } }, "sha512-CgcXHnGtIw/Rjdhnry2TOSVvKeUh2x+XXvLJ/hrw86hBocvROUOFOykJ3/63Uft0OHPGKXf1D5AFPyc71P2arQ=="], @@ -610,20 +610,6 @@ "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="], - "@corbits/oauth-core/@intx/db": ["@intx/db@0.4.0", "", { "dependencies": { "@intx/authz": "0.4.0", "@intx/crypto": "0.4.0", "@intx/hub-common": "0.4.0", "@intx/log": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29", "drizzle-orm": "^0.45.1", "postgres": "^3.4.8" } }, "sha512-B26emrRrpIAlRygTWs6akVA6V/rN07v4YRxj3iTxzAOJVayIHSmPuPmKxqKN/AsBgLq6H1q94RP9sq05yb4twg=="], - - "@corbits/oauth-core/@intx/hub-api": ["@intx/hub-api@0.4.0", "", { "dependencies": { "@hono/standard-validator": "^0.2.2", "@intx/agent": "0.4.0", "@intx/authz": "0.4.0", "@intx/crypto": "0.4.0", "@intx/db": "0.4.0", "@intx/hub-common": "0.4.0", "@intx/hub-sessions": "0.4.0", "@intx/log": "0.4.0", "@intx/mime": "0.4.0", "@intx/storage-isogit": "0.4.0", "@intx/types": "0.4.0", "@intx/workflow-deploy": "0.4.0", "arktype": "^2.1.29", "better-auth": "^1.4.18", "drizzle-orm": "^0.45.1", "hono": "^4.11.9", "hono-openapi": "^1.2.0", "isomorphic-git": "^1.27.2", "ssri": "^12.0.0" } }, "sha512-3Txw7Im38BdRujYeRlxgrzCdvOG1v92556AjNa/6WXSwgXt9Mn2fB4RoQrA6oUHcm10Y94WZh3IjaQsXFl7Qvg=="], - - "@corbits/oauth-core/@intx/types": ["@intx/types@0.4.0", "", { "dependencies": { "arktype": "^2.1.29", "semver": "^7.7.2" } }, "sha512-nJ2fcmskMOZNMRfbHs5ueKpCANHNttoL+sZgIoFaVUF/QLpFWfVp0YV72CQAaa9bVv9j5kRSwtSOCCGSlwQ6Dw=="], - - "@intx/db/@intx/hub-common": ["@intx/hub-common@0.5.0", "", { "dependencies": { "@intx/types": "0.5.0" } }, "sha512-riLxc8a9ZkCaEDUxr3DWlrIaZ/WeLZ9HJmXU9MbcM9TEUfMR68F/EiuSGKwQRFDVH9WwRZB82WN6vuGWbAHksA=="], - - "@intx/hub-api/@intx/hub-common": ["@intx/hub-common@0.5.0", "", { "dependencies": { "@intx/types": "0.5.0" } }, "sha512-riLxc8a9ZkCaEDUxr3DWlrIaZ/WeLZ9HJmXU9MbcM9TEUfMR68F/EiuSGKwQRFDVH9WwRZB82WN6vuGWbAHksA=="], - - "@intx/hub-common/@intx/types": ["@intx/types@0.4.0", "", { "dependencies": { "arktype": "^2.1.29", "semver": "^7.7.2" } }, "sha512-nJ2fcmskMOZNMRfbHs5ueKpCANHNttoL+sZgIoFaVUF/QLpFWfVp0YV72CQAaa9bVv9j5kRSwtSOCCGSlwQ6Dw=="], - - "@intx/hub-sessions/@intx/hub-common": ["@intx/hub-common@0.5.0", "", { "dependencies": { "@intx/types": "0.5.0" } }, "sha512-riLxc8a9ZkCaEDUxr3DWlrIaZ/WeLZ9HJmXU9MbcM9TEUfMR68F/EiuSGKwQRFDVH9WwRZB82WN6vuGWbAHksA=="], - "@npmcli/agent/lru-cache": ["lru-cache@11.5.3", "", {}, "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg=="], "better-call/@better-auth/utils": ["@better-auth/utils@0.5.0", "", { "dependencies": { "@noble/hashes": "^2.0.1" } }, "sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA=="], @@ -654,28 +640,6 @@ "type-is/content-type": ["content-type@2.1.0", "", {}, "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag=="], - "@corbits/oauth-core/@intx/db/@intx/authz": ["@intx/authz@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-A9x4EzcECnFjhDoqj0XjaOb1GaxRyJucXOuIbY+fcPluUuMCGFvExD6DJZwjJmIYdeCvL8i96gPkncu/fAR9qA=="], - - "@corbits/oauth-core/@intx/db/@intx/crypto": ["@intx/crypto@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-4/qWypC90GevbV9u1i/93tn46jsXhj8wE1Pn+awg8/ECpwhHnhPLT5Uy423Arr9eGmRmF6HiMyXcEgH1Z9/Rkw=="], - - "@corbits/oauth-core/@intx/db/@intx/log": ["@intx/log@0.4.0", "", { "dependencies": { "@logtape/hono": "^2.0.2", "@logtape/logtape": "^2.0.2" }, "peerDependencies": { "hono": "^4.0.0" }, "optionalPeers": ["hono"] }, "sha512-f1IPZ/9YpEqlA0I2UZPOlRJOTDoOFEZRwZoUVuw8DpgR1WatOMm4hA0E8o6Mtz+pA0ux7gVdls4y/JZcgypsfQ=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/agent": ["@intx/agent@0.4.0", "", { "dependencies": { "@intx/inference": "0.4.0", "@intx/log": "0.4.0", "@intx/mime": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-qBlqDYnsaRMsug/lEKwUvPgQfjiwppTpfw5JaUh6pwKi0dGvckv3ugjJvLdHM052nTFMgLgOwo1LvbRjPZ5Uwg=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/authz": ["@intx/authz@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-A9x4EzcECnFjhDoqj0XjaOb1GaxRyJucXOuIbY+fcPluUuMCGFvExD6DJZwjJmIYdeCvL8i96gPkncu/fAR9qA=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/crypto": ["@intx/crypto@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-4/qWypC90GevbV9u1i/93tn46jsXhj8wE1Pn+awg8/ECpwhHnhPLT5Uy423Arr9eGmRmF6HiMyXcEgH1Z9/Rkw=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/hub-sessions": ["@intx/hub-sessions@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/crypto": "0.4.0", "@intx/db": "0.4.0", "@intx/hub-common": "0.4.0", "@intx/log": "0.4.0", "@intx/mime": "0.4.0", "@intx/pack-transport": "0.4.0", "@intx/storage-isogit": "0.4.0", "@intx/tool-packaging": "0.4.0", "@intx/types": "0.4.0", "@intx/workflow": "0.4.0", "@intx/workflow-deploy": "0.4.0", "arktype": "^2.1.29", "drizzle-orm": "^0.45.1", "isomorphic-git": "^1.27.2", "tar": "^7.5.1" } }, "sha512-/3nd/B/gENy3lq+MA2AR95tBu3Rkkh176XM+A8/mNMGnolPBGw+1JBUGGJ8gvdvAfo64dwRcEs3BI/VD7zFlPQ=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/log": ["@intx/log@0.4.0", "", { "dependencies": { "@logtape/hono": "^2.0.2", "@logtape/logtape": "^2.0.2" }, "peerDependencies": { "hono": "^4.0.0" }, "optionalPeers": ["hono"] }, "sha512-f1IPZ/9YpEqlA0I2UZPOlRJOTDoOFEZRwZoUVuw8DpgR1WatOMm4hA0E8o6Mtz+pA0ux7gVdls4y/JZcgypsfQ=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/mime": ["@intx/mime@0.4.0", "", { "dependencies": { "@intx/crypto": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-sWrohF2uwVL5AZHbxIEUNiVUBhULff4XB7g6keCmyQWr296GKSvG/HmbihSXxiIvmmDzh9cl+6ZAJz/taxFNog=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/storage-isogit": ["@intx/storage-isogit@0.4.0", "", { "dependencies": { "@intx/log": "0.4.0", "@intx/mime": "0.4.0", "@intx/types": "0.4.0", "@isomorphic-git/lightning-fs": "4.7.0", "arktype": "^2.1.29", "buffer": "^6.0.3", "isomorphic-git": "^1.27.2" } }, "sha512-3H4dhUsWmAixLEBp79vq9NVUf6Z4++pKzaODWFEgNfhLX2WeV5J/t6soUamL6T/8eok/SDgQ/sZiZMiJ5kDKOw=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/workflow-deploy": ["@intx/workflow-deploy@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/tool-packaging": "0.4.0", "@intx/types": "0.4.0", "@intx/workflow": "0.4.0" } }, "sha512-TSLg9lPZvJ+leg2n0I/SWxZjcNQtzsH2oKLD04ptEsBZcbIuMINsQeZBmYV5Brdovy0J/SrWZyrOJ8lc+k/Fdw=="], - "minipass-flush/minipass/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], "minipass-pipeline/minipass/yallist": ["yallist@4.0.0", "", {}, "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="], @@ -684,22 +648,6 @@ "npm-registry-fetch/npm-package-arg/validate-npm-package-name": ["validate-npm-package-name@7.0.2", "", {}, "sha512-hVDIBwsRruT73PbK7uP5ebUt+ezEtCmzZz3F59BSr2F6OVFnJ/6h8liuvdLrQ88Xmnk6/+xGGuq+pG9WwTuy3A=="], - "@corbits/oauth-core/@intx/hub-api/@intx/agent/@intx/inference": ["@intx/inference@0.4.0", "", { "dependencies": { "@intx/log": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-cuaqCqotmjg0OzGUm8QmFJr1xX5wPVS0LeuhrxHsj0X3ImoCzVB4e/ttTc+DaP3K1tTMQ/8Q8HHCAPX36mOecQ=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/hub-sessions/@intx/pack-transport": ["@intx/pack-transport@0.4.0", "", { "dependencies": { "@intx/types": "0.4.0" } }, "sha512-I+axd067ZFXaTRtr2zmBXl6/yU253wLc/YWEdXiPiqz06mIspR2BFJMbSXPzV4pM26n+1tv/9E5VNBQtdiYmSA=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/hub-sessions/@intx/tool-packaging": ["@intx/tool-packaging@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/log": "0.4.0", "@intx/storage-isogit": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29", "isomorphic-git": "^1.27.2", "npm-package-arg": "^12.0.2", "npm-pick-manifest": "^10.0.0", "npm-registry-fetch": "^19.0.0", "semver": "^7.7.2", "ssri": "^12.0.0", "tar": "^7.5.1" } }, "sha512-eBZIbGUcEBp0ppMCceA1PPd75LvXpUyWitqTIu7AsLxRNlU9gbE1hymWPXnhUKnt3LgSlHUi959Ehd6jG6mR7g=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/hub-sessions/@intx/workflow": ["@intx/workflow@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/inference": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-F5Is/lyKb4/WguAVYMDXwtI4ddUvqXbg34rcM6hPUOqupJHpbbD9+ZK/6TDfvbCiEgginbTVwMmNj6Fyg8vU+Q=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/workflow-deploy/@intx/tool-packaging": ["@intx/tool-packaging@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/log": "0.4.0", "@intx/storage-isogit": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29", "isomorphic-git": "^1.27.2", "npm-package-arg": "^12.0.2", "npm-pick-manifest": "^10.0.0", "npm-registry-fetch": "^19.0.0", "semver": "^7.7.2", "ssri": "^12.0.0", "tar": "^7.5.1" } }, "sha512-eBZIbGUcEBp0ppMCceA1PPd75LvXpUyWitqTIu7AsLxRNlU9gbE1hymWPXnhUKnt3LgSlHUi959Ehd6jG6mR7g=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/workflow-deploy/@intx/workflow": ["@intx/workflow@0.4.0", "", { "dependencies": { "@intx/agent": "0.4.0", "@intx/inference": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-F5Is/lyKb4/WguAVYMDXwtI4ddUvqXbg34rcM6hPUOqupJHpbbD9+ZK/6TDfvbCiEgginbTVwMmNj6Fyg8vU+Q=="], - "npm-registry-fetch/npm-package-arg/hosted-git-info/lru-cache": ["lru-cache@11.5.3", "", {}, "sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/hub-sessions/@intx/workflow/@intx/inference": ["@intx/inference@0.4.0", "", { "dependencies": { "@intx/log": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-cuaqCqotmjg0OzGUm8QmFJr1xX5wPVS0LeuhrxHsj0X3ImoCzVB4e/ttTc+DaP3K1tTMQ/8Q8HHCAPX36mOecQ=="], - - "@corbits/oauth-core/@intx/hub-api/@intx/workflow-deploy/@intx/workflow/@intx/inference": ["@intx/inference@0.4.0", "", { "dependencies": { "@intx/log": "0.4.0", "@intx/types": "0.4.0", "arktype": "^2.1.29" } }, "sha512-cuaqCqotmjg0OzGUm8QmFJr1xX5wPVS0LeuhrxHsj0X3ImoCzVB4e/ttTc+DaP3K1tTMQ/8Q8HHCAPX36mOecQ=="], } } diff --git a/e2e/package.test.ts b/e2e/package.test.ts index 6619605..6899a84 100644 --- a/e2e/package.test.ts +++ b/e2e/package.test.ts @@ -60,7 +60,7 @@ beforeAll(async () => { "--no-fund", join(sandbox, `corbits-mcp-${packageManifest.version}.tgz`), ...peers, - "@corbits/oauth-core@0.3.0", + "@corbits/oauth-core@0.3.3", ], hostSandbox, ); @@ -79,7 +79,7 @@ test("packed exports retain the four roles and historical facades", async () => ), ); expect(manifest.dependencies["@corbits/oauth-core"]).toBeUndefined(); - expect(manifest.peerDependencies["@corbits/oauth-core"]).toBe("^0.3.0"); + expect(manifest.peerDependencies["@corbits/oauth-core"]).toBe("^0.3.3"); expect(manifest.peerDependenciesMeta["@corbits/oauth-core"]).toEqual({ optional: true, }); diff --git a/package.json b/package.json index 7abf6d5..e04543c 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@corbits/mcp", - "version": "0.4.0", + "version": "0.4.1", "description": "MCP client tool package for Interchange: streamable HTTP, per-tool grants, OAuth.", "keywords": [ "corbits", @@ -84,8 +84,8 @@ "yaml": "2.8.1" }, "devDependencies": { - "@corbits/credential-http": "0.1.0", - "@corbits/oauth-core": "0.3.0", + "@corbits/credential-http": "0.1.3", + "@corbits/oauth-core": "0.3.3", "@intx/agent": "0.5.0", "@intx/authz": "0.5.0", "@intx/db": "0.5.0", @@ -101,11 +101,11 @@ "zod": "4.6.5" }, "peerDependencies": { - "@corbits/credential-http": "^0.1.0", - "@corbits/oauth-core": "^0.3.0", + "@corbits/credential-http": "^0.1.3", + "@corbits/oauth-core": "^0.3.3", "@intx/agent": "^0.5.0", "@intx/db": "^0.5.0", - "@intx/harness": "^0.4.0 || ^0.5.0", + "@intx/harness": "^0.5.0", "@intx/hub-api": "^0.5.0", "drizzle-orm": "^0.45.2", "hono": "^4.11.9" From 45693e84fd8460147053fcdddb5b2ad5e97799cd Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Sun, 25 Oct 2026 17:17:02 -0700 Subject: [PATCH 2/5] docs: point agents at the 0.4.0 entries Name the client, stateless server, and Interchange bridge, and pin the released OAuth and credential companions an agent should install. --- README.md | 49 ++++++++++++++++++++++++++++++++++++++-------- docs/public-api.md | 2 +- package.json | 2 +- 3 files changed, 43 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index db4ee1a..b6f8506 100644 --- a/README.md +++ b/README.md @@ -47,30 +47,63 @@ or certify the host's sandbox. See [scope and evidence](docs/conformance.md). ## Install +`@corbits/mcp@0.4.0` is the package. Neutral imports `@corbits/mcp/client` and +`@corbits/mcp/server` need no Interchange or OAuth peers. + ```bash bun add @corbits/mcp # For Interchange consumption: bun add @intx/agent @intx/harness -# Historical root / guarded OAuth login also requires OAuth-core: -bun add @corbits/oauth-core@0.3.0 +# Historical root entry and guarded OAuth login: +bun add @corbits/oauth-core@0.3.3 ``` Runs on Node.js 24+ and Bun 1.2+. -Standalone client/server entries do not require OAuth-core or Interchange host -peers. OAuth-core is now an **optional peer**, not a mandatory dependency: this -is a breaking installation change for the historical root and OAuth login users, -who must explicitly install it as shown above. Installing OAuth-core still brings +OAuth-core is an **optional peer**, not a mandatory dependency: this is a +breaking installation change for the historical root and OAuth login users, who +must explicitly install it as shown above. Installing OAuth-core still brings its own DB/hub/Hono dependencies; that host installation is separate from the neutral package. See [public API dependency notes](docs/public-api.md) for the credential-http/harness/types peer conflict affecting the full hub setup. -For the `@corbits/mcp/hub` routes, also install: +For hub discovery, also install `@corbits/credential-http@0.1.3` plus the hub +packages: ```bash -bun add @corbits/credential-http @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono +bun add @corbits/credential-http@0.1.3 @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono +``` + +## Use it from an agent + +List tools with the standalone client. That import needs no Interchange or OAuth +peers: + +```ts +import { mcpConnect, mcpListTools } from "@corbits/mcp/client"; + +const url = "https://mcp.deepwiki.com/mcp"; +const session = await mcpConnect(url); +for (const tool of await mcpListTools(url, { session })) { + console.log(`${tool.name}: ${tool.description ?? ""}`); +} +``` + +After `@intx/agent` and `@intx/harness` are installed, the peer-backed root +entry discovers each server and builds one Interchange tool per remote tool: + +```ts +import { mcpTools } from "@corbits/mcp"; + +const factory = await mcpTools({ + servers: [{ name: "deepwiki", url: "https://mcp.deepwiki.com/mcp" }], +}); ``` +The four entries in the table above are the public surface. This package does +not claim full MCP certification and does not supply a browser renderer. Legacy +sessions are in-memory. The Skills consumer declines dynamic manifests. + ## Quickstart Lists the tools on a public MCP server: diff --git a/docs/public-api.md b/docs/public-api.md index 26fd6a4..4c37c49 100644 --- a/docs/public-api.md +++ b/docs/public-api.md @@ -32,7 +32,7 @@ actual OAuth-core `OAuthDiscoveryError` class. Neutral consumers must not import the optional OAuth implementation merely to perform an `instanceof` check. ```sh -npm install @corbits/mcp @corbits/oauth-core@0.3.0 @intx/agent@0.5.0 @intx/harness@0.5.0 +npm install @corbits/mcp @corbits/oauth-core@0.3.3 @intx/agent@0.5.0 @intx/harness@0.5.0 ``` The full hub peer set does not resolve: credential-http 0.1.0 declares harness diff --git a/package.json b/package.json index e04543c..3899afa 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "@corbits/mcp", "version": "0.4.1", - "description": "MCP client tool package for Interchange: streamable HTTP, per-tool grants, OAuth.", + "description": "MCP client, stateless server, and Interchange bridge over streamable HTTP.", "keywords": [ "corbits", "interchange", From 9c211a5acff03a3e179460e53296732159c22b12 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Mon, 26 Oct 2026 20:41:36 -0700 Subject: [PATCH 3/5] docs: align quickstart pins with declared peers The root mcpTools import requires @corbits/oauth-core 0.3.0 (peer ^0.3.0). credential-http stays at the declared ^0.1.0 peer; 0.1.0 does not resolve on the 0.5 baseline. Name the root, hub, sidecar-bundle, and task-store exports beside the four role entries. --- README.md | 29 +++++++++++++++++++---------- docs/public-api.md | 2 +- 2 files changed, 20 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index b6f8506..327206a 100644 --- a/README.md +++ b/README.md @@ -54,8 +54,8 @@ or certify the host's sandbox. See [scope and evidence](docs/conformance.md). bun add @corbits/mcp # For Interchange consumption: bun add @intx/agent @intx/harness -# Historical root entry and guarded OAuth login: -bun add @corbits/oauth-core@0.3.3 +# Historical root entry and guarded OAuth login (optional peer ^0.3.0): +bun add @corbits/oauth-core@0.3.0 ``` Runs on Node.js 24+ and Bun 1.2+. @@ -67,11 +67,14 @@ its own DB/hub/Hono dependencies; that host installation is separate from the neutral package. See [public API dependency notes](docs/public-api.md) for the credential-http/harness/types peer conflict affecting the full hub setup. -For hub discovery, also install `@corbits/credential-http@0.1.3` plus the hub -packages: +For hub discovery, `@corbits/credential-http` is an optional peer (`^0.1.0`). +This package pins development dependency `0.1.0`. That release declares +`@intx/harness` and `@intx/types` `^0.4.0`, so it does not resolve with the +0.5 baseline, and no companion release number is known. See +[public API dependency notes](docs/public-api.md). The other hub packages: ```bash -bun add @corbits/credential-http@0.1.3 @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono +bun add @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono ``` ## Use it from an agent @@ -89,8 +92,12 @@ for (const tool of await mcpListTools(url, { session })) { } ``` -After `@intx/agent` and `@intx/harness` are installed, the peer-backed root -entry discovers each server and builds one Interchange tool per remote tool: +The root entry requires `@corbits/oauth-core` as well as `@intx/agent` and +`@intx/harness`. Install `@corbits/oauth-core@0.3.0` (optional peer `^0.3.0`). +`@intx/agent` and `@intx/harness` alone are not enough: importing `mcpTools` +from `@corbits/mcp` loads `@corbits/oauth-core`. After those peers are +installed, the root entry discovers each server and builds one Interchange +tool per remote tool: ```ts import { mcpTools } from "@corbits/mcp"; @@ -100,9 +107,11 @@ const factory = await mcpTools({ }); ``` -The four entries in the table above are the public surface. This package does -not claim full MCP certification and does not supply a browser renderer. Legacy -sessions are in-memory. The Skills consumer declines dynamic manifests. +The four entries in the table above are the scoped role entries, not the whole +public surface. The package also exports `.`, `./hub`, `./sidecar-bundle`, and +`./server/task-store`. This package does not claim full MCP certification and +does not supply a browser renderer. Legacy sessions are in-memory. The Skills +consumer declines dynamic manifests. ## Quickstart diff --git a/docs/public-api.md b/docs/public-api.md index 4c37c49..26fd6a4 100644 --- a/docs/public-api.md +++ b/docs/public-api.md @@ -32,7 +32,7 @@ actual OAuth-core `OAuthDiscoveryError` class. Neutral consumers must not import the optional OAuth implementation merely to perform an `instanceof` check. ```sh -npm install @corbits/mcp @corbits/oauth-core@0.3.3 @intx/agent@0.5.0 @intx/harness@0.5.0 +npm install @corbits/mcp @corbits/oauth-core@0.3.0 @intx/agent@0.5.0 @intx/harness@0.5.0 ``` The full hub peer set does not resolve: credential-http 0.1.0 declares harness From a7ba9fba0f6b2f2d7cf8c280f4c883d0564d30d2 Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Mon, 26 Oct 2026 21:30:51 -0700 Subject: [PATCH 4/5] docs: align install pins with 0.4.1 peers --- README.md | 26 ++++++++++++-------------- docs/integration-status.md | 20 +++++++++++--------- docs/migration.md | 10 +++++----- docs/public-api.md | 27 +++++++++++++-------------- 4 files changed, 41 insertions(+), 42 deletions(-) diff --git a/README.md b/README.md index 327206a..d9db344 100644 --- a/README.md +++ b/README.md @@ -47,15 +47,15 @@ or certify the host's sandbox. See [scope and evidence](docs/conformance.md). ## Install -`@corbits/mcp@0.4.0` is the package. Neutral imports `@corbits/mcp/client` and +`@corbits/mcp@0.4.1` is the package. Neutral imports `@corbits/mcp/client` and `@corbits/mcp/server` need no Interchange or OAuth peers. ```bash bun add @corbits/mcp -# For Interchange consumption: -bun add @intx/agent @intx/harness -# Historical root entry and guarded OAuth login (optional peer ^0.3.0): -bun add @corbits/oauth-core@0.3.0 +# For Interchange consumption (optional peers ^0.5.0): +bun add @intx/agent@0.5.0 @intx/harness@0.5.0 +# Historical root entry and guarded OAuth login (optional peer ^0.3.3): +bun add @corbits/oauth-core@0.3.3 ``` Runs on Node.js 24+ and Bun 1.2+. @@ -64,14 +64,11 @@ OAuth-core is an **optional peer**, not a mandatory dependency: this is a breaking installation change for the historical root and OAuth login users, who must explicitly install it as shown above. Installing OAuth-core still brings its own DB/hub/Hono dependencies; that host installation is separate from the -neutral package. See [public API dependency notes](docs/public-api.md) for the -credential-http/harness/types peer conflict affecting the full hub setup. +neutral package. See [public API dependency notes](docs/public-api.md). -For hub discovery, `@corbits/credential-http` is an optional peer (`^0.1.0`). -This package pins development dependency `0.1.0`. That release declares -`@intx/harness` and `@intx/types` `^0.4.0`, so it does not resolve with the -0.5 baseline, and no companion release number is known. See -[public API dependency notes](docs/public-api.md). The other hub packages: +For hub discovery, `@corbits/credential-http` is an optional peer (`^0.1.3`). +Install `@corbits/credential-http@0.1.3`. That release accepts `@intx/harness` +and `@intx/types` `^0.5.0`. The other hub packages: ```bash bun add @intx/authz @intx/crypto @intx/db @intx/hub-api drizzle-orm hono @@ -93,7 +90,8 @@ for (const tool of await mcpListTools(url, { session })) { ``` The root entry requires `@corbits/oauth-core` as well as `@intx/agent` and -`@intx/harness`. Install `@corbits/oauth-core@0.3.0` (optional peer `^0.3.0`). +`@intx/harness`. Install `@corbits/oauth-core@0.3.3` (optional peer `^0.3.3`) +and `@intx/harness@0.5.0` (optional peer `^0.5.0`). `@intx/agent` and `@intx/harness` alone are not enough: importing `mcpTools` from `@corbits/mcp` loads `@corbits/oauth-core`. After those peers are installed, the root entry discovers each server and builds one Interchange @@ -316,7 +314,7 @@ above still apply, including no deprecated HTTP+SSE transport or SSE resumption. - `readCredentialSecret` is now `readCredential`, which returns `{ secret, origin? }`. `discoverMcpServer` takes `credential: { secret, origin? }` instead of `secret`. - `mcpInitialize` returns an `McpSession` (`protocolVersion`, `sessionId?`, `serverInfo?`) and sends `notifications/initialized`. Pass it as `{ session }` to `mcpListTools` and `mcpCallTool`; a stateful server needs it. - The discovery route refuses plain-http loopback URLs unless `allowLoopback` is set. Handles and server names containing `.`, and catalogs repeating a tool name, are refused. `mcpTools` refuses an empty or repeated server name, and a non-https URL, before any request. -- The integration baseline is `@intx/agent` 0.5.0 and `@intx/harness` 0.5.0; see package peer ranges. +- The integration baseline is `@intx/agent` 0.5.0, `@intx/harness` 0.5.0 (peer `^0.5.0`), `@corbits/oauth-core` 0.3.3 (peer `^0.3.3`), and `@corbits/credential-http` 0.1.3 (peer `^0.1.3`). - Discovery rejects authorization-server metadata whose `issuer` differs from the one the protected resource names. ## License diff --git a/docs/integration-status.md b/docs/integration-status.md index 66f90df..b54f15e 100644 --- a/docs/integration-status.md +++ b/docs/integration-status.md @@ -8,10 +8,11 @@ unit tests and 2,116 assertions. This is not a 100% conformance claim. - Public role factories/contracts are exported and exercised through installed tarballs. File-store is explicit `@corbits/mcp/server/task-store` only. -- OAuth-core is an optional peer `^0.3.0` and pinned development dependency 0.3.0. +- OAuth-core is an optional peer `^0.3.3` and pinned development dependency 0.3.3. Root/login consumers install it explicitly. Neutral client/server installations and module graphs exclude optional host stacks. Host/auth fixtures explicitly - install OAuth-core 0.3.0 and agent/harness 0.5.0. + install OAuth-core 0.3.3 and `@intx/harness` 0.5.0 (peer `^0.5.0`). + `@corbits/credential-http` is an optional peer `^0.1.3`. - Opt-in server legacy compatibility is implemented for 2025-11-25/06-18/03-26. [Legacy deployment](legacy-server.md) documents defaults (1,024 sessions, absolute 30-minute TTL), in-memory affinity/restart loss, 10,000 request IDs, @@ -62,14 +63,15 @@ unadvertised issuer handling are additional integration limits, distinct from exact issue acceptance. Resource exchange/refresh propagation exists upstream; this package's local config omission was fixed. -**CL11480 (credential-http):** full pinned hub installation fails npm ERESOLVE: -0.1.0 requires harness/types ^0.4.0 against the 0.5.0 baseline. A companion -release validated with and declaring support for both 0.5.0 peers is needed; -no fixed release number is established. Request+init overrides and insecure -configured schemes also require upstream correction. These optional-host -failures do not block the passing neutral installation. +**CL11480 (credential-http):** the 2026-10-25 snapshot failed npm ERESOLVE on +credential-http 0.1.0, which required harness/types ^0.4.0 against the 0.5.0 +baseline. This release's optional peer is `^0.1.3`. `@corbits/credential-http@0.1.3` +accepts `@intx/harness` and `@intx/types` `^0.5.0`. Request+init overrides and +insecure configured schemes were recorded against 0.1.0 and still require +upstream correction. Those optional-host limits do not block the neutral +installation. -Previously reproduced external install (exit 1): +Previously reproduced external install of 0.1.0 (exit 1): ```sh npm install --prefix "$peer_dir" --ignore-scripts --no-audit --no-fund @corbits/credential-http@0.1.0 @intx/agent@0.5.0 @intx/harness@0.5.0 @intx/db@0.5.0 @intx/hub-api@0.5.0 @intx/types@0.5.0 drizzle-orm@0.45.3 hono@4.13.9 diff --git a/docs/migration.md b/docs/migration.md index bab79ae..cde5c6f 100644 --- a/docs/migration.md +++ b/docs/migration.md @@ -119,11 +119,11 @@ Root import consumers still need their historical Interchange dependencies. Publisher/task-runtime/server-auth and host skill-loader factories are now exported through their role entries and exercised from installed tarballs. OAuth-core is now an optional peer: historical root and guarded login consumers -must explicitly install `@corbits/oauth-core@^0.3.0` alongside their agent/harness -peers. Neutral client/server consumers need none of those optional host packages. -Packed auth fixtures explicitly install OAuth-core 0.3.0. See -[public API](public-api.md) for the neutral URL-error class distinction and the -companion credential-http harness/types 0.5.0 support requirement. +must explicitly install `@corbits/oauth-core@^0.3.3` alongside `@intx/harness@^0.5.0` +and their agent peers. Neutral client/server consumers need none of those optional host packages. +Packed auth fixtures explicitly install OAuth-core 0.3.3. See +[public API](public-api.md) for the neutral URL-error class distinction. +Hub discovery uses optional peer `@corbits/credential-http@^0.1.3`. ## Legacy server rollout diff --git a/docs/public-api.md b/docs/public-api.md index 26fd6a4..308b1db 100644 --- a/docs/public-api.md +++ b/docs/public-api.md @@ -18,10 +18,10 @@ writer; stale-lock recovery requires proof the previous writer is dead. ## Dependency boundary and setup -OAuth-core is an optional peer (`^0.3.0`) and pinned development dependency -(0.3.0). Neutral client/server entries do not require it. Root and guarded OAuth +OAuth-core is an optional peer (`^0.3.3`) and pinned development dependency +(0.3.3). Neutral client/server entries do not require it. Root and guarded OAuth login users must explicitly install OAuth-core plus the root's agent/harness -peers; this is a breaking change from automatic OAuth installation. Host/auth +peers (`@intx/harness` `^0.5.0`); this is a breaking change from automatic OAuth installation. Host/auth packed fixtures explicitly install these dependencies. OAuth-core itself still transitively installs DB/hub/Hono; that cost belongs to the opt-in host setup. @@ -32,14 +32,12 @@ actual OAuth-core `OAuthDiscoveryError` class. Neutral consumers must not import the optional OAuth implementation merely to perform an `instanceof` check. ```sh -npm install @corbits/mcp @corbits/oauth-core@0.3.0 @intx/agent@0.5.0 @intx/harness@0.5.0 +npm install @corbits/mcp @corbits/oauth-core@0.3.3 @intx/agent@0.5.0 @intx/harness@0.5.0 ``` -The full hub peer set does not resolve: credential-http 0.1.0 declares harness -**and types** `^0.4.0`, incompatible with the pinned 0.5.0 baseline. A companion -credential-http release validated with and declaring support for both -`@intx/harness@0.5.0` and `@intx/types@0.5.0` is needed. No known release number -is asserted; no force/legacy-peer-deps or external patch was used. +`@corbits/credential-http` is an optional peer (`^0.1.3`). Install +`@corbits/credential-http@0.1.3`. That release accepts `@intx/harness` and +`@intx/types` `^0.5.0`. ## Installed evidence @@ -83,11 +81,12 @@ provider/hub path has equivalent checks. OAuth-core already propagates resource on code exchange and refresh; the local config-builder omission was fixed, not an absent upstream feature. -**CL11480:** Besides the harness/types peer conflict above, credential-http 0.1.0 -ignores Request+init overrides in its Request branch and permits insecure -configured credential destination schemes. Local hub endpoint/redirect checks -do not fix standalone external provider handles. Upstream correction and host -transport policy remain required; no external package was patched here. +**CL11480:** credential-http 0.1.0 ignored Request+init overrides in its Request +branch and permitted insecure configured credential destination schemes. Peer +`^0.1.3` accepts `@intx/harness` and `@intx/types` `^0.5.0`. Local hub +endpoint/redirect checks do not fix standalone external provider handles. +Upstream correction and host transport policy remain required; no external +package was patched here. The source audit is recorded in `src/auth/INTEGRATION.md`; this public summary keeps the relevant limits available in the packed docs. Production encrypted From 39c6cd5ef0a54646896e501942592fb040e0a24d Mon Sep 17 00:00:00 2001 From: Sawyer Cutler Date: Mon, 26 Oct 2026 21:34:36 -0700 Subject: [PATCH 5/5] ci: install oauth-core 0.3.3 and harness 0.5.0 in the host smoke --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a71ffda..75b58d1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,5 +28,5 @@ jobs: node -e 'import("@corbits/mcp/client").then((m) => { for (const n of ["mcpInitialize", "mcpListTools", "mcpCallTool"]) if (typeof m[n] !== "function") throw new Error("missing export: " + n); })' mkdir -p "$RUNNER_TEMP/host" && cd "$RUNNER_TEMP/host" npm init -y >/dev/null && npm pkg set type=module >/dev/null - npm install "$TARBALL" @intx/agent@0.5.0 @corbits/oauth-core@0.3.2 + npm install "$TARBALL" @intx/agent@0.5.0 @intx/harness@0.5.0 @corbits/oauth-core@0.3.3 node -e 'import("@corbits/mcp").then((m) => { for (const n of ["mcpTools", "mcpInitialize", "mcpListTools", "mcpCallTool"]) if (typeof m[n] !== "function") throw new Error("missing export: " + n); })'