v0.3.0

What's Changed

• 0.3.0: decouple from McpAgent and cover the 2026-07-28 OAuth changes by @bm1549 in #2

Full Changelog: v0.2.0...v0.3.0

v0.2.0

Adds backwards-compatible hooks for building multi-tenant remote MCP servers where each end-user supplies their own credentials.

New on createOAuthWorker

• userIdSource — "email" (default) or "sub".
• resolveUser — Replaces the default allowlist. Returns userId/redirect/reject. Receives parsed oauthReqInfo so handlers don't need to call parseAuthRequest themselves.
• routes — Map of pathname -> handler for custom routes (e.g. /setup).
• registerPolicy — Tightens DCR: PKCE, allowed redirect schemes, raw-IP rejection, max URI count.

New exports

• signResumeToken / verifyResumeToken — 30-min HMAC-signed opaque tokens for deferred-completion flows.
• resumeAuthorization — Wrapper around OAUTH_PROVIDER.completeAuthorization for custom routes.
• signHmac / verifyHmac — Generic helpers.

All additive — defaults preserve 0.1.x behavior exactly.

See the multi-tenant example in the README.

v0.1.1

First publish via GitHub Actions OIDC trusted publishing. SLSA v1 provenance attached. No functional changes from v0.1.0.