v4.1.0
The MCP now consumes @extension.dev/core for all platform-auth logic
(core MIGRATION.md phase 2). No tool schema changes, no behavior changes:
the JSON-string envelopes are byte-compatible and pinned by tests.
- New dependency
@extension.dev/core^0.2.0: device-code login, credential
store, and publish client now live there, shared with every other surface. - Deleted
src/lib/credentials.ts,src/lib/github-device.ts,
src/lib/login-flow.tsand their migrated tests;login,whoami,
logout, andrelease-promoteimport from core. tools/publish.tsis a thin adapter over core'spublish(); the frozen
PublishAuthError / PublishConfigError / PublishNetworkError / PublishError
envelopes and the success passthrough are pinned by a new
publish-envelopetest.- New
core-boundaryregression test: no file undersrc/may redefine the
credential store or import auth primitives from anywhere but
@extension.dev/core. - CI and Release workflows pass
NPM_TOKENto the install step (core is
npm-restricted until the public flip).