feat!: streamable HTTP transport (hostable) + remove OIDC browser auth

.dockerignore

@@ -0,0 +1,15 @@
+.git
+node_modules
+dist
+coverage
+tests
+docs
+.agents
+.claude
+.claude-plugin
+.codex-plugin
+skills
+*.log
+.env
+.env.*
+.DS_Store

.env.example

@@ -5,7 +5,7 @@
 HORIZON_URL=https://horizon.example.com
 
 # === Authentication (auto-detected from which variables are set) ===
-# Priority: mTLS > API Key > OIDC browser
+# Priority: mTLS > API Key (startup fails closed if neither is set)
 
 # Option 1: API Key (set both)
 HORIZON_API_ID=<your-api-id>
@@ -20,18 +20,13 @@ HORIZON_API_KEY=<your-api-key>
 # HORIZON_CLIENT_PFX=/path/to/client.p12
 # HORIZON_CLIENT_PFX_PASSWORD=<optional-pfx-password>
 
-# Option 4: OIDC browser session
-# Just set HORIZON_URL. A Chromium window opens for login at startup.
-# Requires Playwright in the runtime environment (see docs/installation.md).
-
 # DEPRECATED - no longer required, kept for backward compatibility.
 # The server logs a warning if this is set.
 # HORIZON_AUTH_MODE=
 
 # === Optional - TLS and timeouts ===
 HORIZON_VERIFY_SSL=true
 HORIZON_TIMEOUT=30
-HORIZON_LOGIN_TIMEOUT=300
 HORIZON_EXPORT_TIMEOUT=120
 
 # === Optional - logging and version compatibility ===
@@ -41,6 +36,25 @@ HORIZON_LOG_LEVEL=INFO
 # Comma-separated list of versions that are likely to work but emit a warning.
 # HORIZON_WARN_VERSIONS=2.7,2.9
 
+# === Optional - streamable HTTP transport ===
+# Set HORIZON_TRANSPORT=http to serve over HTTP instead of stdio. One MCP
+# instance per Horizon; the backend is always HORIZON_URL above.
+# HORIZON_TRANSPORT=http
+# HORIZON_HTTP_HOST=127.0.0.1            # 0.0.0.0 only behind a trusted edge
+# HORIZON_HTTP_PORT=8080
+# HORIZON_HTTP_PATH=/mcp
+# HORIZON_HTTP_AUTH_MODE=service         # service | api-key | mtls
+# A non-loopback bind requires one of these (else startup fails closed):
+# HORIZON_PUBLIC_URL=https://mcp.example.com
+# HORIZON_TRUSTED_HOSTS=mcp.example.com
+# HORIZON_TRUSTED_ORIGINS=https://app.example.com   # only for browser callers
+# Inbound mTLS (HORIZON_HTTP_AUTH_MODE=mtls), pick one termination topology:
+# HORIZON_HTTP_TLS_CERT=/path/to/listener.crt
+# HORIZON_HTTP_TLS_KEY=/path/to/listener.key
+# HORIZON_INBOUND_CERT_HEADER=x-forwarded-client-cert
+# HORIZON_TRUSTED_PROXY=10.0.0.0/8
+# HORIZON_FORWARD_CERT_HEADER=SSL_CLIENT_CERT
+
 # === Development / testing only (never read by the server itself) ===
 # HORIZON_E2E_URL=https://qa.horizon.example.com
 # HORIZON_E2E_API_ID=<your-e2e-api-id>

Dockerfile

@@ -0,0 +1,42 @@
+# syntax=docker/dockerfile:1
+
+# ---- Build stage ---------------------------------------------------------
+FROM oven/bun:1 AS build
+WORKDIR /app
+
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY tsconfig.json tsup.config.ts ./
+COPY src ./src
+RUN bun run build
+
+# Prune dev dependencies so the runtime image only carries production deps.
+RUN bun install --frozen-lockfile --production
+
+# ---- Runtime stage -------------------------------------------------------
+FROM node:24-slim AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+COPY package.json ./
+
+# Streamable HTTP defaults. The operator MUST also provide, at minimum:
+#   HORIZON_URL              the single Horizon backend this instance serves
+#   HORIZON_HTTP_AUTH_MODE   service | api-key | mtls
+#   HORIZON_TRUSTED_HOSTS or HORIZON_PUBLIC_URL
+#       binding 0.0.0.0 with neither set fails closed and refuses to start
+#   plus the credential for the chosen auth mode (see README "Transports").
+#
+# Liveness/readiness probes should target /healthz and /readyz. Both are
+# Host-validated, so the probe MUST send a Host header that is in
+# HORIZON_TRUSTED_HOSTS (or derived from HORIZON_PUBLIC_URL).
+ENV HORIZON_TRANSPORT=http \
+    HORIZON_HTTP_HOST=0.0.0.0 \
+    HORIZON_HTTP_PORT=8080
+
+EXPOSE 8080
+USER node
+CMD ["node", "dist/index.js"]