Function extractToken

packages/mcp/src/auth.ts:137–148

(
  query: Record<string, unknown>,
  authHeader: string | undefined,
)

 * Checks ?token= query param first, then Authorization: Bearer header.
 */
export function extractToken(
  query: Record<string, unknown>,
  authHeader: string | undefined,
): string | undefined {
  if (typeof query['token'] === 'string') {
    return query['token'];
  }
  if (authHeader?.startsWith('Bearer ')) {
    return authHeader.slice(7);
  }
  return undefined;
}