diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 12ff3d2..e55157b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,10 +36,10 @@ jobs:
       # `--locked` fails if Cargo.lock is out of date, so CI also guards the
       # dependency pins (e.g. ic-agent / ic-transport-types) from silent drift.
       - name: Build
-        run: cargo build --locked --all-targets
+        run: cargo build --locked --workspace --all-targets
 
       - name: Test
-        run: cargo test --locked --all-targets
+        run: cargo test --locked --workspace --all-targets
 
   # Block new internal network identifiers from entering the repository. Secret
   # scanning and push protection already cover credentials; this covers the
diff --git a/.github/workflows/publish-crate.yml b/.github/workflows/publish-crate.yml
index dc78c05..97d72be 100644
--- a/.github/workflows/publish-crate.yml
+++ b/.github/workflows/publish-crate.yml
@@ -31,8 +31,10 @@
 #   Environment name   release             <- must match the `environment:` below,
 #                                             or be left blank to accept any
 # A trusted publisher can only be configured on a crate that already exists, so the
-# FIRST release (0.1.0) has to be published by hand — `cargo publish --locked` with
-# a personal token — and every release after it goes through this workflow.
+# FIRST release of each crate has to be published by hand — `cargo publish --locked`
+# with a personal token (imcp2's 0.1.0 was; imcp2-core's first release must be, and
+# its trusted publisher configured with this same repository/workflow/environment)
+# — and every release after it goes through this workflow.
 #
 # REQUIRED REPOSITORY SETTINGS, to be in place BEFORE the trusted publisher is
 # enabled. Neither can be expressed in this file, and without them the guards below
@@ -101,20 +103,24 @@ jobs:
           rustup default stable
           rustc --version && cargo --version
 
-      # A tag that disagrees with the manifest publishes a version under a name
-      # nobody can check out — and crates.io cannot take it back. Read the version
-      # from cargo itself rather than grepping the manifest, so the check reads the
-      # same field `cargo publish` will.
-      - name: Check the tag matches Cargo.toml
+      # A tag that disagrees with the manifests publishes a version under a name
+      # nobody can check out — and crates.io cannot take it back. Read the versions
+      # from cargo itself rather than grepping the manifests, so the check reads the
+      # same field `cargo publish` will. Both workspace crates release in lockstep:
+      # one tag, one version, two packages (imcp2 depends on imcp2-core "=version"
+      # semantics via the workspace pin, so a skew would not resolve anyway).
+      - name: Check the tag matches both Cargo.toml versions
         run: |
           tag="${GITHUB_REF_NAME#v}"
-          manifest="$(cargo metadata --format-version 1 --no-deps |
-            jq -er '.packages[] | select(.name == "imcp2") | .version')"
-          echo "tag=$tag manifest=$manifest"
-          if [ "$tag" != "$manifest" ]; then
-            echo "::error::tag ${GITHUB_REF_NAME} does not match Cargo.toml version ${manifest}" >&2
-            exit 1
-          fi
+          for pkg in imcp2-core imcp2; do
+            manifest="$(cargo metadata --format-version 1 --no-deps |
+              jq -er --arg pkg "$pkg" '.packages[] | select(.name == $pkg) | .version')"
+            echo "tag=$tag $pkg=$manifest"
+            if [ "$tag" != "$manifest" ]; then
+              echo "::error::tag ${GITHUB_REF_NAME} does not match ${pkg}'s Cargo.toml version ${manifest}" >&2
+              exit 1
+            fi
+          done
 
       # A tag can name any commit in the repository, including one that never went
       # through review. This catches the mistake — tagging a topic branch, or a
@@ -135,15 +141,21 @@ jobs:
       # immutable public release. `--locked` also guards Cargo.lock from drift, and
       # the lockfile is what ships in the .crate.
       - name: Test
-        run: cargo test --locked --all-targets
+        run: cargo test --locked --workspace --all-targets
 
-      # Rehearses the real thing — packages the crate and compiles the package in
-      # isolation — but stops short of uploading, so a package that only builds
-      # because of something untracked in the working tree fails here rather than
-      # after the upload is already permanent. This is also the verify build that
-      # lets the publish job skip its own; see `--no-verify` below.
+      # Rehearses the real thing — packages each crate, and compiles imcp2-core's
+      # package in isolation — but stops short of uploading, so a package that only
+      # builds because of something untracked in the working tree fails here rather
+      # than after the upload is already permanent. imcp2's package cannot be
+      # compile-verified before this release's imcp2-core exists on crates.io (it
+      # depends on it by version), so its rehearsal is `cargo package` without the
+      # verify build: the workspace test above already compiled exactly these
+      # sources. This is also the verify work that lets the publish job skip its
+      # own; see `--no-verify` below.
       - name: Package
-        run: cargo publish --locked --dry-run
+        run: |
+          cargo publish --locked --dry-run -p imcp2-core
+          cargo package --locked --no-verify -p imcp2
 
   # Holds the credential, and compiles nothing.
   publish:
@@ -177,10 +189,19 @@ jobs:
       # it `cargo publish` compiles the package — running the dependency tree's build
       # scripts and proc macros — while CARGO_REGISTRY_TOKEN sits in their
       # environment. The verify build is not skipped, only moved: the `verify` job
-      # ran `cargo publish --locked --dry-run` over this same commit, which packages
-      # and compiles exactly what is uploaded here. What remains in this job is
-      # reading files into a .crate and an HTTPS upload.
-      - name: Publish
-        run: cargo publish --locked --no-verify
+      # packaged both crates (and compiled imcp2-core's package) over this same
+      # commit, and the workspace test suite compiled exactly these sources. What
+      # remains in this job is reading files into a .crate and an HTTPS upload.
+      #
+      # Order matters: imcp2 depends on imcp2-core by version, so core publishes
+      # first; `cargo publish` waits for the just-published crate to appear in the
+      # index before returning, so the second publish resolves the first.
+      - name: Publish imcp2-core
+        run: cargo publish --locked --no-verify -p imcp2-core
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+
+      - name: Publish imcp2
+        run: cargo publish --locked --no-verify -p imcp2
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
diff --git a/Cargo.lock b/Cargo.lock
index a4da979..1e9e2ba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -483,10 +483,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
- "js-sys",
  "num-traits",
  "serde",
- "wasm-bindgen",
  "windows-link",
 ]
 
@@ -1779,16 +1777,13 @@ dependencies = [
  "axum",
  "base64 0.22.1",
  "candid",
- "candid_parser",
- "crc32fast",
  "getrandom 0.3.4",
  "hex",
  "http-body-util",
  "ic-agent",
+ "imcp2-core",
  "pocket-ic",
  "prometheus",
- "regex",
- "reqwest 0.13.4",
  "rmcp",
  "serde",
  "serde_json",
@@ -1804,6 +1799,30 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "imcp2-core"
+version = "0.2.0"
+dependencies = [
+ "base64 0.22.1",
+ "candid",
+ "candid_parser",
+ "crc32fast",
+ "getrandom 0.3.4",
+ "hex",
+ "http",
+ "ic-agent",
+ "regex",
+ "reqwest 0.13.4",
+ "rmcp",
+ "serde",
+ "serde_json",
+ "sha2 0.11.0",
+ "tokio",
+ "tracing",
+ "url",
+ "urlencoding",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.14.0"
@@ -2210,25 +2229,6 @@ dependencies = [
  "autocfg",
 ]
 
-[[package]]
-name = "oauth2"
-version = "5.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
-dependencies = [
- "base64 0.22.1",
- "chrono",
- "getrandom 0.2.17",
- "http",
- "rand 0.8.6",
- "serde",
- "serde_json",
- "serde_path_to_error",
- "sha2 0.10.9",
- "thiserror 1.0.69",
- "url",
-]
-
 [[package]]
 name = "object"
 version = "0.37.3"
@@ -2931,11 +2931,9 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
- "oauth2",
  "pastey",
  "pin-project-lite",
  "rand 0.10.1",
- "reqwest 0.13.4",
  "rmcp-macros",
  "schemars 1.2.1",
  "serde",
@@ -2947,7 +2945,6 @@ dependencies = [
  "tokio-util",
  "tower-service",
  "tracing",
- "url",
  "uuid",
 ]
 
@@ -4074,7 +4071,6 @@ dependencies = [
  "idna",
  "percent-encoding",
  "serde",
- "serde_derive",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 1772c0d..321c1b3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -20,24 +20,27 @@ categories = [
 # Everything the library and the bundled binary compile from ships; the
 # deployment scaffolding (container, systemd/native deploy, dashboards, CI,
 # submission docs) is repository-only and would just inflate the .crate.
-# `src/assets` and `static` are NOT optional: both are pulled in at compile
-# time with `include_str!`.
+# `src/assets` is NOT optional: it is pulled in at compile time with
+# `include_str!`. `crates/` holds the other workspace members (each packaged
+# on its own), so it is excluded from THIS package.
 exclude = [
     ".github/",
     ".dockerignore",
     "Dockerfile",
+    "crates/",
     "deploy/",
     "docs/",
     "monitoring/",
 ]
 
-[dependencies]
-rmcp = { version = "1.7", features = [
-    "server",
-    "macros",
-    "transport-streamable-http-server",
-    "auth",
-] }
+[workspace]
+members = [".", "crates/imcp2-core"]
+
+# Single source of truth for the version pins both crates share, so the agent,
+# codec, and candid lines can never drift between imcp2-core and imcp2.
+[workspace.dependencies]
+imcp2-core = { path = "crates/imcp2-core", version = "0.2.0" }
+rmcp = "1.7"
 # The Agent is INJECTED by the embedding application (see McpServer::new), so a
 # host shares one boundary-node client and one ic-agent across the process.
 # Deliberately a direct dependency for now: sourcing ic-agent through ic-bn-lib
@@ -51,12 +54,40 @@ ic-agent = "0.49"
 # worker-blocking CPU (ICPBB-382); 0.10.31 made it O(n).
 candid = { version = "0.10.31", features = ["value"] }
 candid_parser = "0.3.2"
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "signal", "time"] }
-axum = "0.8"
-anyhow = "1"
+tokio = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tracing = "0.1"
+sha2 = "0.11.0"
+base64 = "0.22.1"
+hex = "0.4.3"
+crc32fast = "1"
+regex = "1.12.4"
+reqwest = { version = "0.13", default-features = false, features = ["rustls"] }
+getrandom = "0.3.4"
+urlencoding = "2.1.3"
+url = "2"
+http = "1"
+
+[dependencies]
+# The transport/OAuth-agnostic components (the tool surface, the II session
+# engine, the connect-handshake primitives) live in imcp2-core; this crate adds
+# the hosted composition: the OAuth 2.1 authorization server, the
+# streamable-HTTP transport, and the axum routers.
+imcp2-core = { workspace = true }
+rmcp = { workspace = true, features = [
+    "server",
+    "macros",
+    "transport-streamable-http-server",
+] }
+ic-agent = { workspace = true }
+candid = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "signal", "time"] }
+axum = "0.8"
+anyhow = "1"
+serde = { workspace = true }
+serde_json = { workspace = true }
+tracing = { workspace = true }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 tokio-util = "0.7"
 uuid = { version = "1", features = ["v4"] }
@@ -67,15 +98,12 @@ tower-http = { version = "0.7", features = ["cors"] }
 # estate. The `process` feature adds CPU / RSS / file-descriptor collectors on
 # Linux, which is the deploy target.
 prometheus = { version = "0.14", features = ["process"] }
-sha2 = "0.11.0"
-base64 = "0.22.1"
-hex = "0.4.3"
-crc32fast = "1"
-regex = "1.12.4"
-reqwest = { version = "0.13", default-features = false, features = ["rustls"] }
-getrandom = "0.3.4"
-urlencoding = "2.1.3"
-url = "2"
+sha2 = { workspace = true }
+base64 = { workspace = true }
+hex = { workspace = true }
+getrandom = { workspace = true }
+urlencoding = { workspace = true }
+url = { workspace = true }
 # Only for the PocketIC-backed end-to-end test (src/e2e_handshake.rs), behind
 # the `e2e` feature so the default build never compiles it. Client library for a
 # local Internet Identity canister; version tracks the `pocket-ic` server binary.
diff --git a/Dockerfile b/Dockerfile
index 5b3ffc1..67b13cc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
-# Multi-stage build for the MCP server. The WASM Candid codec under static/wasm
-# is prebuilt and committed, so no wasm toolchain is needed here.
+# Multi-stage build for the MCP server. Everything the binary serves is
+# compiled in via include_str!, so the runtime image carries only the binary.
 FROM rust:1-slim-bookworm AS build
 WORKDIR /app
 # GIT_SHA / BUILD_TIME are baked into the binary (option_env! in main.rs) and
@@ -11,8 +11,9 @@ ENV GIT_SHA=${GIT_SHA}
 ENV BUILD_TIME=${BUILD_TIME}
 COPY Cargo.toml Cargo.lock ./
 COPY src ./src
-# static/ is needed at build time too: tools.rs include_str!s the candid/OQL references.
-COPY static ./static
+# The workspace member crates (imcp2-core carries the tool surface and its
+# compiled-in candid/OQL references under crates/imcp2-core/static).
+COPY crates ./crates
 RUN cargo build --release
 
 FROM debian:bookworm-slim
@@ -21,8 +22,6 @@ WORKDIR /app
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 COPY --from=build /app/target/release/imcp2 /usr/local/bin/imcp2
-# Static assets (signing frontend + WASM codec) are served relative to the workdir.
-COPY static ./static
 # See deploy/native/imcp2.service: the per-request log line is debug-level, and
 # is worth keeping on a deployed host.
 ENV RUST_LOG=info,imcp2::metrics=debug
diff --git a/crates/imcp2-core/Cargo.toml b/crates/imcp2-core/Cargo.toml
new file mode 100644
index 0000000..e8f4296
--- /dev/null
+++ b/crates/imcp2-core/Cargo.toml
@@ -0,0 +1,36 @@
+[package]
+name = "imcp2-core"
+version = "0.2.0"
+edition = "2021"
+description = "Transport-agnostic components of the IMCP2 Internet Computer MCP server: the tool surface, the Internet Identity session engine, and the II connect-handshake primitives."
+license = "Apache-2.0"
+repository = "https://github.com/dfinity/imcp2"
+homepage = "https://mcp.internetcomputer.org"
+keywords = ["mcp", "internet-computer", "icp", "candid"]
+categories = ["network-programming", "api-bindings"]
+
+[dependencies]
+# No transport feature: each binary picks its own (streamable-HTTP in imcp2,
+# stdio in imcp2-local). `server` + `macros` carry the tool router, the
+# ServerHandler machinery, and the schemars re-export every tool schema
+# derives against.
+rmcp = { workspace = true, features = ["server", "macros"] }
+ic-agent = { workspace = true }
+candid = { workspace = true }
+candid_parser = { workspace = true }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "sync", "net"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+tracing = { workspace = true }
+sha2 = { workspace = true }
+base64 = { workspace = true }
+hex = { workspace = true }
+crc32fast = { workspace = true }
+regex = { workspace = true }
+reqwest = { workspace = true }
+getrandom = { workspace = true }
+urlencoding = { workspace = true }
+url = { workspace = true }
+# The request-extension type the Bearer session lookup reads (axum re-exports
+# this same type; depending on `http` directly keeps axum out of this crate).
+http = { workspace = true }
diff --git a/src/assets/connect-callback.html b/crates/imcp2-core/src/assets/connect-callback.html
similarity index 100%
rename from src/assets/connect-callback.html
rename to crates/imcp2-core/src/assets/connect-callback.html
diff --git a/src/assets/connect.css b/crates/imcp2-core/src/assets/connect.css
similarity index 100%
rename from src/assets/connect.css
rename to crates/imcp2-core/src/assets/connect.css
diff --git a/src/assets/dfinity-logo.svg b/crates/imcp2-core/src/assets/dfinity-logo.svg
similarity index 100%
rename from src/assets/dfinity-logo.svg
rename to crates/imcp2-core/src/assets/dfinity-logo.svg
diff --git a/src/calls.rs b/crates/imcp2-core/src/calls.rs
similarity index 100%
rename from src/calls.rs
rename to crates/imcp2-core/src/calls.rs
diff --git a/src/discover.rs b/crates/imcp2-core/src/discover.rs
similarity index 100%
rename from src/discover.rs
rename to crates/imcp2-core/src/discover.rs
diff --git a/src/identities.rs b/crates/imcp2-core/src/identities.rs
similarity index 99%
rename from src/identities.rs
rename to crates/imcp2-core/src/identities.rs
index 4cd1c7c..891110d 100644
--- a/src/identities.rs
+++ b/crates/imcp2-core/src/identities.rs
@@ -86,7 +86,7 @@ const REDERIVE_MARGIN_NS: u64 = 30 * 1_000_000_000;
 /// entries out instead of blocking sign-in, and granted sessions are never
 /// touched. Also the cap on `AuthStore.authz`, which holds one entry per
 /// pending connect (see `crate::auth`), so the two maps stay in step.
-pub(crate) const MAX_PENDING_CONNECTS: usize = 1_024;
+pub const MAX_PENDING_CONNECTS: usize = 1_024;
 
 /// Hard ceiling on the session map. Only sessions holding a redeemed grant can
 /// push toward it (pending ones are bounded far lower by
@@ -592,7 +592,7 @@ impl Identities {
     /// Errors when the session map is at capacity ([`make_room`]) — the connect
     /// cannot be started, and `/oauth/authorize` surfaces that as a "try again in
     /// a moment" screen rather than handing II a key it isn't tracking.
-    pub(crate) async fn registration_pubkey_b64(&self, session_id: &str) -> Result<String, String> {
+    pub async fn registration_pubkey_b64(&self, session_id: &str) -> Result<String, String> {
         self.ensure_session(session_id).await?;
         let mut sessions = self.sessions.write().await;
         let s = sessions.get_mut(session_id).ok_or("no such session")?;
@@ -933,7 +933,7 @@ impl Identities {
     /// > (decoded as [`McpRegisterV2Reply`]; [`McpRegisterV2Ok`] is the `Ok`
     /// > payload). Re-verify the shapes if II's `.did` ever moves; the read-only
     /// > `opt text`/`variant` outage (#40) is the standing lesson against drift.
-    pub(crate) async fn redeem_registration_delegation(
+    pub async fn redeem_registration_delegation(
         &self,
         session_id: &str,
         reg_user_key: Vec<u8>,
@@ -1327,13 +1327,13 @@ fn map_delegation_error(e: AccountDelegationError) -> String {
 /// what II returned from `mcp_register_v2`. Surfaced to the connect handler so
 /// it can log the access level; the values are also recorded on the session.
 #[derive(Debug)]
-pub(crate) struct RegistrationOutcome {
+pub struct RegistrationOutcome {
     /// Grant expiration (ns since the Unix epoch).
-    pub(crate) expiration_ns: u64,
+    pub expiration_ns: u64,
     /// The recorded access level, in the delegation vocabulary: `"queries"` =
     /// read-only, `"all"` = full (always present — `McpRegistrationV2`'s
     /// `permissions` is non-optional).
-    pub(crate) permissions: &'static str,
+    pub permissions: &'static str,
 }
 
 // ---- II candid contract for the mcp_* delegation methods --------------------
diff --git a/crates/imcp2-core/src/iiconnect.rs b/crates/imcp2-core/src/iiconnect.rs
new file mode 100644
index 0000000..4c41758
--- /dev/null
+++ b/crates/imcp2-core/src/iiconnect.rs
@@ -0,0 +1,507 @@
+//! Internet Identity **connect-handshake primitives**, shared by every binary
+//! that logs a user in with II's registration-delegation flow: building the II
+//! `/mcp` connect link, rendering the pinned fragment-reading callback page,
+//! parsing the fragment's delegation chain, and the `#4091` auth-callback
+//! allow-list path. Everything here is parameterised on plain values (URLs,
+//! strings) and returns plain values — the embedding server wraps them in its
+//! own HTTP handlers and supplies its own state (an OAuth authorization server
+//! in the hosted `imcp2` binary; a transient loopback listener in a local one).
+
+use base64::Engine;
+use candid::Principal;
+use ic_agent::identity::{Delegation, SignedDelegation};
+use serde::Deserialize;
+
+/// Build Internet Identity's `/mcp` connect link for one connection. Everything
+/// is in the URL **fragment** (never sent to II's servers): `callback` (the
+/// pinned callback URL on the caller's origin), the single-use `state`, the
+/// requested grant `ttl` in SECONDS, and `registration_key` — this connect's
+/// registration public key `pub(X)` (DER, base64url), toward which II builds
+/// the registration chain `P_reg -> Y -> X` (param name per
+/// dfinity/internet-identity#4093; its presence selects the connect flow). II
+/// navigates the tab back to `callback` — validated against the origin's
+/// [`AUTH_CALLBACKS_WELL_KNOWN`] allow-list (#4091) — with the delegation in
+/// the fragment; the callback page rendered by [`pinned_callback_page`] is the
+/// sole fragment reader. No `priv(X)` is ever put in the link — only its
+/// public half.
+pub fn ii_mcp_url(ii_url: &str, callback_url: &str, state: &str, ttl_secs: u64, reg_pubkey_b64: &str) -> String {
+    format!(
+        "{ii_url}/mcp#callback={cb}&state={st}&ttl={ttl_secs}&registration_key={rk}",
+        cb = urlencoding::encode(callback_url),
+        st = urlencoding::encode(state),
+        rk = urlencoding::encode(reg_pubkey_b64),
+    )
+}
+
+// ---- Callback allow-list (II #4091) ---------------------------------------
+
+/// The well-known path Internet Identity fetches a server's **auth-callback
+/// allow-list** from (dfinity/internet-identity#4091): before contacting the
+/// connect callback named in the (attacker-craftable) link fragment, II fetches
+/// `<callback origin>` + this path — `redirect: "error"`, no credentials,
+/// `no-store`, 8 KB cap, `application/json` required — and rejects the connect
+/// unless the callback URL is EXACTLY (string-equal) one of the declared
+/// entries. **Fail-closed**: a missing/unfetchable file fails every connect for
+/// this origin, so serving this document is mandatory once #4091 ships.
+pub const AUTH_CALLBACKS_WELL_KNOWN: &str = "/.well-known/ii-auth-callbacks";
+
+/// A fresh CSP nonce: 128 bits from the OS CSPRNG, **standard** base64. CSP3's
+/// `base64-value` grammar also admits base64url, but CSP2's does not (`-`/`_`
+/// absent), so use the standard alphabet for maximum parser compatibility — a
+/// strict-CSP2 parser that rejected the nonce source would block the inline
+/// script and break the callback page. `+`/`/`/`=` are all safe where the nonce
+/// rides (a quoted HTML attribute and a header value).
+pub fn csp_nonce() -> String {
+    let mut bytes = [0u8; 16];
+    getrandom::fill(&mut bytes).expect("getrandom");
+    base64::engine::general_purpose::STANDARD.encode(bytes)
+}
+
+/// Styling for the pinned callback page, following the DFINITY brand guidelines
+/// (Parchment/Ink/Rust palette, an editorial serif display over a UI sans, a
+/// grid-paper surface, and the official gradient-infinity logo). A full-bleed
+/// screen: the status stage (a spinner on a soft elevated tile plus an accessible
+/// serif headline) fills and centres the viewport, with a foot-of-page "Hosted
+/// by" mark; the spinner is CSS-only (disabled under `prefers-reduced-motion`).
+/// Light/dark theming via `prefers-color-scheme` with a `data-theme` override,
+/// using the brand's Bark/Bone/Ember dark palette. Fully self-contained (no
+/// external fonts, images, or stylesheets; the logo is inlined into the served
+/// HTML), so it renders identically under the pinned page's strict
+/// `default-src 'none'` CSP. The stylesheet lives in `assets/connect.css` and is
+/// compiled into the binary via `include_str!` (no runtime file I/O), so it is
+/// authored as a real `.css` file rather than a Rust string literal. The pinned
+/// page serves it in a `<style nonce>` block (with `style-src 'nonce-...'` added
+/// to its CSP so the block is allowed WITHOUT `'unsafe-inline'`). The `.error`
+/// modifier (added to `.screen` client-side) hides the spinner tile once a
+/// terminal message is shown. Public so the embedding server's other
+/// browser-facing pages (e.g. `imcp2`'s error screens) reuse the one shell.
+pub const CONNECT_PAGE_CSS: &str = include_str!("assets/connect.css");
+
+/// The official DFINITY logo (gradient-infinity mark + wordmark), taken from
+/// dfinity.org. It lives in `assets/dfinity-logo.svg` and is compiled into the
+/// binary via `include_str!`, then inlined into the served HTML so it needs no
+/// external fetch under the pinned page's strict CSP. The infinity keeps the
+/// brand gradients; the wordmark is set to `currentColor` so it follows the
+/// page's Ink/Bone text color across light and dark themes. Public for the
+/// same reason as [`CONNECT_PAGE_CSS`].
+pub const CONNECT_LOGO_SVG: &str = include_str!("assets/dfinity-logo.svg");
+
+/// HTML template for the pinned callback page, kept as a real `.html` asset file
+/// (compiled in via `include_str!`, no runtime file I/O) rather than an inline
+/// Rust string literal, so the markup reads and diffs as HTML. It is a self-
+/// contained document with `__TOKEN__` placeholders spliced in at render time
+/// (the stylesheet `__CSS__`, the logo `__LOGO__`, and the per-response
+/// `__NONCE__`/`__SCRIPT__`). No user-influenced value is ever interpolated.
+const PINNED_PAGE_HTML: &str = include_str!("assets/connect-callback.html");
+
+/// The pinned page's inline script, kept as a PLAIN string, not a `format!`
+/// template, so it reads naturally (no doubled braces, room for comments). The
+/// one dynamic value, the redeem URL, is spliced in by replacing
+/// `__REDEEM_URL__`, which sits inside a quoted JS string literal below.
+const PINNED_PAGE_JS: &str = r#"(function () {
+  function show(t, err) {
+    document.getElementById('m').textContent = t;
+    if (err) {
+      var c = document.querySelector('.screen');
+      if (c) { c.classList.add('error'); }
+    }
+  }
+  // II delivers #delegation=<chain JSON>&state=<state>: the two-hop chain plus
+  // the connect state, percent-encoded by URLSearchParams and decoded again by
+  // it here. Consent (permissions, max_ttl) is NOT in the fragment: the user
+  // chose it earlier at II's prepare step, which stored it keyed by P_reg, and
+  // mcp_register_v2 recovers it server-side. So the page forwards only the chain
+  // and the state; the backend redeems with mcp_register_v2(session_key).
+  var params = new URLSearchParams(location.hash.slice(1));
+  var body = JSON.stringify({
+    state: params.get('state') || '',
+    delegation: params.get('delegation') || ''
+  });
+  // Scrub the delegation from the address bar, keeping the path and any query
+  // string the declared callback carries. Best-effort: the POST below works
+  // even if a browser refuses the history call.
+  try { history.replaceState(null, '', location.pathname + location.search); } catch (e) {}
+  fetch("__REDEEM_URL__", {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    credentials: 'same-origin',
+    body: body
+  })
+    .then(function (r) { return r.json().catch(function () { return {}; }); })
+    .then(function (d) {
+      if (d && d.redirect) {
+        location.replace(d.redirect);
+      } else {
+        show((d && d.error) || "We couldn't finish the connection. Restart from your client.", true);
+      }
+    })
+    .catch(function () {
+      show("We couldn't reach the server. Restart from your client.", true);
+    });
+})();"#;
+
+/// A rendered pinned callback page: the final HTML plus the
+/// `Content-Security-Policy` header value its nonce is bound into. The
+/// embedding server turns this into an HTTP response, adding its own
+/// non-CSP hardening headers (`Referrer-Policy: no-referrer`,
+/// `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`).
+pub struct PinnedPage {
+    /// The complete, self-contained HTML document.
+    pub html: String,
+    /// The `Content-Security-Policy` value matching the nonce spliced into
+    /// `html`'s inline `<script>`/`<style>` blocks.
+    pub csp: String,
+}
+
+/// Render the strict-CSP, non-reflecting **pinned callback page** — the sole
+/// reader of the delegation fragment II delivers. A fresh per-response nonce is
+/// bound into the CSP and BOTH the inline `<script>` and `<style>`, so no
+/// `'unsafe-inline'` is needed; `connect-src 'self'` limits the page's only
+/// network reach to the same-origin redeem endpoint, and `default-src 'none'`
+/// forbids loading anything else (all styling is inline and self-contained; see
+/// [`CONNECT_PAGE_CSS`]). No attacker-supplied value (fragment, query) is ever
+/// interpolated into the HTML; the fragment is read client-side and sent via
+/// `fetch`, never written to the DOM.
+///
+/// The fragment shape matches II's frontend (merged contract): the delegation
+/// chain plus the connect state only:
+/// `#delegation=<JSON.stringify(DelegationChain.toJSON())>&state=<state>`,
+/// percent-encoded by `URLSearchParams`. The script reads both fields and
+/// POSTs them as a [`RedeemBody`] to `redeem_url` (same-origin). `contact` is
+/// the address shown by the page's error state so a failed handshake carries a
+/// "report it" line.
+pub fn pinned_callback_page(redeem_url: &str, contact: &str) -> PinnedPage {
+    let nonce = csp_nonce();
+    let redeem = js_escape(redeem_url);
+    let script = PINNED_PAGE_JS.replace("__REDEEM_URL__", &redeem);
+    // The markup lives in `assets/connect-callback.html` (include_str!). The
+    // status line is a `role=status` / `aria-live=polite` region so screen
+    // readers announce both "Connecting agent to Internet Identity…" and any
+    // terminal error the script swaps in. Below it sits a `.contact-hint` line
+    // (hidden during a normal connect; revealed by the stylesheet once the
+    // script adds `.error` to `.screen`) so every handshake/redeem failure the
+    // user lands on carries the "contact us to report it" line. The DFINITY logo
+    // carries its own `aria-label`; the spinner is decorative (`aria-hidden`).
+    // `__NONCE__` (both the `<style>` and `<script>` tags), the self-contained
+    // stylesheet, logo, the contact address, and redeem script are spliced in;
+    // none of those values contains a placeholder token, so the order is immaterial.
+    let html = PINNED_PAGE_HTML
+        .replace("__NONCE__", &nonce)
+        .replace("__CSS__", CONNECT_PAGE_CSS)
+        .replace("__LOGO__", CONNECT_LOGO_SVG)
+        .replace("__CONTACT__", contact)
+        .replace("__SCRIPT__", &script);
+    // `style-src 'nonce-{nonce}'` admits ONLY the nonce'd `<style>` block above
+    // (no `'unsafe-inline'`, so an injected `style=` attribute or stray `<style>`
+    // still can't apply). Without it the block falls back to `default-src
+    // 'none'` and the page renders unstyled.
+    // `img-src 'self'`: CSP governs the `<link rel=icon>` fetch as an image, so
+    // without it the favicon is dropped.
+    // `frame-ancestors 'none'`: II reaches this page only by top-level
+    // navigation, so framing is never legitimate: deny it outright so the
+    // delegation-bearing page can't be embedded for UI redress. X-Frame-Options
+    // covers legacy browsers that predate CSP2 (modern ones ignore it when
+    // frame-ancestors is present).
+    let csp = format!(
+        "default-src 'none'; script-src 'nonce-{nonce}'; style-src 'nonce-{nonce}'; \
+         img-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; \
+         frame-ancestors 'none'"
+    );
+    PinnedPage { html, csp }
+}
+
+/// Escape a string for embedding inside a double-quoted JS string literal.
+pub fn js_escape(s: &str) -> String {
+    s.replace('\\', "\\\\").replace('"', "\\\"").replace('<', "\\x3c")
+}
+
+// ---- The redeem body + delegation-chain parsing ---------------------------
+
+/// The redeem POST body — what the pinned callback page sends after parsing
+/// the fragment: the `state` echo and the delegation chain's JSON text exactly
+/// as II's frontend put it in the fragment
+/// (`JSON.stringify(DelegationChain.toJSON())`, dfinity/internet-identity#4093).
+/// **No consent values and no anchor are carried**: the user's chosen
+/// permissions/TTL were captured earlier at `prepare_mcp_registration_delegation`
+/// (keyed by `P_reg`), and II recovers them, and the user's identity number,
+/// from `caller() == P_reg`, so the server never sees any of them.
+#[derive(Deserialize)]
+pub struct RedeemBody {
+    /// The single-use connect state (= session id), echoed by II.
+    pub state: String,
+    /// The two-hop `P_reg -> Y -> X` chain as agent-js `DelegationChain` JSON
+    /// ([`JsonDelegationChain`]); `der(P_reg)` rides inside as `publicKey`.
+    #[serde(default)]
+    pub delegation: String,
+}
+
+/// Size cap for the redeem body's `delegation` JSON text, checked BEFORE
+/// parsing so oversized attacker-controlled input is rejected without large
+/// allocations (same posture as the discovery-buffering bound, CWE-770). A
+/// legitimate chain — one delegation plus a canister signature with its
+/// certificate — is a few KB of hex/JSON, so this is generous while staying
+/// far under a server's request-body limits.
+pub const MAX_REG_DELEGATION_JSON: usize = 64 * 1024;
+
+/// agent-js `DelegationChain.toJSON()`, the wire shape II's frontend delivers
+/// in the callback fragment (dfinity/internet-identity#4093): byte fields are
+/// HEX strings, `expiration` is a HEX string of ns since the epoch
+/// (`BigInt.toString(16)`), `targets` are principal texts, and `publicKey` is
+/// the chain root `der(P_reg)`. `delegations` carries TWO hops — the
+/// canister-signed `P_reg -> Y` toward II's ephemeral browser-held `Y`, and
+/// the `Y`-signed `Y -> X` toward our registration key (the split keeps the
+/// canister-signed piece, which transits the IC, inert on its own).
+///
+/// `deny_unknown_fields` on purpose: every field of a delegation is covered by
+/// its canister signature, so a field this parser does not carry (e.g. a future
+/// `permissions`) could never re-hash to what II signed — dropping it silently
+/// would resurface the opaque "sig not found in the signature tree" replica
+/// error (the #40 read-only outage). Failing fast names the real problem.
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct JsonDelegationChain {
+    delegations: Vec<JsonSignedDelegation>,
+    #[serde(rename = "publicKey")]
+    public_key: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct JsonSignedDelegation {
+    delegation: JsonDelegation,
+    signature: String,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(deny_unknown_fields)]
+struct JsonDelegation {
+    pubkey: String,
+    /// Hex string of ns since the Unix epoch (agent-js `BigInt.toString(16)`).
+    expiration: String,
+    #[serde(default)]
+    targets: Option<Vec<String>>,
+}
+
+/// Decode a hex string field of the chain JSON.
+fn hex_decode(field: &str, s: &str) -> Result<Vec<u8>, String> {
+    hex::decode(s.trim()).map_err(|e| format!("{field} is not valid hex: {e}"))
+}
+
+/// Parse the fragment's `DelegationChain` JSON into `(der(P_reg), chain)` as
+/// `ic-agent` types — hop count is preserved verbatim (two hops per rev3 of the
+/// guide; the redeem path only requires that the FINAL hop targets our `X`, and
+/// the replica verifies every hop authoritatively). The chain carries no
+/// `permissions` field: the access level isn't stored in the delegation at all.
+/// The user chose it at consent, II stored it under `P_reg` at
+/// `prepare_mcp_registration_delegation`, and it never touches the server. So a
+/// `permissions` field appearing here would be unexpected, and
+/// [`JsonDelegationChain`] fails fast if one ever does.
+pub fn parse_registration_delegation(delegation_json: &str) -> Result<(Vec<u8>, Vec<SignedDelegation>), String> {
+    // Bound the size BEFORE parsing (see MAX_REG_DELEGATION_JSON): reject
+    // oversized input without allocating for it. This also inherently bounds
+    // every field inside the JSON (pubkeys, signatures, targets).
+    if delegation_json.len() > MAX_REG_DELEGATION_JSON {
+        return Err(format!("delegation exceeds {MAX_REG_DELEGATION_JSON} bytes"));
+    }
+    let chain: JsonDelegationChain =
+        serde_json::from_str(delegation_json).map_err(|e| format!("delegation JSON: {e}"))?;
+    let user_key = hex_decode("publicKey", &chain.public_key)?;
+    let delegations = chain
+        .delegations
+        .iter()
+        .map(|d| {
+            let targets = match &d.delegation.targets {
+                None => None,
+                Some(ts) => Some(
+                    ts.iter()
+                        .map(|t| {
+                            Principal::from_text(t.trim())
+                                .map_err(|e| format!("delegation target principal: {e}"))
+                        })
+                        .collect::<Result<Vec<_>, _>>()?,
+                ),
+            };
+            Ok(SignedDelegation {
+                delegation: Delegation {
+                    pubkey: hex_decode("delegation pubkey", &d.delegation.pubkey)?,
+                    expiration: u64::from_str_radix(d.delegation.expiration.trim(), 16)
+                        .map_err(|_| "delegation expiration is not a hex u64".to_string())?,
+                    targets,
+                    permissions: None,
+                },
+                signature: hex_decode("delegation signature", &d.signature)?,
+            })
+        })
+        .collect::<Result<Vec<_>, String>>()?;
+    Ok((user_key, delegations))
+}
+
+#[cfg(test)]
+mod tests {
+    // A REAL agent-js `DelegationChain.toJSON()` payload round-trips: built
+    // exactly as II's #4093 frontend emits it (hex byte fields, HEX-string
+    // expiration, principal-text targets, top-level `publicKey` = der(P_reg)),
+    // carrying rev3's TWO hops (`P_reg -> Y` canister-signed, `Y -> X`
+    // browser-signed) — decodes into `(der(P_reg), [both hops in order])`.
+    #[test]
+    fn parse_registration_delegation_round_trips_two_hops() {
+        let der_preg = vec![1u8, 2, 3];
+        let der_y = vec![7u8, 7, 7]; // II's ephemeral browser-held key
+        let der_x = vec![9u8, 8, 7, 6]; // our registration key
+        let sig_canister = vec![4u8, 5, 6];
+        let sig_y = vec![1u8, 9, 9];
+        let chain_json = serde_json::json!({
+            "delegations": [
+                {
+                    "delegation": {
+                        "pubkey": hex::encode(&der_y),
+                        "expiration": format!("{:x}", 66_u64), // BigInt.toString(16)
+                        "targets": ["aaaaa-aa"],
+                    },
+                    "signature": hex::encode(&sig_canister),
+                },
+                {
+                    "delegation": {
+                        "pubkey": hex::encode(&der_x),
+                        "expiration": format!("{:x}", 66_u64),
+                    },
+                    "signature": hex::encode(&sig_y),
+                },
+            ],
+            "publicKey": hex::encode(&der_preg),
+        })
+        .to_string();
+        let (uk, chain) = super::parse_registration_delegation(&chain_json).expect("parse");
+        assert_eq!(uk, der_preg);
+        assert_eq!(chain.len(), 2, "both hops preserved, in order");
+        // Hop 1: canister-signed P_reg -> Y. Its `targets` round-trips from
+        // principal text (`aaaaa-aa` here as a stand-in; live chains carry the
+        // II canister id).
+        assert_eq!(chain[0].delegation.pubkey, der_y);
+        assert_eq!(chain[0].delegation.expiration, 66);
+        assert_eq!(chain[0].signature, sig_canister);
+        assert_eq!(
+            chain[0].delegation.targets.as_ref().unwrap()[0],
+            candid::Principal::management_canister()
+        );
+        // Hop 2: browser-signed Y -> X.
+        assert_eq!(chain[1].delegation.pubkey, der_x);
+        assert_eq!(chain[1].signature, sig_y);
+        assert_eq!(chain[1].delegation.targets, None);
+        // Neither hop carries a permissions field; the access level was chosen
+        // at consent and stored by II under P_reg (recovered from caller()), so
+        // it never rides the delegation or the fragment.
+        assert!(chain.iter().all(|d| d.delegation.permissions.is_none()));
+    }
+
+    // Malformed input fails with a clear error: non-JSON, bad hex, a
+    // non-hex expiration — and, critically, an UNKNOWN field inside the
+    // delegation (deny_unknown_fields): every delegation field is covered by
+    // the canister signature, so silently dropping one could never re-hash to
+    // what II signed (the #40 outage class) — fail fast instead.
+    #[test]
+    fn parse_registration_delegation_rejects_bad_input() {
+        assert!(super::parse_registration_delegation("not json").is_err());
+
+        let bad_hex = serde_json::json!({
+            "delegations": [{
+                "delegation": { "pubkey": "zz", "expiration": "1" },
+                "signature": "0102",
+            }],
+            "publicKey": "010203",
+        })
+        .to_string();
+        let err = super::parse_registration_delegation(&bad_hex).expect_err("bad hex must fail");
+        assert!(err.contains("not valid hex"), "got: {err}");
+
+        let bad_exp = serde_json::json!({
+            "delegations": [{
+                "delegation": { "pubkey": "0102", "expiration": "not-hex" },
+                "signature": "0102",
+            }],
+            "publicKey": "010203",
+        })
+        .to_string();
+        let err = super::parse_registration_delegation(&bad_exp).expect_err("bad expiration must fail");
+        assert!(err.contains("expiration"), "got: {err}");
+
+        // A field this parser does not carry (e.g. a future `permissions`)
+        // must fail fast rather than be silently dropped.
+        let unknown_field = serde_json::json!({
+            "delegations": [{
+                "delegation": { "pubkey": "0102", "expiration": "1", "permissions": "queries" },
+                "signature": "0102",
+            }],
+            "publicKey": "010203",
+        })
+        .to_string();
+        let err = super::parse_registration_delegation(&unknown_field)
+            .expect_err("an unknown delegation field must fail fast, not silently drop");
+        assert!(err.contains("permissions"), "got: {err}");
+    }
+
+    // CWE-770 guard: an oversized delegation payload is rejected BEFORE any
+    // JSON parse, so an attacker-sized payload can't force large allocations.
+    // A legit chain is a few KB, far below the cap.
+    #[test]
+    fn parse_registration_delegation_bounds_input_size() {
+        let huge = "A".repeat(super::MAX_REG_DELEGATION_JSON + 1);
+        let err = super::parse_registration_delegation(&huge).expect_err("oversized delegation rejected");
+        assert!(err.contains("exceeds"), "got: {err}");
+
+        // At-cap input proceeds past the size check (and fails on content,
+        // not on size) — the bound doesn't clip legitimate-shaped requests.
+        let at_cap = "A".repeat(super::MAX_REG_DELEGATION_JSON);
+        let err = super::parse_registration_delegation(&at_cap).expect_err("fails on content, not size");
+        assert!(!err.contains("exceeds"), "at-cap input must pass the size check: {err}");
+    }
+
+    // The CSP nonce must use the STANDARD base64 alphabet: CSP2's base64-value
+    // grammar has no `-`/`_`, so a base64url nonce risks a strict parser dropping
+    // the source and blocking the inline script (breaking the callback page).
+    #[test]
+    fn csp_nonce_is_standard_base64() {
+        for _ in 0..16 {
+            let n = super::csp_nonce();
+            assert!(
+                !n.contains('-') && !n.contains('_'),
+                "CSP nonce must not use base64url characters: {n}"
+            );
+            assert!(n.len() >= 22, "128-bit nonce floor: {n}");
+        }
+    }
+
+    // The connect link carries everything in the FRAGMENT, percent-encoded, in
+    // the #4093 parameter order; the pinned page's CSP binds the same nonce
+    // into both inline blocks.
+    #[test]
+    fn ii_mcp_url_encodes_fragment_params() {
+        let url = super::ii_mcp_url(
+            "https://id.ai",
+            "http://127.0.0.1:4361/callback",
+            "sess-1",
+            3600,
+            "AQID",
+        );
+        assert!(url.starts_with("https://id.ai/mcp#callback="));
+        assert!(url.contains("callback=http%3A%2F%2F127.0.0.1%3A4361%2Fcallback"), "{url}");
+        assert!(url.contains("&state=sess-1&ttl=3600&registration_key=AQID"), "{url}");
+    }
+
+    #[test]
+    fn pinned_page_binds_one_nonce_into_html_and_csp() {
+        let page = super::pinned_callback_page("/oauth/connect/redeem", "mcp@dfinity.org");
+        // The CSP names a nonce; that same nonce appears in the HTML (script +
+        // style), and the redeem URL is spliced into the script.
+        let nonce = page
+            .csp
+            .split("script-src 'nonce-")
+            .nth(1)
+            .and_then(|s| s.split('\'').next())
+            .expect("CSP carries a script nonce");
+        assert!(page.html.contains(nonce), "nonce must be spliced into the HTML");
+        assert!(page.html.contains("/oauth/connect/redeem"), "redeem URL spliced into the script");
+        assert!(page.html.contains("mcp@dfinity.org"), "contact line spliced in");
+        assert!(!page.html.contains("__NONCE__") && !page.html.contains("__SCRIPT__"));
+    }
+}
diff --git a/crates/imcp2-core/src/lib.rs b/crates/imcp2-core/src/lib.rs
new file mode 100644
index 0000000..29e9b4e
--- /dev/null
+++ b/crates/imcp2-core/src/lib.rs
@@ -0,0 +1,49 @@
+//! imcp2-core — the transport/OAuth-agnostic components of the IMCP2 Internet
+//! Computer MCP server, from which a serving binary is composed:
+//!
+//!   * [`tools::IcTools`] — the complete MCP tool surface (canister reads and
+//!     writes in textual Candid, app/canister discovery, OQL, canister
+//!     management, IC skills), an [`rmcp`] `ServerHandler` ready to serve over
+//!     whichever transport the binary picks (streamable-HTTP in the hosted
+//!     `imcp2` server, stdio in a local one).
+//!   * [`identities`] — the Internet Identity session engine: the per-connection
+//!     session-key grant (registered with II via `mcp_register_v2`) and the
+//!     short-lived per-app account delegations minted from it on demand.
+//!   * [`iiconnect`] — the II connect-handshake primitives (the `/mcp` connect
+//!     link, the pinned fragment-reading callback page, the delegation-chain
+//!     parser, the `#4091` auth-callback allow-list path), parameterised on
+//!     plain values so each binary wraps them in its own HTTP handlers.
+//!
+//! How a tool call finds the II session it acts as is the one seam between
+//! deployments: the hosted server resolves it per request from the
+//! [`AuthedSession`] extension its bearer-token gate injects
+//! ([`SessionSource::Bearer`]), while a single-user local server pins one
+//! session established at login ([`SessionSource::Singleton`]). The tool
+//! implementations are identical in both.
+//!
+//! The IC [`Agent`] is **inherited from the embedding application**, not built
+//! here: the binary passes in its own agent, so anonymous canister calls go
+//! through the host's boundary-node client and the whole process links a
+//! single `ic-agent`.
+
+pub mod identities;
+pub mod iiconnect;
+pub mod skills;
+pub mod tools;
+
+mod calls;
+mod discover;
+mod management;
+
+pub use identities::{IiInstance, SessionGauges};
+pub use tools::{AuthedSession, IcTools, SessionSource};
+/// The IC [`Agent`] type the components are built around, re-exported so
+/// callers construct the injected agent from the exact `ic-agent` version this
+/// crate links.
+pub use ic_agent::{self, Agent};
+
+/// A sensible default IC API boundary node (the public mainnet endpoint) for
+/// callers that just want `Agent::builder().with_url(IC_URL).build()`. A host
+/// with its own boundary-node routing supplies an agent built against that
+/// instead.
+pub const IC_URL: &str = "https://icp-api.io";
diff --git a/src/management.rs b/crates/imcp2-core/src/management.rs
similarity index 100%
rename from src/management.rs
rename to crates/imcp2-core/src/management.rs
diff --git a/src/skills.rs b/crates/imcp2-core/src/skills.rs
similarity index 100%
rename from src/skills.rs
rename to crates/imcp2-core/src/skills.rs
diff --git a/src/tools.rs b/crates/imcp2-core/src/tools.rs
similarity index 97%
rename from src/tools.rs
rename to crates/imcp2-core/src/tools.rs
index 3151759..c7b4b75 100644
--- a/src/tools.rs
+++ b/crates/imcp2-core/src/tools.rs
@@ -17,7 +17,7 @@ use rmcp::{
     schemars, ErrorData as McpError, RoleServer, ServerHandler,
 };
 
-use crate::{auth, calls, discover, identities, identities::Identities, management, skills};
+use crate::{calls, discover, identities, identities::Identities, management, skills};
 
 /// Cap on the per-canister Candid probes open_app / discover_app_canisters run to
 /// fill in OQL / api-doc capability flags (#3). Discovery output is already bounded,
@@ -49,19 +49,44 @@ const OQL_PRIMER_MD: &str = include_str!("../static/oql-primer.md");
 // together.
 
 #[derive(Clone)]
-pub(crate) struct IcTools {
+pub struct IcTools {
     agent: Agent,
     identities: Identities,
     skills: skills::SkillsCatalog,
+    /// Where a tool call finds the Internet Identity session it acts as — the
+    /// one per-deployment seam (see [`SessionSource`]).
+    session: SessionSource,
 }
 
 #[tool_router]
 impl IcTools {
-    pub(crate) fn new(agent: Agent, identities: Identities, skills: skills::SkillsCatalog) -> Self {
+    pub fn new(
+        agent: Agent,
+        identities: Identities,
+        skills: skills::SkillsCatalog,
+        session: SessionSource,
+    ) -> Self {
         Self {
             agent,
             identities,
             skills,
+            session,
+        }
+    }
+
+    /// The session id this tool call acts as, per the deployment's
+    /// [`SessionSource`]: looked up from the request's [`AuthedSession`]
+    /// extension under `Bearer` (multi-user, hosted), or the fixed
+    /// login-established session under `Singleton` (single-user, local).
+    /// `None` means the call is unauthenticated ("needs an authenticated
+    /// session" errors at the call sites are unchanged).
+    fn current_session_id(&self, ctx: &RequestContext<RoleServer>) -> Option<String> {
+        match &self.session {
+            SessionSource::Bearer => authed_session(ctx).map(|s| s.session_id),
+            SessionSource::Singleton(id) => {
+                let _ = ctx;
+                Some(id.clone())
+            }
         }
     }
 
@@ -348,9 +373,9 @@ impl IcTools {
         match origin {
             None => Ok((self.agent.clone(), None)),
             Some(origin) => {
-                let session_id = authed_session(ctx)
-                    .ok_or_else(|| format!("{what} as an app needs an authenticated session"))?
-                    .session_id;
+                let session_id = self
+                    .current_session_id(ctx)
+                    .ok_or_else(|| format!("{what} as an app needs an authenticated session"))?;
                 let delegated = self
                     .identities
                     .delegated_identity_for(&session_id, origin, account)
@@ -806,8 +831,8 @@ impl IcTools {
         Parameters(identities::GetPrincipalArgs { derivation_origin, account }): Parameters<identities::GetPrincipalArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let session_id = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let session_id = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("getting an app principal needs an authenticated session".into())),
         };
         // `derivation_origin` is a required String here, so this always yields a
@@ -862,8 +887,8 @@ impl IcTools {
         Parameters(identities::ListAccountsArgs { derivation_origin }): Parameters<identities::ListAccountsArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let session_id = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let session_id = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("listing your accounts needs an authenticated session".into())),
         };
         // `derivation_origin` is a required String here, so this always yields a
@@ -1295,8 +1320,8 @@ impl IcTools {
         Parameters(_args): Parameters<management::NoArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("checking your cycles balance needs an authenticated session".into())),
         };
         match management::cycles_balance(&self.identities, &sid).await {
@@ -1318,8 +1343,8 @@ impl IcTools {
         Parameters(args): Parameters<management::CreateCanisterArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("creating a canister needs an authenticated session".into())),
         };
         match management::create_canister(&self.identities, &sid, args).await {
@@ -1341,8 +1366,8 @@ impl IcTools {
         Parameters(args): Parameters<management::TopUpArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("topping up a canister needs an authenticated session".into())),
         };
         let canister_id = args.canister_id.clone();
@@ -1362,8 +1387,8 @@ impl IcTools {
         Parameters(args): Parameters<management::InstallCodeArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("installing code needs an authenticated session".into())),
         };
         let canister_id = args.canister_id.clone();
@@ -1383,8 +1408,8 @@ impl IcTools {
         Parameters(args): Parameters<management::CanisterRefArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("reading canister status needs an authenticated session".into())),
         };
         let canister_id = args.canister_id.clone();
@@ -1404,8 +1429,8 @@ impl IcTools {
         Parameters(args): Parameters<management::UpdateSettingsArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("updating settings needs an authenticated session".into())),
         };
         let canister_id = args.canister_id.clone();
@@ -1425,8 +1450,8 @@ impl IcTools {
         Parameters(management::CanisterRefArgs { canister_id }): Parameters<management::CanisterRefArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("starting a canister needs an authenticated session".into())),
         };
         let result = management::start_canister(&self.identities, &sid, &canister_id).await;
@@ -1443,8 +1468,8 @@ impl IcTools {
         Parameters(management::CanisterRefArgs { canister_id }): Parameters<management::CanisterRefArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("stopping a canister needs an authenticated session".into())),
         };
         let result = management::stop_canister(&self.identities, &sid, &canister_id).await;
@@ -1461,8 +1486,8 @@ impl IcTools {
         Parameters(management::CanisterRefArgs { canister_id }): Parameters<management::CanisterRefArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("uninstalling code needs an authenticated session".into())),
         };
         let result = management::uninstall_code(&self.identities, &sid, &canister_id).await;
@@ -1479,8 +1504,8 @@ impl IcTools {
         Parameters(management::CanisterRefArgs { canister_id }): Parameters<management::CanisterRefArgs>,
         ctx: RequestContext<RoleServer>,
     ) -> Result<CallToolResult, McpError> {
-        let sid = match authed_session(&ctx) {
-            Some(s) => s.session_id,
+        let sid = match self.current_session_id(&ctx) {
+            Some(s) => s,
             None => return Ok(err("deleting a canister needs an authenticated session".into())),
         };
         let result = management::delete_canister(&self.identities, &sid, &canister_id).await;
@@ -1488,12 +1513,36 @@ impl IcTools {
     }
 }
 
-/// The authenticated MCP session of the calling request, if it carried a valid
-/// bearer token (injected by [`auth::require_token`]).
-fn authed_session(ctx: &RequestContext<RoleServer>) -> Option<auth::AuthedSession> {
+/// Where [`IcTools`] finds the Internet Identity session a tool call acts as —
+/// the one seam between deployments. The tool implementations are identical
+/// under both variants.
+#[derive(Clone, Debug)]
+pub enum SessionSource {
+    /// Multi-user (the hosted server): resolve the session per request from
+    /// the [`AuthedSession`] extension its bearer-token gate injected.
+    Bearer,
+    /// Single-user (a local server): every call acts as this one session,
+    /// established by the binary's own login flow.
+    Singleton(String),
+}
+
+/// The verified session id of an authenticated MCP session, injected into the
+/// request extensions by the embedding server's auth gate (the hosted binary's
+/// bearer-token middleware) and read back under [`SessionSource::Bearer`].
+#[derive(Clone, Debug)]
+pub struct AuthedSession {
+    pub session_id: String,
+}
+
+/// The authenticated MCP session of the calling request, if the embedding
+/// server's auth gate injected one. The transport surfaces the HTTP request's
+/// `Parts` in the tool context's extensions; `http::request::Parts` is the
+/// same type axum re-exports, so this reads what an axum middleware inserted
+/// without this crate depending on axum.
+fn authed_session(ctx: &RequestContext<RoleServer>) -> Option<AuthedSession> {
     ctx.extensions
-        .get::<axum::http::request::Parts>()
-        .and_then(|parts| parts.extensions.get::<auth::AuthedSession>())
+        .get::<http::request::Parts>()
+        .and_then(|parts| parts.extensions.get::<AuthedSession>())
         .cloned()
 }
 
diff --git a/static/candid-reference.md b/crates/imcp2-core/static/candid-reference.md
similarity index 100%
rename from static/candid-reference.md
rename to crates/imcp2-core/static/candid-reference.md
diff --git a/static/candid-textual-syntax.md b/crates/imcp2-core/static/candid-textual-syntax.md
similarity index 100%
rename from static/candid-textual-syntax.md
rename to crates/imcp2-core/static/candid-textual-syntax.md
diff --git a/static/oql-primer.md b/crates/imcp2-core/static/oql-primer.md
similarity index 100%
rename from static/oql-primer.md
rename to crates/imcp2-core/static/oql-primer.md
diff --git a/deploy/native/build.sh b/deploy/native/build.sh
index 77fffbe..fcf96d1 100755
--- a/deploy/native/build.sh
+++ b/deploy/native/build.sh
@@ -55,7 +55,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 COPY Cargo.toml Cargo.lock ./
 COPY src ./src
-COPY static ./static
+COPY crates ./crates
 RUN cargo build --release
 FROM scratch AS bin
 COPY --from=build /app/target/release/imcp2 /imcp2
diff --git a/src/auth.rs b/src/auth.rs
index 240e66a..1dd8181 100644
--- a/src/auth.rs
+++ b/src/auth.rs
@@ -105,15 +105,16 @@ use axum::{
     Form,
 };
 use base64::Engine;
-use candid::Principal;
-use ic_agent::identity::{Delegation, SignedDelegation};
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
 use tokio::sync::RwLock;
 use uuid::Uuid;
 
-use crate::identities::Identities;
+use imcp2_core::identities::Identities;
+use imcp2_core::iiconnect::{self, RedeemBody};
+pub use imcp2_core::iiconnect::AUTH_CALLBACKS_WELL_KNOWN;
+pub use imcp2_core::AuthedSession;
 
 /// How long an authorization request and its pending II handshake stay valid
 /// before the user must restart.
@@ -691,7 +692,7 @@ pub struct AuthStore {
     clients: Arc<ClientStore>,
     tokens: Arc<RwLock<HashMap<String, TokenInfo>>>,
     /// Auth-code connects in flight, keyed by `session_id` (= the II connect
-    /// `state`). Bounded at [`crate::identities::MAX_PENDING_CONNECTS`] (one
+    /// `state`). Bounded at [`imcp2_core::identities::MAX_PENDING_CONNECTS`] (one
     /// entry per pending connect, same as the session map) and swept of expired
     /// entries by [`AuthStore::reap_expired`].
     authz: Arc<RwLock<HashMap<String, AuthzPending>>>,
@@ -840,7 +841,7 @@ impl AuthStore {
     }
 
     /// The II instance this store serves.
-    fn instance(&self) -> &crate::identities::IiInstance {
+    fn instance(&self) -> &imcp2_core::identities::IiInstance {
         self.identities.instance()
     }
 
@@ -891,7 +892,7 @@ impl AuthStore {
     /// entries pair 1:1 with these.
     async fn insert_pending(&self, session_id: String, pending: AuthzPending) {
         let mut authz = self.authz.write().await;
-        make_room(&mut authz, crate::identities::MAX_PENDING_CONNECTS, AuthzPending::remaining);
+        make_room(&mut authz, imcp2_core::identities::MAX_PENDING_CONNECTS, AuthzPending::remaining);
         authz.insert(session_id, pending);
     }
 
@@ -1282,27 +1283,16 @@ fn build_redirect(redirect_uri: &str, code: &str, client_state: &str, iss: &str)
 /// ([`connect_callback_page`]). No `priv(X)` is ever put in the link — only its
 /// public half.
 fn ii_mcp_url(store: &AuthStore, session_id: &str, reg_pubkey_b64: &str) -> String {
-    format!(
-        "{ii}/mcp#callback={cb}&state={st}&ttl={ttl}&registration_key={rk}",
-        ii = store.instance().ii_url,
-        cb = urlencoding::encode(&connect_callback_url(store)),
-        st = urlencoding::encode(session_id),
-        ttl = GRANT_TTL_SECS,
-        rk = urlencoding::encode(reg_pubkey_b64),
+    iiconnect::ii_mcp_url(
+        &store.instance().ii_url,
+        &connect_callback_url(store),
+        session_id,
+        GRANT_TTL_SECS,
+        reg_pubkey_b64,
     )
 }
 // ---- Callback allow-list (II #4091) ---------------------------------------
 
-/// The well-known path Internet Identity fetches a server's **auth-callback
-/// allow-list** from (dfinity/internet-identity#4091): before contacting the
-/// connect callback named in the (attacker-craftable) link fragment, II fetches
-/// `<callback origin>` + this path — `redirect: "error"`, no credentials,
-/// `no-store`, 8 KB cap, `application/json` required — and rejects the connect
-/// unless the callback URL is EXACTLY (string-equal) one of the declared
-/// entries. **Fail-closed**: a missing/unfetchable file fails every connect for
-/// this origin, so serving this document is mandatory once #4091 ships.
-pub const AUTH_CALLBACKS_WELL_KNOWN: &str = "/.well-known/ii-auth-callbacks";
-
 /// An instance's connect-callback URL — the single source of truth used BOTH in
 /// the II link fragment and in the [`auth_callbacks`] allow-list, so the two
 /// can never drift: II matches them by exact string equality (no
@@ -1343,161 +1333,17 @@ pub async fn connect_callback_page(State(store): State<AuthStore>) -> Response {
     pinned_callback_page(&store.mcp_path)
 }
 
-/// A fresh CSP nonce: 128 bits from the OS CSPRNG, **standard** base64. CSP3's
-/// `base64-value` grammar also admits base64url, but CSP2's does not (`-`/`_`
-/// absent), so use the standard alphabet for maximum parser compatibility — a
-/// strict-CSP2 parser that rejected the nonce source would block the inline
-/// script and break the callback page. `+`/`/`/`=` are all safe where the nonce
-/// rides (a quoted HTML attribute and a header value).
-fn csp_nonce() -> String {
-    let mut bytes = [0u8; 16];
-    getrandom::fill(&mut bytes).expect("getrandom");
-    base64::engine::general_purpose::STANDARD.encode(bytes)
-}
-
-/// Styling for the pinned callback page, following the DFINITY brand guidelines
-/// (Parchment/Ink/Rust palette, an editorial serif display over a UI sans, a
-/// grid-paper surface, and the official gradient-infinity logo). A full-bleed
-/// screen: the status stage (a spinner on a soft elevated tile plus an accessible
-/// serif headline) fills and centres the viewport, with a foot-of-page "Hosted
-/// by" mark; the spinner is CSS-only (disabled under `prefers-reduced-motion`).
-/// Light/dark theming via `prefers-color-scheme` with a `data-theme` override,
-/// using the brand's Bark/Bone/Ember dark palette. Fully self-contained (no
-/// external fonts, images, or stylesheets; the logo is inlined into the served
-/// HTML), so it renders identically under the pinned page's strict
-/// `default-src 'none'` CSP. The stylesheet lives in `assets/connect.css` and is
-/// compiled into the binary via `include_str!` (no runtime file I/O), so it is
-/// authored as a real `.css` file rather than a Rust string literal. The pinned
-/// page serves it in a `<style nonce>` block (with `style-src 'nonce-...'` added
-/// to its CSP so the block is allowed WITHOUT `'unsafe-inline'`). The `.error`
-/// modifier (added to `.screen` client-side) hides the spinner tile once a
-/// terminal message is shown.
-const CONNECT_PAGE_CSS: &str = include_str!("assets/connect.css");
-
-/// The official DFINITY logo (gradient-infinity mark + wordmark), taken from
-/// dfinity.org. It lives in `assets/dfinity-logo.svg` and is compiled into the
-/// binary via `include_str!`, then inlined into the served HTML so it needs no
-/// external fetch under the pinned page's strict CSP. The infinity keeps the
-/// brand gradients; the wordmark is set to `currentColor` so it follows the
-/// page's Ink/Bone text color across light and dark themes.
-const CONNECT_LOGO_SVG: &str = include_str!("assets/dfinity-logo.svg");
-
-/// HTML template for the pinned callback page, kept as a real `.html` asset file
-/// (compiled in via `include_str!`, no runtime file I/O) rather than an inline
-/// Rust string literal, so the markup reads and diffs as HTML. It is a self-
-/// contained document with `__TOKEN__` placeholders spliced in at render time
-/// (the stylesheet `__CSS__`, the logo `__LOGO__`, and the per-response
-/// `__NONCE__`/`__SCRIPT__`). No user-influenced value is ever interpolated.
-const PINNED_PAGE_HTML: &str = include_str!("assets/connect-callback.html");
-
-/// The strict-CSP, non-reflecting pinned callback page. `nonce` is a fresh
-/// per-response value bound into the CSP header and BOTH the inline `<script>`
-/// and `<style>`, so no `'unsafe-inline'` is needed; `connect-src 'self'` limits
-/// the page's only network reach to the same-origin redeem endpoint, and
-/// `default-src 'none'` forbids loading anything else (all styling is inline and
-/// self-contained; see [`CONNECT_PAGE_CSS`]). No attacker-supplied value
-/// (fragment, query) is ever interpolated into the HTML; the fragment is read
-/// client-side and sent via `fetch`, never written to the DOM.
-///
-/// The fragment shape matches II's frontend (merged contract): the delegation
-/// chain plus the connect state only:
-/// `#delegation=<JSON.stringify(DelegationChain.toJSON())>&state=<state>`,
-/// percent-encoded by `URLSearchParams`. The script reads both fields and
-/// forwards them to the redeem endpoint (the chain's JSON text and the state
-/// echo). There is no `anchor`, and no `permissions`/`ttl`, in the fragment:
-/// the consent was captured earlier at `prepare_mcp_registration_delegation`
-/// (keyed by `P_reg`), and II recovers it (and the user's identity number)
-/// from `caller() == P_reg`, so the server sees none of them.
-///
-/// The pinned page's inline script and stylesheet are kept as PLAIN strings,
-/// not `format!` templates, so they read naturally (no doubled braces, room for
-/// comments). The one dynamic value in the script, the redeem URL, is spliced in
-/// by replacing `__REDEEM_URL__`, which sits inside a quoted JS string literal
-/// below.
-const PINNED_PAGE_JS: &str = r#"(function () {
-  function show(t, err) {
-    document.getElementById('m').textContent = t;
-    if (err) {
-      var c = document.querySelector('.screen');
-      if (c) { c.classList.add('error'); }
-    }
-  }
-  // II delivers #delegation=<chain JSON>&state=<state>: the two-hop chain plus
-  // the connect state, percent-encoded by URLSearchParams and decoded again by
-  // it here. Consent (permissions, max_ttl) is NOT in the fragment: the user
-  // chose it earlier at II's prepare step, which stored it keyed by P_reg, and
-  // mcp_register_v2 recovers it server-side. So the page forwards only the chain
-  // and the state; the backend redeems with mcp_register_v2(session_key).
-  var params = new URLSearchParams(location.hash.slice(1));
-  var body = JSON.stringify({
-    state: params.get('state') || '',
-    delegation: params.get('delegation') || ''
-  });
-  // Scrub the delegation from the address bar, keeping the path and any query
-  // string the declared callback carries. Best-effort: the POST below works
-  // even if a browser refuses the history call.
-  try { history.replaceState(null, '', location.pathname + location.search); } catch (e) {}
-  fetch("__REDEEM_URL__", {
-    method: 'POST',
-    headers: { 'content-type': 'application/json' },
-    credentials: 'same-origin',
-    body: body
-  })
-    .then(function (r) { return r.json().catch(function () { return {}; }); })
-    .then(function (d) {
-      if (d && d.redirect) {
-        location.replace(d.redirect);
-      } else {
-        show((d && d.error) || "We couldn't finish the connection. Restart from your client.", true);
-      }
-    })
-    .catch(function () {
-      show("We couldn't reach the server. Restart from your client.", true);
-    });
-})();"#;
-
+/// The strict-CSP pinned callback page (rendered by
+/// [`iiconnect::pinned_callback_page`], which binds a fresh nonce into the CSP
+/// and both inline blocks), wrapped into a Response with this deployment's
+/// redeem URL and the non-CSP hardening headers.
 fn pinned_callback_page(prefix: &str) -> Response {
-    let nonce = csp_nonce();
-    let redeem = js_escape(&format!("{prefix}/oauth/connect/redeem"));
-    let script = PINNED_PAGE_JS.replace("__REDEEM_URL__", &redeem);
-    // The markup lives in `assets/connect-callback.html` (include_str!). The
-    // status line is a `role=status` / `aria-live=polite` region so screen
-    // readers announce both "Connecting agent to Internet Identity…" and any
-    // terminal error the script swaps in. Below it sits a `.contact-hint` line
-    // (hidden during a normal connect; revealed by the stylesheet once the
-    // script adds `.error` to `.screen`) so every handshake/redeem failure the
-    // user lands on carries the "contact us to report it" line. The DFINITY logo
-    // carries its own `aria-label`; the spinner is decorative (`aria-hidden`).
-    // `__NONCE__` (both the `<style>` and `<script>` tags), the self-contained
-    // stylesheet, logo, the contact address, and redeem script are spliced in;
-    // none of those values contains a placeholder token, so the order is immaterial.
-    let html = PINNED_PAGE_HTML
-        .replace("__NONCE__", &nonce)
-        .replace("__CSS__", CONNECT_PAGE_CSS)
-        .replace("__LOGO__", CONNECT_LOGO_SVG)
-        .replace("__CONTACT__", CONTACT)
-        .replace("__SCRIPT__", &script);
-    // `style-src 'nonce-{nonce}'` admits ONLY the nonce'd `<style>` block above
-    // (no `'unsafe-inline'`, so an injected `style=` attribute or stray `<style>`
-    // still can't apply). Without it the block falls back to `default-src
-    // 'none'` and the page renders unstyled.
-    // `img-src 'self'`: CSP governs the `<link rel=icon>` fetch as an image, so
-    // without it the favicon is dropped.
-    // `frame-ancestors 'none'`: II reaches this page only by top-level
-    // navigation, so framing is never legitimate: deny it outright so the
-    // delegation-bearing page can't be embedded for UI redress. X-Frame-Options
-    // covers legacy browsers that predate CSP2 (modern ones ignore it when
-    // frame-ancestors is present).
-    let csp = format!(
-        "default-src 'none'; script-src 'nonce-{nonce}'; style-src 'nonce-{nonce}'; \
-         img-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; \
-         frame-ancestors 'none'"
-    );
-    let mut resp = Html(html).into_response();
+    let page = iiconnect::pinned_callback_page(&format!("{prefix}/oauth/connect/redeem"), CONTACT);
+    let mut resp = Html(page.html).into_response();
     let h = resp.headers_mut();
     h.insert(
         axum::http::header::CONTENT_SECURITY_POLICY,
-        axum::http::HeaderValue::from_str(&csp).expect("valid CSP"),
+        axum::http::HeaderValue::from_str(&page.csp).expect("valid CSP"),
     );
     h.insert(
         axum::http::header::REFERRER_POLICY,
@@ -1588,11 +1434,11 @@ fn contact_report_hint() -> String {
 /// `<style>`, everything else is denied (`default-src 'none'`), and framing is
 /// refused so the page can't be embedded for UI redress.
 fn error_screen(status: StatusCode, title: &str, headline: &str, detail: &str, hint: &str) -> Response {
-    let nonce = csp_nonce();
+    let nonce = iiconnect::csp_nonce();
     let html = CONNECT_ERROR_HTML
         .replace("__NONCE__", &nonce)
-        .replace("__CSS__", CONNECT_PAGE_CSS)
-        .replace("__LOGO__", CONNECT_LOGO_SVG)
+        .replace("__CSS__", iiconnect::CONNECT_PAGE_CSS)
+        .replace("__LOGO__", iiconnect::CONNECT_LOGO_SVG)
         .replace("__TITLE__", title)
         .replace("__HEADLINE__", headline)
         .replace("__DETAIL__", detail)
@@ -1661,126 +1507,6 @@ fn not_allowlisted_page() -> Response {
     )
 }
 
-/// POST /oauth/connect/redeem body — what [`pinned_callback_page`] sends after
-/// parsing the fragment: the `state` echo and the delegation chain's JSON text
-/// exactly as II's frontend put it in the fragment
-/// (`JSON.stringify(DelegationChain.toJSON())`, dfinity/internet-identity#4093).
-/// **No consent values and no anchor are carried**: the user's chosen
-/// permissions/TTL were captured earlier at `prepare_mcp_registration_delegation`
-/// (keyed by `P_reg`), and II recovers them, and the user's identity number,
-/// from `caller() == P_reg`, so the server never sees any of them.
-#[derive(Deserialize)]
-pub struct RedeemBody {
-    /// The single-use connect state (= session id), echoed by II.
-    state: String,
-    /// The two-hop `P_reg -> Y -> X` chain as agent-js `DelegationChain` JSON
-    /// ([`JsonDelegationChain`]); `der(P_reg)` rides inside as `publicKey`.
-    #[serde(default)]
-    delegation: String,
-}
-
-/// Size cap for the redeem body's `delegation` JSON text, checked BEFORE
-/// parsing so oversized attacker-controlled input is rejected without large
-/// allocations (same posture as the discovery-buffering bound, CWE-770). A
-/// legitimate chain — one delegation plus a canister signature with its
-/// certificate — is a few KB of hex/JSON, so this is generous while staying
-/// far under axum's 2 MB body default. Defense-in-depth: the cookie gate
-/// already means only the connect's own initiator can reach the parse at all.
-const MAX_REG_DELEGATION_JSON: usize = 64 * 1024;
-
-/// agent-js `DelegationChain.toJSON()`, the wire shape II's frontend delivers
-/// in the callback fragment (dfinity/internet-identity#4093): byte fields are
-/// HEX strings, `expiration` is a HEX string of ns since the epoch
-/// (`BigInt.toString(16)`), `targets` are principal texts, and `publicKey` is
-/// the chain root `der(P_reg)`. `delegations` carries TWO hops — the
-/// canister-signed `P_reg -> Y` toward II's ephemeral browser-held `Y`, and
-/// the `Y`-signed `Y -> X` toward our registration key (the split keeps the
-/// canister-signed piece, which transits the IC, inert on its own).
-///
-/// `deny_unknown_fields` on purpose: every field of a delegation is covered by
-/// its canister signature, so a field this parser does not carry (e.g. a future
-/// `permissions`) could never re-hash to what II signed — dropping it silently
-/// would resurface the opaque "sig not found in the signature tree" replica
-/// error (the #40 read-only outage). Failing fast names the real problem.
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct JsonDelegationChain {
-    delegations: Vec<JsonSignedDelegation>,
-    #[serde(rename = "publicKey")]
-    public_key: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct JsonSignedDelegation {
-    delegation: JsonDelegation,
-    signature: String,
-}
-
-#[derive(Debug, Deserialize)]
-#[serde(deny_unknown_fields)]
-struct JsonDelegation {
-    pubkey: String,
-    /// Hex string of ns since the Unix epoch (agent-js `BigInt.toString(16)`).
-    expiration: String,
-    #[serde(default)]
-    targets: Option<Vec<String>>,
-}
-
-/// Decode a hex string field of the chain JSON.
-fn hex_decode(field: &str, s: &str) -> Result<Vec<u8>, String> {
-    hex::decode(s.trim()).map_err(|e| format!("{field} is not valid hex: {e}"))
-}
-
-/// Parse the fragment's `DelegationChain` JSON into `(der(P_reg), chain)` as
-/// `ic-agent` types — hop count is preserved verbatim (two hops per rev3 of the
-/// guide; the redeem path only requires that the FINAL hop targets our `X`, and
-/// the replica verifies every hop authoritatively). The chain carries no
-/// `permissions` field: the access level isn't stored in the delegation at all.
-/// The user chose it at consent, II stored it under `P_reg` at
-/// `prepare_mcp_registration_delegation`, and it never touches the server. So a
-/// `permissions` field appearing here would be unexpected, and
-/// [`JsonDelegationChain`] fails fast if one ever does.
-fn parse_registration_delegation(delegation_json: &str) -> Result<(Vec<u8>, Vec<SignedDelegation>), String> {
-    // Bound the size BEFORE parsing (see MAX_REG_DELEGATION_JSON): reject
-    // oversized input without allocating for it. This also inherently bounds
-    // every field inside the JSON (pubkeys, signatures, targets).
-    if delegation_json.len() > MAX_REG_DELEGATION_JSON {
-        return Err(format!("delegation exceeds {MAX_REG_DELEGATION_JSON} bytes"));
-    }
-    let chain: JsonDelegationChain =
-        serde_json::from_str(delegation_json).map_err(|e| format!("delegation JSON: {e}"))?;
-    let user_key = hex_decode("publicKey", &chain.public_key)?;
-    let delegations = chain
-        .delegations
-        .iter()
-        .map(|d| {
-            let targets = match &d.delegation.targets {
-                None => None,
-                Some(ts) => Some(
-                    ts.iter()
-                        .map(|t| {
-                            Principal::from_text(t.trim())
-                                .map_err(|e| format!("delegation target principal: {e}"))
-                        })
-                        .collect::<Result<Vec<_>, _>>()?,
-                ),
-            };
-            Ok(SignedDelegation {
-                delegation: Delegation {
-                    pubkey: hex_decode("delegation pubkey", &d.delegation.pubkey)?,
-                    expiration: u64::from_str_radix(d.delegation.expiration.trim(), 16)
-                        .map_err(|_| "delegation expiration is not a hex u64".to_string())?,
-                    targets,
-                    permissions: None,
-                },
-                signature: hex_decode("delegation signature", &d.signature)?,
-            })
-        })
-        .collect::<Result<Vec<_>, String>>()?;
-    Ok((user_key, delegations))
-}
-
 /// A JSON error the pinned page reads and displays.
 fn redeem_err(msg: &str) -> Response {
     (StatusCode::BAD_REQUEST, Json(json!({ "error": msg }))).into_response()
@@ -1882,7 +1608,7 @@ pub async fn connect_redeem(
     // before claiming, so a malformed delivery never occupies the single-flight
     // slot. No consent values are parsed: they're not in the fragment (II
     // captured them at prepare and recovers them from caller() == P_reg).
-    let (user_key, chain) = match parse_registration_delegation(&body.delegation) {
+    let (user_key, chain) = match iiconnect::parse_registration_delegation(&body.delegation) {
         Ok(v) => v,
         Err(e) => return redeem_err(&format!("We couldn't read the sign-in response. Restart from your client. ({e})")),
     };
@@ -1959,11 +1685,6 @@ pub async fn connect_redeem(
     Json(json!({ "redirect": build_redirect(&redirect_uri, &code, &client_state, &iss) })).into_response()
 }
 
-/// Escape a string for embedding inside a double-quoted JS string literal.
-fn js_escape(s: &str) -> String {
-    s.replace('\\', "\\\\").replace('"', "\\\"").replace('<', "\\x3c")
-}
-
 // ---- Token: exchange an authorization code ------------------------------
 
 #[derive(Debug, Deserialize)]
@@ -2253,14 +1974,6 @@ pub async fn protected_resource_metadata(State(store): State<AuthStore>) -> Resp
 
 // ---- Bearer-token gate for /mcp -----------------------------------------
 
-/// The verified principal + session id of the authenticated MCP session,
-/// injected into request extensions so tools can attribute actions and bind
-/// per-session delegated identities.
-#[derive(Clone, Debug)]
-pub struct AuthedSession {
-    pub session_id: String,
-}
-
 pub async fn require_token(State(store): State<AuthStore>, mut request: Request<Body>, next: Next) -> Response {
     // The `Bearer` auth-scheme is case-insensitive (RFC 7235 §2.1), so match it
     // that way — an `Authorization: bearer <token>` must be recognized too.
@@ -2703,7 +2416,7 @@ mod tests {
     }
 
     fn test_store_cfg(require_resource: bool) -> super::AuthStore {
-        use crate::identities::{Identities, IiInstance};
+        use imcp2_core::identities::{Identities, IiInstance};
         use candid::Principal;
         let agent = crate::Agent::builder()
             .with_url("https://ii.test")
@@ -2799,7 +2512,7 @@ mod tests {
     // cap and that the connect just started is the one kept.)
     #[tokio::test]
     async fn pending_connects_are_capped() {
-        let cap = crate::identities::MAX_PENDING_CONNECTS;
+        let cap = imcp2_core::identities::MAX_PENDING_CONNECTS;
         let store = test_store();
         for i in 0..cap + 16 {
             seed_pending(&store, &format!("sess-{i}"), "bind").await;
@@ -2910,7 +2623,7 @@ mod tests {
     #[tokio::test]
     async fn auth_callbacks_declares_link_callbacks_verbatim() {
         use axum::extract::State;
-        use crate::identities::{Identities, IiInstance};
+        use imcp2_core::identities::{Identities, IiInstance};
         use candid::Principal;
         let make = |mcp_path: &'static str| {
             let agent = crate::Agent::builder()
@@ -3589,139 +3302,6 @@ mod tests {
         }
     }
 
-    // A well-formed fragment payload — agent-js `DelegationChain.toJSON()`
-    // exactly as II's #4093 frontend emits it (hex byte fields, HEX-string
-    // expiration, principal-text targets, top-level `publicKey` = der(P_reg)),
-    // carrying rev3's TWO hops (`P_reg -> Y` canister-signed, `Y -> X`
-    // browser-signed) — decodes into `(der(P_reg), [both hops in order])`.
-    #[test]
-    fn parse_registration_delegation_round_trips_two_hops() {
-        let der_preg = vec![1u8, 2, 3];
-        let der_y = vec![7u8, 7, 7]; // II's ephemeral browser-held key
-        let der_x = vec![9u8, 8, 7, 6]; // our registration key
-        let sig_canister = vec![4u8, 5, 6];
-        let sig_y = vec![1u8, 9, 9];
-        let chain_json = serde_json::json!({
-            "delegations": [
-                {
-                    "delegation": {
-                        "pubkey": hex::encode(&der_y),
-                        "expiration": format!("{:x}", 66_u64), // BigInt.toString(16)
-                        "targets": ["aaaaa-aa"],
-                    },
-                    "signature": hex::encode(&sig_canister),
-                },
-                {
-                    "delegation": {
-                        "pubkey": hex::encode(&der_x),
-                        "expiration": format!("{:x}", 66_u64),
-                    },
-                    "signature": hex::encode(&sig_y),
-                },
-            ],
-            "publicKey": hex::encode(&der_preg),
-        })
-        .to_string();
-        let (uk, chain) = super::parse_registration_delegation(&chain_json).expect("parse");
-        assert_eq!(uk, der_preg);
-        assert_eq!(chain.len(), 2, "both hops preserved, in order");
-        // Hop 1: canister-signed P_reg -> Y. Its `targets` round-trips from
-        // principal text (`aaaaa-aa` here as a stand-in; live chains carry the
-        // II canister id).
-        assert_eq!(chain[0].delegation.pubkey, der_y);
-        assert_eq!(chain[0].delegation.expiration, 66);
-        assert_eq!(chain[0].signature, sig_canister);
-        assert_eq!(
-            chain[0].delegation.targets.as_ref().unwrap()[0],
-            candid::Principal::management_canister()
-        );
-        // Hop 2: browser-signed Y -> X.
-        assert_eq!(chain[1].delegation.pubkey, der_x);
-        assert_eq!(chain[1].signature, sig_y);
-        assert_eq!(chain[1].delegation.targets, None);
-        // Neither hop carries a permissions field; the access level was chosen
-        // at consent and stored by II under P_reg (recovered from caller()), so
-        // it never rides the delegation or the fragment.
-        assert!(chain.iter().all(|d| d.delegation.permissions.is_none()));
-    }
-
-    // Malformed input fails with a clear error: non-JSON, bad hex, a
-    // non-hex expiration — and, critically, an UNKNOWN field inside the
-    // delegation (deny_unknown_fields): every delegation field is covered by
-    // the canister signature, so silently dropping one could never re-hash to
-    // what II signed (the #40 outage class) — fail fast instead.
-    #[test]
-    fn parse_registration_delegation_rejects_bad_input() {
-        assert!(super::parse_registration_delegation("not json").is_err());
-
-        let bad_hex = serde_json::json!({
-            "delegations": [{
-                "delegation": { "pubkey": "zz", "expiration": "1" },
-                "signature": "0102",
-            }],
-            "publicKey": "010203",
-        })
-        .to_string();
-        let err = super::parse_registration_delegation(&bad_hex).expect_err("bad hex must fail");
-        assert!(err.contains("not valid hex"), "got: {err}");
-
-        let bad_exp = serde_json::json!({
-            "delegations": [{
-                "delegation": { "pubkey": "0102", "expiration": "not-hex" },
-                "signature": "0102",
-            }],
-            "publicKey": "010203",
-        })
-        .to_string();
-        let err = super::parse_registration_delegation(&bad_exp).expect_err("bad expiration must fail");
-        assert!(err.contains("expiration"), "got: {err}");
-
-        // A field this parser does not carry (e.g. a future `permissions`)
-        // must fail fast rather than be silently dropped.
-        let unknown_field = serde_json::json!({
-            "delegations": [{
-                "delegation": { "pubkey": "0102", "expiration": "1", "permissions": "queries" },
-                "signature": "0102",
-            }],
-            "publicKey": "010203",
-        })
-        .to_string();
-        let err = super::parse_registration_delegation(&unknown_field)
-            .expect_err("an unknown delegation field must fail fast, not silently drop");
-        assert!(err.contains("permissions"), "got: {err}");
-    }
-
-    // CWE-770 guard: an oversized delegation payload is rejected BEFORE any
-    // JSON parse, so an attacker-sized payload can't force large allocations.
-    // A legit chain is a few KB, far below the cap.
-    #[test]
-    fn parse_registration_delegation_bounds_input_size() {
-        let huge = "A".repeat(super::MAX_REG_DELEGATION_JSON + 1);
-        let err = super::parse_registration_delegation(&huge).expect_err("oversized delegation rejected");
-        assert!(err.contains("exceeds"), "got: {err}");
-
-        // At-cap input proceeds past the size check (and fails on content,
-        // not on size) — the bound doesn't clip legitimate-shaped requests.
-        let at_cap = "A".repeat(super::MAX_REG_DELEGATION_JSON);
-        let err = super::parse_registration_delegation(&at_cap).expect_err("fails on content, not size");
-        assert!(!err.contains("exceeds"), "at-cap input must pass the size check: {err}");
-    }
-
-    // The CSP nonce must use the STANDARD base64 alphabet: CSP2's base64-value
-    // grammar has no `-`/`_`, so a base64url nonce risks a strict parser dropping
-    // the source and blocking the inline script (breaking the callback page).
-    #[test]
-    fn csp_nonce_is_standard_base64() {
-        for _ in 0..16 {
-            let n = super::csp_nonce();
-            assert!(
-                !n.contains('-') && !n.contains('_'),
-                "CSP nonce must not use base64url characters: {n}"
-            );
-            assert!(n.len() >= 22, "128-bit nonce floor: {n}");
-        }
-    }
-
     // Redemption is SINGLE-FLIGHT per connect: the first claim wins, a concurrent
     // claim is refused while mid-flight, a released (failed) claim can be retried,
     // and once a code exists every later claim returns it (idempotent) instead of
diff --git a/src/lib.rs b/src/lib.rs
index 694926b..723e5e2 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -74,16 +74,16 @@
 //! and `SKILLS_URL` (the IC skills registry).
 
 mod auth;
-mod calls;
 // Docs live in the module itself (`//!` in src/metrics.rs): an outer doc
 // comment here would resolve its intra-doc links in *this* scope rather than
 // the module's, silently breaking the links to `Registry` and `MatchedPath`.
 pub mod metrics;
-mod discover;
-mod identities;
-mod management;
-mod skills;
-mod tools;
+
+// The transport/OAuth-agnostic components — the tool surface, the II session
+// engine, and the connect-handshake primitives — live in the `imcp2-core`
+// crate; this crate composes them with the OAuth 2.1 authorization server and
+// the streamable-HTTP transport.
+use imcp2_core::{identities, skills, tools};
 
 // Real II<>MCP handshake test against a live Internet Identity canister in
 // PocketIC. In-crate (not tests/) so it can use the feature-gated optional
@@ -106,17 +106,10 @@ use rmcp::transport::{
 use tokio_util::sync::CancellationToken;
 
 pub use auth::SharedClients;
-pub use identities::{IiInstance, SessionGauges};
-/// The IC [`Agent`] type the server is built around, re-exported so callers
-/// construct the injected agent from the exact `ic-agent` version this crate
-/// links.
-pub use ic_agent::{self, Agent};
-
-/// A sensible default IC API boundary node (the public mainnet endpoint) for
-/// callers that just want `Agent::builder().with_url(IC_URL).build()`. A host
-/// with its own boundary-node routing supplies an agent built against that
-/// instead.
-pub const IC_URL: &str = "https://icp-api.io";
+/// The components this server is composed from, re-exported so embedders keep
+/// importing everything from `imcp2` (the types are `imcp2-core`'s — one
+/// defining crate, so type identity is preserved).
+pub use imcp2_core::{ic_agent, Agent, IiInstance, SessionGauges, IC_URL};
 
 /// Everything an [`McpServer`] is built from.
 pub struct McpConfig {
@@ -260,7 +253,16 @@ impl McpServer {
             let (agent, identities, skills) =
                 (self.agent.clone(), self.identities.clone(), self.skills.clone());
             StreamableHttpService::new(
-                move || Ok(tools::IcTools::new(agent.clone(), identities.clone(), skills.clone())),
+                move || {
+                    Ok(tools::IcTools::new(
+                        agent.clone(),
+                        identities.clone(),
+                        skills.clone(),
+                        // Multi-user: each request's session comes from the
+                        // bearer-token gate's AuthedSession extension.
+                        imcp2_core::SessionSource::Bearer,
+                    ))
+                },
                 LocalSessionManager::default().into(),
                 // Stateless + plain-JSON responses: our tools are pure
                 // request/response with no server-initiated messages, and this
diff --git a/src/main.rs b/src/main.rs
index d371cb6..b077a7f 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -306,7 +306,7 @@ fn openai_apps_challenge_router(token: Option<String>) -> Router {
 /// (`assets/dfinity-logo.svg`), inlined once on first use so the served page
 /// stays fully self-contained (no external fonts, scripts, or images).
 const PRIVACY_POLICY_HTML: &str = include_str!("assets/privacy-policy.html");
-const DFINITY_LOGO_SVG: &str = include_str!("assets/dfinity-logo.svg");
+const DFINITY_LOGO_SVG: &str = imcp2_core::iiconnect::CONNECT_LOGO_SVG;
 
 fn privacy_policy_page() -> &'static str {
     static PAGE: std::sync::OnceLock<String> = std::sync::OnceLock::new();