@burdenoff/mcp-libs 2026.1007.4 → 2026.1008.2

package/dist/modules/devportal/index.js

@@ -4,9 +4,9 @@ import { z } from 'zod';
 // src/modules/devportal/operations.ts
 var LIST_ORGANIZATIONS = `
   query ListOrganizations($limit: Int, $offset: Int) {
-    organizations(limit: $limit, offset: $offset) {
-      edges { node { id name slug status } }
-      totalCount pageInfo { hasNextPage }
+    myOrganizations(limit: $limit, offset: $offset) {
+      items { id name slug status }
+      total
     }
   }
 `;
@@ -33,11 +33,11 @@ var UPDATE_ORGANIZATION = `
 `;
 var DELETE_ORGANIZATION = `
   mutation DeleteOrganization($id: ID!) {
-    deleteOrganization(id: $id) { success }
+    deleteOrganization(id: $id)
   }
 `;
 var LIST_APPLICATIONS = `
-  query ListApplications($organizationId: ID, $status: String, $limit: Int) {
+  query ListApplications($organizationId: ID, $status: AppStatus, $limit: Int) {
     applications(organizationId: $organizationId, status: $status, limit: $limit) {
       edges { node { id name status installCount averageRating } }
       totalCount
@@ -81,14 +81,7 @@ var PUBLISH_APPLICATION = `
 `;
 var DELETE_APPLICATION = `
   mutation DeleteApplication($id: ID!) {
-    deleteApplication(id: $id) { success }
-  }
-`;
-var APPLICATION_VERSIONS = `
-  query ApplicationVersions($applicationId: ID!) {
-    applicationVersions(applicationId: $applicationId) {
-      id version status isLatest isStable releaseNotes
-    }
+    deleteApplication(id: $id)
   }
 `;
 var CREATE_APPLICATION_VERSION = `
@@ -106,15 +99,15 @@ var LIST_WEBHOOKS = `
   }
 `;
 var CREATE_WEBHOOK = `
-  mutation CreateDevportalWebhook($input: CreateWebhookInput!) {
-    createWebhook(input: $input) {
-      id name url status
+  mutation CreateDevportalWebhook($applicationId: ID!, $input: CreateWebhookInput!) {
+    createWebhook(applicationId: $applicationId, input: $input) {
+      webhook { id name url events isActive status failureCount }
     }
   }
 `;
 var DELETE_WEBHOOK = `
   mutation DeleteDevportalWebhook($id: ID!) {
-    deleteWebhook(id: $id) { success }
+    deleteWebhook(id: $id)
   }
 `;
 var APPLICATION_ANALYTICS = `
@@ -124,17 +117,11 @@ var APPLICATION_ANALYTICS = `
     }
   }
 `;
-var ORGANIZATION_REVENUE = `
-  query OrganizationRevenue($organizationId: ID!, $period: String!) {
-    organizationRevenue(organizationId: $organizationId, period: $period) {
-      totalEarnings currency netEarnings
-    }
-  }
-`;
 var ADMIN_REVIEWS = `
-  query AdminReviews($status: String) {
-    adminReviews(status: $status) {
-      edges { node { id applicationId reviewStatus reviewNotes } }
+  query AdminReviews($applicationId: ID!, $status: AppReviewStatus, $limit: Int, $offset: Int) {
+    appReviews(applicationId: $applicationId, status: $status, limit: $limit, offset: $offset) {
+      edges { cursor node { id applicationId } }
+      pageInfo { hasNextPage }
       totalCount
     }
   }
@@ -154,71 +141,69 @@ var REJECT_APPLICATION = `
   }
 `;
 var LIST_API_KEYS = `
-  query ApiKeys($applicationId: ID!) {
-    apiKeys(applicationId: $applicationId) {
-      id applicationId name prefix scopes lastUsedAt isActive createdAt
+  query ApiKeys($appId: ID!) {
+    appApiKeys(appId: $appId) {
+      apiKeys { id appId name prefix scopes expiresAt lastUsedAt createdAt }
     }
   }
 `;
 var CREATE_API_KEY = `
-  mutation CreateApiKey($input: CreateApiKeyInput!) {
-    createApiKey(input: $input) {
-      id applicationId name prefix token scopes isActive createdAt
+  mutation CreateApiKey($input: GenerateAPIKeyInput!) {
+    generateAPIKey(input: $input) {
+      keyId apiKey apiSecret
     }
   }
 `;
 var REVOKE_API_KEY = `
-  mutation RevokeApiKey($id: ID!) {
-    revokeApiKey(id: $id) { success }
-  }
-`;
-var LIST_OAUTH_CLIENTS = `
-  query OAuthClients($applicationId: ID!) {
-    oauthClients(applicationId: $applicationId) {
-      id applicationId clientId name redirectUris grantTypes isActive createdAt
-    }
-  }
-`;
-var CREATE_OAUTH_CLIENT = `
-  mutation CreateOAuthClient($input: CreateOAuthClientInput!) {
-    createOAuthClient(input: $input) {
-      id applicationId clientId clientSecret name redirectUris grantTypes isActive createdAt
-    }
-  }
-`;
-var DELETE_OAUTH_CLIENT = `
-  mutation DeleteOAuthClient($id: ID!) {
-    deleteOAuthClient(id: $id) { success }
+  mutation RevokeApiKey($keyId: String!) {
+    revokeAPIKey(keyId: $keyId)
   }
 `;
 var LIST_DELEGATIONS = `
-  query Delegations($applicationId: ID, $workspaceId: ID) {
-    delegations(applicationId: $applicationId, workspaceId: $workspaceId) {
-      id applicationId workspaceId scopes status expiresAt createdAt
+  query Delegations($first: Int) {
+    currentUserDelegations(pagination: { limit: $first }) {
+      delegations {
+        id appId userId grantedBy grantedAt expiresAt scopes status workspaceIds
+        app { id name }
+      }
     }
   }
 `;
 var CREATE_DELEGATION = `
-  mutation CreateDelegation($input: CreateDelegationInput!) {
-    createDelegation(input: $input) {
-      id applicationId workspaceId scopes status expiresAt
+  mutation CreateDelegation($input: GrantDelegationInput!) {
+    grantDelegation(input: $input) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status
     }
   }
 `;
 var REVOKE_DELEGATION = `
   mutation RevokeDelegation($id: ID!) {
-    revokeDelegation(id: $id) { success }
+    revokeDelegation(id: $id)
   }
 `;
 
 // src/modules/devportal/tools.ts
-var OAuthGrantTypeEnum = z.enum(["AUTHORIZATION_CODE", "CLIENT_CREDENTIALS", "REFRESH_TOKEN", "PASSWORD", "IMPLICIT"]).describe("OAuth 2.0 grant type");
+var AppStatusEnum = z.enum(["DRAFT", "REVIEW", "PUBLISHED", "ARCHIVED"]).describe("Application status");
+var AppReviewStatusEnum = z.enum(["PENDING", "APPROVED", "REJECTED"]).describe("Application review status");
+function stubbedTool(server, _productName, toolName, title, description, featureNote, inputSchema, altSuggestions) {
+  server.registerTool(
+    toolName,
+    {
+      title,
+      description: `${description} [intentionally stubbed: ${featureNote} Use ${altSuggestions.join(", ")} instead.]`,
+      inputSchema
+    },
+    async () => errorResult(
+      `[stubbed] ${featureNote} Use ${altSuggestions.join(", ")} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`
+    )
+  );
+}
 function registerDevportalTools(server, ctx, track) {
   server.registerTool(
     track(mcpToolName(ctx.productName, "devportal_orgs_list")),
     {
       title: "List Devportal Organizations",
-      description: "List publisher organizations.",
+      description: "List publisher organizations the caller owns (uses `myOrganizations` on the live supergraph).",
       inputSchema: {
         limit: z.number().optional().describe("Page size (default 50)"),
         offset: z.number().optional().describe("Skip results")
@@ -228,8 +213,8 @@ function registerDevportalTools(server, ctx, track) {
       try {
         const data = await ctx.gql.global.request(LIST_ORGANIZATIONS, { limit: limit ?? 50, offset: offset ?? 0 });
         return jsonResult({
-          items: data.organizations.edges.map((e) => e.node),
-          totalCount: data.organizations.totalCount
+          items: data.myOrganizations.items,
+          totalCount: data.myOrganizations.total
         });
       } catch (error) {
         ctx.logger.error("devportal_orgs_list failed", { error: String(error) });
@@ -266,19 +251,16 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_orgs_create")),
     {
       title: "Create Publisher Organization",
-      description: "Create a publisher organization.",
+      description: "Create a publisher organization. The live supergraph requires `slug` \u2014 auto-derive from the name (kebab-case) if not supplied.",
       inputSchema: {
         name: z.string().describe("Organization name"),
-        description: z.string().optional(),
-        tier: z.string().optional().describe("INDIVIDUAL|ORGANIZATION|ENTERPRISE (default ORGANIZATION)")
+        slug: z.string().optional().describe("URL slug \u2014 auto-derived from `name` (kebab-case) when omitted"),
+        description: z.string().optional()
       }
     },
-    async ({ name, description, tier }) => {
+    async ({ name, slug, description }) => {
       try {
-        const input = {
-          name,
-          tier: (tier ?? "ORGANIZATION").toUpperCase()
-        };
+        const input = { name, slug: slug ?? slugify(name) };
         if (description !== void 0) input.description = description;
         const data = await ctx.gql.global.request(
           CREATE_ORGANIZATION,
@@ -346,10 +328,10 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_list")),
     {
       title: "List Devportal Applications",
-      description: "List devportal applications.",
+      description: "List devportal applications. `status` is the live `AppStatus` enum (DRAFT|REVIEW|PUBLISHED|ARCHIVED).",
       inputSchema: {
         organizationId: z.string().optional(),
-        status: z.string().optional().describe("DRAFT|REVIEW|PUBLISHED|ARCHIVED"),
+        status: AppStatusEnum.optional(),
         limit: z.number().optional().describe("Page size (default 50)")
       }
     },
@@ -357,7 +339,7 @@ function registerDevportalTools(server, ctx, track) {
       try {
         const data = await ctx.gql.global.request(LIST_APPLICATIONS, {
           organizationId,
-          status: status ? status.toUpperCase() : void 0,
+          status,
           limit: limit ?? 50
         });
         return jsonResult({
@@ -399,19 +381,19 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_create")),
     {
       title: "Create Devportal Application",
-      description: "Create a devportal application.",
+      description: 'Create a devportal application under the caller\'s default organization. The live `CreateApplicationInput` does NOT accept `organizationId` (was previously forwarded; rejected by the schema with "Field organizationId is not defined by type CreateApplicationInput").',
       inputSchema: {
         name: z.string().describe("Application name"),
-        organizationId: z.string().describe("Owning organization ID"),
-        appType: z.string().optional().describe("API_INTEGRATION|WEB_APP|MOBILE_APP (default API_INTEGRATION)"),
+        appType: AppStatusEnum.describe(
+          "API_INTEGRATION|WEB_APP|MOBILE_APP (default API_INTEGRATION)"
+        ).optional(),
         description: z.string().optional()
       }
     },
-    async ({ name, organizationId, appType, description }) => {
+    async ({ name, appType, description }) => {
       try {
         const input = {
           name,
-          organizationId,
           appType: (appType ?? "API_INTEGRATION").toUpperCase()
         };
         if (description !== void 0) input.description = description;
@@ -508,7 +490,7 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_delete")),
     {
       title: "Delete Devportal Application",
-      description: "Delete a devportal application.",
+      description: "Delete a devportal application. Live mutation returns Boolean! (no selection set).",
       inputSchema: { id: z.string().describe("Application ID") }
     },
     async ({ id }) => {
@@ -523,27 +505,17 @@ function registerDevportalTools(server, ctx, track) {
       }
     }
   );
-  server.registerTool(
+  stubbedTool(
+    server,
+    ctx.productName,
     track(mcpToolName(ctx.productName, "devportal_apps_versions_list")),
+    "List Application Versions",
+    "List versions for an application.",
+    "`Query.applicationVersions(applicationId)` was removed from the alpha devportal supergraph; there is no surviving `versions` field on `app(applicationId)`.",
     {
-      title: "List Application Versions",
-      description: "List versions for an application.",
-      inputSchema: { applicationId: z.string().describe("Application ID") }
+      applicationId: z.string().describe("Application ID")
     },
-    async ({ applicationId }) => {
-      try {
-        const data = await ctx.gql.global.request(
-          APPLICATION_VERSIONS,
-          { applicationId }
-        );
-        return jsonResult(data.applicationVersions);
-      } catch (error) {
-        ctx.logger.error("devportal_apps_versions_list failed", { error: String(error) });
-        return errorResult(
-          `Failed to list versions: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    [`\`_devportal_apps_versions_create\``, `\`_devportal_apps_analytics\``]
   );
   server.registerTool(
     track(mcpToolName(ctx.productName, "devportal_apps_versions_create")),
@@ -579,7 +551,7 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_webhooks_list")),
     {
       title: "List Application Webhooks",
-      description: "List webhooks attached to an application.",
+      description: "List webhooks attached to an application (live global `Query.webhooks(applicationId)`).",
       inputSchema: { applicationId: z.string().describe("Application ID") }
     },
     async ({ applicationId }) => {
@@ -600,7 +572,7 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_webhooks_add")),
     {
       title: "Add Application Webhook",
-      description: "Add a webhook to an application.",
+      description: "Add a webhook to an application. The live mutation takes `applicationId` as a top-level argument plus `input: CreateWebhookInput!`. The result is `WebhookCreated { webhook { ... } }` (the type itself has no `id`).",
       inputSchema: {
         applicationId: z.string().describe("Application ID"),
         name: z.string().describe("Webhook name"),
@@ -612,18 +584,14 @@ function registerDevportalTools(server, ctx, track) {
     async ({ applicationId, name, url, events, maxRetries }) => {
       try {
         const input = {
-          applicationId,
           name,
           url,
           events,
           retryEnabled: true,
           maxRetries: maxRetries ?? 5
         };
-        const data = await ctx.gql.global.request(
-          CREATE_WEBHOOK,
-          { input }
-        );
-        return jsonResult(data.createWebhook);
+        const data = await ctx.gql.global.request(CREATE_WEBHOOK, { applicationId, input });
+        return jsonResult(data.createWebhook.webhook);
       } catch (error) {
         ctx.logger.error("devportal_apps_webhooks_add failed", { error: String(error) });
         return errorResult(
@@ -636,7 +604,7 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_apps_webhooks_remove")),
     {
       title: "Remove Application Webhook",
-      description: "Remove a webhook by ID.",
+      description: "Remove a webhook by ID. Live mutation returns Boolean! (no selection set).",
       inputSchema: { id: z.string().describe("Webhook ID") }
     },
     async ({ id }) => {
@@ -680,46 +648,43 @@ function registerDevportalTools(server, ctx, track) {
       }
     }
   );
-  server.registerTool(
+  stubbedTool(
+    server,
+    ctx.productName,
     track(mcpToolName(ctx.productName, "devportal_revenue")),
+    "Organization Revenue",
+    "Get revenue summary for an organization.",
+    "`Query.organizationRevenue` (and any `revenue` field on `organization` / `app`) was removed from the alpha supergraph.",
     {
-      title: "Organization Revenue",
-      description: "Get revenue summary for an organization.",
-      inputSchema: {
-        organizationId: z.string().describe("Organization ID"),
-        period: z.string().optional().describe("LAST_7_DAYS|LAST_30_DAYS|YTD (default LAST_30_DAYS)")
-      }
+      organizationId: z.string().describe("Organization ID"),
+      period: z.string().optional().describe("LAST_7_DAYS|LAST_30_DAYS|YTD (default LAST_30_DAYS)")
     },
-    async ({ organizationId, period }) => {
-      try {
-        const data = await ctx.gql.global.request(ORGANIZATION_REVENUE, {
-          organizationId,
-          period: (period ?? "LAST_30_DAYS").toUpperCase()
-        });
-        return jsonResult(data.organizationRevenue);
-      } catch (error) {
-        ctx.logger.error("devportal_revenue failed", { error: String(error) });
-        return errorResult(
-          `Failed to fetch revenue: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    [`\`_billing_invoices_list\``, `\`_billing_subscriptions_list\``]
   );
   server.registerTool(
     track(mcpToolName(ctx.productName, "devportal_admin_reviews_list")),
     {
       title: "List Admin Application Reviews",
-      description: "List applications in the admin review queue.",
+      description: "List applications in the admin review queue. Live query is `appReviews(applicationId, status, limit, offset)` (the unscoped `adminReviews` field was removed). `applicationId` is required, `status` filters the connection server-side, and pagination uses `limit` + `offset` (NOT `first`/`after`).",
       inputSchema: {
-        status: z.string().optional().describe("PENDING|APPROVED|REJECTED (default PENDING)")
+        applicationId: z.string().describe("Application ID to scope the review queue to"),
+        status: AppReviewStatusEnum.optional(),
+        limit: z.number().optional().describe("Page size (default 20)"),
+        offset: z.number().optional().describe("Skip results")
       }
     },
-    async ({ status }) => {
+    async ({ applicationId, status, limit, offset }) => {
       try {
-        const data = await ctx.gql.global.request(ADMIN_REVIEWS, { status: (status ?? "PENDING").toUpperCase() });
+        const data = await ctx.gql.global.request(ADMIN_REVIEWS, {
+          applicationId,
+          status,
+          limit: limit ?? 20,
+          offset: offset ?? 0
+        });
         return jsonResult({
-          items: data.adminReviews.edges.map((e) => e.node),
-          totalCount: data.adminReviews.totalCount
+          items: data.appReviews.edges.map((e) => e.node),
+          totalCount: data.appReviews.totalCount,
+          pageInfo: data.appReviews.pageInfo
         });
       } catch (error) {
         ctx.logger.error("devportal_admin_reviews_list failed", { error: String(error) });
@@ -783,17 +748,15 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_api_keys_list")),
     {
       title: "List API Keys",
-      description: "List API keys issued for a devportal application. Returns an array of key metadata (no secret material).",
+      description: "List API keys for an application. Live query is `appApiKeys(appId: ID!)`.",
       inputSchema: {
-        applicationId: z.string().describe("Application ID that owns the API keys")
+        applicationId: z.string().describe("Application ID (forwarded as `appId`)")
       }
     },
     async ({ applicationId }) => {
       try {
-        const data = await ctx.gql.global.request(LIST_API_KEYS, {
-          applicationId
-        });
-        return jsonResult(data.apiKeys);
+        const data = await ctx.gql.global.request(LIST_API_KEYS, { appId: applicationId });
+        return jsonResult(data.appApiKeys.apiKeys);
       } catch (error) {
         ctx.logger.error("devportal_api_keys_list failed", { error: String(error) });
         return errorResult(
@@ -806,24 +769,26 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_api_keys_create")),
     {
       title: "Create API Key",
-      description: "Mint a new API key for an application. Returns the full key including the one-time-visible `token` \u2014 surface it once and never persist server-side after handoff.",
+      description: "Mint a new API key via `generateAPIKey(input: GenerateAPIKeyInput!)` (live auth mutation). Returns the full key including the one-time-visible `apiKey`/`apiSecret`.",
       inputSchema: {
-        applicationId: z.string().describe("Application ID that will own the key"),
-        name: z.string().min(1).describe("Human-readable name for the key (audit/UI label)"),
-        scopes: z.array(z.string()).optional().describe("Scope identifiers granted to the key (omit for default scopes)"),
-        expiresAt: z.string().optional().describe("ISO 8601 expiry timestamp (omit for non-expiring key)")
+        applicationId: z.string().describe("Application ID (forwarded as `appId`)"),
+        name: z.string().min(1).describe("Human-readable name for the key"),
+        scopes: z.array(z.string()).min(1).describe(
+          "Scope identifiers granted to the key \u2014 REQUIRED on the live `GenerateAPIKeyInput.scope`"
+        ),
+        expiresAt: z.string().optional().describe("ISO 8601 expiry timestamp")
       }
     },
     async ({ applicationId, name, scopes, expiresAt }) => {
       try {
-        const input = { applicationId, name };
-        if (scopes !== void 0) input.scopes = scopes;
+        const input = {
+          appId: applicationId,
+          name,
+          scope: scopes
+        };
         if (expiresAt !== void 0) input.expiresAt = expiresAt;
-        const data = await ctx.gql.global.request(
-          CREATE_API_KEY,
-          { input }
-        );
-        return jsonResult(data.createApiKey);
+        const data = await ctx.gql.global.request(CREATE_API_KEY, { input });
+        return jsonResult({ ...data.generateAPIKey, name, scopes, applicationId });
       } catch (error) {
         ctx.logger.error("devportal_api_keys_create failed", { error: String(error) });
         return errorResult(
@@ -836,12 +801,12 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_api_keys_revoke")),
     {
       title: "Revoke API Key",
-      description: "Revoke an API key by ID. Revocation is irreversible. Returns `{ status, message, apiKeyId }`.",
-      inputSchema: { id: z.string().describe("API key ID to revoke") }
+      description: "Revoke an API key via `revokeAPIKey(keyId: String!)` (live global mutation, returns Boolean!).",
+      inputSchema: { id: z.string().describe("API key ID (forwarded as `keyId`)") }
     },
     async ({ id }) => {
       try {
-        await ctx.gql.global.request(REVOKE_API_KEY, { id });
+        await ctx.gql.global.request(REVOKE_API_KEY, { keyId: id });
         return jsonResult({ status: "success", message: "API key revoked", apiKeyId: id });
       } catch (error) {
         ctx.logger.error("devportal_api_keys_revoke failed", { error: String(error) });
@@ -851,100 +816,60 @@ function registerDevportalTools(server, ctx, track) {
       }
     }
   );
-  server.registerTool(
+  stubbedTool(
+    server,
+    ctx.productName,
     track(mcpToolName(ctx.productName, "devportal_oauth_list")),
+    "List OAuth Clients",
+    "List OAuth 2.0 clients registered for a devportal application.",
+    "`Query.oauthClients(applicationId)` no longer exists on the alpha supergraph, and `app(id)` does not expose a nested `oauthClients` field either.",
     {
-      title: "List OAuth Clients",
-      description: "List OAuth 2.0 clients registered for a devportal application.",
-      inputSchema: {
-        applicationId: z.string().describe("Application ID that owns the OAuth clients")
-      }
+      applicationId: z.string().describe("Application ID")
     },
-    async ({ applicationId }) => {
-      try {
-        const data = await ctx.gql.global.request(
-          LIST_OAUTH_CLIENTS,
-          { applicationId }
-        );
-        return jsonResult(data.oauthClients);
-      } catch (error) {
-        ctx.logger.error("devportal_oauth_list failed", { error: String(error) });
-        return errorResult(
-          `Failed to list OAuth clients: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    [`\`_auth_current_user_apps\``]
   );
-  server.registerTool(
+  stubbedTool(
+    server,
+    ctx.productName,
     track(mcpToolName(ctx.productName, "devportal_oauth_create")),
+    "Create OAuth Client",
+    "Register a new OAuth 2.0 client for an application.",
+    "`Mutation.createOAuthClient` (and `CreateOAuthClientInput`) have been removed from the alpha supergraph.",
     {
-      title: "Create OAuth Client",
-      description: "Register a new OAuth 2.0 client for an application. Returns the client including the one-time-visible `clientSecret`.",
-      inputSchema: {
-        applicationId: z.string().describe("Application ID that will own the client"),
-        name: z.string().min(1).describe("Human-readable client name"),
-        redirectUris: z.array(z.string()).optional().describe("Allowed redirect URIs for authorization-code flows"),
-        grantTypes: z.array(OAuthGrantTypeEnum).optional().describe("OAuth grant types the client is allowed to use")
-      }
+      applicationId: z.string().describe("Application ID"),
+      name: z.string().describe("Client name"),
+      redirectUris: z.array(z.string()).optional(),
+      grantTypes: z.array(z.string()).optional()
     },
-    async ({ applicationId, name, redirectUris, grantTypes }) => {
-      try {
-        const input = { applicationId, name };
-        if (redirectUris !== void 0) input.redirectUris = redirectUris;
-        if (grantTypes !== void 0) input.grantTypes = grantTypes;
-        const data = await ctx.gql.global.request(
-          CREATE_OAUTH_CLIENT,
-          { input }
-        );
-        return jsonResult(data.createOAuthClient);
-      } catch (error) {
-        ctx.logger.error("devportal_oauth_create failed", { error: String(error) });
-        return errorResult(
-          `Failed to create OAuth client: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    [`\`_auth_current_user_apps\` (read-only on alpha)`]
   );
-  server.registerTool(
+  stubbedTool(
+    server,
+    ctx.productName,
     track(mcpToolName(ctx.productName, "devportal_oauth_delete")),
+    "Delete OAuth Client",
+    "Delete an OAuth 2.0 client by ID.",
+    "`Mutation.deleteOAuthClient` has been removed from the alpha supergraph (no successor field).",
     {
-      title: "Delete OAuth Client",
-      description: "Delete an OAuth 2.0 client by ID. Returns `{ status, message, oauthClientId }`.",
-      inputSchema: { id: z.string().describe("OAuth client ID") }
+      id: z.string().describe("OAuth client ID")
     },
-    async ({ id }) => {
-      try {
-        await ctx.gql.global.request(DELETE_OAUTH_CLIENT, { id });
-        return jsonResult({
-          status: "success",
-          message: "OAuth client deleted",
-          oauthClientId: id
-        });
-      } catch (error) {
-        ctx.logger.error("devportal_oauth_delete failed", { error: String(error) });
-        return errorResult(
-          `Failed to delete OAuth client: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    [`\`_auth_*\` surface for current OAuth flows`]
   );
   server.registerTool(
     track(mcpToolName(ctx.productName, "devportal_delegations_list")),
     {
       title: "List Delegations",
-      description: "List workspace delegations issued to applications. Filter by application or workspace.",
+      description: "List workspace delegations issued to applications. Live impl proxies through the global `Query.currentUserDelegations` (calls scoped to the caller). Note: in-scope filtering by application/workspace is not supported on the live schema \u2014 pass `first` to paginate.",
       inputSchema: {
-        applicationId: z.string().optional().describe("Filter by application ID"),
-        workspaceId: z.string().optional().describe("Filter by workspace ID")
+        first: z.number().optional().describe(
+          "Page size (default 50). Filter args from the old `delegations(...)` were dropped."
+        )
       }
     },
-    async ({ applicationId, workspaceId }) => {
+    async ({ first }) => {
       try {
-        const data = await ctx.gql.global.request(
-          LIST_DELEGATIONS,
-          { applicationId, workspaceId }
-        );
-        return jsonResult(data.delegations);
+        const data = await ctx.gql.global.request(LIST_DELEGATIONS, { first: first ?? 50 });
+        return jsonResult(data.currentUserDelegations.delegations);
       } catch (error) {
         ctx.logger.error("devportal_delegations_list failed", { error: String(error) });
         return errorResult(
@@ -957,24 +882,27 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_delegations_create")),
     {
       title: "Create Delegation",
-      description: "Grant a workspace delegation to an application with the given scopes. Returns the persisted delegation.",
+      description: "Grant a workspace delegation to an application. Live impl is `grantDelegation(input: GrantDelegationInput!)` (renamed from `CreateDelegationInput`); `appId` replaces `applicationId`. The grant is implicitly to the calling actor \u2014 `GrantDelegationInput` does NOT take a `userId`.",
       inputSchema: {
-        applicationId: z.string().describe("Application ID receiving the delegation"),
-        workspaceId: z.string().describe("Workspace ID granting the delegation"),
-        scopes: z.array(z.string()).optional().describe("Scope identifiers granted to the application (omit for default scope set)"),
-        expiresAt: z.string().optional().describe("ISO 8601 expiry timestamp (omit for non-expiring delegation)")
+        applicationId: z.string().describe("Application ID receiving the delegation (forwarded as `appId`)"),
+        scopes: z.array(z.string()).min(1).describe(
+          "Scope identifiers granted to the application \u2014 REQUIRED on the live GrantDelegationInput"
+        ),
+        workspaceIds: z.array(z.string()).optional().describe(
+          "Optional list of workspace IDs scoping the delegation (forwarded as `workspaceIds`)"
+        ),
+        expiresAt: z.string().optional().describe(
+          "ISO 8601 expiry timestamp (DateTime scalar \u2014 must be a full ISO 8601 instant, not a date)"
+        )
       }
     },
-    async ({ applicationId, workspaceId, scopes, expiresAt }) => {
+    async ({ applicationId, scopes, workspaceIds, expiresAt }) => {
       try {
-        const input = { applicationId, workspaceId };
-        if (scopes !== void 0) input.scopes = scopes;
+        const input = { appId: applicationId, scopes };
+        if (workspaceIds !== void 0) input.workspaceIds = workspaceIds;
         if (expiresAt !== void 0) input.expiresAt = expiresAt;
-        const data = await ctx.gql.global.request(
-          CREATE_DELEGATION,
-          { input }
-        );
-        return jsonResult(data.createDelegation);
+        const data = await ctx.gql.global.request(CREATE_DELEGATION, { input });
+        return jsonResult(data.grantDelegation);
       } catch (error) {
         ctx.logger.error("devportal_delegations_create failed", { error: String(error) });
         return errorResult(
@@ -987,8 +915,8 @@ function registerDevportalTools(server, ctx, track) {
     track(mcpToolName(ctx.productName, "devportal_delegations_revoke")),
     {
       title: "Revoke Delegation",
-      description: "Revoke a workspace delegation by ID. Returns `{ status, message, delegationId }`.",
-      inputSchema: { id: z.string().describe("Delegation ID to revoke") }
+      description: "Revoke a workspace delegation via `revokeDelegation(id: ID!)` (live schema, returns Boolean!; no selection set).",
+      inputSchema: { id: z.string().describe("Delegation ID") }
     },
     async ({ id }) => {
       try {
@@ -1003,6 +931,9 @@ function registerDevportalTools(server, ctx, track) {
     }
   );
 }
+function slugify(s) {
+  return s.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 64) || "org";
+}
 
 // src/modules/devportal/index.ts
 var devportalModule = {