@burdenoff/mcp-libs 2026.1008.3 → 2026.1008.4

package/dist/modules/auth/index.js

@@ -182,6 +182,201 @@ var ME = `
     me { id email username isActive emailVerified }
   }
 `;
+var CURRENT_USER = `
+  query currentUser {
+    currentUser {
+      id email firstName lastName username phoneNumber name
+      emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt
+    }
+  }
+`;
+var UPDATE_CURRENT_USER_PROFILE = `
+  mutation updateCurrentUserProfile($input: UpdateUserInput!) {
+    updateCurrentUserProfile(input: $input) {
+      id name firstName lastName username phoneNumber timezone language
+    }
+  }
+`;
+var AUTH_AUDIT_LOGS = `
+  query authAuditLogs($pagination: PaginationInput) {
+    authAuditLogs(pagination: $pagination) {
+      id action resource resourceType resourceId description
+      ipAddress userAgent metadata createdAt
+    }
+  }
+`;
+var ACTIVE_SESSIONS = `
+  query activeSessions($pagination: PaginationInput) {
+    activeSessions(pagination: $pagination) {
+      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent
+    }
+  }
+`;
+var REVOKE_SESSION = `
+  mutation revokeSession($id: ID!) {
+    revokeSession(id: $id)
+  }
+`;
+var CURRENT_USER_MFA_METHODS = `
+  query currentUserMFAMethods($pagination: PaginationInput) {
+    currentUserMFAMethods(pagination: $pagination) {
+      id method status createdAt updatedAt
+    }
+  }
+`;
+var SETUP_MFA = `
+  mutation setupMFA($method: MFAMethod!) {
+    setupMFA(method: $method) {
+      method backupCodes qrCode secret
+    }
+  }
+`;
+var ENABLE_MFA = `
+  mutation enableMFA($code: String!) {
+    enableMFA(code: $code)
+  }
+`;
+var DISABLE_MFA = `
+  mutation disableMFA {
+    disableMFA
+  }
+`;
+var MY_API_KEYS = `
+  query myApiKeys($pagination: PaginationInput) {
+    myApiKeys(pagination: $pagination) {
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+    }
+  }
+`;
+var APP_API_KEYS = `
+  query appApiKeys($appId: ID!, $pagination: PaginationInput) {
+    appApiKeys(appId: $appId, pagination: $pagination) {
+      apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }
+    }
+  }
+`;
+var GENERATE_API_KEY = `
+  mutation generateAPIKey($input: GenerateAPIKeyInput!) {
+    generateAPIKey(input: $input) {
+      keyId apiKey apiSecret
+    }
+  }
+`;
+var REVOKE_API_KEY = `
+  mutation revokeAPIKey($keyId: String!) {
+    revokeAPIKey(keyId: $keyId)
+  }
+`;
+var ROTATE_API_KEY = `
+  mutation rotateAPIKey($keyId: String!) {
+    rotateAPIKey(keyId: $keyId) {
+      apiSecret
+    }
+  }
+`;
+var CURRENT_USER_DELEGATIONS = `
+  query currentUserDelegations($pagination: PaginationInput) {
+    currentUserDelegations(pagination: $pagination) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds
+      status revokedAt revokedBy
+      app { id name }
+    }
+  }
+`;
+var GRANT_DELEGATION = `
+  mutation grantDelegation($input: GrantDelegationInput!) {
+    grantDelegation(input: $input) {
+      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status
+    }
+  }
+`;
+var REVOKE_DELEGATION = `
+  mutation revokeDelegation($id: ID!, $reason: String) {
+    revokeDelegation(id: $id, reason: $reason)
+  }
+`;
+var CURRENT_USER_APPS = `
+  query currentUserApps($pagination: PaginationInput) {
+    currentUserApps(pagination: $pagination) {
+      apps { id clientId name description type actorType status ownerUserId redirectUris scopes createdAt updatedAt }
+    }
+  }
+`;
+var GET_APP = `
+  query app($id: ID!) {
+    app(id: $id) {
+      id clientId name description type actorType status ownerUserId redirectUris scopes
+    }
+  }
+`;
+var CREATE_APP = `
+  mutation createApp($input: CreateAppInput!) {
+    createApp(input: $input) {
+      app { id clientId name type status }
+      clientSecret
+    }
+  }
+`;
+var UPDATE_APP = `
+  mutation updateApp($id: ID!, $input: UpdateAppInput!) {
+    updateApp(id: $id, input: $input) {
+      id name description redirectUris scopes status
+    }
+  }
+`;
+var DEACTIVATE_APP = `
+  mutation deactivateApp($id: ID!) {
+    deactivateApp(id: $id)
+  }
+`;
+var GET_SSO_CONFIG = `
+  query getSSOConfig($tenantId: String!) {
+    getSSOConfig(tenantId: $tenantId) {
+      id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata
+    }
+  }
+`;
+var SAVE_SSO_CONFIG = `
+  mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {
+    saveSSOConfig(tenantId: $tenantId, input: $input) {
+      id identifier entityId ssoUrl sloUrl certificate enabled
+    }
+  }
+`;
+var DELETE_SSO_CONFIG = `
+  mutation deleteSSOConfig($tenantId: String!) {
+    deleteSSOConfig(tenantId: $tenantId)
+  }
+`;
+var LIST_USERS = `
+  query users($filter: UserFilterInput, $pagination: PaginationInput) {
+    users(filter: $filter, pagination: $pagination) {
+      users { id email firstName lastName username role status createdAt }
+      totalCount hasMore
+    }
+  }
+`;
+var GET_USER = `
+  query user($id: ID!) {
+    user(id: $id) {
+      id email firstName lastName username role status emailVerified lastLoginAt
+    }
+  }
+`;
+var UPDATE_USER = `
+  mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {
+    updateUser(id: $id, input: $input) {
+      id email firstName lastName username role status
+    }
+  }
+`;
+var INVITE_USER = `
+  mutation inviteUser($input: InviteUserInput!) {
+    inviteUser(input: $input) {
+      id email status invitedAt expiresAt
+    }
+  }
+`;
 
 // src/modules/auth/more-tools.ts
 function err(ctx, name, message, error) {
@@ -422,6 +617,837 @@ function registerAuthMoreTools(server, ctx, track) {
     }
   );
 }
+function err2(ctx, name, message, error) {
+  ctx.logger.error(`${name} failed`, { error });
+  return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);
+}
+function registerAuthExtraTools(server, ctx, track) {
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_profile_get")),
+    {
+      title: "Get Profile",
+      description: "Show the current authenticated user (id, email, name, role, status).",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        const d = await ctx.gql.global.request(
+          CURRENT_USER
+        );
+        return jsonResult(d.currentUser);
+      } catch (e) {
+        return err2(ctx, "auth_profile_get", "Failed to fetch profile", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_profile_update")),
+    {
+      title: "Update Profile",
+      description: "Update the current user profile (any subset of fields).",
+      inputSchema: {
+        firstName: z.string().optional(),
+        lastName: z.string().optional(),
+        name: z.string().optional(),
+        username: z.string().optional(),
+        phoneNumber: z.string().optional(),
+        timezone: z.string().optional(),
+        language: z.string().optional()
+      }
+    },
+    async (args) => {
+      try {
+        const input = {};
+        if (args.firstName !== void 0) input.firstName = args.firstName;
+        if (args.lastName !== void 0) input.lastName = args.lastName;
+        if (args.name !== void 0) input.name = args.name;
+        if (args.username !== void 0) input.username = args.username;
+        if (args.phoneNumber !== void 0) input.phoneNumber = args.phoneNumber;
+        if (args.timezone !== void 0) input.timezone = args.timezone;
+        if (args.language !== void 0) input.language = args.language;
+        if (Object.keys(input).length === 0) {
+          return errorResult("No updates specified \u2014 provide at least one field.");
+        }
+        const d = await ctx.gql.global.request(UPDATE_CURRENT_USER_PROFILE, { input });
+        return jsonResult({ status: "success", user: d.updateCurrentUserProfile });
+      } catch (e) {
+        return err2(ctx, "auth_profile_update", "Failed to update profile", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sessions_list")),
+    {
+      title: "List Active Sessions",
+      description: "List active sessions for the current user (browser/device sessions).",
+      inputSchema: {
+        limit: z.number().optional().describe("Page size (default 50)"),
+        offset: z.number().optional()
+      }
+    },
+    async ({ limit, offset }) => {
+      try {
+        const d = await ctx.gql.global.request(ACTIVE_SESSIONS, {
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({ sessions: d.activeSessions, total: d.activeSessions.length });
+      } catch (e) {
+        return err2(ctx, "auth_sessions_list", "Failed to list sessions", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sessions_revoke")),
+    {
+      title: "Revoke Session",
+      description: "Revoke (sign out) a single session by id.",
+      inputSchema: { id: z.string().describe("Session ID to revoke") }
+    },
+    async ({ id }) => {
+      try {
+        await ctx.gql.global.request(REVOKE_SESSION, { id });
+        return jsonResult({ status: "success", message: `Session ${id} revoked.` });
+      } catch (e) {
+        return err2(ctx, "auth_sessions_revoke", "Failed to revoke session", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_mfa_list")),
+    {
+      title: "List MFA Methods",
+      description: "List MFA methods enrolled for the current user.",
+      inputSchema: {
+        limit: z.number().optional().describe("Page size (default 50)"),
+        offset: z.number().optional()
+      }
+    },
+    async ({ limit, offset }) => {
+      try {
+        const d = await ctx.gql.global.request(CURRENT_USER_MFA_METHODS, {
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({
+          methods: d.currentUserMFAMethods,
+          total: d.currentUserMFAMethods.length
+        });
+      } catch (e) {
+        return err2(ctx, "auth_mfa_list", "Failed to list MFA methods", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_mfa_enroll")),
+    {
+      title: "Enroll MFA",
+      description: "Begin MFA enrollment. Returns the qrCode, secret, and one-time backup codes the user must save BEFORE calling auth_mfa_verify.",
+      inputSchema: {
+        method: z.enum(["TOTP", "SMS", "EMAIL"]).describe("MFA method to enroll")
+      }
+    },
+    async ({ method }) => {
+      try {
+        const d = await ctx.gql.global.request(
+          SETUP_MFA,
+          { method }
+        );
+        return jsonResult({
+          status: "enrollment_started",
+          enrollment: d.setupMFA,
+          message: "Save your backup codes; verify with auth_mfa_verify."
+        });
+      } catch (e) {
+        return err2(ctx, "auth_mfa_enroll", "Failed to enroll MFA", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_mfa_verify")),
+    {
+      title: "Verify MFA Enrollment",
+      description: "Verify MFA enrollment by submitting the code from the authenticator.",
+      inputSchema: { code: z.string().describe("OTP code from authenticator") }
+    },
+    async ({ code }) => {
+      try {
+        await ctx.gql.global.request(ENABLE_MFA, { code });
+        return jsonResult({ status: "success", message: "MFA enabled." });
+      } catch (e) {
+        return err2(ctx, "auth_mfa_verify", "Failed to verify MFA", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_mfa_disable")),
+    {
+      title: "Disable MFA",
+      description: "Disable MFA for the current user.",
+      inputSchema: {}
+    },
+    async () => {
+      try {
+        await ctx.gql.global.request(DISABLE_MFA);
+        return jsonResult({ status: "success", message: "MFA disabled." });
+      } catch (e) {
+        return err2(ctx, "auth_mfa_disable", "Failed to disable MFA", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_api_keys_list")),
+    {
+      title: "List API Keys",
+      description: "List API keys for the current user; pass appId to scope to a specific app.",
+      inputSchema: {
+        appId: z.string().optional().describe("Restrict to keys owned by an app id"),
+        limit: z.number().optional(),
+        offset: z.number().optional()
+      }
+    },
+    async ({ appId, limit, offset }) => {
+      try {
+        const pagination = { limit: limit ?? 50, offset: offset ?? 0 };
+        if (appId) {
+          const d2 = await ctx.gql.global.request(APP_API_KEYS, { appId, pagination });
+          return jsonResult({
+            keys: d2.appApiKeys.apiKeys,
+            total: d2.appApiKeys.apiKeys.length
+          });
+        }
+        const d = await ctx.gql.global.request(MY_API_KEYS, { pagination });
+        return jsonResult({
+          keys: d.myApiKeys.apiKeys,
+          total: d.myApiKeys.apiKeys.length
+        });
+      } catch (e) {
+        return err2(ctx, "auth_api_keys_list", "Failed to list API keys", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_api_keys_create")),
+    {
+      title: "Create API Key",
+      description: "Generate a new API key for an app. Returns apiKey + apiSecret \u2014 the secret is only shown once.",
+      inputSchema: {
+        name: z.string().describe("Friendly name for the key"),
+        appId: z.string().describe("Owning app id"),
+        scopes: z.array(z.string()).optional().describe("Scope strings"),
+        expiresAt: z.string().optional().describe("ISO expiry date")
+      }
+    },
+    async ({ name, appId, scopes, expiresAt }) => {
+      try {
+        const input = { name, appId };
+        if (scopes !== void 0) input.scope = scopes;
+        if (expiresAt !== void 0) input.expiresAt = expiresAt;
+        const d = await ctx.gql.global.request(GENERATE_API_KEY, { input });
+        return jsonResult({
+          status: "success",
+          message: "API key generated. The apiSecret is only shown ONCE \u2014 store it now.",
+          key: d.generateAPIKey
+        });
+      } catch (e) {
+        return err2(ctx, "auth_api_keys_create", "Failed to create API key", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_api_keys_revoke")),
+    {
+      title: "Revoke API Key",
+      description: "Revoke an API key by its keyId.",
+      inputSchema: { keyId: z.string().describe("Key ID to revoke") }
+    },
+    async ({ keyId }) => {
+      try {
+        await ctx.gql.global.request(REVOKE_API_KEY, { keyId });
+        return jsonResult({ status: "success", message: `API key ${keyId} revoked.` });
+      } catch (e) {
+        return err2(ctx, "auth_api_keys_revoke", "Failed to revoke API key", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_api_keys_rotate")),
+    {
+      title: "Rotate API Key",
+      description: "Rotate an API key \u2014 invalidates the previous secret and returns a new one (shown only once).",
+      inputSchema: { keyId: z.string().describe("Key ID to rotate") }
+    },
+    async ({ keyId }) => {
+      try {
+        const d = await ctx.gql.global.request(
+          ROTATE_API_KEY,
+          { keyId }
+        );
+        return jsonResult({
+          status: "success",
+          message: "API key rotated. Save the new secret \u2014 it is only shown once.",
+          apiSecret: d.rotateAPIKey.apiSecret
+        });
+      } catch (e) {
+        return err2(ctx, "auth_api_keys_rotate", "Failed to rotate API key", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_audit_log_query")),
+    {
+      title: "Query Auth Audit Log",
+      description: "Recent auth audit events for the current user.",
+      inputSchema: {
+        limit: z.number().optional().describe("Page size (default 50)"),
+        offset: z.number().optional()
+      }
+    },
+    async ({ limit, offset }) => {
+      try {
+        const d = await ctx.gql.global.request(AUTH_AUDIT_LOGS, {
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({ events: d.authAuditLogs, total: d.authAuditLogs.length });
+      } catch (e) {
+        return err2(ctx, "auth_audit_log_query", "Failed to query audit log", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_delegations_list")),
+    {
+      title: "List Delegations",
+      description: "Delegations granted by/to the current user.",
+      inputSchema: {
+        limit: z.number().optional().describe("Page size (default 50)"),
+        offset: z.number().optional()
+      }
+    },
+    async ({ limit, offset }) => {
+      try {
+        const d = await ctx.gql.global.request(CURRENT_USER_DELEGATIONS, {
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({
+          delegations: d.currentUserDelegations,
+          total: d.currentUserDelegations.length
+        });
+      } catch (e) {
+        return err2(ctx, "auth_delegations_list", "Failed to list delegations", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_delegations_grant")),
+    {
+      title: "Grant Delegation",
+      description: "Grant a delegation to an app (consent on behalf of a user).",
+      inputSchema: {
+        appId: z.string().describe("App id receiving delegation"),
+        userId: z.string().describe("User to delegate as"),
+        scopes: z.array(z.string()).optional(),
+        workspaceIds: z.array(z.string()).optional(),
+        expiresAt: z.string().optional().describe("ISO expiry")
+      }
+    },
+    async ({ appId, userId, scopes, workspaceIds, expiresAt }) => {
+      try {
+        const input = { appId, userId };
+        if (scopes !== void 0) input.scopes = scopes;
+        if (workspaceIds !== void 0) input.workspaceIds = workspaceIds;
+        if (expiresAt !== void 0) input.expiresAt = expiresAt;
+        const d = await ctx.gql.global.request(
+          GRANT_DELEGATION,
+          { input }
+        );
+        return jsonResult({ status: "success", delegation: d.grantDelegation });
+      } catch (e) {
+        return err2(ctx, "auth_delegations_grant", "Failed to grant delegation", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_delegations_revoke")),
+    {
+      title: "Revoke Delegation",
+      description: "Revoke a delegation by its id.",
+      inputSchema: {
+        id: z.string().describe("Delegation ID"),
+        reason: z.string().optional()
+      }
+    },
+    async ({ id, reason }) => {
+      try {
+        await ctx.gql.global.request(REVOKE_DELEGATION, {
+          id,
+          ...reason !== void 0 ? { reason } : {}
+        });
+        return jsonResult({ status: "success", message: `Delegation ${id} revoked.` });
+      } catch (e) {
+        return err2(ctx, "auth_delegations_revoke", "Failed to revoke delegation", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_list")),
+    {
+      title: "List Apps",
+      description: "List OAuth/system apps owned by the current user.",
+      inputSchema: {
+        limit: z.number().optional(),
+        offset: z.number().optional()
+      }
+    },
+    async ({ limit, offset }) => {
+      try {
+        const d = await ctx.gql.global.request(CURRENT_USER_APPS, {
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({
+          apps: d.currentUserApps.apps,
+          total: d.currentUserApps.apps.length
+        });
+      } catch (e) {
+        return err2(ctx, "auth_apps_list", "Failed to list apps", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_get")),
+    {
+      title: "Get App",
+      description: "Get a single app by its id.",
+      inputSchema: { id: z.string().describe("App ID") }
+    },
+    async ({ id }) => {
+      try {
+        const d = await ctx.gql.global.request(
+          GET_APP,
+          { id }
+        );
+        if (!d.app) {
+          return errorResult(`App ${id} not found.`);
+        }
+        return jsonResult(d.app);
+      } catch (e) {
+        return err2(ctx, "auth_apps_get", "Failed to get app", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_create")),
+    {
+      title: "Create App",
+      description: "Create an OAuth or system app. Returns the app + clientSecret (shown only once).",
+      inputSchema: {
+        name: z.string().describe("App name"),
+        description: z.string().optional(),
+        type: z.enum(["OAUTH", "SYSTEM"]).optional().describe("App type (default OAUTH)"),
+        actorType: z.enum(["USER", "APP", "SERVICE"]).optional().describe("Actor type (default APP)"),
+        redirectUris: z.array(z.string()).optional().describe("OAuth redirect URIs"),
+        scopes: z.array(z.string()).optional()
+      }
+    },
+    async ({ name, description, type, actorType, redirectUris, scopes }) => {
+      try {
+        const input = {
+          name,
+          type: type ?? "OAUTH",
+          actorType: actorType ?? "APP"
+        };
+        if (description !== void 0) input.description = description;
+        if (redirectUris !== void 0) input.redirectUris = redirectUris;
+        if (scopes !== void 0) input.scopes = scopes;
+        const d = await ctx.gql.global.request(CREATE_APP, { input });
+        return jsonResult({
+          status: "success",
+          message: "App created. clientSecret only shown once \u2014 store it now.",
+          app: d.createApp.app,
+          clientSecret: d.createApp.clientSecret
+        });
+      } catch (e) {
+        return err2(ctx, "auth_apps_create", "Failed to create app", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_update")),
+    {
+      title: "Update App",
+      description: "Update an app (name, description, redirect URIs, scopes, status).",
+      inputSchema: {
+        id: z.string().describe("App ID"),
+        name: z.string().optional(),
+        description: z.string().optional(),
+        redirectUris: z.array(z.string()).optional(),
+        scopes: z.array(z.string()).optional(),
+        status: z.string().optional().describe("Status (e.g. ACTIVE, INACTIVE)")
+      }
+    },
+    async ({ id, name, description, redirectUris, scopes, status }) => {
+      try {
+        const input = {};
+        if (name !== void 0) input.name = name;
+        if (description !== void 0) input.description = description;
+        if (redirectUris !== void 0) input.redirectUris = redirectUris;
+        if (scopes !== void 0) input.scopes = scopes;
+        if (status !== void 0) input.status = status.toUpperCase();
+        if (Object.keys(input).length === 0) {
+          return errorResult("No updates specified \u2014 provide at least one field.");
+        }
+        const d = await ctx.gql.global.request(
+          UPDATE_APP,
+          { id, input }
+        );
+        return jsonResult({ status: "success", app: d.updateApp });
+      } catch (e) {
+        return err2(ctx, "auth_apps_update", "Failed to update app", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_deactivate")),
+    {
+      title: "Deactivate App",
+      description: "Deactivate an app by its id (revoke is not currently a separate mutation).",
+      inputSchema: { id: z.string().describe("App ID") }
+    },
+    async ({ id }) => {
+      try {
+        await ctx.gql.global.request(DEACTIVATE_APP, { id });
+        return jsonResult({ status: "success", message: `App ${id} deactivated.` });
+      } catch (e) {
+        return err2(ctx, "auth_apps_deactivate", "Failed to deactivate app", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_apps_authorize_url")),
+    {
+      title: "Build OAuth Authorize URL",
+      description: "Build the OAuth authorization URL for an app (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.",
+      inputSchema: {
+        clientId: z.string().describe("OAuth client id"),
+        redirectUri: z.string().describe("Redirect URI (must be registered)"),
+        scopes: z.array(z.string()).optional(),
+        state: z.string().optional().describe("Opaque state value"),
+        responseType: z.string().optional().describe('Default "code"')
+      }
+    },
+    async ({ clientId, redirectUri, scopes, state, responseType }) => {
+      const cfg = ctx.config.read();
+      const issuer = ctx.env === "prod" ? ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace("/graphql", "") : cfg.globalEndpoint.replace("/graphql", "");
+      const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        response_type: responseType ?? "code"
+      });
+      if (scopes && scopes.length > 0) params.set("scope", scopes.join(" "));
+      if (state) params.set("state", state);
+      const url = `${issuer.replace(/\/$/, "")}/oauth/authorize?${params.toString()}`;
+      return jsonResult({ url });
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sso_get")),
+    {
+      title: "Get SSO Config",
+      description: "Get SSO (SAML/OIDC) configuration for a tenant.",
+      inputSchema: { tenantId: z.string().describe("Tenant ID") }
+    },
+    async ({ tenantId }) => {
+      try {
+        const d = await ctx.gql.global.request(
+          GET_SSO_CONFIG,
+          { tenantId }
+        );
+        return jsonResult(d.getSSOConfig);
+      } catch (e) {
+        return err2(ctx, "auth_sso_get", "Failed to get SSO config", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sso_configure")),
+    {
+      title: "Configure SSO",
+      description: "Save (upsert) SSO configuration for a tenant.",
+      inputSchema: {
+        tenantId: z.string().describe("Tenant ID"),
+        entityId: z.string().describe("SAML EntityID / OIDC issuer"),
+        ssoUrl: z.string().describe("SSO endpoint URL"),
+        sloUrl: z.string().optional().describe("SLO endpoint URL"),
+        certificate: z.string().optional().describe("X.509 certificate PEM"),
+        enabled: z.boolean().optional().describe("Enable after save (default false)")
+      }
+    },
+    async ({ tenantId, entityId, ssoUrl, sloUrl, certificate, enabled }) => {
+      try {
+        const input = {
+          entityId,
+          ssoUrl,
+          enabled: enabled ?? false
+        };
+        if (sloUrl !== void 0) input.sloUrl = sloUrl;
+        if (certificate !== void 0) input.certificate = certificate;
+        const d = await ctx.gql.global.request(
+          SAVE_SSO_CONFIG,
+          { tenantId, input }
+        );
+        return jsonResult({ status: "success", config: d.saveSSOConfig });
+      } catch (e) {
+        return err2(ctx, "auth_sso_configure", "Failed to save SSO config", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sso_test")),
+    {
+      title: "Test SSO",
+      description: "Build the SSO test login URL for a tenant. Returns the URL to open in a browser; this tool does not perform any server call.",
+      inputSchema: { tenantId: z.string().describe("Tenant ID") }
+    },
+    async ({ tenantId }) => {
+      const cfg = ctx.config.read();
+      const issuer = ctx.env === "prod" ? ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace("/graphql", "") : cfg.globalEndpoint.replace("/graphql", "");
+      const url = `${issuer.replace(/\/$/, "")}/sso/${encodeURIComponent(tenantId)}/test`;
+      return jsonResult({ url, message: "Open this URL in a browser to test SSO." });
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_sso_delete")),
+    {
+      title: "Delete SSO Config",
+      description: "Delete SSO configuration for a tenant.",
+      inputSchema: { tenantId: z.string().describe("Tenant ID") }
+    },
+    async ({ tenantId }) => {
+      try {
+        await ctx.gql.global.request(DELETE_SSO_CONFIG, { tenantId });
+        return jsonResult({ status: "success", message: `SSO config for ${tenantId} deleted.` });
+      } catch (e) {
+        return err2(ctx, "auth_sso_delete", "Failed to delete SSO config", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_users_list")),
+    {
+      title: "List Users (admin)",
+      description: "List users with optional filters. Requires admin permission.",
+      inputSchema: {
+        email: z.string().optional(),
+        username: z.string().optional(),
+        role: z.string().optional(),
+        status: z.string().optional(),
+        search: z.string().optional(),
+        limit: z.number().optional(),
+        offset: z.number().optional()
+      }
+    },
+    async ({ email, username, role, status, search, limit, offset }) => {
+      try {
+        const filter = {};
+        if (email !== void 0) filter.email = email;
+        if (username !== void 0) filter.username = username;
+        if (role !== void 0) filter.role = role.toUpperCase();
+        if (status !== void 0) filter.status = status.toUpperCase();
+        if (search !== void 0) filter.search = search;
+        const d = await ctx.gql.global.request(LIST_USERS, {
+          filter: Object.keys(filter).length > 0 ? filter : void 0,
+          pagination: { limit: limit ?? 50, offset: offset ?? 0 }
+        });
+        return jsonResult({
+          users: d.users.users,
+          totalCount: d.users.totalCount,
+          hasMore: d.users.hasMore
+        });
+      } catch (e) {
+        return err2(ctx, "auth_users_list", "Failed to list users", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_users_get")),
+    {
+      title: "Get User (admin)",
+      description: "Get a user by id. Requires admin permission.",
+      inputSchema: { id: z.string().describe("User ID") }
+    },
+    async ({ id }) => {
+      try {
+        const d = await ctx.gql.global.request(GET_USER, { id });
+        if (!d.user) {
+          return errorResult(`User ${id} not found.`);
+        }
+        return jsonResult(d.user);
+      } catch (e) {
+        return err2(ctx, "auth_users_get", "Failed to get user", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_users_invite")),
+    {
+      title: "Invite User (admin)",
+      description: "Send an invitation email to a new user.",
+      inputSchema: {
+        email: z.string().describe("Invitee email"),
+        role: z.string().optional().describe("Role to assign on accept"),
+        firstName: z.string().optional(),
+        lastName: z.string().optional(),
+        workspaceIds: z.array(z.string()).optional()
+      }
+    },
+    async ({ email, role, firstName, lastName, workspaceIds }) => {
+      try {
+        const input = { email };
+        if (role !== void 0) input.role = role.toUpperCase();
+        if (firstName !== void 0) input.firstName = firstName;
+        if (lastName !== void 0) input.lastName = lastName;
+        if (workspaceIds !== void 0) input.workspaceIds = workspaceIds;
+        const d = await ctx.gql.global.request(
+          INVITE_USER,
+          { input }
+        );
+        return jsonResult({ status: "success", invitation: d.inviteUser });
+      } catch (e) {
+        return err2(ctx, "auth_users_invite", "Failed to invite user", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_users_update")),
+    {
+      title: "Update User (admin)",
+      description: "Update a user (admin). Pass any subset of mutable fields.",
+      inputSchema: {
+        id: z.string().describe("User ID"),
+        firstName: z.string().optional(),
+        lastName: z.string().optional(),
+        username: z.string().optional(),
+        phoneNumber: z.string().optional(),
+        role: z.string().optional(),
+        status: z.string().optional(),
+        emailVerified: z.boolean().optional()
+      }
+    },
+    async ({ id, firstName, lastName, username, phoneNumber, role, status, emailVerified }) => {
+      try {
+        const input = {};
+        if (firstName !== void 0) input.firstName = firstName;
+        if (lastName !== void 0) input.lastName = lastName;
+        if (username !== void 0) input.username = username;
+        if (phoneNumber !== void 0) input.phoneNumber = phoneNumber;
+        if (role !== void 0) input.role = role.toUpperCase();
+        if (status !== void 0) input.status = status.toUpperCase();
+        if (emailVerified !== void 0) input.emailVerified = emailVerified;
+        if (Object.keys(input).length === 0) {
+          return errorResult("No updates specified \u2014 provide at least one field.");
+        }
+        const d = await ctx.gql.global.request(UPDATE_USER, {
+          id,
+          input
+        });
+        return jsonResult({ status: "success", user: d.updateUser });
+      } catch (e) {
+        return err2(ctx, "auth_users_update", "Failed to update user", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_security_summary")),
+    {
+      title: "Account Security Summary",
+      description: "One-shot account security overview: profile, MFA methods, active sessions, recent audit log, API keys, delegations.",
+      inputSchema: {
+        recentLimit: z.number().optional().describe("How many recent audit events / sessions to include (default 10)")
+      }
+    },
+    async ({ recentLimit }) => {
+      const limit = recentLimit ?? 10;
+      const pagination = { limit, offset: 0 };
+      const summary = {};
+      try {
+        const profile = await ctx.gql.global.request(CURRENT_USER).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.profile = profile;
+        const mfa = await ctx.gql.global.request(CURRENT_USER_MFA_METHODS, { pagination }).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.mfa = mfa;
+        const sessions = await ctx.gql.global.request(ACTIVE_SESSIONS, {
+          pagination
+        }).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.sessions = sessions;
+        const audit = await ctx.gql.global.request(AUTH_AUDIT_LOGS, {
+          pagination
+        }).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.auditLog = audit;
+        const keys = await ctx.gql.global.request(MY_API_KEYS, {
+          pagination
+        }).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.apiKeys = keys;
+        const delegations = await ctx.gql.global.request(CURRENT_USER_DELEGATIONS, { pagination }).catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));
+        summary.delegations = delegations;
+        return jsonResult(summary);
+      } catch (e) {
+        return err2(ctx, "auth_security_summary", "Failed to build security summary", e);
+      }
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_register_get_url")),
+    {
+      title: "Build Registration URL",
+      description: "Build the registration URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.",
+      inputSchema: {
+        email: z.string().optional().describe("Pre-fill the email field")
+      }
+    },
+    async ({ email }) => {
+      const cfg = ctx.config.read();
+      const issuer = ctx.env === "prod" ? ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace("/graphql", "") : cfg.globalEndpoint.replace("/graphql", "");
+      const params = new URLSearchParams();
+      if (email) params.set("email", email);
+      const qs = params.toString();
+      const url = `${issuer.replace(/\/$/, "")}/register${qs ? `?${qs}` : ""}`;
+      return jsonResult({ url });
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_reset_password_get_url")),
+    {
+      title: "Build Password Reset URL",
+      description: "Build the password reset URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.",
+      inputSchema: {
+        email: z.string().optional().describe("Pre-fill the email field")
+      }
+    },
+    async ({ email }) => {
+      const cfg = ctx.config.read();
+      const issuer = ctx.env === "prod" ? ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace("/graphql", "") : cfg.globalEndpoint.replace("/graphql", "");
+      const params = new URLSearchParams();
+      if (email) params.set("email", email);
+      const qs = params.toString();
+      const url = `${issuer.replace(/\/$/, "")}/reset-password${qs ? `?${qs}` : ""}`;
+      return jsonResult({ url });
+    }
+  );
+  server.registerTool(
+    track(mcpToolName(ctx.productName, "auth_magic_link_get_url")),
+    {
+      title: "Build Magic-Link URL",
+      description: "Build the magic-link login URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.",
+      inputSchema: {
+        email: z.string().describe("Email to send the magic link to")
+      }
+    },
+    async ({ email }) => {
+      const cfg = ctx.config.read();
+      const issuer = ctx.env === "prod" ? ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace("/graphql", "") : cfg.globalEndpoint.replace("/graphql", "");
+      const params = new URLSearchParams({ email });
+      const url = `${issuer.replace(/\/$/, "")}/magic-link?${params.toString()}`;
+      return jsonResult({ url });
+    }
+  );
+}
 
 // src/modules/auth/index.ts
 var authModule = {
@@ -437,6 +1463,7 @@ var authModule = {
     };
     registerAuthTools(server, ctx, track);
     registerAuthMoreTools(server, ctx, track);
+    registerAuthExtraTools(server, ctx, track);
     return { tools, resources: [], prompts: [] };
   }
 };