@c1m-public/platform-auth 0.13.0 → 0.14.0

package/README.md

@@ -11,7 +11,6 @@ need — the boundary is the subpath.
 ```
 .               session: token reads, handoff, proxy gate, refresh   (Web Request/Response)
 ./next          session, server-only guard                            (Next route handlers)
-./mcp-tokens    self-service MCP PAT lifecycle                        (framework-neutral)
 ./service-accounts  operator-owned service accounts and credentials   (framework-neutral)
 ./access        authorization: snapshot, keys, predicates             (framework-neutral)
 ./access/next   access loader: require / forbidden / invalidate       (Next, server-only)
@@ -21,23 +20,6 @@ need — the boundary is the subpath.
 `next` and `react` are **optional** peer dependencies: a BFF that only reads
 sessions never needs them.
 
-## `./mcp-tokens` — MCP personal access tokens
-
-`createMCPTokenClient` lists, mints, and revokes the signed-in platform user's
-own MCP tokens under `/api/v1/platform/auth/me/mcp-tokens`. The client resolves
-the bearer on every request, never retries mint or revoke, and emits bounded
-observations containing operation metadata but no URL, bearer, or PAT material.
-
-The subpath also exports `MCP_ACCESS_PERMISSION`,
-`MCP_TOKENS_MANAGE_PERMISSION`, `MCP_TOOL_PERMISSIONS`,
-`MCP_WILDCARD_TOOL_PERMISSIONS`, the request/response types, and the structural
-`MCPTokenAPIError` predicate. The permission ceiling `["*"]` follows future
-read-only tool permissions; mutating permissions must always be named
-explicitly. A minted `raw_token` is a one-time value: callers must keep it out
-of URLs, logs, storage, and telemetry. A `recent_authentication_required` API
-error is a step-up challenge, not an expired session; send the user through the
-host application's re-authentication path before retrying the mint.
-
 ## `./service-accounts` — operator service accounts
 
 `createServiceAccountClient` manages the operator-owned service accounts under

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CPjLkXA-.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';

package/dist/access/index.js

@@ -20,7 +20,6 @@ var PLATFORM_PERMISSIONS = [
   "platform.docs.manage",
   "platform.docs.view",
   "platform.mcp.access",
-  "platform.mcp.tokens.manage",
   "platform.observability.manage",
   "platform.observability.view",
   "platform.offboarding.view",
@@ -49,6 +48,7 @@ var DASH_PERMISSIONS = [
   "dash.customers.manage",
   "dash.domains.manage",
   "dash.domains.view",
+  "dash.mcp.access",
   "dash.members.manage",
   "dash.ownership.transfer",
   "dash.plans.manage",

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-CPjLkXA-.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CPjLkXA-.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-C-wuZVM9.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-C-wuZVM9.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -276,7 +276,6 @@ var PLATFORM_PERMISSIONS = [
   "platform.docs.manage",
   "platform.docs.view",
   "platform.mcp.access",
-  "platform.mcp.tokens.manage",
   "platform.observability.manage",
   "platform.observability.view",
   "platform.offboarding.view",
@@ -305,6 +304,7 @@ var DASH_PERMISSIONS = [
   "dash.customers.manage",
   "dash.domains.manage",
   "dash.domains.view",
+  "dash.mcp.access",
   "dash.members.manage",
   "dash.ownership.transfer",
   "dash.plans.manage",

package/dist/{index-CPjLkXA-.d.ts → index-C-wuZVM9.d.ts}

@@ -1,8 +1,8 @@
 /** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.mcp.tokens.manage", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
+declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.service_accounts.manage", "platform.service_accounts.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.domains.view", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
+declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.domains.view", "dash.mcp.access", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
 type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
 /** Membership-mirrored dash role bundles (grant keys at dash scope). */
 declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];

package/dist/service-accounts.d.ts

@@ -77,10 +77,13 @@ interface ReplaceServiceAccountGrantsInput {
     expected_version: number;
     reason: string;
 }
+type ServiceAccountCredentialTemplate = "read_only" | "full" | "custom";
 interface MintServiceAccountCredentialInput {
     name: string;
     audience: ServiceAccountAudience;
-    operation_ids: string[];
+    /** Authority template; `custom` names the permissions to carry. Operations are derived server-side. */
+    template: ServiceAccountCredentialTemplate;
+    permissions?: string[];
     dash_ids: string[];
     expires_in_days: number;
     expected_version: number;
@@ -143,4 +146,4 @@ declare function createServiceAccountClient(options: CreateServiceAccountClientO
 };
 type ServiceAccountClient = ReturnType<typeof createServiceAccountClient>;
 
-export { type CreateServiceAccountClientOptions, type CreateServiceAccountInput, type MintServiceAccountCredentialInput, type MintServiceAccountCredentialResponse, type ReplaceServiceAccountGrantsInput, type RevokeServiceAccountCredentialInput, SERVICE_ACCOUNTS_MANAGE_PERMISSION, SERVICE_ACCOUNTS_VIEW_PERMISSION, ServiceAccountAPIError, type ServiceAccountAudience, type ServiceAccountClient, type ServiceAccountCredential, type ServiceAccountCredentialPage, type ServiceAccountEnvelope, type ServiceAccountGrant, type ServiceAccountGrantInput, type ServiceAccountGrantPage, type ServiceAccountGrantScope, type ServiceAccountListParams, type ServiceAccountOperation, type ServiceAccountPage, type ServiceAccountRequestObservation, type ServiceAccountRequestOutcome, type ServiceAccountView, type UpdateServiceAccountInput, createServiceAccountClient, isServiceAccountAPIError };
+export { type CreateServiceAccountClientOptions, type CreateServiceAccountInput, type MintServiceAccountCredentialInput, type MintServiceAccountCredentialResponse, type ReplaceServiceAccountGrantsInput, type RevokeServiceAccountCredentialInput, SERVICE_ACCOUNTS_MANAGE_PERMISSION, SERVICE_ACCOUNTS_VIEW_PERMISSION, ServiceAccountAPIError, type ServiceAccountAudience, type ServiceAccountClient, type ServiceAccountCredential, type ServiceAccountCredentialPage, type ServiceAccountCredentialTemplate, type ServiceAccountEnvelope, type ServiceAccountGrant, type ServiceAccountGrantInput, type ServiceAccountGrantPage, type ServiceAccountGrantScope, type ServiceAccountListParams, type ServiceAccountOperation, type ServiceAccountPage, type ServiceAccountRequestObservation, type ServiceAccountRequestOutcome, type ServiceAccountView, type UpdateServiceAccountInput, createServiceAccountClient, isServiceAccountAPIError };

package/dist/service-accounts.js

@@ -149,7 +149,6 @@ function isServiceAccountAPIError(error) {
 var basePath = "/api/v1/platform/identity/service-accounts";
 var uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var credentialIDPattern = /^[0-9a-f]{32}$/;
-var operationIDPattern = /^[a-z][a-z0-9]*(?:\.[a-z][a-z0-9]*)+$/;
 var timestampPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
 var secretPattern = /^mml_sa_([0-9a-f]{32})_([0-9a-f]{64})$/;
 var configurationError = (message) => new Error(message);
@@ -298,9 +297,12 @@ function mintInput(value) {
   if (audience !== "platform" && !audience.startsWith("dash:")) {
     throw configurationError("audience must be platform or dash:<dash_id>");
   }
-  const operationIDs = [...new Set(value.operation_ids.map((item) => requiredString(item, "operation_id", configurationError)))];
-  if (operationIDs.length < 1 || operationIDs.length > 64 || operationIDs.some((item) => !operationIDPattern.test(item))) {
-    throw configurationError("operation_ids must contain 1 to 64 stable operation ids");
+  if (value.template !== "read_only" && value.template !== "full" && value.template !== "custom") {
+    throw configurationError("template must be read_only, full or custom");
+  }
+  const permissions = [...new Set((value.permissions ?? []).map((item) => requiredString(item, "permission", configurationError)))];
+  if (value.template === "custom" && (permissions.length < 1 || permissions.length > 64)) {
+    throw configurationError("a custom template must name 1 to 64 permissions");
   }
   const dashIDs = [...new Set(value.dash_ids.map((item) => requiredString(item, "dash_id", configurationError)))];
   if (dashIDs.length > 32 || dashIDs.includes("*")) throw configurationError("dash_ids must name at most 32 explicit Dashes");
@@ -316,7 +318,8 @@ function mintInput(value) {
   return {
     name,
     audience,
-    operation_ids: operationIDs,
+    template: value.template,
+    ...value.template === "custom" ? { permissions } : {},
     dash_ids: dashIDs,
     expires_in_days: value.expires_in_days,
     expected_version: version(value.expected_version),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -20,10 +20,6 @@
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
     },
-    "./mcp-tokens": {
-      "types": "./dist/mcp-tokens.d.ts",
-      "default": "./dist/mcp-tokens.js"
-    },
     "./service-accounts": {
       "types": "./dist/service-accounts.d.ts",
       "default": "./dist/service-accounts.js"

package/dist/mcp-tokens.d.ts

@@ -1,79 +0,0 @@
-declare const MCP_TOOL_PERMISSIONS: readonly ["dash.domains.view", "dash.workspaces.view", "platform.audit.view", "platform.ops.manage", "platform.ops.view", "platform.tenants.view"];
-declare const MCP_WILDCARD_TOOL_PERMISSIONS: readonly ["dash.domains.view", "dash.workspaces.view", "platform.audit.view", "platform.ops.view", "platform.tenants.view"];
-type MCPToolPermission = (typeof MCP_TOOL_PERMISSIONS)[number];
-
-declare const MCP_ACCESS_PERMISSION: "platform.mcp.access";
-declare const MCP_TOKENS_MANAGE_PERMISSION: "platform.mcp.tokens.manage";
-declare const MCP_PERMISSION_WILDCARD: "*";
-type MCPTokenPermission = typeof MCP_ACCESS_PERMISSION | typeof MCP_PERMISSION_WILDCARD | MCPToolPermission;
-type MCPTokenOperation = "platform_user.auth.mcp_tokens.list" | "platform_user.auth.mcp_tokens.mint" | "platform_user.auth.mcp_tokens.revoke";
-type MCPTokenRequestOutcome = "success" | "api_error" | "network_error" | "timeout" | "invalid_response" | "cancelled";
-interface MCPTokenView {
-    token_id: string;
-    name: string;
-    /** Recorded ceilings may include permissions added by a newer server. */
-    permissions: string[];
-    app_allowlist: string[];
-    created_at: string;
-    expires_at: string;
-    last_used_at?: string;
-    revoked_at?: string;
-}
-interface MCPTokenPage {
-    items: MCPTokenView[];
-    next_cursor?: string;
-    has_more: boolean;
-    mcp_enabled: boolean;
-}
-interface MCPTokenListParams {
-    cursor?: string;
-    limit?: number;
-}
-interface MintMCPTokenInput {
-    name: string;
-    expires_in_days: number;
-    permissions: MCPTokenPermission[];
-    app_allowlist: string[];
-}
-interface MintMCPTokenResponse {
-    token: MCPTokenView;
-    raw_token: string;
-}
-interface MCPTokenRequestObservation {
-    operation: MCPTokenOperation;
-    method: string;
-    outcome: MCPTokenRequestOutcome;
-    status: number;
-    requestId: string;
-    durationMs: number;
-    attempts: number;
-}
-interface CreateMCPTokenClientOptions {
-    baseUrl: string;
-    getAccessToken: () => Promise<string | null | undefined> | string | null | undefined;
-    getHeaders?: () => Promise<HeadersInit | undefined> | HeadersInit | undefined;
-    fetch?: typeof globalThis.fetch;
-    /** Per attempt (default 10000). */
-    timeoutMs?: number;
-    /** Additional attempts for GET only (default 1). Mint and revoke are never retried. */
-    retryAttempts?: number;
-    /** Cap on one retry delay (default 2000). */
-    maxRetryDelayMs?: number;
-    observe?: (event: MCPTokenRequestObservation) => void;
-    signal?: AbortSignal;
-}
-declare class MCPTokenAPIError extends Error {
-    readonly status: number;
-    readonly code: string;
-    readonly requestId: string;
-    constructor(message: string, status: number, code: string, requestId: string);
-}
-declare function isMCPTokenAPIError(error: unknown): error is MCPTokenAPIError;
-declare function createMCPTokenClient(options: CreateMCPTokenClientOptions): {
-    readonly list: (params?: MCPTokenListParams) => Promise<MCPTokenPage>;
-    readonly mint: (input: MintMCPTokenInput) => Promise<MintMCPTokenResponse>;
-    readonly revoke: (tokenId: string) => Promise<void>;
-};
-type MCPTokenClient = ReturnType<typeof createMCPTokenClient>;
-
-export { type CreateMCPTokenClientOptions, MCPTokenAPIError, type MCPTokenClient, type MCPTokenListParams, type MCPTokenOperation, type MCPTokenPage, type MCPTokenPermission, type MCPTokenRequestObservation, type MCPTokenRequestOutcome, type MCPTokenView, type MCPToolPermission, MCP_ACCESS_PERMISSION, MCP_PERMISSION_WILDCARD, MCP_TOKENS_MANAGE_PERMISSION, MCP_TOOL_PERMISSIONS, MCP_WILDCARD_TOOL_PERMISSIONS, type MintMCPTokenInput, type MintMCPTokenResponse, createMCPTokenClient, isMCPTokenAPIError };

package/dist/mcp-tokens.js

@@ -1,357 +0,0 @@
-// ../transport/src/index.ts
-var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
-var TransportError = class extends Error {
-  constructor(failure) {
-    super(failure.message || failure.outcome);
-    this.failure = failure;
-    this.name = "TransportError";
-  }
-  failure;
-};
-function isTransportError(error) {
-  return error instanceof TransportError || typeof error === "object" && error !== null && error.name === "TransportError";
-}
-function positiveNumber(value, label, fail) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw fail(`${label} must be a positive finite number`);
-  return value;
-}
-function nonNegativeInteger(value, label, fail) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw fail(`${label} must be a non-negative safe integer`);
-  return value;
-}
-function requiredString(value, label, fail) {
-  const normalized = typeof value === "string" ? value.trim() : "";
-  if (!normalized) throw fail(`${label} is required`);
-  return normalized;
-}
-function backoffDelay(attempt, maxDelayMs) {
-  const base = Math.min(250 * 2 ** Math.max(attempt, 0), maxDelayMs);
-  return Math.floor(Math.random() * base);
-}
-function retryDelay(response, attempt, maxDelayMs) {
-  const value = response.headers.get("Retry-After");
-  if (!value) return backoffDelay(attempt, maxDelayMs);
-  const seconds = Number(value);
-  if (Number.isFinite(seconds)) return Math.min(Math.max(seconds * 1e3, 0), maxDelayMs);
-  const date = Date.parse(value);
-  return Number.isNaN(date) ? backoffDelay(attempt, maxDelayMs) : Math.min(Math.max(date - Date.now(), 0), maxDelayMs);
-}
-function wait(ms) {
-  return ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms));
-}
-function combineSignals(...signals) {
-  const active = signals.filter((signal) => Boolean(signal));
-  if (active.length === 0) return void 0;
-  if (active.length === 1) return active[0];
-  return AbortSignal.any(active);
-}
-function isRetryableRequest(method, headers, retry) {
-  if (method === "GET") return true;
-  return retry.idempotentWrites === true && headers.has("Idempotency-Key");
-}
-async function performRequest(transport, url, init, observe, decode) {
-  const method = (init.method ?? "GET").toUpperCase();
-  const headers = new Headers(init.headers);
-  const startedAt = Date.now();
-  const retryable = isRetryableRequest(method, headers, transport.retry);
-  const maxAttempts = retryable ? transport.retry.attempts : 0;
-  let attempts = 0;
-  let status = 0;
-  let requestId = "";
-  let outcome = "network_error";
-  const fail = (failure) => {
-    outcome = failure.outcome;
-    throw new TransportError({ requestId, ...failure });
-  };
-  try {
-    let response;
-    for (let attempt = 0; attempt <= maxAttempts; attempt += 1) {
-      attempts = attempt + 1;
-      const controller = new AbortController();
-      const timeout = setTimeout(() => controller.abort(), transport.timeoutMs);
-      try {
-        response = await transport.fetch(url, {
-          ...init,
-          method,
-          headers,
-          signal: combineSignals(transport.signal, init.signal, controller.signal)
-        });
-      } catch {
-        if (controller.signal.aborted) fail({ outcome: "timeout", status: 0, code: "", message: "" });
-        if (transport.signal?.aborted || init.signal?.aborted) fail({ outcome: "cancelled", status: 0, code: "", message: "" });
-        if (attempt < maxAttempts) {
-          await wait(backoffDelay(attempt, transport.retry.maxDelayMs));
-          continue;
-        }
-        fail({ outcome: "network_error", status: 0, code: "", message: "" });
-      } finally {
-        clearTimeout(timeout);
-      }
-      if (!RETRYABLE_STATUSES.has(response.status) || attempt === maxAttempts) break;
-      await wait(retryDelay(response, attempt, transport.retry.maxDelayMs));
-    }
-    if (!response) return fail({ outcome: "network_error", status: 0, code: "", message: "" });
-    status = response.status;
-    requestId = response.headers.get("X-Request-ID") ?? "";
-    if (!response.ok) {
-      const envelope = await response.json().catch(() => ({}));
-      if (typeof envelope.request_id === "string") requestId = envelope.request_id;
-      return fail({
-        outcome: "api_error",
-        status,
-        code: typeof envelope.code === "string" ? envelope.code : "",
-        message: typeof envelope.message === "string" ? envelope.message : "",
-        requestId
-      });
-    }
-    let payload;
-    try {
-      if (status === 204) {
-        payload = void 0;
-      } else {
-        const text = await response.text();
-        const parsed = text ? JSON.parse(text) : void 0;
-        payload = decode ? decode(parsed) : parsed;
-      }
-    } catch {
-      return fail({ outcome: "invalid_response", status, code: "", message: "", requestId });
-    }
-    outcome = "success";
-    return { payload, status, requestId };
-  } finally {
-    if (observe) {
-      try {
-        observe({ method, outcome, status, requestId, durationMs: Math.max(0, Date.now() - startedAt), attempts });
-      } catch {
-      }
-    }
-  }
-}
-
-// src/access/generated/mcp-tools.ts
-var MCP_TOOL_PERMISSIONS = [
-  "dash.domains.view",
-  "dash.workspaces.view",
-  "platform.audit.view",
-  "platform.ops.manage",
-  "platform.ops.view",
-  "platform.tenants.view"
-];
-var MCP_WILDCARD_TOOL_PERMISSIONS = [
-  "dash.domains.view",
-  "dash.workspaces.view",
-  "platform.audit.view",
-  "platform.ops.view",
-  "platform.tenants.view"
-];
-
-// src/mcp-tokens.ts
-var MCP_ACCESS_PERMISSION = "platform.mcp.access";
-var MCP_TOKENS_MANAGE_PERMISSION = "platform.mcp.tokens.manage";
-var MCP_PERMISSION_WILDCARD = "*";
-var MCPTokenAPIError = class extends Error {
-  constructor(message, status, code, requestId) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.requestId = requestId;
-    this.name = "MCPTokenAPIError";
-  }
-  status;
-  code;
-  requestId;
-};
-function isMCPTokenAPIError(error) {
-  return error instanceof MCPTokenAPIError || typeof error === "object" && error !== null && error.name === "MCPTokenAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
-}
-var configurationError = (message) => new Error(message);
-var basePath = "/api/v1/platform/auth/me/mcp-tokens";
-var tokenIDPattern = /^[0-9a-f]{32}$/;
-var rawTokenPattern = /^sd_pat_([0-9a-f]{32})_[A-Za-z0-9_-]{43}$/;
-var timestampPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
-function invalidResponse() {
-  throw new Error("invalid MCP token response");
-}
-function objectValue(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) invalidResponse();
-  return value;
-}
-function responseString(value, options = {}) {
-  if (value === void 0 && options.optional) return void 0;
-  if (typeof value !== "string" || value.length === 0) invalidResponse();
-  if (options.tokenID && !tokenIDPattern.test(value)) invalidResponse();
-  if (options.timestamp && (!timestampPattern.test(value) || !Number.isFinite(Date.parse(value)))) invalidResponse();
-  return value;
-}
-function responseStrings(value) {
-  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) invalidResponse();
-  return [...value];
-}
-function parseMCPTokenView(value) {
-  const item = objectValue(value);
-  return {
-    token_id: responseString(item.token_id, { tokenID: true }),
-    name: responseString(item.name),
-    permissions: responseStrings(item.permissions),
-    app_allowlist: responseStrings(item.app_allowlist),
-    created_at: responseString(item.created_at, { timestamp: true }),
-    expires_at: responseString(item.expires_at, { timestamp: true }),
-    last_used_at: responseString(item.last_used_at, { optional: true, timestamp: true }),
-    revoked_at: responseString(item.revoked_at, { optional: true, timestamp: true })
-  };
-}
-function parseMCPTokenPage(value) {
-  const page = objectValue(value);
-  if (!Array.isArray(page.items) || typeof page.has_more !== "boolean" || typeof page.mcp_enabled !== "boolean") invalidResponse();
-  const nextCursor = responseString(page.next_cursor, { optional: true });
-  if (Boolean(nextCursor) !== page.has_more) invalidResponse();
-  return {
-    items: page.items.map(parseMCPTokenView),
-    next_cursor: nextCursor,
-    has_more: page.has_more,
-    mcp_enabled: page.mcp_enabled
-  };
-}
-function parseMintMCPTokenResponse(value) {
-  const response = objectValue(value);
-  const token = parseMCPTokenView(response.token);
-  const rawToken = responseString(response.raw_token);
-  const match = rawToken.match(rawTokenPattern);
-  if (!match || match[1] !== token.token_id) invalidResponse();
-  return { token, raw_token: rawToken };
-}
-function normalizedStrings(values, label, max) {
-  if (!Array.isArray(values)) throw configurationError(`${label} must be an array`);
-  const normalized = [...new Set(values.map((value) => requiredString(value, label, configurationError)))];
-  if (normalized.length > max) throw configurationError(`${label} must contain at most ${max} entries`);
-  return normalized;
-}
-function mintInput(value) {
-  const name = requiredString(value.name, "name", configurationError);
-  if (name.length > 64) throw configurationError("name must be 64 characters or fewer");
-  if (!Number.isSafeInteger(value.expires_in_days) || value.expires_in_days < 1 || value.expires_in_days > 90) {
-    throw configurationError("expires_in_days must be an integer from 1 to 90");
-  }
-  const permissions = normalizedStrings(value.permissions, "permissions", 32);
-  if (permissions.includes(MCP_PERMISSION_WILDCARD)) {
-    if (permissions.length !== 1) {
-      throw configurationError('permissions "*" must be the only entry');
-    }
-  } else {
-    if (!permissions.includes(MCP_ACCESS_PERMISSION)) throw configurationError(`permissions must include ${MCP_ACCESS_PERMISSION}`);
-    if (permissions.length < 2) throw configurationError("permissions must include at least one MCP tool permission");
-    const allowedPermissions = /* @__PURE__ */ new Set([MCP_ACCESS_PERMISSION, ...MCP_TOOL_PERMISSIONS]);
-    if (permissions.some((permission) => !allowedPermissions.has(permission))) {
-      throw configurationError("permissions contains a key that is not available to MCP tools");
-    }
-  }
-  const appAllowlist = normalizedStrings(value.app_allowlist, "app_allowlist", 32);
-  if (appAllowlist.includes("*") && appAllowlist.length !== 1) {
-    throw configurationError('app_allowlist "*" must be the only entry');
-  }
-  return {
-    name,
-    expires_in_days: value.expires_in_days,
-    permissions,
-    app_allowlist: appAllowlist
-  };
-}
-function tokenIDInput(value) {
-  const tokenID = requiredString(value, "tokenId", configurationError);
-  if (!tokenIDPattern.test(tokenID)) throw configurationError("tokenId must be a 32-character hexadecimal MCP token id");
-  return tokenID;
-}
-function createMCPTokenClient(options) {
-  const baseUrl = requiredString(options.baseUrl, "baseUrl", configurationError).replace(/\/+$/, "");
-  const transport = {
-    fetch: (input, init) => (options.fetch ?? globalThis.fetch)(input, init),
-    timeoutMs: positiveNumber(options.timeoutMs ?? 1e4, "timeoutMs", configurationError),
-    retry: {
-      attempts: nonNegativeInteger(options.retryAttempts ?? 1, "retryAttempts", configurationError),
-      maxDelayMs: positiveNumber(options.maxRetryDelayMs ?? 2e3, "maxRetryDelayMs", configurationError),
-      idempotentWrites: false
-    },
-    signal: options.signal
-  };
-  async function request(operation, path, decode, init = {}) {
-    const method = (init.method ?? "GET").toUpperCase();
-    const report = options.observe && ((event) => {
-      options.observe?.({ operation, ...event });
-    });
-    let headers;
-    try {
-      const accessToken = requiredString(await options.getAccessToken() ?? "", "access token", configurationError);
-      headers = new Headers(await options.getHeaders?.());
-      new Headers(init.headers).forEach((value, key) => headers.set(key, value));
-      headers.set("Authorization", `Bearer ${accessToken}`);
-      headers.set("Accept", "application/json");
-      if (init.body !== void 0) headers.set("Content-Type", "application/json");
-    } catch (error) {
-      try {
-        report?.({ method, outcome: "network_error", status: 0, requestId: "", durationMs: 0, attempts: 0 });
-      } catch {
-      }
-      throw error;
-    }
-    try {
-      const result = await performRequest(
-        transport,
-        `${baseUrl}${path}`,
-        { ...init, method, headers, cache: "no-store" },
-        report,
-        decode
-      );
-      return result.payload;
-    } catch (error) {
-      if (!isTransportError(error)) throw error;
-      const { outcome, status, code, message, requestId } = error.failure;
-      switch (outcome) {
-        case "timeout":
-          throw new MCPTokenAPIError("MCP token request timed out", 0, "mcp_token_request_timeout", "");
-        case "cancelled":
-          throw new MCPTokenAPIError("MCP token request was cancelled", 0, "mcp_token_request_cancelled", "");
-        case "network_error":
-          throw new MCPTokenAPIError("MCP token service is unavailable", 0, "mcp_token_service_unavailable", "");
-        case "invalid_response":
-          throw new MCPTokenAPIError("MCP token service returned an invalid response", status, "mcp_token_invalid_response", requestId);
-        case "api_error":
-          throw new MCPTokenAPIError(message || code || "MCP token request failed", status, code, requestId);
-      }
-    }
-  }
-  return {
-    list(params = {}) {
-      const query = new URLSearchParams();
-      const cursor = params.cursor?.trim();
-      if (cursor) query.set("cursor", cursor);
-      if (params.limit !== void 0) {
-        const limit = positiveNumber(params.limit, "limit", configurationError);
-        if (!Number.isSafeInteger(limit) || limit > 100) throw configurationError("limit must be an integer from 1 to 100");
-        query.set("limit", String(limit));
-      }
-      return request(
-        "platform_user.auth.mcp_tokens.list",
-        `${basePath}${query.size ? `?${query}` : ""}`,
-        parseMCPTokenPage
-      );
-    },
-    mint(input) {
-      return request("platform_user.auth.mcp_tokens.mint", basePath, parseMintMCPTokenResponse, {
-        method: "POST",
-        body: JSON.stringify(mintInput(input))
-      });
-    },
-    revoke(tokenId) {
-      return request(
-        "platform_user.auth.mcp_tokens.revoke",
-        `${basePath}/${tokenIDInput(tokenId)}`,
-        (payload) => {
-          if (payload !== void 0) invalidResponse();
-        },
-        { method: "DELETE" }
-      );
-    }
-  };
-}
-
-export { MCPTokenAPIError, MCP_ACCESS_PERMISSION, MCP_PERMISSION_WILDCARD, MCP_TOKENS_MANAGE_PERMISSION, MCP_TOOL_PERMISSIONS, MCP_WILDCARD_TOOL_PERMISSIONS, createMCPTokenClient, isMCPTokenAPIError };