@c1m-public/platform-auth 0.9.2 → 0.11.0

package/README.md

@@ -11,6 +11,7 @@ need — the boundary is the subpath.
 ```
 .               session: token reads, handoff, proxy gate, refresh   (Web Request/Response)
 ./next          session, server-only guard                            (Next route handlers)
+./mcp-tokens    self-service MCP PAT lifecycle                        (framework-neutral)
 ./access        authorization: snapshot, keys, predicates             (framework-neutral)
 ./access/next   access loader: require / forbidden / invalidate       (Next, server-only)
 ./access/react  <Can>, useCan, AccessProvider                         (client)
@@ -19,6 +20,23 @@ need — the boundary is the subpath.
 `next` and `react` are **optional** peer dependencies: a BFF that only reads
 sessions never needs them.
 
+## `./mcp-tokens` — MCP personal access tokens
+
+`createMCPTokenClient` lists, mints, and revokes the signed-in platform user's
+own MCP tokens under `/api/v1/platform/auth/me/mcp-tokens`. The client resolves
+the bearer on every request, never retries mint or revoke, and emits bounded
+observations containing operation metadata but no URL, bearer, or PAT material.
+
+The subpath also exports `MCP_ACCESS_PERMISSION`,
+`MCP_TOKENS_MANAGE_PERMISSION`, `MCP_TOOL_PERMISSIONS`,
+`MCP_WILDCARD_TOOL_PERMISSIONS`, the request/response types, and the structural
+`MCPTokenAPIError` predicate. The permission ceiling `["*"]` follows future
+read-only tool permissions; mutating permissions must always be named
+explicitly. A minted `raw_token` is a one-time value: callers must keep it out
+of URLs, logs, storage, and telemetry. A `recent_authentication_required` API
+error is a step-up challenge, not an expired session; send the user through the
+host application's re-authentication path before retrying the mint.
+
 ## `.` — session
 
 | Export | Purpose |

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-HL6QFIZy.js';

package/dist/access/index.js

@@ -1,5 +1,6 @@
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [
+  "affiliates.enrollments.manage",
   "affiliates.finance.manage",
   "affiliates.partners.manage",
   "affiliates.programmes.manage",
@@ -12,20 +13,25 @@ var PLATFORM_PERMISSIONS = [
   "platform.audit.view",
   "platform.auth.manage",
   "platform.billing.manage",
+  "platform.billing.view",
   "platform.channels.manage",
   "platform.channels.view",
   "platform.config.manage",
   "platform.docs.manage",
   "platform.docs.view",
+  "platform.mcp.access",
+  "platform.mcp.tokens.manage",
   "platform.observability.manage",
   "platform.observability.view",
   "platform.offboarding.view",
   "platform.ops.manage",
+  "platform.ops.view",
   "platform.support.impersonate",
   "platform.support.sessions",
   "platform.tenants.archive",
   "platform.tenants.manage",
   "platform.tenants.restore",
+  "platform.tenants.view",
   "platform.users.deactivate",
   "platform.users.delete",
   "platform.users.invite",
@@ -36,16 +42,20 @@ var PLATFORM_PERMISSIONS = [
 var DASH_PERMISSIONS = [
   "dash.apps.manage",
   "dash.billing.manage",
+  "dash.billing.view",
   "dash.channels.manage",
   "dash.customers.manage",
   "dash.domains.manage",
+  "dash.domains.view",
   "dash.members.manage",
   "dash.ownership.transfer",
   "dash.plans.manage",
+  "dash.plans.view",
   "dash.publish",
   "dash.settings.manage",
   "dash.workspaces.admin",
-  "dash.workspaces.manage"
+  "dash.workspaces.manage",
+  "dash.workspaces.view"
 ];
 var DASH_ROLES = [
   "dash.admin",
@@ -176,20 +186,20 @@ function parseAccessSnapshot(input) {
 }
 
 // src/access/predicates.ts
-function entryCoversApp(entry, saasApp) {
+function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
     case "saas_app":
-      if (saasApp === void 0) return true;
-      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+      if (dashId === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:
       return false;
   }
 }
 function hasPermission(snapshot, key, opts = {}) {
   if (!snapshot.active) return false;
-  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.dashId));
 }
 function hasAnyPermission(snapshot, keys, opts = {}) {
   return keys.some((key) => hasPermission(snapshot, key, opts));
@@ -204,11 +214,11 @@ function hasWorkspacePermission(snapshot, workspaceId, key) {
 }
 function managedDashes(snapshot) {
   if (!snapshot.active) return [];
-  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+  return Object.entries(snapshot.dash_roles).map(([dashId, role]) => ({ dashId, role })).sort((a, b) => a.dashId.localeCompare(b.dashId));
 }
-function dashRole(snapshot, saasApp) {
+function dashRole(snapshot, dashId) {
   if (!snapshot.active) return "";
-  return snapshot.dash_roles[saasApp] ?? "";
+  return snapshot.dash_roles[dashId] ?? "";
 }
 function isPlatformOwner(snapshot) {
   return snapshot.active && snapshot.is_owner;
@@ -229,7 +239,7 @@ function appScopes(snapshot, key) {
 function permissionsFor(snapshot, opts = {}) {
   if (!snapshot.active) return [];
   const keys = /* @__PURE__ */ new Set();
-  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
+  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.dashId)) keys.add(entry.key);
   return [...keys].sort();
 }
 
@@ -256,6 +266,11 @@ function forwardedRequestHeaders(request, init) {
   return applyForwardedClientHeaders(request.headers, new Headers(init));
 }
 
+// src/forwarding.ts
+function forwardedRequestHeaders2(request, init) {
+  return forwardedRequestHeaders(request, init);
+}
+
 // src/internal.ts
 function resolveValue(value) {
   return typeof value === "function" ? value() : value;
@@ -279,7 +294,7 @@ async function timedFetch(url, options = {}) {
 var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
 async function fetchAccessSnapshot(opts) {
   const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
-  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
+  const headers = opts.request ? forwardedRequestHeaders2(opts.request, opts.headers) : new Headers(opts.headers);
   headers.set("Authorization", `Bearer ${opts.accessToken}`);
   headers.set("Accept", "application/json");
   let response;

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-CbsCWtku.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-CbsCWtku.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-HL6QFIZy.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-HL6QFIZy.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -87,6 +87,11 @@ function forwardedRequestHeaders(request, init) {
   return applyForwardedClientHeaders(request.headers, new Headers(init));
 }
 
+// src/forwarding.ts
+function forwardedRequestHeaders2(request, init) {
+  return forwardedRequestHeaders(request, init);
+}
+
 // src/access/snapshot.ts
 var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
 function emptySnapshot(subjectId = "") {
@@ -166,7 +171,7 @@ function parseAccessSnapshot(input) {
 var DEFAULT_ACCESS_ENDPOINT_PATH = "/api/v1/platform/access";
 async function fetchAccessSnapshot(opts) {
   const url = `${resolveValue(opts.apiUrl).replace(/\/$/, "")}${opts.endpointPath ?? DEFAULT_ACCESS_ENDPOINT_PATH}`;
-  const headers = opts.request ? forwardedRequestHeaders(opts.request, opts.headers) : new Headers(opts.headers);
+  const headers = opts.request ? forwardedRequestHeaders2(opts.request, opts.headers) : new Headers(opts.headers);
   headers.set("Authorization", `Bearer ${opts.accessToken}`);
   headers.set("Accept", "application/json");
   let response;
@@ -192,20 +197,20 @@ async function fetchAccessSnapshot(opts) {
 }
 
 // src/access/predicates.ts
-function entryCoversApp(entry, saasApp) {
+function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
     case "saas_app":
-      if (saasApp === void 0) return true;
-      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+      if (dashId === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:
       return false;
   }
 }
 function hasPermission(snapshot, key, opts = {}) {
   if (!snapshot.active) return false;
-  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.dashId));
 }
 function hasAnyPermission(snapshot, keys, opts = {}) {
   return keys.some((key) => hasPermission(snapshot, key, opts));
@@ -220,11 +225,11 @@ function hasWorkspacePermission(snapshot, workspaceId, key) {
 }
 function managedDashes(snapshot) {
   if (!snapshot.active) return [];
-  return Object.entries(snapshot.dash_roles).map(([saasApp, role]) => ({ saasApp, role })).sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+  return Object.entries(snapshot.dash_roles).map(([dashId, role]) => ({ dashId, role })).sort((a, b) => a.dashId.localeCompare(b.dashId));
 }
-function dashRole(snapshot, saasApp) {
+function dashRole(snapshot, dashId) {
   if (!snapshot.active) return "";
-  return snapshot.dash_roles[saasApp] ?? "";
+  return snapshot.dash_roles[dashId] ?? "";
 }
 function isPlatformOwner(snapshot) {
   return snapshot.active && snapshot.is_owner;
@@ -245,12 +250,13 @@ function appScopes(snapshot, key) {
 function permissionsFor(snapshot, opts = {}) {
   if (!snapshot.active) return [];
   const keys = /* @__PURE__ */ new Set();
-  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.saasApp)) keys.add(entry.key);
+  for (const entry of snapshot.permissions) if (entryCoversApp(entry, opts.dashId)) keys.add(entry.key);
   return [...keys].sort();
 }
 
 // src/access/generated/keys.ts
 var PLATFORM_PERMISSIONS = [
+  "affiliates.enrollments.manage",
   "affiliates.finance.manage",
   "affiliates.partners.manage",
   "affiliates.programmes.manage",
@@ -263,20 +269,25 @@ var PLATFORM_PERMISSIONS = [
   "platform.audit.view",
   "platform.auth.manage",
   "platform.billing.manage",
+  "platform.billing.view",
   "platform.channels.manage",
   "platform.channels.view",
   "platform.config.manage",
   "platform.docs.manage",
   "platform.docs.view",
+  "platform.mcp.access",
+  "platform.mcp.tokens.manage",
   "platform.observability.manage",
   "platform.observability.view",
   "platform.offboarding.view",
   "platform.ops.manage",
+  "platform.ops.view",
   "platform.support.impersonate",
   "platform.support.sessions",
   "platform.tenants.archive",
   "platform.tenants.manage",
   "platform.tenants.restore",
+  "platform.tenants.view",
   "platform.users.deactivate",
   "platform.users.delete",
   "platform.users.invite",
@@ -287,16 +298,20 @@ var PLATFORM_PERMISSIONS = [
 var DASH_PERMISSIONS = [
   "dash.apps.manage",
   "dash.billing.manage",
+  "dash.billing.view",
   "dash.channels.manage",
   "dash.customers.manage",
   "dash.domains.manage",
+  "dash.domains.view",
   "dash.members.manage",
   "dash.ownership.transfer",
   "dash.plans.manage",
+  "dash.plans.view",
   "dash.publish",
   "dash.settings.manage",
   "dash.workspaces.admin",
-  "dash.workspaces.manage"
+  "dash.workspaces.manage",
+  "dash.workspaces.view"
 ];
 var DASH_ROLES = [
   "dash.admin",

package/dist/access/react.d.ts

@@ -28,7 +28,7 @@ interface AccessSnapshot {
      * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
      * the subject's dash membership. This is the admission list for the dash
      * area: the dashes this subject runs. What they may *do* on one is a normal
-     * `hasPermission(snapshot, key, { saasApp })` check — platform managers hold
+     * `hasPermission(snapshot, key, { dashId })` check — platform managers hold
      * their authority platform-wide and so appear here not at all.
      */
     dash_roles: Record<string, string>;
@@ -40,10 +40,10 @@ interface AccessSnapshot {
 
 interface PermissionCheckOptions {
     /**
-     * SaaS app (dash) slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app entry satisfy the check.
+     * Dash slug the check is about. Omit for "anywhere": platform
+     * entries and any saas_app-scoped entry satisfy the check.
      */
-    saasApp?: string;
+    dashId?: string;
 }
 
 interface AccessProviderProps {
@@ -70,6 +70,6 @@ interface CanProps extends PermissionCheckOptions {
     children: ReactNode;
 }
 /** Render-gate. Presentation only — the backend remains the security boundary. */
-declare function Can({ permission, mode, workspaceId, saasApp, not, fallback, children }: CanProps): react.JSX.Element;
+declare function Can({ permission, mode, workspaceId, dashId, not, fallback, children }: CanProps): react.JSX.Element;
 
 export { AccessProvider, type AccessProviderProps, Can, type CanProps, useAccess, useAccessOrEmpty, useCan, useCanWorkspace, useIsPlatformOwner };

package/dist/access/react.js

@@ -4,20 +4,20 @@
 import { createContext, useContext, useMemo } from "react";
 
 // src/access/predicates.ts
-function entryCoversApp(entry, saasApp) {
+function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
     case "saas_app":
-      if (saasApp === void 0) return true;
-      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === saasApp.toLowerCase();
+      if (dashId === void 0) return true;
+      return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:
       return false;
   }
 }
 function hasPermission(snapshot, key, opts = {}) {
   if (!snapshot.active) return false;
-  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.saasApp));
+  return snapshot.permissions.some((entry) => entry.key === key && entryCoversApp(entry, opts.dashId));
 }
 function hasWorkspacePermission(snapshot, workspaceId, key) {
   if (!snapshot.active) return false;
@@ -69,10 +69,10 @@ function useCanWorkspace(workspaceId) {
 function useIsPlatformOwner() {
   return isPlatformOwner(useAccess());
 }
-function Can({ permission, mode = "all", workspaceId, saasApp, not = false, fallback = null, children }) {
+function Can({ permission, mode = "all", workspaceId, dashId, not = false, fallback = null, children }) {
   const snapshot = useAccess();
   const keys = typeof permission === "string" ? [permission] : permission;
-  const check = (key) => workspaceId !== void 0 ? hasWorkspacePermission(snapshot, workspaceId, key) : hasPermission(snapshot, key, { saasApp });
+  const check = (key) => workspaceId !== void 0 ? hasWorkspacePermission(snapshot, workspaceId, key) : hasPermission(snapshot, key, { dashId });
   const allowed = mode === "any" ? keys.some(check) : keys.every(check);
   return /* @__PURE__ */ jsx(Fragment, { children: allowed !== not ? children : fallback });
 }

package/dist/{index-CbsCWtku.d.ts → index-HL6QFIZy.d.ts}

@@ -1,8 +1,8 @@
 /** Platform-operator permission keys. */
-declare const PLATFORM_PERMISSIONS: readonly ["affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
+declare const PLATFORM_PERMISSIONS: readonly ["affiliates.enrollments.manage", "affiliates.finance.manage", "affiliates.partners.manage", "affiliates.programmes.manage", "affiliates.view", "linkservice.domains.manage", "linkservice.links.manage", "linkservice.qr.manage", "linkservice.view", "platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.billing.view", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.mcp.access", "platform.mcp.tokens.manage", "platform.observability.manage", "platform.observability.view", "platform.offboarding.view", "platform.ops.manage", "platform.ops.view", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.tenants.view", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
 /** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
-declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage"];
+declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.billing.view", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.domains.view", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.plans.view", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage", "dash.workspaces.view"];
 type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
 /** Membership-mirrored dash role bundles (grant keys at dash scope). */
 declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];
@@ -65,7 +65,7 @@ interface AccessSnapshot {
      * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
      * the subject's dash membership. This is the admission list for the dash
      * area: the dashes this subject runs. What they may *do* on one is a normal
-     * `hasPermission(snapshot, key, { saasApp })` check — platform managers hold
+     * `hasPermission(snapshot, key, { dashId })` check — platform managers hold
      * their authority platform-wide and so appear here not at all.
      */
     dash_roles: Record<string, string>;
@@ -80,17 +80,17 @@ declare function parseAccessSnapshot(input: unknown): AccessSnapshot;
 
 interface PermissionCheckOptions {
     /**
-     * SaaS app (dash) slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app entry satisfy the check.
+     * Dash slug the check is about. Omit for "anywhere": platform
+     * entries and any saas_app-scoped entry satisfy the check.
      */
-    saasApp?: string;
+    dashId?: string;
 }
 /**
  * Mirrors c1m-server authz.entryCoversApp: platform scope covers every app;
  * saas_app scope covers "*" or a case-insensitive slug match; workspace-scoped
  * entries never satisfy an app-level check.
  */
-declare function entryCoversApp(entry: AccessEntry, saasApp: string | undefined): boolean;
+declare function entryCoversApp(entry: AccessEntry, dashId: string | undefined): boolean;
 /** True when the subject is active and holds `key` for the given app (or anywhere). */
 declare function hasPermission(snapshot: AccessSnapshot, key: string, opts?: PermissionCheckOptions): boolean;
 declare function hasAnyPermission(snapshot: AccessSnapshot, keys: readonly string[], opts?: PermissionCheckOptions): boolean;
@@ -108,14 +108,14 @@ declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: s
  * `hasPermission(snapshot, "platform.tenants.manage")` instead.
  */
 declare function managedDashes(snapshot: AccessSnapshot): Array<{
-    saasApp: string;
+    dashId: string;
     role: string;
 }>;
 /** The dash bundle held on one dash, or "" when the subject holds none there. */
-declare function dashRole(snapshot: AccessSnapshot, saasApp: string): string;
+declare function dashRole(snapshot: AccessSnapshot, dashId: string): string;
 declare function isPlatformOwner(snapshot: AccessSnapshot): boolean;
 /**
- * The saas_app scopes under which `key` is held. Returns `{ all: true }` when a
+ * The dash scopes under which `key` is held. Returns `{ all: true }` when a
  * platform-scoped or "*" entry grants it everywhere; otherwise the explicit
  * app slugs (empty = nowhere). Mirrors authz.AppPermissionScope.
  */
@@ -123,7 +123,7 @@ declare function appScopes(snapshot: AccessSnapshot, key: string): {
     all: boolean;
     apps: string[];
 };
-/** Distinct permission keys held for `saasApp` (or anywhere). Handy for nav/badges. */
+/** Distinct permission keys held for `dashId` (or anywhere). Handy for nav/badges. */
 declare function permissionsFor(snapshot: AccessSnapshot, opts?: PermissionCheckOptions): string[];
 
 /** A value that may be fixed or resolved per call (env read at request time). */

package/dist/{index-BnchfjP_.d.ts → index-aKe58m6n.d.ts}

@@ -1,5 +1,3 @@
-import '@c1m-public/transport';
-
 interface SessionUser {
     id: string;
     email: string;
@@ -59,6 +57,9 @@ declare function parseAuthResponse(value: unknown): AuthResponse | null;
  */
 declare function safeInternalPath(raw: string | null | undefined): string | null;
 
+declare function applyForwardedClientHeaders(incoming: Headers, headers?: Headers): Headers;
+declare function forwardedRequestHeaders(request: Request, init?: HeadersInit): Headers;
+
 interface CookieOptions {
     httpOnly?: boolean;
     secure?: boolean;
@@ -232,4 +233,4 @@ interface SessionGateInput {
 }
 declare function evaluateSessionGate(input: SessionGateInput): Promise<SessionGateDecision>;
 
-export { type AsyncResolvable as A, deleteCookie as B, type CookieOptions as C, type DeviceIdentity as D, evaluateSessionGate as E, handoffErrorMessage as F, hasSessionShape as G, HANDOFF_ERROR_FALLBACK as H, hasTokenAudience as I, isAuthErrorCode as J, isHandoffErrorCode as K, isTokenExpired as L, isTokenExpiringSoon as M, parseAuthResponse as N, parseRefreshEnvelope as O, readCookie as P, safeInternalPath as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, serializeCookie as U, setCookie as V, sourceStartPath as W, tokenMaxAgeSeconds as X, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshedSession as k, SSO_ERROR_MESSAGES as l, type SessionGateDecision as m, type SessionGateInput as n, type SessionRefresher as o, type SessionRefresherConfig as p, type SessionUser as q, authErrorMessage as r, brokerPaths as s, createDeviceIdentity as t, createHandoffSource as u, createHandoffTarget as v, createSessionRefresher as w, decodeBase64Url as x, decodeDefaultSession as y, decodeTokenPayload as z };
+export { type AsyncResolvable as A, decodeTokenPayload as B, type CookieOptions as C, type DeviceIdentity as D, deleteCookie as E, evaluateSessionGate as F, forwardedRequestHeaders as G, HANDOFF_ERROR_FALLBACK as H, handoffErrorMessage as I, hasSessionShape as J, hasTokenAudience as K, isAuthErrorCode as L, isHandoffErrorCode as M, isTokenExpired as N, isTokenExpiringSoon as O, parseAuthResponse as P, parseRefreshEnvelope as Q, type Resolvable as R, type SessionData as S, type TokenPayload as T, readCookie as U, safeInternalPath as V, serializeCookie as W, setCookie as X, sourceStartPath as Y, tokenMaxAgeSeconds as Z, AUTH_ERROR_MESSAGES as a, type AuthResponse as b, type DeviceIdentityConfig as c, type DeviceIdentityStore as d, HANDOFF_ERROR_MESSAGES as e, type HandoffSource as f, type HandoffSourceConfig as g, type HandoffSourceTarget as h, type HandoffTarget as i, type HandoffTargetConfig as j, type RefreshedSession as k, SSO_ERROR_MESSAGES as l, type SessionGateDecision as m, type SessionGateInput as n, type SessionRefresher as o, type SessionRefresherConfig as p, type SessionUser as q, applyForwardedClientHeaders as r, authErrorMessage as s, brokerPaths as t, createDeviceIdentity as u, createHandoffSource as v, createHandoffTarget as w, createSessionRefresher as x, decodeBase64Url as y, decodeDefaultSession as z };

package/dist/index.d.ts

@@ -1,2 +1 @@
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, S as SessionData, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as authErrorMessage, s as brokerPaths, t as createDeviceIdentity, u as createHandoffSource, v as createHandoffTarget, w as createSessionRefresher, x as decodeBase64Url, y as decodeDefaultSession, z as decodeTokenPayload, B as deleteCookie, E as evaluateSessionGate, F as handoffErrorMessage, G as hasSessionShape, I as hasTokenAudience, J as isAuthErrorCode, K as isHandoffErrorCode, L as isTokenExpired, M as isTokenExpiringSoon, N as parseAuthResponse, O as parseRefreshEnvelope, P as readCookie, Q as safeInternalPath, U as serializeCookie, V as setCookie, W as sourceStartPath, X as tokenMaxAgeSeconds } from './index-BnchfjP_.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, C as CookieOptions, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, S as SessionData, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';

package/dist/index.js

@@ -123,6 +123,14 @@ function forwardedRequestHeaders(request, init) {
   return applyForwardedClientHeaders(request.headers, new Headers(init));
 }
 
+// src/forwarding.ts
+function applyForwardedClientHeaders2(incoming, headers = new Headers()) {
+  return applyForwardedClientHeaders(incoming, headers);
+}
+function forwardedRequestHeaders2(request, init) {
+  return forwardedRequestHeaders(request, init);
+}
+
 // src/cookies.ts
 function readCookie(request, name) {
   const header = request.headers.get("cookie");
@@ -151,12 +159,27 @@ function serializeCookie(name, value, options = {}) {
   return parts.join("; ");
 }
 function setCookie(response, name, value, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, value, options));
 }
 function deleteCookie(response, name, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, "", { ...options, maxAge: 0 }));
+}
+function appendSetCookie(response, cookie) {
+  try {
+    response.headers.append("Set-Cookie", cookie);
+    return response;
+  } catch (error) {
+    if (!(error instanceof TypeError) || !/immutable/i.test(error.message)) {
+      throw error;
+    }
+    const mutable = new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+    mutable.headers.append("Set-Cookie", cookie);
+    return mutable;
+  }
 }
 
 // src/device-cookie.ts
@@ -316,8 +339,11 @@ function createHandoffTarget(config) {
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
   const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
-    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
-    return response;
+    let result = response;
+    for (const name of Object.values(cookies)) {
+      result = deleteCookie(result, name, { path: "/", secure });
+    }
+    return result;
   };
   const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
   return {
@@ -335,11 +361,11 @@ function createHandoffTarget(config) {
       const start = new URL(sourceStartPath(config.app), sourceOrigin);
       start.searchParams.set("code_challenge", await s256(verifier));
       start.searchParams.set("state", state);
-      const response = redirect(start);
-      setCookie(response, cookies.verifier, verifier, cookieOptions);
-      setCookie(response, cookies.state, state, cookieOptions);
+      let response = redirect(start);
+      response = setCookie(response, cookies.verifier, verifier, cookieOptions);
+      response = setCookie(response, cookies.state, state, cookieOptions);
       const from = safeInternalPath(url.searchParams.get("from"));
-      if (from) setCookie(response, cookies.from, from, cookieOptions);
+      if (from) response = setCookie(response, cookies.from, from, cookieOptions);
       return response;
     },
     /** GET `?code=&state=` */
@@ -355,7 +381,7 @@ function createHandoffTarget(config) {
       const device = config.device.read(request);
       const respond = (response) => config.device.persist(response, device);
       try {
-        const headers = forwardedRequestHeaders(request, {
+        const headers = forwardedRequestHeaders2(request, {
           "Content-Type": "application/json",
           "X-Client-Type": config.clientType,
           "X-Client-Device-ID": device.value
@@ -404,7 +430,7 @@ function createHandoffSource(config) {
       const token = await config.getAccessToken(request);
       if (!token) return sourceLogin();
       try {
-        const headers = forwardedRequestHeaders(request, {
+        const headers = forwardedRequestHeaders2(request, {
           "Content-Type": "application/json",
           "X-Client-Type": config.clientType,
           Authorization: `Bearer ${token}`
@@ -531,4 +557,4 @@ async function evaluateSessionGate(input) {
   return { kind: "redirect_login" };
 }
 
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, applyForwardedClientHeaders, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, forwardedRequestHeaders, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, SSO_ERROR_MESSAGES, applyForwardedClientHeaders2 as applyForwardedClientHeaders, authErrorMessage, brokerPaths, createDeviceIdentity, createHandoffSource, createHandoffTarget, createSessionRefresher, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, forwardedRequestHeaders2 as forwardedRequestHeaders, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isTokenExpired, isTokenExpiringSoon, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };

package/dist/mcp-tokens.d.ts

@@ -0,0 +1,79 @@
+declare const MCP_TOOL_PERMISSIONS: readonly ["dash.domains.view", "dash.workspaces.view", "platform.audit.view", "platform.ops.manage", "platform.ops.view", "platform.tenants.view"];
+declare const MCP_WILDCARD_TOOL_PERMISSIONS: readonly ["dash.domains.view", "dash.workspaces.view", "platform.audit.view", "platform.ops.view", "platform.tenants.view"];
+type MCPToolPermission = (typeof MCP_TOOL_PERMISSIONS)[number];
+
+declare const MCP_ACCESS_PERMISSION: "platform.mcp.access";
+declare const MCP_TOKENS_MANAGE_PERMISSION: "platform.mcp.tokens.manage";
+declare const MCP_PERMISSION_WILDCARD: "*";
+type MCPTokenPermission = typeof MCP_ACCESS_PERMISSION | typeof MCP_PERMISSION_WILDCARD | MCPToolPermission;
+type MCPTokenOperation = "platform_user.auth.mcp_tokens.list" | "platform_user.auth.mcp_tokens.mint" | "platform_user.auth.mcp_tokens.revoke";
+type MCPTokenRequestOutcome = "success" | "api_error" | "network_error" | "timeout" | "invalid_response" | "cancelled";
+interface MCPTokenView {
+    token_id: string;
+    name: string;
+    /** Recorded ceilings may include permissions added by a newer server. */
+    permissions: string[];
+    app_allowlist: string[];
+    created_at: string;
+    expires_at: string;
+    last_used_at?: string;
+    revoked_at?: string;
+}
+interface MCPTokenPage {
+    items: MCPTokenView[];
+    next_cursor?: string;
+    has_more: boolean;
+    mcp_enabled: boolean;
+}
+interface MCPTokenListParams {
+    cursor?: string;
+    limit?: number;
+}
+interface MintMCPTokenInput {
+    name: string;
+    expires_in_days: number;
+    permissions: MCPTokenPermission[];
+    app_allowlist: string[];
+}
+interface MintMCPTokenResponse {
+    token: MCPTokenView;
+    raw_token: string;
+}
+interface MCPTokenRequestObservation {
+    operation: MCPTokenOperation;
+    method: string;
+    outcome: MCPTokenRequestOutcome;
+    status: number;
+    requestId: string;
+    durationMs: number;
+    attempts: number;
+}
+interface CreateMCPTokenClientOptions {
+    baseUrl: string;
+    getAccessToken: () => Promise<string | null | undefined> | string | null | undefined;
+    getHeaders?: () => Promise<HeadersInit | undefined> | HeadersInit | undefined;
+    fetch?: typeof globalThis.fetch;
+    /** Per attempt (default 10000). */
+    timeoutMs?: number;
+    /** Additional attempts for GET only (default 1). Mint and revoke are never retried. */
+    retryAttempts?: number;
+    /** Cap on one retry delay (default 2000). */
+    maxRetryDelayMs?: number;
+    observe?: (event: MCPTokenRequestObservation) => void;
+    signal?: AbortSignal;
+}
+declare class MCPTokenAPIError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly requestId: string;
+    constructor(message: string, status: number, code: string, requestId: string);
+}
+declare function isMCPTokenAPIError(error: unknown): error is MCPTokenAPIError;
+declare function createMCPTokenClient(options: CreateMCPTokenClientOptions): {
+    readonly list: (params?: MCPTokenListParams) => Promise<MCPTokenPage>;
+    readonly mint: (input: MintMCPTokenInput) => Promise<MintMCPTokenResponse>;
+    readonly revoke: (tokenId: string) => Promise<void>;
+};
+type MCPTokenClient = ReturnType<typeof createMCPTokenClient>;
+
+export { type CreateMCPTokenClientOptions, MCPTokenAPIError, type MCPTokenClient, type MCPTokenListParams, type MCPTokenOperation, type MCPTokenPage, type MCPTokenPermission, type MCPTokenRequestObservation, type MCPTokenRequestOutcome, type MCPTokenView, type MCPToolPermission, MCP_ACCESS_PERMISSION, MCP_PERMISSION_WILDCARD, MCP_TOKENS_MANAGE_PERMISSION, MCP_TOOL_PERMISSIONS, MCP_WILDCARD_TOOL_PERMISSIONS, type MintMCPTokenInput, type MintMCPTokenResponse, createMCPTokenClient, isMCPTokenAPIError };

package/dist/mcp-tokens.js

@@ -0,0 +1,357 @@
+// ../transport/src/index.ts
+var RETRYABLE_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
+var TransportError = class extends Error {
+  constructor(failure) {
+    super(failure.message || failure.outcome);
+    this.failure = failure;
+    this.name = "TransportError";
+  }
+  failure;
+};
+function isTransportError(error) {
+  return error instanceof TransportError || typeof error === "object" && error !== null && error.name === "TransportError";
+}
+function positiveNumber(value, label, fail) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) throw fail(`${label} must be a positive finite number`);
+  return value;
+}
+function nonNegativeInteger(value, label, fail) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw fail(`${label} must be a non-negative safe integer`);
+  return value;
+}
+function requiredString(value, label, fail) {
+  const normalized = typeof value === "string" ? value.trim() : "";
+  if (!normalized) throw fail(`${label} is required`);
+  return normalized;
+}
+function backoffDelay(attempt, maxDelayMs) {
+  const base = Math.min(250 * 2 ** Math.max(attempt, 0), maxDelayMs);
+  return Math.floor(Math.random() * base);
+}
+function retryDelay(response, attempt, maxDelayMs) {
+  const value = response.headers.get("Retry-After");
+  if (!value) return backoffDelay(attempt, maxDelayMs);
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return Math.min(Math.max(seconds * 1e3, 0), maxDelayMs);
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? backoffDelay(attempt, maxDelayMs) : Math.min(Math.max(date - Date.now(), 0), maxDelayMs);
+}
+function wait(ms) {
+  return ms <= 0 ? Promise.resolve() : new Promise((resolve) => setTimeout(resolve, ms));
+}
+function combineSignals(...signals) {
+  const active = signals.filter((signal) => Boolean(signal));
+  if (active.length === 0) return void 0;
+  if (active.length === 1) return active[0];
+  return AbortSignal.any(active);
+}
+function isRetryableRequest(method, headers, retry) {
+  if (method === "GET") return true;
+  return retry.idempotentWrites === true && headers.has("Idempotency-Key");
+}
+async function performRequest(transport, url, init, observe, decode) {
+  const method = (init.method ?? "GET").toUpperCase();
+  const headers = new Headers(init.headers);
+  const startedAt = Date.now();
+  const retryable = isRetryableRequest(method, headers, transport.retry);
+  const maxAttempts = retryable ? transport.retry.attempts : 0;
+  let attempts = 0;
+  let status = 0;
+  let requestId = "";
+  let outcome = "network_error";
+  const fail = (failure) => {
+    outcome = failure.outcome;
+    throw new TransportError({ requestId, ...failure });
+  };
+  try {
+    let response;
+    for (let attempt = 0; attempt <= maxAttempts; attempt += 1) {
+      attempts = attempt + 1;
+      const controller = new AbortController();
+      const timeout = setTimeout(() => controller.abort(), transport.timeoutMs);
+      try {
+        response = await transport.fetch(url, {
+          ...init,
+          method,
+          headers,
+          signal: combineSignals(transport.signal, init.signal, controller.signal)
+        });
+      } catch {
+        if (controller.signal.aborted) fail({ outcome: "timeout", status: 0, code: "", message: "" });
+        if (transport.signal?.aborted || init.signal?.aborted) fail({ outcome: "cancelled", status: 0, code: "", message: "" });
+        if (attempt < maxAttempts) {
+          await wait(backoffDelay(attempt, transport.retry.maxDelayMs));
+          continue;
+        }
+        fail({ outcome: "network_error", status: 0, code: "", message: "" });
+      } finally {
+        clearTimeout(timeout);
+      }
+      if (!RETRYABLE_STATUSES.has(response.status) || attempt === maxAttempts) break;
+      await wait(retryDelay(response, attempt, transport.retry.maxDelayMs));
+    }
+    if (!response) return fail({ outcome: "network_error", status: 0, code: "", message: "" });
+    status = response.status;
+    requestId = response.headers.get("X-Request-ID") ?? "";
+    if (!response.ok) {
+      const envelope = await response.json().catch(() => ({}));
+      if (typeof envelope.request_id === "string") requestId = envelope.request_id;
+      return fail({
+        outcome: "api_error",
+        status,
+        code: typeof envelope.code === "string" ? envelope.code : "",
+        message: typeof envelope.message === "string" ? envelope.message : "",
+        requestId
+      });
+    }
+    let payload;
+    try {
+      if (status === 204) {
+        payload = void 0;
+      } else {
+        const text = await response.text();
+        const parsed = text ? JSON.parse(text) : void 0;
+        payload = decode ? decode(parsed) : parsed;
+      }
+    } catch {
+      return fail({ outcome: "invalid_response", status, code: "", message: "", requestId });
+    }
+    outcome = "success";
+    return { payload, status, requestId };
+  } finally {
+    if (observe) {
+      try {
+        observe({ method, outcome, status, requestId, durationMs: Math.max(0, Date.now() - startedAt), attempts });
+      } catch {
+      }
+    }
+  }
+}
+
+// src/access/generated/mcp-tools.ts
+var MCP_TOOL_PERMISSIONS = [
+  "dash.domains.view",
+  "dash.workspaces.view",
+  "platform.audit.view",
+  "platform.ops.manage",
+  "platform.ops.view",
+  "platform.tenants.view"
+];
+var MCP_WILDCARD_TOOL_PERMISSIONS = [
+  "dash.domains.view",
+  "dash.workspaces.view",
+  "platform.audit.view",
+  "platform.ops.view",
+  "platform.tenants.view"
+];
+
+// src/mcp-tokens.ts
+var MCP_ACCESS_PERMISSION = "platform.mcp.access";
+var MCP_TOKENS_MANAGE_PERMISSION = "platform.mcp.tokens.manage";
+var MCP_PERMISSION_WILDCARD = "*";
+var MCPTokenAPIError = class extends Error {
+  constructor(message, status, code, requestId) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.requestId = requestId;
+    this.name = "MCPTokenAPIError";
+  }
+  status;
+  code;
+  requestId;
+};
+function isMCPTokenAPIError(error) {
+  return error instanceof MCPTokenAPIError || typeof error === "object" && error !== null && error.name === "MCPTokenAPIError" && typeof error.status === "number" && typeof error.code === "string" && typeof error.requestId === "string";
+}
+var configurationError = (message) => new Error(message);
+var basePath = "/api/v1/platform/auth/me/mcp-tokens";
+var tokenIDPattern = /^[0-9a-f]{32}$/;
+var rawTokenPattern = /^sd_pat_([0-9a-f]{32})_[A-Za-z0-9_-]{43}$/;
+var timestampPattern = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+function invalidResponse() {
+  throw new Error("invalid MCP token response");
+}
+function objectValue(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) invalidResponse();
+  return value;
+}
+function responseString(value, options = {}) {
+  if (value === void 0 && options.optional) return void 0;
+  if (typeof value !== "string" || value.length === 0) invalidResponse();
+  if (options.tokenID && !tokenIDPattern.test(value)) invalidResponse();
+  if (options.timestamp && (!timestampPattern.test(value) || !Number.isFinite(Date.parse(value)))) invalidResponse();
+  return value;
+}
+function responseStrings(value) {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string" || entry.length === 0)) invalidResponse();
+  return [...value];
+}
+function parseMCPTokenView(value) {
+  const item = objectValue(value);
+  return {
+    token_id: responseString(item.token_id, { tokenID: true }),
+    name: responseString(item.name),
+    permissions: responseStrings(item.permissions),
+    app_allowlist: responseStrings(item.app_allowlist),
+    created_at: responseString(item.created_at, { timestamp: true }),
+    expires_at: responseString(item.expires_at, { timestamp: true }),
+    last_used_at: responseString(item.last_used_at, { optional: true, timestamp: true }),
+    revoked_at: responseString(item.revoked_at, { optional: true, timestamp: true })
+  };
+}
+function parseMCPTokenPage(value) {
+  const page = objectValue(value);
+  if (!Array.isArray(page.items) || typeof page.has_more !== "boolean" || typeof page.mcp_enabled !== "boolean") invalidResponse();
+  const nextCursor = responseString(page.next_cursor, { optional: true });
+  if (Boolean(nextCursor) !== page.has_more) invalidResponse();
+  return {
+    items: page.items.map(parseMCPTokenView),
+    next_cursor: nextCursor,
+    has_more: page.has_more,
+    mcp_enabled: page.mcp_enabled
+  };
+}
+function parseMintMCPTokenResponse(value) {
+  const response = objectValue(value);
+  const token = parseMCPTokenView(response.token);
+  const rawToken = responseString(response.raw_token);
+  const match = rawToken.match(rawTokenPattern);
+  if (!match || match[1] !== token.token_id) invalidResponse();
+  return { token, raw_token: rawToken };
+}
+function normalizedStrings(values, label, max) {
+  if (!Array.isArray(values)) throw configurationError(`${label} must be an array`);
+  const normalized = [...new Set(values.map((value) => requiredString(value, label, configurationError)))];
+  if (normalized.length > max) throw configurationError(`${label} must contain at most ${max} entries`);
+  return normalized;
+}
+function mintInput(value) {
+  const name = requiredString(value.name, "name", configurationError);
+  if (name.length > 64) throw configurationError("name must be 64 characters or fewer");
+  if (!Number.isSafeInteger(value.expires_in_days) || value.expires_in_days < 1 || value.expires_in_days > 90) {
+    throw configurationError("expires_in_days must be an integer from 1 to 90");
+  }
+  const permissions = normalizedStrings(value.permissions, "permissions", 32);
+  if (permissions.includes(MCP_PERMISSION_WILDCARD)) {
+    if (permissions.length !== 1) {
+      throw configurationError('permissions "*" must be the only entry');
+    }
+  } else {
+    if (!permissions.includes(MCP_ACCESS_PERMISSION)) throw configurationError(`permissions must include ${MCP_ACCESS_PERMISSION}`);
+    if (permissions.length < 2) throw configurationError("permissions must include at least one MCP tool permission");
+    const allowedPermissions = /* @__PURE__ */ new Set([MCP_ACCESS_PERMISSION, ...MCP_TOOL_PERMISSIONS]);
+    if (permissions.some((permission) => !allowedPermissions.has(permission))) {
+      throw configurationError("permissions contains a key that is not available to MCP tools");
+    }
+  }
+  const appAllowlist = normalizedStrings(value.app_allowlist, "app_allowlist", 32);
+  if (appAllowlist.includes("*") && appAllowlist.length !== 1) {
+    throw configurationError('app_allowlist "*" must be the only entry');
+  }
+  return {
+    name,
+    expires_in_days: value.expires_in_days,
+    permissions,
+    app_allowlist: appAllowlist
+  };
+}
+function tokenIDInput(value) {
+  const tokenID = requiredString(value, "tokenId", configurationError);
+  if (!tokenIDPattern.test(tokenID)) throw configurationError("tokenId must be a 32-character hexadecimal MCP token id");
+  return tokenID;
+}
+function createMCPTokenClient(options) {
+  const baseUrl = requiredString(options.baseUrl, "baseUrl", configurationError).replace(/\/+$/, "");
+  const transport = {
+    fetch: (input, init) => (options.fetch ?? globalThis.fetch)(input, init),
+    timeoutMs: positiveNumber(options.timeoutMs ?? 1e4, "timeoutMs", configurationError),
+    retry: {
+      attempts: nonNegativeInteger(options.retryAttempts ?? 1, "retryAttempts", configurationError),
+      maxDelayMs: positiveNumber(options.maxRetryDelayMs ?? 2e3, "maxRetryDelayMs", configurationError),
+      idempotentWrites: false
+    },
+    signal: options.signal
+  };
+  async function request(operation, path, decode, init = {}) {
+    const method = (init.method ?? "GET").toUpperCase();
+    const report = options.observe && ((event) => {
+      options.observe?.({ operation, ...event });
+    });
+    let headers;
+    try {
+      const accessToken = requiredString(await options.getAccessToken() ?? "", "access token", configurationError);
+      headers = new Headers(await options.getHeaders?.());
+      new Headers(init.headers).forEach((value, key) => headers.set(key, value));
+      headers.set("Authorization", `Bearer ${accessToken}`);
+      headers.set("Accept", "application/json");
+      if (init.body !== void 0) headers.set("Content-Type", "application/json");
+    } catch (error) {
+      try {
+        report?.({ method, outcome: "network_error", status: 0, requestId: "", durationMs: 0, attempts: 0 });
+      } catch {
+      }
+      throw error;
+    }
+    try {
+      const result = await performRequest(
+        transport,
+        `${baseUrl}${path}`,
+        { ...init, method, headers, cache: "no-store" },
+        report,
+        decode
+      );
+      return result.payload;
+    } catch (error) {
+      if (!isTransportError(error)) throw error;
+      const { outcome, status, code, message, requestId } = error.failure;
+      switch (outcome) {
+        case "timeout":
+          throw new MCPTokenAPIError("MCP token request timed out", 0, "mcp_token_request_timeout", "");
+        case "cancelled":
+          throw new MCPTokenAPIError("MCP token request was cancelled", 0, "mcp_token_request_cancelled", "");
+        case "network_error":
+          throw new MCPTokenAPIError("MCP token service is unavailable", 0, "mcp_token_service_unavailable", "");
+        case "invalid_response":
+          throw new MCPTokenAPIError("MCP token service returned an invalid response", status, "mcp_token_invalid_response", requestId);
+        case "api_error":
+          throw new MCPTokenAPIError(message || code || "MCP token request failed", status, code, requestId);
+      }
+    }
+  }
+  return {
+    list(params = {}) {
+      const query = new URLSearchParams();
+      const cursor = params.cursor?.trim();
+      if (cursor) query.set("cursor", cursor);
+      if (params.limit !== void 0) {
+        const limit = positiveNumber(params.limit, "limit", configurationError);
+        if (!Number.isSafeInteger(limit) || limit > 100) throw configurationError("limit must be an integer from 1 to 100");
+        query.set("limit", String(limit));
+      }
+      return request(
+        "platform_user.auth.mcp_tokens.list",
+        `${basePath}${query.size ? `?${query}` : ""}`,
+        parseMCPTokenPage
+      );
+    },
+    mint(input) {
+      return request("platform_user.auth.mcp_tokens.mint", basePath, parseMintMCPTokenResponse, {
+        method: "POST",
+        body: JSON.stringify(mintInput(input))
+      });
+    },
+    revoke(tokenId) {
+      return request(
+        "platform_user.auth.mcp_tokens.revoke",
+        `${basePath}/${tokenIDInput(tokenId)}`,
+        (payload) => {
+          if (payload !== void 0) invalidResponse();
+        },
+        { method: "DELETE" }
+      );
+    }
+  };
+}
+
+export { MCPTokenAPIError, MCP_ACCESS_PERMISSION, MCP_PERMISSION_WILDCARD, MCP_TOKENS_MANAGE_PERMISSION, MCP_TOOL_PERMISSIONS, MCP_WILDCARD_TOOL_PERMISSIONS, createMCPTokenClient, isMCPTokenAPIError };

package/dist/next.d.ts

@@ -1,6 +1,5 @@
-import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-BnchfjP_.js';
-export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as authErrorMessage, s as brokerPaths, t as createDeviceIdentity, u as createHandoffSource, v as createHandoffTarget, w as createSessionRefresher, x as decodeBase64Url, y as decodeDefaultSession, z as decodeTokenPayload, B as deleteCookie, E as evaluateSessionGate, F as handoffErrorMessage, G as hasSessionShape, I as hasTokenAudience, J as isAuthErrorCode, K as isHandoffErrorCode, L as isTokenExpired, M as isTokenExpiringSoon, N as parseAuthResponse, O as parseRefreshEnvelope, P as readCookie, Q as safeInternalPath, U as serializeCookie, V as setCookie, W as sourceStartPath, X as tokenMaxAgeSeconds } from './index-BnchfjP_.js';
-export { applyForwardedClientHeaders, forwardedRequestHeaders } from '@c1m-public/transport';
+import { R as Resolvable, A as AsyncResolvable, S as SessionData, C as CookieOptions } from './index-aKe58m6n.js';
+export { a as AUTH_ERROR_MESSAGES, b as AuthResponse, D as DeviceIdentity, c as DeviceIdentityConfig, d as DeviceIdentityStore, H as HANDOFF_ERROR_FALLBACK, e as HANDOFF_ERROR_MESSAGES, f as HandoffSource, g as HandoffSourceConfig, h as HandoffSourceTarget, i as HandoffTarget, j as HandoffTargetConfig, k as RefreshedSession, l as SSO_ERROR_MESSAGES, m as SessionGateDecision, n as SessionGateInput, o as SessionRefresher, p as SessionRefresherConfig, q as SessionUser, T as TokenPayload, r as applyForwardedClientHeaders, s as authErrorMessage, t as brokerPaths, u as createDeviceIdentity, v as createHandoffSource, w as createHandoffTarget, x as createSessionRefresher, y as decodeBase64Url, z as decodeDefaultSession, B as decodeTokenPayload, E as deleteCookie, F as evaluateSessionGate, G as forwardedRequestHeaders, I as handoffErrorMessage, J as hasSessionShape, K as hasTokenAudience, L as isAuthErrorCode, M as isHandoffErrorCode, N as isTokenExpired, O as isTokenExpiringSoon, P as parseAuthResponse, Q as parseRefreshEnvelope, U as readCookie, V as safeInternalPath, W as serializeCookie, X as setCookie, Y as sourceStartPath, Z as tokenMaxAgeSeconds } from './index-aKe58m6n.js';
 
 /**
  * The error vocabulary every first-party platform surface uses at its edge.

package/dist/next.js

@@ -128,6 +128,14 @@ function forwardedRequestHeaders(request, init) {
   return applyForwardedClientHeaders(request.headers, new Headers(init));
 }
 
+// src/forwarding.ts
+function applyForwardedClientHeaders2(incoming, headers = new Headers()) {
+  return applyForwardedClientHeaders(incoming, headers);
+}
+function forwardedRequestHeaders2(request, init) {
+  return forwardedRequestHeaders(request, init);
+}
+
 // src/cookies.ts
 function readCookie(request, name) {
   const header = request.headers.get("cookie");
@@ -156,12 +164,27 @@ function serializeCookie(name, value, options = {}) {
   return parts.join("; ");
 }
 function setCookie(response, name, value, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, value, options));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, value, options));
 }
 function deleteCookie(response, name, options) {
-  response.headers.append("Set-Cookie", serializeCookie(name, "", { ...options, maxAge: 0 }));
-  return response;
+  return appendSetCookie(response, serializeCookie(name, "", { ...options, maxAge: 0 }));
+}
+function appendSetCookie(response, cookie) {
+  try {
+    response.headers.append("Set-Cookie", cookie);
+    return response;
+  } catch (error) {
+    if (!(error instanceof TypeError) || !/immutable/i.test(error.message)) {
+      throw error;
+    }
+    const mutable = new Response(response.body, {
+      status: response.status,
+      statusText: response.statusText,
+      headers: response.headers
+    });
+    mutable.headers.append("Set-Cookie", cookie);
+    return mutable;
+  }
 }
 
 // src/device-cookie.ts
@@ -321,8 +344,11 @@ function createHandoffTarget(config) {
   const cookieOptions = { httpOnly: true, secure, sameSite: "lax", path: "/", maxAge: HANDOFF_COOKIE_TTL_SECONDS };
   const timeout = config.timeoutMs ?? config.fetchTimeoutMs ?? DEFAULT_FETCH_TIMEOUT_MS;
   const clearHandoffCookies = (response) => {
-    for (const name of Object.values(cookies)) deleteCookie(response, name, { path: "/", secure });
-    return response;
+    let result = response;
+    for (const name of Object.values(cookies)) {
+      result = deleteCookie(result, name, { path: "/", secure });
+    }
+    return result;
   };
   const fail = (origin, code) => clearHandoffCookies(loginErrorRedirect(origin, config.loginPath, code));
   return {
@@ -340,11 +366,11 @@ function createHandoffTarget(config) {
       const start = new URL(sourceStartPath(config.app), sourceOrigin);
       start.searchParams.set("code_challenge", await s256(verifier));
       start.searchParams.set("state", state);
-      const response = redirect(start);
-      setCookie(response, cookies.verifier, verifier, cookieOptions);
-      setCookie(response, cookies.state, state, cookieOptions);
+      let response = redirect(start);
+      response = setCookie(response, cookies.verifier, verifier, cookieOptions);
+      response = setCookie(response, cookies.state, state, cookieOptions);
       const from = safeInternalPath(url.searchParams.get("from"));
-      if (from) setCookie(response, cookies.from, from, cookieOptions);
+      if (from) response = setCookie(response, cookies.from, from, cookieOptions);
       return response;
     },
     /** GET `?code=&state=` */
@@ -360,7 +386,7 @@ function createHandoffTarget(config) {
       const device = config.device.read(request);
       const respond = (response) => config.device.persist(response, device);
       try {
-        const headers = forwardedRequestHeaders(request, {
+        const headers = forwardedRequestHeaders2(request, {
           "Content-Type": "application/json",
           "X-Client-Type": config.clientType,
           "X-Client-Device-ID": device.value
@@ -409,7 +435,7 @@ function createHandoffSource(config) {
       const token = await config.getAccessToken(request);
       if (!token) return sourceLogin();
       try {
-        const headers = forwardedRequestHeaders(request, {
+        const headers = forwardedRequestHeaders2(request, {
           "Content-Type": "application/json",
           "X-Client-Type": config.clientType,
           Authorization: `Bearer ${token}`
@@ -597,7 +623,7 @@ async function controlRequest(run) {
 async function buildForwardedRequestHeaders(initHeaders) {
   const headers$1 = new Headers(initHeaders);
   try {
-    applyForwardedClientHeaders(await headers(), headers$1);
+    applyForwardedClientHeaders2(await headers(), headers$1);
   } catch {
   }
   return headers$1;
@@ -747,10 +773,11 @@ function createSessionStore(config) {
   }
   function writeSessionCookies(response, accessToken, refreshToken, rememberMe = config.defaultRememberMe ?? true) {
     assertAudience(accessToken);
-    setCookie(response, names.session, accessToken, cookieOptions(rememberMe, accessToken));
-    if (refreshToken) setCookie(response, names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
-    setCookie(response, names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
-    return response;
+    let result = setCookie(response, names.session, accessToken, cookieOptions(rememberMe, accessToken));
+    if (refreshToken) {
+      result = setCookie(result, names.refreshToken, refreshToken, cookieOptions(rememberMe, refreshToken));
+    }
+    return setCookie(result, names.rememberMe, rememberMe ? "true" : "false", cookieOptions(rememberMe));
   }
   async function getAccessToken() {
     const store = await jar("getAccessToken");
@@ -805,8 +832,11 @@ function createSessionStore(config) {
     }
   }
   function clearSessionCookies(response) {
-    for (const name of [names.session, names.refreshToken, names.rememberMe]) deleteCookie(response, name, clearOptions());
-    return response;
+    let result = response;
+    for (const name of [names.session, names.refreshToken, names.rememberMe]) {
+      result = deleteCookie(result, name, clearOptions());
+    }
+    return result;
   }
   async function requireSession() {
     const session = await getSession();
@@ -834,4 +864,4 @@ function createSessionStore(config) {
   };
 }
 
-export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, SSO_ERROR_MESSAGES, SessionExpiredError, applyForwardedClientHeaders, authErrorMessage, authenticationErrorFor, brokerPaths, buildForwardedRequestHeaders, controlRequest, createDeviceIdentity, createHandoffSource, createHandoffTarget, createPlatformFetch, createSessionRefresher, createSessionStore, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, forwardedRequestHeaders, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, isTokenExpired, isTokenExpiringSoon, mapControlError, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };
+export { AUTH_ERROR_MESSAGES, HANDOFF_ERROR_FALLBACK, HANDOFF_ERROR_MESSAGES, PlatformServerFetchError, RecentAuthenticationRequiredError, SSOReauthenticationRequiredError, SSO_ERROR_MESSAGES, SessionExpiredError, applyForwardedClientHeaders2 as applyForwardedClientHeaders, authErrorMessage, authenticationErrorFor, brokerPaths, buildForwardedRequestHeaders, controlRequest, createDeviceIdentity, createHandoffSource, createHandoffTarget, createPlatformFetch, createSessionRefresher, createSessionStore, decodeBase64Url, decodeDefaultSession, decodeTokenPayload, deleteCookie, evaluateSessionGate, forwardedRequestHeaders2 as forwardedRequestHeaders, handoffErrorMessage, hasSessionShape, hasTokenAudience, isAuthErrorCode, isHandoffErrorCode, isPlatformServerFetchError, isRecentAuthenticationRequiredError, isSSOReauthenticationRequiredError, isSessionExpiredError, isTokenExpired, isTokenExpiringSoon, mapControlError, parseAuthResponse, parseRefreshEnvelope, readCookie, safeInternalPath, serializeCookie, setCookie, sourceStartPath, tokenMaxAgeSeconds };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.9.2",
+  "version": "0.11.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",
@@ -20,6 +20,10 @@
       "types": "./dist/next.d.ts",
       "default": "./dist/next.js"
     },
+    "./mcp-tokens": {
+      "types": "./dist/mcp-tokens.d.ts",
+      "default": "./dist/mcp-tokens.js"
+    },
     "./access": {
       "types": "./dist/access/index.d.ts",
       "default": "./dist/access/index.js"