@forumone/throughline 2.2.0 → 2.3.0-pr-315-e1a501e

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @forumone/throughline
 
+## 2.3.0-pr-315-e1a501e
+
+### Minor Changes
+
+- e1a501e: `@forumone/throughline/mcp-oauth`: people connect Claude, Claude Code or ChatGPT to `/api/mcp` by signing in, not by being handed an API key (forumone-2026#838).
+
+  - `mcpOAuth()` adds an OAuth 2.1 authorization server for `/api/mcp`, with discovery, client ID metadata documents and dynamic registration, PKCE S256, `iss` in the response, rotating refresh tokens and reuse detection, plus revocation. Apps are recognised by an allowlist of their redirect URIs. Its `overrideAuth` goes to `mcpPlugin`.
+  - An admin-only **MCP access** global decides which apps may connect and which tools administrators and everyone else are offered. Connections and their tools are re-read on every request, so a policy change, a revoked connection or a lost role takes effect at the next call.
+  - **Connect MCP** (`/admin/connect-mcp`) shows the address, a button for Claude, the Claude Code command and the ChatGPT steps, and lists the person's connected apps with Disconnect. The consent screen names the app by the callback it matched, not by what it calls itself.
+  - API keys keep working beside it. By default the person behind a key is now held to the same `eligible` rule on every request.
+  - `AUDIT_ACTIONS` gains `mcp.connected` and `mcp.disconnected`. **This is an enum migration in the host.** `ReportsNav` takes an optional `label`.
+
+### Patch Changes
+
+- @forumone/throughline-design-system@2.3.0-pr-315-e1a501e
+
 ## 2.2.0
 
 ### Minor Changes

package/dist/audit/types.d.ts

@@ -3,7 +3,7 @@
  * actions from this list rather than introducing free-form strings, so
  * audit queries (C8) can build on a known taxonomy.
  */
-export declare const AUDIT_ACTIONS: readonly ["content.find", "content.create", "content.update", "content.delete", "design.list", "design.suggest", "design.validate", "design.get_contract", "design.find_anti_pattern", "publishing.draft", "publishing.publish", "publishing.unpublish", "publishing.schedule", "publishing.rollback", "approval.requested", "approval.granted", "approval.declined", "approval.changes_requested", "approval.expired", "approval.discussed", "form.created", "form.updated", "form.submission_received", "integration.synced", "integration.failed", "system.error", "system.healthcheck"];
+export declare const AUDIT_ACTIONS: readonly ["content.find", "content.create", "content.update", "content.delete", "design.list", "design.suggest", "design.validate", "design.get_contract", "design.find_anti_pattern", "publishing.draft", "publishing.publish", "publishing.unpublish", "publishing.schedule", "publishing.rollback", "approval.requested", "approval.granted", "approval.declined", "approval.changes_requested", "approval.expired", "approval.discussed", "form.created", "form.updated", "form.submission_received", "integration.synced", "integration.failed", "system.error", "system.healthcheck", "mcp.connected", "mcp.disconnected"];
 export type AuditAction = (typeof AUDIT_ACTIONS)[number];
 /**
  * MCP server identifiers: the `mcp_server` enum on the audit collection. A

package/dist/audit/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,aAAa,6jBA4BhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,iKAapB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,aAAa,kmBA8BhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,iKAapB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/audit/types.js

@@ -31,6 +31,8 @@ export const AUDIT_ACTIONS = [
     'integration.failed',
     'system.error',
     'system.healthcheck',
+    'mcp.connected',
+    'mcp.disconnected',
 ];
 /**
  * MCP server identifiers: the `mcp_server` enum on the audit collection. A

package/dist/audit/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,cAAc;IACd,0BAA0B;IAC1B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,oBAAoB;CACZ,CAAA;AAIV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;IACP,cAAc;IACd,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,SAAS;CACD,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,cAAc;IACd,0BAA0B;IAC1B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,oBAAoB;IACpB,eAAe;IACf,kBAAkB;CACV,CAAA;AAIV;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;IACP,cAAc;IACd,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,SAAS;CACD,CAAA"}

package/dist/editorial/palette/ReportsNav.d.ts

@@ -1,5 +1,7 @@
 import type { Report } from './sources.js';
-export declare function ReportsNav({ reports }: {
+export declare function ReportsNav({ reports, label, }: {
     reports?: Report[];
+    /** The group's heading. `mcpOAuth` reuses this for its own link. */
+    label?: string;
 }): import("react").JSX.Element | null;
 //# sourceMappingURL=ReportsNav.d.ts.map

package/dist/editorial/palette/ReportsNav.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ReportsNav.d.ts","sourceRoot":"","sources":["../../../src/editorial/palette/ReportsNav.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAiB1C,wBAAgB,UAAU,CAAC,EAAE,OAAY,EAAE,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,sCAiClE"}
+{"version":3,"file":"ReportsNav.d.ts","sourceRoot":"","sources":["../../../src/editorial/palette/ReportsNav.tsx"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAiB1C,wBAAgB,UAAU,CAAC,EACzB,OAAY,EACZ,KAAiB,GAClB,EAAE;IACD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,sCAiCA"}

package/dist/editorial/palette/ReportsNav.js

@@ -16,15 +16,15 @@ forumone-2026's `admin/ReportsNav.tsx`.
 registered and any the site adds: the sidebar is where editors go to reach
 content, and a report above Content pushed it down.
 */
-export function ReportsNav({ reports = [] }) {
+export function ReportsNav({ reports = [], label = 'Reports', }) {
     const pathname = usePathname();
     const { config: { routes: { admin }, }, } = useConfig();
     if (reports.length === 0)
         return null;
-    return (_jsx(NavGroup, { label: "Reports", children: reports.map(({ path, label }) => {
+    return (_jsx(NavGroup, { label: label, children: reports.map(({ path, label: text }) => {
             const href = `${admin}${path}`;
             const active = pathname === href || pathname.startsWith(`${href}/`);
-            const content = (_jsxs(_Fragment, { children: [active && _jsx("div", { className: "nav__link-indicator" }), _jsx("span", { className: "nav__link-label", children: label })] }));
+            const content = (_jsxs(_Fragment, { children: [active && _jsx("div", { className: "nav__link-indicator" }), _jsx("span", { className: "nav__link-label", children: text })] }));
             return pathname === href ? (_jsx("div", { className: "nav__link", children: content }, path)) : (_jsx(Link, { className: "nav__link", href: href, prefetch: false, children: content }, path));
         }) }));
 }

package/dist/editorial/palette/ReportsNav.js.map

@@ -1 +1 @@
-{"version":3,"file":"ReportsNav.js","sourceRoot":"","sources":["../../../src/editorial/palette/ReportsNav.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,cAAc,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD,+EAA+E;AAC/E,sCAAsC;AACtC,MAAM,IAAI,GAAG,SAAS,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;AAElF;;;;;;;;;EASE;AAEF,MAAM,UAAU,UAAU,CAAC,EAAE,OAAO,GAAG,EAAE,EAA0B;IACjE,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,EACJ,MAAM,EAAE,EACN,MAAM,EAAE,EAAE,KAAK,EAAE,GAClB,GACF,GAAG,SAAS,EAAE,CAAA;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAErC,OAAO,CACL,KAAC,QAAQ,IAAC,KAAK,EAAC,SAAS,YACtB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,CAAA;YAC9B,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;YACnE,MAAM,OAAO,GAAG,CACd,8BACG,MAAM,IAAI,cAAK,SAAS,EAAC,qBAAqB,GAAG,EAClD,eAAM,SAAS,EAAC,iBAAiB,YAAE,KAAK,GAAQ,IAC/C,CACJ,CAAA;YACD,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CACzB,cAAgB,SAAS,EAAC,WAAW,YAClC,OAAO,IADA,IAAI,CAER,CACP,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,IAAY,SAAS,EAAC,WAAW,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,YAC/D,OAAO,IADC,IAAI,CAER,CACR,CAAA;QACH,CAAC,CAAC,GACO,CACZ,CAAA;AACH,CAAC"}
+{"version":3,"file":"ReportsNav.js","sourceRoot":"","sources":["../../../src/editorial/palette/ReportsNav.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,cAAc,MAAM,cAAc,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD,+EAA+E;AAC/E,sCAAsC;AACtC,MAAM,IAAI,GAAG,SAAS,IAAI,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAA;AAElF;;;;;;;;;EASE;AAEF,MAAM,UAAU,UAAU,CAAC,EACzB,OAAO,GAAG,EAAE,EACZ,KAAK,GAAG,SAAS,GAKlB;IACC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAA;IAC9B,MAAM,EACJ,MAAM,EAAE,EACN,MAAM,EAAE,EAAE,KAAK,EAAE,GAClB,GACF,GAAG,SAAS,EAAE,CAAA;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAErC,OAAO,CACL,KAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YACnB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,IAAI,EAAE,CAAA;YAC9B,MAAM,MAAM,GAAG,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAA;YACnE,MAAM,OAAO,GAAG,CACd,8BACG,MAAM,IAAI,cAAK,SAAS,EAAC,qBAAqB,GAAG,EAClD,eAAM,SAAS,EAAC,iBAAiB,YAAE,IAAI,GAAQ,IAC9C,CACJ,CAAA;YACD,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CACzB,cAAgB,SAAS,EAAC,WAAW,YAClC,OAAO,IADA,IAAI,CAER,CACP,CAAC,CAAC,CAAC,CACF,KAAC,IAAI,IAAY,SAAS,EAAC,WAAW,EAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,YAC/D,OAAO,IADC,IAAI,CAER,CACR,CAAA;QACH,CAAC,CAAC,GACO,CACZ,CAAA;AACH,CAAC"}

package/dist/exports/rsc.d.ts

@@ -14,4 +14,5 @@ export { HealthSummary } from '../editorial/health/HealthSummary.js';
 export { ContentCalendarView } from '../editorial/calendar/ContentCalendarView.js';
 export { ContentCalendarReport } from '../editorial/calendar/ContentCalendarReport.js';
 export { YourWorkDashboard, YourWorkReport } from '../editorial/work/YourWork.js';
+export { ConnectMcpView, McpAuthorizeView } from '../mcp-oauth/admin/views.js';
 //# sourceMappingURL=rsc.d.ts.map

package/dist/exports/rsc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA"}
+{"version":3,"file":"rsc.d.ts","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAG1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAGjF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/exports/rsc.js

@@ -16,4 +16,6 @@ export { HealthSummary } from '../editorial/health/HealthSummary.js';
 export { ContentCalendarView } from '../editorial/calendar/ContentCalendarView.js';
 export { ContentCalendarReport } from '../editorial/calendar/ContentCalendarReport.js';
 export { YourWorkDashboard, YourWorkReport } from '../editorial/work/YourWork.js';
+// MCP sign-in
+export { ConnectMcpView, McpAuthorizeView } from '../mcp-oauth/admin/views.js';
 //# sourceMappingURL=rsc.js.map

package/dist/exports/rsc.js.map

@@ -1 +1 @@
-{"version":3,"file":"rsc.js","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA"}
+{"version":3,"file":"rsc.js","sourceRoot":"","sources":["../../src/exports/rsc.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,QAAQ;AACR,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAE1D,YAAY;AACZ,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAA;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AACtF,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAEjF,cAAc;AACd,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/mcp-oauth/admin/McpClientActions.d.ts

@@ -0,0 +1,15 @@
+import React from 'react';
+export declare function CopyValue({ value, label }: {
+    value: string;
+    label?: string;
+}): React.ReactNode;
+export declare function ConsentActions({ request, allow, clientLabel, }: {
+    request: string;
+    /** False when the person may not connect: only Cancel is offered. */
+    allow?: boolean;
+    clientLabel: string;
+}): React.ReactNode;
+export declare function RevokeConnectionButton({ id }: {
+    id: number | string;
+}): React.ReactNode;
+//# sourceMappingURL=McpClientActions.d.ts.map

package/dist/mcp-oauth/admin/McpClientActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpClientActions.d.ts","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/McpClientActions.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAmB,MAAM,OAAO,CAAA;AAcvC,wBAAgB,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC,SAAS,CAoB9F;AAED,wBAAgB,cAAc,CAAC,EAC7B,OAAO,EACP,KAAY,EACZ,WAAW,GACZ,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,KAAK,CAAC,SAAS,CA4ClB;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,EAAE,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,KAAK,CAAC,SAAS,CA+CvF"}

package/dist/mcp-oauth/admin/McpClientActions.js

@@ -0,0 +1,79 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { useState } from 'react';
+import { Button, useConfig } from '@payloadcms/ui';
+import { useRouter } from 'next/navigation.js';
+/*
+The three things on the MCP pages that need the browser: copying, answering
+the consent screen, and revoking a connection.
+
+The consent answer is a `fetch` followed by `location.assign`, not a form post
+that redirects. A form post's redirect to claude.ai or chatgpt.com is governed by
+the page's `form-action` CSP, which a site is right to keep to `'self'`; a
+navigation the script starts is not.
+*/
+export function CopyValue({ value, label }) {
+    const [copied, setCopied] = useState(false);
+    return (_jsxs("div", { className: "tl-mcp__copy", children: [_jsx("code", { className: "tl-mcp__value", children: value }), _jsx(Button, { buttonStyle: "secondary", size: "small", margin: false, onClick: () => {
+                    void navigator.clipboard.writeText(value).then(() => {
+                        setCopied(true);
+                        setTimeout(() => setCopied(false), 2000);
+                    });
+                }, children: copied ? 'Copied' : (label ?? 'Copy') })] }));
+}
+export function ConsentActions({ request, allow = true, clientLabel, }) {
+    const { config } = useConfig();
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    async function answer(decision) {
+        setBusy(true);
+        setError(null);
+        try {
+            const response = await fetch(`${config.serverURL ?? ''}${config.routes.api}/oauth/consent`, {
+                method: 'POST',
+                credentials: 'same-origin',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({ request, decision }),
+            });
+            const body = (await response.json());
+            if (body.redirect) {
+                window.location.assign(body.redirect);
+                return;
+            }
+            setError(body.error ?? 'Something went wrong. Start again from the app.');
+        }
+        catch {
+            setError('Something went wrong. Start again from the app.');
+        }
+        setBusy(false);
+    }
+    return (_jsxs("div", { className: "tl-mcp__actions", children: [allow && (_jsxs(Button, { buttonStyle: "primary", disabled: busy, onClick: () => void answer('allow'), children: ["Allow ", clientLabel] })), _jsx(Button, { buttonStyle: "secondary", disabled: busy, onClick: () => void answer('deny'), children: "Cancel" }), error && (_jsx("p", { className: "tl-mcp__error", role: "alert", children: error }))] }));
+}
+export function RevokeConnectionButton({ id }) {
+    const { config } = useConfig();
+    const router = useRouter();
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    return (_jsxs(_Fragment, { children: [_jsx(Button, { buttonStyle: "secondary", size: "small", margin: false, disabled: busy, onClick: () => {
+                    setBusy(true);
+                    setError(null);
+                    void fetch(`${config.serverURL ?? ''}${config.routes.api}/oauth/grants/${String(id)}/revoke`, {
+                        method: 'POST',
+                        credentials: 'same-origin',
+                    })
+                        .then(async (response) => {
+                        if (!response.ok) {
+                            const body = (await response.json().catch(() => ({})));
+                            setError(body.error ?? 'Could not disconnect it.');
+                            setBusy(false);
+                            return;
+                        }
+                        router.refresh();
+                    })
+                        .catch(() => {
+                        setError('Could not disconnect it.');
+                        setBusy(false);
+                    });
+                }, children: "Disconnect" }), error && (_jsx("span", { className: "tl-mcp__error", role: "alert", children: error }))] }));
+}
+//# sourceMappingURL=McpClientActions.js.map

package/dist/mcp-oauth/admin/McpClientActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpClientActions.js","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/McpClientActions.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ,OAAc,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AACvC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C;;;;;;;;EAQE;AAEF,MAAM,UAAU,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAqC;IAC3E,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,OAAO,CACL,eAAK,SAAS,EAAC,cAAc,aAC3B,eAAM,SAAS,EAAC,eAAe,YAAE,KAAK,GAAQ,EAC9C,KAAC,MAAM,IACL,WAAW,EAAC,WAAW,EACvB,IAAI,EAAC,OAAO,EACZ,MAAM,EAAE,KAAK,EACb,OAAO,EAAE,GAAG,EAAE;oBACZ,KAAK,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;wBAClD,SAAS,CAAC,IAAI,CAAC,CAAA;wBACf,UAAU,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;oBAC1C,CAAC,CAAC,CAAA;gBACJ,CAAC,YAEA,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,GAC/B,IACL,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAC7B,OAAO,EACP,KAAK,GAAG,IAAI,EACZ,WAAW,GAMZ;IACC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,KAAK,UAAU,MAAM,CAAC,QAA0B;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,QAAQ,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,gBAAgB,EAAE;gBAC1F,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;gBAC1B,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;aAC5C,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0C,CAAA;YAC7E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,iDAAiD,CAAC,CAAA;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,iDAAiD,CAAC,CAAA;QAC7D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,CAAA;IAChB,CAAC;IAED,OAAO,CACL,eAAK,SAAS,EAAC,iBAAiB,aAC7B,KAAK,IAAI,CACR,MAAC,MAAM,IAAC,WAAW,EAAC,SAAS,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,uBACxE,WAAW,IACX,CACV,EACD,KAAC,MAAM,IAAC,WAAW,EAAC,WAAW,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,uBAEzE,EACR,KAAK,IAAI,CACR,YAAG,SAAS,EAAC,eAAe,EAAC,IAAI,EAAC,OAAO,YACtC,KAAK,GACJ,CACL,IACG,CACP,CAAA;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAE,EAAE,EAA2B;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAgB,IAAI,CAAC,CAAA;IAEvD,OAAO,CACL,8BACE,KAAC,MAAM,IACL,WAAW,EAAC,WAAW,EACvB,IAAI,EAAC,OAAO,EACZ,MAAM,EAAE,KAAK,EACb,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,GAAG,EAAE;oBACZ,OAAO,CAAC,IAAI,CAAC,CAAA;oBACb,QAAQ,CAAC,IAAI,CAAC,CAAA;oBACd,KAAK,KAAK,CACR,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,EAAE,CAAC,SAAS,EACjF;wBACE,MAAM,EAAE,MAAM;wBACd,WAAW,EAAE,aAAa;qBAC3B,CACF;yBACE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;wBACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;4BACjB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAuB,CAAA;4BAC5E,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,0BAA0B,CAAC,CAAA;4BAClD,OAAO,CAAC,KAAK,CAAC,CAAA;4BACd,OAAM;wBACR,CAAC;wBACD,MAAM,CAAC,OAAO,EAAE,CAAA;oBAClB,CAAC,CAAC;yBACD,KAAK,CAAC,GAAG,EAAE;wBACV,QAAQ,CAAC,0BAA0B,CAAC,CAAA;wBACpC,OAAO,CAAC,KAAK,CAAC,CAAA;oBAChB,CAAC,CAAC,CAAA;gBACN,CAAC,2BAGM,EACR,KAAK,IAAI,CACR,eAAM,SAAS,EAAC,eAAe,EAAC,IAAI,EAAC,OAAO,YACzC,KAAK,GACD,CACR,IACA,CACJ,CAAA;AACH,CAAC"}

package/dist/mcp-oauth/admin/styles.d.ts

@@ -0,0 +1,2 @@
+export declare const MCP_CSS = "\n.tl-mcp { max-width: 52rem; padding-bottom: calc(var(--base) * 3); }\n.tl-mcp h1 { margin-bottom: calc(var(--base) * 0.5); }\n.tl-mcp__lede { font-size: 1.05rem; color: var(--theme-elevation-800); }\n.tl-mcp__section { margin-top: calc(var(--base) * 2); padding-top: var(--base); border-top: 1px solid var(--theme-elevation-100); }\n.tl-mcp__section h2 { font-size: 1.15rem; margin-bottom: calc(var(--base) * 0.5); }\n.tl-mcp__section ol, .tl-mcp__section ul { padding-left: 1.25rem; }\n.tl-mcp__section li { margin-bottom: calc(var(--base) * 0.4); }\n.tl-mcp__copy { display: flex; flex-wrap: wrap; align-items: center; gap: calc(var(--base) * 0.5); margin: calc(var(--base) * 0.5) 0; }\n.tl-mcp__value { padding: calc(var(--base) * 0.4) calc(var(--base) * 0.6); border: 1px solid var(--theme-elevation-150); border-radius: var(--style-radius-s); background: var(--theme-elevation-50); font-size: 0.9rem; overflow-wrap: anywhere; }\n.tl-mcp__button { display: inline-block; padding: calc(var(--base) * 0.4) calc(var(--base) * 0.9); border-radius: var(--style-radius-s); background: var(--theme-elevation-900); color: var(--theme-elevation-0); text-decoration: none; font-weight: 600; }\n.tl-mcp__button:hover, .tl-mcp__button:focus-visible { background: var(--theme-elevation-750); color: var(--theme-elevation-0); }\n.tl-mcp__note { color: var(--theme-elevation-600); font-size: 0.9rem; }\n.tl-mcp__notice { padding: calc(var(--base) * 0.6) var(--base); border-left: 3px solid var(--theme-warning-500); background: var(--theme-warning-50, var(--theme-elevation-50)); }\n.tl-mcp__error { color: var(--theme-error-500); margin: 0; }\n.tl-mcp__actions { display: flex; flex-wrap: wrap; align-items: center; gap: calc(var(--base) * 0.5); margin-top: calc(var(--base) * 1.5); }\n.tl-mcp__tools { list-style: none; padding: 0; }\n.tl-mcp__tools li { margin-bottom: calc(var(--base) * 0.4); }\n.tl-mcp__table { width: 100%; border-collapse: collapse; }\n.tl-mcp__table th, .tl-mcp__table td { text-align: left; padding: calc(var(--base) * 0.4) calc(var(--base) * 0.5); border-bottom: 1px solid var(--theme-elevation-100); vertical-align: middle; }\n.tl-mcp__table th { font-weight: 600; color: var(--theme-elevation-700); }\n";
+//# sourceMappingURL=styles.d.ts.map

package/dist/mcp-oauth/admin/styles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.d.ts","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/styles.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,OAAO,mrEAqBnB,CAAA"}

package/dist/mcp-oauth/admin/styles.js

@@ -0,0 +1,27 @@
+/*
+The MCP pages' styles, in Payload's tokens, rendered as a React 19
+`<style href precedence>` like the editorial views'.
+*/
+export const MCP_CSS = `
+.tl-mcp { max-width: 52rem; padding-bottom: calc(var(--base) * 3); }
+.tl-mcp h1 { margin-bottom: calc(var(--base) * 0.5); }
+.tl-mcp__lede { font-size: 1.05rem; color: var(--theme-elevation-800); }
+.tl-mcp__section { margin-top: calc(var(--base) * 2); padding-top: var(--base); border-top: 1px solid var(--theme-elevation-100); }
+.tl-mcp__section h2 { font-size: 1.15rem; margin-bottom: calc(var(--base) * 0.5); }
+.tl-mcp__section ol, .tl-mcp__section ul { padding-left: 1.25rem; }
+.tl-mcp__section li { margin-bottom: calc(var(--base) * 0.4); }
+.tl-mcp__copy { display: flex; flex-wrap: wrap; align-items: center; gap: calc(var(--base) * 0.5); margin: calc(var(--base) * 0.5) 0; }
+.tl-mcp__value { padding: calc(var(--base) * 0.4) calc(var(--base) * 0.6); border: 1px solid var(--theme-elevation-150); border-radius: var(--style-radius-s); background: var(--theme-elevation-50); font-size: 0.9rem; overflow-wrap: anywhere; }
+.tl-mcp__button { display: inline-block; padding: calc(var(--base) * 0.4) calc(var(--base) * 0.9); border-radius: var(--style-radius-s); background: var(--theme-elevation-900); color: var(--theme-elevation-0); text-decoration: none; font-weight: 600; }
+.tl-mcp__button:hover, .tl-mcp__button:focus-visible { background: var(--theme-elevation-750); color: var(--theme-elevation-0); }
+.tl-mcp__note { color: var(--theme-elevation-600); font-size: 0.9rem; }
+.tl-mcp__notice { padding: calc(var(--base) * 0.6) var(--base); border-left: 3px solid var(--theme-warning-500); background: var(--theme-warning-50, var(--theme-elevation-50)); }
+.tl-mcp__error { color: var(--theme-error-500); margin: 0; }
+.tl-mcp__actions { display: flex; flex-wrap: wrap; align-items: center; gap: calc(var(--base) * 0.5); margin-top: calc(var(--base) * 1.5); }
+.tl-mcp__tools { list-style: none; padding: 0; }
+.tl-mcp__tools li { margin-bottom: calc(var(--base) * 0.4); }
+.tl-mcp__table { width: 100%; border-collapse: collapse; }
+.tl-mcp__table th, .tl-mcp__table td { text-align: left; padding: calc(var(--base) * 0.4) calc(var(--base) * 0.5); border-bottom: 1px solid var(--theme-elevation-100); vertical-align: middle; }
+.tl-mcp__table th { font-weight: 600; color: var(--theme-elevation-700); }
+`;
+//# sourceMappingURL=styles.js.map

package/dist/mcp-oauth/admin/styles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"styles.js","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/styles.ts"],"names":[],"mappings":"AAAA;;;EAGE;AACF,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBtB,CAAA"}

package/dist/mcp-oauth/admin/views.d.ts

@@ -0,0 +1,4 @@
+import type { AdminViewServerProps } from 'payload';
+export declare function ConnectMcpView(props: AdminViewServerProps): Promise<import("react").JSX.Element>;
+export declare function McpAuthorizeView(props: AdminViewServerProps): Promise<import("react").JSX.Element>;
+//# sourceMappingURL=views.d.ts.map

package/dist/mcp-oauth/admin/views.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.d.ts","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/views.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AA6FnD,wBAAsB,cAAc,CAAC,KAAK,EAAE,oBAAoB,wCA8N/D;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,oBAAoB,wCA0EjE"}

package/dist/mcp-oauth/admin/views.js

@@ -0,0 +1,99 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { DefaultTemplate } from '@payloadcms/next/templates';
+import { Gutter } from '@payloadcms/ui';
+import { redirect } from 'next/navigation.js';
+import { isLoopback, MCP_CLIENT_RULES } from '../clients.js';
+import { unseal } from '../crypto.js';
+import { keys, mcpOAuthRuntime, MCP_ACCESS_SLUG, MCP_OAUTH_GRANTS_SLUG, readPolicy, toolsFor, } from '../runtime.js';
+import { resolveClient } from '../store.js';
+import { ConsentActions, CopyValue, RevokeConnectionButton } from './McpClientActions.js';
+import { MCP_CSS } from './styles.js';
+function Styles() {
+    return (_jsx("style", { href: "throughline-mcp", precedence: "default", children: MCP_CSS }));
+}
+function Page({ props, children }) {
+    const { initPageResult, params, searchParams, payload, i18n } = props;
+    const { req, permissions, locale, visibleEntities } = initPageResult;
+    return (_jsxs(DefaultTemplate, { i18n: i18n, ...(locale ? { locale } : {}), ...(params ? { params } : {}), payload: payload, permissions: permissions, req: req, ...(searchParams ? { searchParams } : {}), user: req.user, visibleEntities: visibleEntities, children: [_jsx(Styles, {}), _jsx(Gutter, { className: "tl-mcp", children: children })] }));
+}
+function signedInOrLogin(props, here) {
+    const user = props.initPageResult.req.user;
+    if (!user) {
+        const admin = props.payload.config.routes.admin;
+        redirect(`${admin}/login?redirect=${encodeURIComponent(here)}`);
+    }
+    return user;
+}
+function firstSentence(text) {
+    const match = /^(.+?[.!?])(\s|$)/.exec(text);
+    return (match?.[1] ?? text).trim();
+}
+function when(value) {
+    if (typeof value !== 'string')
+        return '—';
+    const date = new Date(value);
+    return Number.isNaN(date.getTime())
+        ? '—'
+        : date.toLocaleString('en-US', { dateStyle: 'medium', timeStyle: 'short' });
+}
+function claudeAddUrl(runtime) {
+    // Claude's add-connector form, filled in. Two spellings of the parameters
+    // are in use; both are sent, and an unknown one is ignored.
+    const url = new URL('https://claude.ai/customize/connectors');
+    url.searchParams.set('modal', 'add-custom-connector');
+    url.searchParams.set('connectorName', runtime.serverName);
+    url.searchParams.set('connectorUrl', runtime.resource);
+    url.searchParams.set('mcpName', runtime.serverName);
+    url.searchParams.set('mcpServerUrl', runtime.resource);
+    return url.toString();
+}
+export async function ConnectMcpView(props) {
+    const { payload } = props;
+    const runtime = mcpOAuthRuntime(payload.config);
+    const admin = payload.config.routes.admin;
+    const user = signedInOrLogin(props, `${admin}${runtime.connectPath}`);
+    const policy = await readPolicy(payload, runtime);
+    const verdict = runtime.eligible(user);
+    const isAdmin = runtime.isAdmin(user);
+    const { docs: connections } = await payload.find({
+        collection: MCP_OAUTH_GRANTS_SLUG,
+        where: {
+            and: [{ user: { equals: user['id'] } }, { status: { not_equals: 'pending' } }],
+        },
+        sort: '-connectedAt',
+        limit: 50,
+        depth: 0,
+        overrideAccess: true,
+    });
+    const tools = toolsFor(user, policy, runtime);
+    return (_jsxs(Page, { props: props, children: [_jsx("h1", { children: "Connect MCP" }), _jsxs("p", { className: "tl-mcp__lede", children: ["Connect Claude", policy.clients.chatgpt ? ', ChatGPT' : '', " or Claude Code to", ' ', runtime.serverName, ", and draft, check and publish content by asking. The app works as you: it can do what you can do here, and everything it does is recorded under your name."] }), verdict !== true ? (_jsxs("p", { className: "tl-mcp__notice", children: ["You can\u2019t connect an app yet. ", verdict] })) : (_jsxs(_Fragment, { children: [_jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "The server\u2019s address" }), _jsxs("p", { children: ["Every app asks for this. You sign in with your usual ", runtime.serverName, " login; there is no key to copy."] }), _jsx(CopyValue, { value: runtime.resource, label: "Copy address" })] }), policy.clients.claude && (_jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "Claude \u2014 on the web, the desktop app and mobile" }), runtime.claudeConnector === 'organization' ? (_jsxs("ol", { children: [_jsx("li", { children: _jsx("a", { className: "tl-mcp__button", href: "https://claude.ai/customize/connectors", target: "_blank", rel: "noopener noreferrer", children: "Open Claude\u2019s connectors" }) }), _jsxs("li", { children: ["Find ", _jsx("strong", { children: runtime.serverName }), ", marked ", _jsx("em", { children: "Custom" }), ", and click", ' ', _jsx("strong", { children: "Connect" }), "."] }), _jsxs("li", { children: ["Claude sends you here to sign in. Check what it asks for and click", ' ', _jsx("strong", { children: "Allow" }), "."] })] })) : (_jsxs("ol", { children: [_jsxs("li", { children: [_jsxs("a", { className: "tl-mcp__button", href: claudeAddUrl(runtime), target: "_blank", rel: "noopener noreferrer", children: ["Add ", runtime.serverName, " to Claude"] }), ' ', "\u2014 the form opens with the name and address filled in. If it opens empty, paste the address above."] }), _jsxs("li", { children: ["Click ", _jsx("strong", { children: "Add" }), ", then ", _jsx("strong", { children: "Connect" }), "."] }), _jsxs("li", { children: ["Claude sends you here to sign in. Check what it asks for and click", ' ', _jsx("strong", { children: "Allow" }), "."] })] })), _jsxs("p", { className: "tl-mcp__note", children: ["One connection works everywhere you use Claude: claude.ai, the desktop app and the mobile apps.", runtime.claudeConnector === 'organization' && (_jsxs(_Fragment, { children: [' ', "Using a personal Claude account instead?", ' ', _jsx("a", { href: claudeAddUrl(runtime), target: "_blank", rel: "noopener noreferrer", children: "Add it to your own account" }), "."] }))] })] })), policy.clients.claudeCode && (_jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "Claude Code" }), _jsx("p", { children: "In a terminal:" }), _jsx(CopyValue, { value: `claude mcp add --transport http ${runtime.claudeCodeName} ${runtime.resource}` }), _jsxs("p", { children: ["Then, inside Claude Code, run ", _jsx("code", { children: "/mcp" }), ", choose", ' ', _jsx("strong", { children: runtime.claudeCodeName }), " and sign in. Your browser opens here; click ", _jsx("strong", { children: "Allow" }), "."] })] })), policy.clients.chatgpt && (_jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "ChatGPT" }), _jsx("p", { children: "ChatGPT has no install link, so this takes a few steps, once:" }), _jsxs("ol", { children: [_jsxs("li", { children: ["In ChatGPT, open ", _jsx("strong", { children: "Settings \u2192 Apps" }), " (or", ' ', _jsx("strong", { children: "Apps & Connectors" }), ") \u2192 ", _jsx("strong", { children: "Advanced settings" }), ", and turn on ", _jsx("strong", { children: "Developer mode" }), "."] }), _jsxs("li", { children: ["Back in ", _jsx("strong", { children: "Apps" }), ", choose ", _jsx("strong", { children: "Create" }), ". Name it", ' ', runtime.serverName, ", paste the address above as the", ' ', _jsx("strong", { children: "MCP server URL" }), ", and choose ", _jsx("strong", { children: "OAuth" }), " for authentication."] }), _jsxs("li", { children: ["ChatGPT sends you here to sign in. Check what it asks for and click", ' ', _jsx("strong", { children: "Allow" }), "."] })] }), _jsx("p", { className: "tl-mcp__note", children: "ChatGPT asks you to confirm before each change it makes. Content you work on goes to your ChatGPT account, under its own data settings." })] })), _jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "What a connected app can use" }), _jsx("p", { children: tools.length === 0
+                                    ? 'Nothing yet: an administrator has not chosen any tools for your role.'
+                                    : tools.join(', ') })] })] })), _jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "Your connected apps" }), connections.length === 0 ? (_jsx("p", { children: "None yet." })) : (_jsxs("table", { className: "tl-mcp__table", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { children: "App" }), _jsx("th", { children: "Connected" }), _jsx("th", { children: "Last used" }), _jsx("th", { children: "Status" }), _jsx("th", {})] }) }), _jsx("tbody", { children: connections.map((grant) => (_jsxs("tr", { children: [_jsx("td", { children: String(grant['clientName']) }), _jsx("td", { children: when(grant['connectedAt']) }), _jsx("td", { children: when(grant['lastUsedAt']) }), _jsx("td", { children: grant['status'] === 'active'
+                                                ? 'Connected'
+                                                : `Disconnected${grant['revokedReason'] ? ` — ${String(grant['revokedReason'])}` : ''}` }), _jsx("td", { children: grant['status'] === 'active' && (_jsx(RevokeConnectionButton, { id: grant['id'] })) })] }, String(grant['id'])))) })] }))] }), isAdmin && (_jsxs("section", { className: "tl-mcp__section", children: [_jsx("h2", { children: "For administrators" }), _jsxs("ul", { children: [_jsxs("li", { children: [_jsx("a", { href: `${admin}/collections/${MCP_OAUTH_GRANTS_SLUG}`, children: "Everyone\u2019s connected apps" }), ' ', "\u2014 and disconnect any of them."] }), _jsxs("li", { children: [_jsx("a", { href: `${admin}/globals/${MCP_ACCESS_SLUG}`, children: "MCP access" }), " \u2014 which apps may connect, and which tools each role gets."] }), _jsxs("li", { children: [_jsx("a", { href: `${admin}/collections/payload-mcp-api-keys`, children: "API keys" }), " \u2014 for scripts, and for choosing tools key by key."] })] })] }))] }));
+}
+export async function McpAuthorizeView(props) {
+    const { payload, searchParams } = props;
+    const runtime = mcpOAuthRuntime(payload.config);
+    const admin = payload.config.routes.admin;
+    const sealed = typeof searchParams?.['request'] === 'string' ? searchParams['request'] : undefined;
+    const here = `${admin}${runtime.connectPath}/authorize${sealed ? `?request=${encodeURIComponent(sealed)}` : ''}`;
+    const user = signedInOrLogin(props, here);
+    const request = unseal(keys(payload).request, sealed);
+    if (!request) {
+        return (_jsxs(Page, { props: props, children: [_jsx("h1", { children: "This sign-in link has expired" }), _jsx("p", { children: "Go back to the app and connect again." })] }));
+    }
+    const policy = await readPolicy(payload, runtime);
+    const client = await resolveClient(payload, policy, request.clientId);
+    if ('error' in client) {
+        return (_jsxs(Page, { props: props, children: [_jsx("h1", { children: "This app can\u2019t connect" }), _jsx("p", { children: client.error })] }));
+    }
+    const label = MCP_CLIENT_RULES[client.kind].label;
+    const verdict = runtime.eligible(user);
+    const served = new Map(runtime.tools.map((tool) => [tool.name, tool.description ?? '']));
+    const tools = toolsFor(user, policy, runtime);
+    const name = String(user['name'] ?? user['email'] ?? 'you');
+    const host = new URL(request.redirectUri).host;
+    return (_jsxs(Page, { props: props, children: [_jsxs("h1", { children: ["Connect ", label, " to ", runtime.serverName, "?"] }), verdict !== true ? (_jsx("p", { className: "tl-mcp__notice", children: verdict })) : (_jsxs(_Fragment, { children: [_jsxs("p", { className: "tl-mcp__lede", children: [label, " will work as ", _jsx("strong", { children: name }), ". It can do what you can do in", ' ', runtime.serverName, ", through the tools below, and everything it does is recorded under your name. Publishing still follows your role and any approval a page needs."] }), isLoopback(request.redirectUri) && (_jsx("p", { className: "tl-mcp__notice", children: "This connection signs in through an app on your own computer. Only allow it if you have just started connecting from Claude Code, or another app you trust." })), _jsx("ul", { className: "tl-mcp__tools", children: tools.map((tool) => (_jsxs("li", { children: [_jsx("code", { children: tool }), " ", firstSentence(served.get(tool) ?? '')] }, tool))) }), _jsxs("p", { className: "tl-mcp__note", children: ["After you allow it, you go back to ", _jsx("strong", { children: host }), ". You can disconnect it at any time from ", _jsx("a", { href: `${admin}${runtime.connectPath}`, children: "Connect MCP" }), "."] })] })), _jsx(ConsentActions, { request: sealed, allow: verdict === true, clientLabel: label })] }));
+}
+//# sourceMappingURL=views.js.map

package/dist/mcp-oauth/admin/views.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../src/mcp-oauth/admin/views.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAG7C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EACL,IAAI,EACJ,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,UAAU,EACV,QAAQ,GAET,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAuB,MAAM,aAAa,CAAA;AAChE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAA;AACzF,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAerC,SAAS,MAAM;IACb,OAAO,CACL,gBAAO,IAAI,EAAC,iBAAiB,EAAC,UAAU,EAAC,SAAS,YAC/C,OAAO,GACF,CACT,CAAA;AACH,CAAC;AAED,SAAS,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAwD;IACrF,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAA;IACrE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,cAAc,CAAA;IACpE,OAAO,CACL,MAAC,eAAe,IACd,IAAI,EAAE,IAAI,KACN,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC1B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC9B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,GAAG,KACJ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC1C,IAAI,EAAE,GAAG,CAAC,IAAoC,EAC9C,eAAe,EAAE,eAAe,aAEhC,KAAC,MAAM,KAAG,EACV,KAAC,MAAM,IAAC,SAAS,EAAC,QAAQ,YAAE,QAAQ,GAAU,IAC9B,CACnB,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAA2B,EAAE,IAAY;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,IAAiC,CAAA;IACvE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAA;QAC/C,QAAQ,CAAC,GAAG,KAAK,mBAAmB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5C,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;AACpC,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB;IAC5C,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,wCAAwC,CAAC,CAAA;IAC7D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAA;IACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACtD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA2B;IAC9D,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IACzB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACrE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAErC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QAC/C,UAAU,EAAE,qBAA8B;QAC1C,KAAK,EAAE;YACL,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC;SACtE;QACV,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,CAAC;QACR,cAAc,EAAE,IAAI;KACrB,CAAC,CAAA;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAE7C,OAAO,CACL,MAAC,IAAI,IAAC,KAAK,EAAE,KAAK,aAChB,uCAAoB,EACpB,aAAG,SAAS,EAAC,cAAc,+BACV,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,wBAAoB,GAAG,EAC9E,OAAO,CAAC,UAAU,mKAEjB,EAEH,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAClB,aAAG,SAAS,EAAC,gBAAgB,oDAAgC,OAAO,IAAK,CAC1E,CAAC,CAAC,CAAC,CACF,8BACE,mBAAS,SAAS,EAAC,iBAAiB,aAClC,qDAA6B,EAC7B,iFACwD,OAAO,CAAC,UAAU,wCAEtE,EACJ,KAAC,SAAS,IAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAC,cAAc,GAAG,IACnD,EAET,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,CACxB,mBAAS,SAAS,EAAC,iBAAiB,aAClC,gFAAwD,EACvD,OAAO,CAAC,eAAe,KAAK,cAAc,CAAC,CAAC,CAAC,CAC5C,yBACE,uBACE,YACE,SAAS,EAAC,gBAAgB,EAC1B,IAAI,EAAC,wCAAwC,EAC7C,MAAM,EAAC,QAAQ,EACf,GAAG,EAAC,qBAAqB,8CAGvB,GACD,EACL,kCACO,2BAAS,OAAO,CAAC,UAAU,GAAU,eAAS,kCAAe,iBAAY,GAAG,EACjF,uCAAwB,SACrB,EACL,+FACqE,GAAG,EACtE,qCAAsB,SACnB,IACF,CACN,CAAC,CAAC,CAAC,CACF,yBACE,yBACE,aACE,SAAS,EAAC,gBAAgB,EAC1B,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAC3B,MAAM,EAAC,QAAQ,EACf,GAAG,EAAC,qBAAqB,qBAEpB,OAAO,CAAC,UAAU,kBACrB,EAAC,GAAG,8GAGL,EACL,mCACQ,mCAAoB,aAAO,uCAAwB,SACtD,EACL,+FACqE,GAAG,EACtE,qCAAsB,SACnB,IACF,CACN,EACD,aAAG,SAAS,EAAC,cAAc,gHAGxB,OAAO,CAAC,eAAe,KAAK,cAAc,IAAI,CAC7C,8BACG,GAAG,8CACqC,GAAG,EAC5C,YAAG,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,EAAC,QAAQ,EAAC,GAAG,EAAC,qBAAqB,2CAErE,SAEH,CACJ,IACC,IACI,CACX,EAEA,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,CAC5B,mBAAS,SAAS,EAAC,iBAAiB,aAClC,uCAAoB,EACpB,yCAAqB,EACrB,KAAC,SAAS,IACR,KAAK,EAAE,mCAAmC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,EAAE,GACtF,EACF,0DACgC,kCAAiB,cAAS,GAAG,EAC3D,2BAAS,OAAO,CAAC,cAAc,GAAU,mDACnC,qCAAsB,SAC1B,IACI,CACX,EAEA,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,CACzB,mBAAS,SAAS,EAAC,iBAAiB,aAClC,mCAAgB,EAChB,wFAAoE,EACpE,yBACE,8CACmB,oDAAgC,UAAK,GAAG,EACzD,iDAAsC,eAAI,iDAAkC,oBACpE,8CAA+B,SACpC,EACL,qCACU,oCAAqB,eAAS,sCAAuB,eAAU,GAAG,EACzE,OAAO,CAAC,UAAU,sCAAkC,GAAG,EACxD,8CAA+B,mBAAa,qCAAsB,4BAE/D,EACL,gGACsE,GAAG,EACvE,qCAAsB,SACnB,IACF,EACL,YAAG,SAAS,EAAC,cAAc,wJAGvB,IACI,CACX,EAED,mBAAS,SAAS,EAAC,iBAAiB,aAClC,wDAAqC,EACrC,sBACG,KAAK,CAAC,MAAM,KAAK,CAAC;oCACjB,CAAC,CAAC,uEAAuE;oCACzE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAClB,IACI,IACT,CACJ,EAED,mBAAS,SAAS,EAAC,iBAAiB,aAClC,+CAA4B,EAC3B,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAC1B,oCAAgB,CACjB,CAAC,CAAC,CAAC,CACF,iBAAO,SAAS,EAAC,eAAe,aAC9B,0BACE,yBACE,+BAAY,EACZ,qCAAkB,EAClB,qCAAkB,EAClB,kCAAe,EACf,cAAM,IACH,GACC,EACR,0BACI,WAAoC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACpD,yBACE,uBAAK,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAM,EACtC,uBAAK,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAM,EACrC,uBAAK,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAM,EACpC,uBACG,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;gDAC3B,CAAC,CAAC,WAAW;gDACb,CAAC,CAAC,eAAe,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,GACtF,EACL,uBACG,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAC/B,KAAC,sBAAsB,IAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAoB,GAAI,CAC/D,GACE,KAbE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAcvB,CACN,CAAC,GACI,IACF,CACT,IACO,EAET,OAAO,IAAI,CACV,mBAAS,SAAS,EAAC,iBAAiB,aAClC,8CAA2B,EAC3B,yBACE,yBACE,YAAG,IAAI,EAAE,GAAG,KAAK,gBAAgB,qBAAqB,EAAE,+CAEpD,EAAC,GAAG,0CAEL,EACL,yBACE,YAAG,IAAI,EAAE,GAAG,KAAK,YAAY,eAAe,EAAE,2BAAgB,uEAE3D,EACL,yBACE,YAAG,IAAI,EAAE,GAAG,KAAK,mCAAmC,yBAAc,+DAE/D,IACF,IACG,CACX,IACI,CACR,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAA2B;IAChE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,KAAK,CAAA;IACvC,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAA;IACzC,MAAM,MAAM,GAAG,OAAO,YAAY,EAAE,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAClG,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,OAAO,CAAC,WAAW,aAAa,MAAM,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IAChH,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAEzC,MAAM,OAAO,GAAG,MAAM,CAAiB,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACrE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,CACL,MAAC,IAAI,IAAC,KAAK,EAAE,KAAK,aAChB,yDAAsC,EACtC,gEAA4C,IACvC,CACR,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;IACrE,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CACL,MAAC,IAAI,IAAC,KAAK,EAAE,KAAK,aAChB,uDAA+B,EAC/B,sBAAI,MAAM,CAAC,KAAK,GAAK,IAChB,CACR,CAAA;IACH,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAG,IAAiC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAC/F,CAAA;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAA;IAE9C,OAAO,CACL,MAAC,IAAI,IAAC,KAAK,EAAE,KAAK,aAChB,qCACW,KAAK,UAAM,OAAO,CAAC,UAAU,SACnC,EACJ,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAClB,YAAG,SAAS,EAAC,gBAAgB,YAAE,OAAO,GAAK,CAC5C,CAAC,CAAC,CAAC,CACF,8BACE,aAAG,SAAS,EAAC,cAAc,aACxB,KAAK,oBAAe,2BAAS,IAAI,GAAU,oCAA+B,GAAG,EAC7E,OAAO,CAAC,UAAU,wJAEjB,EACH,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAClC,YAAG,SAAS,EAAC,gBAAgB,4KAGzB,CACL,EACD,aAAI,SAAS,EAAC,eAAe,YAC1B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CACnB,yBACE,yBAAO,IAAI,GAAQ,OAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KADnD,IAAI,CAER,CACN,CAAC,GACC,EACL,aAAG,SAAS,EAAC,cAAc,oDACU,2BAAS,IAAI,GAAU,+CAChD,YAAG,IAAI,EAAE,GAAG,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,4BAAiB,SAClE,IACH,CACJ,EACD,KAAC,cAAc,IAAC,OAAO,EAAE,MAAgB,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,WAAW,EAAE,KAAK,GAAI,IACrF,CACR,CAAA;AACH,CAAC"}

package/dist/mcp-oauth/auth.d.ts

@@ -0,0 +1,12 @@
+import { type PayloadRequest } from 'payload';
+import { type McpOAuthRuntime } from './runtime.js';
+/** The shape `plugin-mcp` resolves a request to. Declared structurally: it is not a dependency here. */
+export interface McpAccessSettings {
+    user: Record<string, unknown>;
+    'payload-mcp-tool'?: Record<string, boolean>;
+    'payload-mcp-prompt'?: Record<string, boolean>;
+    [key: string]: unknown;
+}
+export type OverrideAuth = (req: PayloadRequest, getDefaultMcpAccessSettings: (overrideApiKey?: null | string) => Promise<McpAccessSettings>) => Promise<McpAccessSettings>;
+export declare function createOverrideAuth(runtime: McpOAuthRuntime): OverrideAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/mcp-oauth/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAGhE,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,cAAc,CAAA;AA0BrB,wGAAwG;AACxG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,cAAc,EACnB,2BAA2B,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,GAAG,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,KACxF,OAAO,CAAC,iBAAiB,CAAC,CAAA;AAyB/B,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,eAAe,GAAG,YAAY,CAiCzE"}

package/dist/mcp-oauth/auth.js

@@ -0,0 +1,56 @@
+import { UnauthorizedError } from 'payload';
+import { TOKEN_PREFIX } from './crypto.js';
+import { protectedResourceMetadataUrl } from './metadata.js';
+import { MCP_OAUTH_STRATEGY, readPolicy, toCamelCase, toolsFor, } from './runtime.js';
+import { authenticateAccessToken } from './store.js';
+function challenge(req, runtime, error, description) {
+    const parts = [
+        ...(error ? [`error="${error}"`] : []),
+        // A header value is Latin-1; a site's refusal may be prose with curly quotes.
+        ...(description
+            ? [
+                `error_description="${description.replace(/[’‘]/g, "'").replace(/[^\x20-\x7e]|["\\]/g, '')}"`,
+            ]
+            : []),
+        `resource_metadata="${protectedResourceMetadataUrl(runtime)}"`,
+        'scope="mcp"',
+    ];
+    const headers = req.responseHeaders ?? new Headers();
+    headers.set('WWW-Authenticate', `Bearer ${parts.join(', ')}`);
+    req.responseHeaders = headers;
+    throw new UnauthorizedError();
+}
+export function createOverrideAuth(runtime) {
+    return async (req, getDefault) => {
+        const header = req.headers.get('authorization') ?? '';
+        const bearer = header.startsWith('Bearer ') ? header.slice('Bearer '.length).trim() : '';
+        if (!bearer)
+            challenge(req, runtime);
+        if (bearer.startsWith(TOKEN_PREFIX.access)) {
+            const policy = await readPolicy(req.payload, runtime);
+            const result = await authenticateAccessToken(req.payload, runtime, policy, bearer);
+            if ('reason' in result)
+                challenge(req, runtime, 'invalid_token', result.reason);
+            const tools = toolsFor(result.user, policy, runtime);
+            return {
+                user: { ...result.user, collection: runtime.users, _strategy: MCP_OAUTH_STRATEGY },
+                'payload-mcp-tool': Object.fromEntries(tools.map((name) => [toCamelCase(name), true])),
+                'payload-mcp-prompt': Object.fromEntries(runtime.prompts.map((prompt) => [toCamelCase(prompt.name), true])),
+            };
+        }
+        let settings;
+        try {
+            settings = await getDefault();
+        }
+        catch {
+            challenge(req, runtime, 'invalid_token', 'The token is not valid.');
+        }
+        if (runtime.recheckApiKeyHolders) {
+            const verdict = runtime.eligible(settings.user);
+            if (verdict !== true)
+                challenge(req, runtime, 'invalid_token', verdict);
+        }
+        return settings;
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/mcp-oauth/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/mcp-oauth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAuB,MAAM,SAAS,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,WAAW,EACX,QAAQ,GAET,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAA;AAsCpD,SAAS,SAAS,CAChB,GAAmB,EACnB,OAAwB,EACxB,KAAc,EACd,WAAoB;IAEpB,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,8EAA8E;QAC9E,GAAG,CAAC,WAAW;YACb,CAAC,CAAC;gBACE,sBAAsB,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,GAAG;aAC9F;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sBAAsB,4BAA4B,CAAC,OAAO,CAAC,GAAG;QAC9D,aAAa;KACd,CAAA;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,eAAe,IAAI,IAAI,OAAO,EAAE,CAAA;IACpD,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC7D,GAAG,CAAC,eAAe,GAAG,OAAO,CAAA;IAC7B,MAAM,IAAI,iBAAiB,EAAE,CAAA;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAwB;IACzD,OAAO,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;QACxF,IAAI,CAAC,MAAM;YAAE,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QAEpC,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;YACrD,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;YAClF,IAAI,QAAQ,IAAI,MAAM;gBAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;YAE/E,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;YACpD,OAAO;gBACL,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE;gBAClF,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACtF,oBAAoB,EAAE,MAAM,CAAC,WAAW,CACtC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAClE;aACF,CAAA;QACH,CAAC;QAED,IAAI,QAA2B,CAAA;QAC/B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,UAAU,EAAE,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,yBAAyB,CAAC,CAAA;QACrE,CAAC;QACD,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;YAC/C,IAAI,OAAO,KAAK,IAAI;gBAAE,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAA;QACzE,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;AACH,CAAC"}

package/dist/mcp-oauth/cimd.d.ts

@@ -0,0 +1,13 @@
+export interface ClientMetadataDocument {
+    client_id: string;
+    client_name?: string;
+    redirect_uris: string[];
+}
+/** Whether `clientId` is the kind of URL this server will fetch. */
+export declare function isMetadataDocumentUrl(clientId: string): boolean;
+export type FetchLike = (url: string, init: RequestInit) => Promise<Response>;
+/** The document at `clientId`, or why it could not be used. */
+export declare function fetchClientMetadata(clientId: string, fetchImpl?: FetchLike): Promise<ClientMetadataDocument | {
+    error: string;
+}>;
+//# sourceMappingURL=cimd.d.ts.map

package/dist/mcp-oauth/cimd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cimd.d.ts","sourceRoot":"","sources":["../../src/mcp-oauth/cimd.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAKD,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAgB/D;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE7E,+DAA+D;AAC/D,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAiB,GAC3B,OAAO,CAAC,sBAAsB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAqDrD"}