@forwardreach/saas-mcp 0.1.0

package/README.md

@@ -0,0 +1,7 @@
+# @forwardreach/saas-mcp
+
+This package is published for use by ReachMe.chat, PeopleThread, and approved ReachMe/PeopleThread partners.
+
+It is not intended as a general-purpose public package. Full integration and development documentation is maintained in the private `forwardreach/saas-shared` repository for users with access:
+
+https://github.com/forwardreach/saas-shared/blob/main/docs/packages/saas-mcp.md

package/dist/client/index.d.ts

@@ -0,0 +1 @@
+export * from "./management.js";

package/dist/client/index.js

@@ -0,0 +1 @@
+export * from "./management.js";

package/dist/client/management.d.ts

@@ -0,0 +1,80 @@
+import type { McpAuditEventFilters, McpAuditEventListResponse, McpConnectionDetailResponse, McpConnectionListResponse, McpConnectionRevokeResponse, McpCreateDeveloperTokenInput, McpDeveloperTokenCreateResponse, McpDeveloperTokenListResponse, McpDeveloperTokenRevokeResponse, McpScopeValue } from "../core/types.js";
+/**
+ * Product-specific management route overrides used by the shared settings UI.
+ *
+ * Defaults are `/workspaces/{workspaceId}/mcp/...`; products mounted under a
+ * prefix such as `/api` should override these paths or provide an `apiBaseUrl`.
+ */
+export interface McpManagementClientRoutes {
+    /** GET: list connected OAuth grants. */
+    connections?: string;
+    /** GET: connection detail for one OAuth grant. */
+    connectionDetail?: (grantId: string) => string;
+    /** POST: revoke one OAuth grant and its active tokens. */
+    revokeConnection?: (grantId: string) => string;
+    /** GET/POST: list or create developer tokens. */
+    developerTokens?: string;
+    /** POST: revoke one developer token. */
+    revokeDeveloperToken?: (tokenId: string) => string;
+    /** GET: list audit events with query-string filters. */
+    auditEvents?: string;
+}
+/** Configuration for creating a browser-safe MCP management client. */
+export interface CreateMcpManagementClientOptions {
+    /** Optional absolute API origin/base path; omitted paths resolve against the current origin. */
+    apiBaseUrl?: string;
+    /** Workspace whose MCP settings are being managed. */
+    workspaceId: string;
+    /** Fetch implementation, useful for tests or non-browser runtimes. */
+    fetch?: typeof globalThis.fetch;
+    /** Static or lazy request headers, for example CSRF or product auth headers. */
+    headers?: HeadersInit | (() => HeadersInit | Promise<HeadersInit>);
+    /** Optional product route overrides. */
+    routes?: McpManagementClientRoutes;
+}
+/**
+ * Browser-side contract consumed by the MCP settings components (`McpConnectedClients`, `McpDeveloperTokens`, `McpActivity`).
+ *
+ * Products may use `createMcpManagementClient` or provide their own object with
+ * the same shape when they need custom transport, auth, caching, or error
+ * handling.
+ */
+export interface McpManagementClient<S extends McpScopeValue = McpScopeValue> {
+    /** List OAuth connections for the workspace. */
+    listConnections(input?: {
+        userId?: string;
+        includeRevoked?: boolean;
+    }): Promise<McpConnectionListResponse<S>>;
+    /** Load one OAuth connection and its recent activity. */
+    getConnection(grantId: string, input?: {
+        userId?: string;
+        includeRevoked?: boolean;
+    }): Promise<McpConnectionDetailResponse<S>>;
+    /** Revoke an OAuth grant for the workspace. */
+    revokeConnection(grantId: string, input?: {
+        userId?: string;
+        reason?: string | null;
+    }): Promise<McpConnectionRevokeResponse<S>>;
+    /** List manually created developer tokens for the workspace. */
+    listDeveloperTokens(input?: {
+        userId?: string;
+        includeRevoked?: boolean;
+    }): Promise<McpDeveloperTokenListResponse<S>>;
+    /** Create a developer token and return its one-time raw secret. */
+    createDeveloperToken(input: McpCreateDeveloperTokenInput<S>): Promise<McpDeveloperTokenCreateResponse<S>>;
+    /** Revoke a developer token without affecting OAuth grants. */
+    revokeDeveloperToken(tokenId: string, input?: {
+        userId?: string;
+        reason?: string | null;
+    }): Promise<McpDeveloperTokenRevokeResponse<S>>;
+    /** List audit events using server-side filters where supported by the product. */
+    listAuditEvents(filters?: McpAuditEventFilters): Promise<McpAuditEventListResponse>;
+}
+/**
+ * Create a fetch-based client for the shared MCP management API shape.
+ *
+ * The client sends JSON bodies for mutations, serializes filters as query
+ * parameters for list endpoints, and throws an Error when the server responds
+ * with a non-2xx status.
+ */
+export declare function createMcpManagementClient<S extends McpScopeValue = McpScopeValue>(options: CreateMcpManagementClientOptions): McpManagementClient<S>;

package/dist/client/management.js

@@ -0,0 +1,78 @@
+function defaultRoutes(workspaceId) {
+    const workspaceBase = `/workspaces/${encodeURIComponent(workspaceId)}/mcp`;
+    return {
+        connections: `${workspaceBase}/connections`,
+        connectionDetail: (grantId) => `${workspaceBase}/connections/${encodeURIComponent(grantId)}`,
+        revokeConnection: (grantId) => `${workspaceBase}/connections/${encodeURIComponent(grantId)}/revoke`,
+        developerTokens: `${workspaceBase}/developer-tokens`,
+        revokeDeveloperToken: (tokenId) => `${workspaceBase}/developer-tokens/${encodeURIComponent(tokenId)}/revoke`,
+        auditEvents: `${workspaceBase}/audit-events`
+    };
+}
+function urlWithQuery(apiBaseUrl, path, query) {
+    const url = new URL(path, apiBaseUrl ? `${apiBaseUrl.replace(/\/+$/, "")}/` : globalThis.location?.origin ?? "http://localhost");
+    for (const [key, value] of Object.entries(query ?? {})) {
+        if (value !== undefined && value !== null && value !== "")
+            url.searchParams.set(key, String(value));
+    }
+    if (!apiBaseUrl && path.startsWith("/"))
+        return `${url.pathname}${url.search}`;
+    return url.toString();
+}
+async function resolvedHeaders(headers) {
+    return typeof headers === "function" ? await headers() : headers ?? {};
+}
+async function parseJsonResponse(response) {
+    if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        const message = typeof body.error === "string" ? body.error : `MCP management request failed with ${response.status}`;
+        throw new Error(message);
+    }
+    return (await response.json());
+}
+/**
+ * Create a fetch-based client for the shared MCP management API shape.
+ *
+ * The client sends JSON bodies for mutations, serializes filters as query
+ * parameters for list endpoints, and throws an Error when the server responds
+ * with a non-2xx status.
+ */
+export function createMcpManagementClient(options) {
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const routes = { ...defaultRoutes(options.workspaceId), ...(options.routes ?? {}) };
+    async function request(path, init = {}, query) {
+        const headers = await resolvedHeaders(options.headers);
+        const response = await fetchImpl(urlWithQuery(options.apiBaseUrl, path, query), {
+            ...init,
+            headers: {
+                ...headers,
+                ...(init.body ? { "content-type": "application/json" } : {}),
+                ...(init.headers ?? {})
+            }
+        });
+        return parseJsonResponse(response);
+    }
+    return {
+        listConnections(input = {}) {
+            return request(routes.connections, {}, input);
+        },
+        getConnection(grantId, input = {}) {
+            return request(routes.connectionDetail(grantId), {}, input);
+        },
+        revokeConnection(grantId, input = {}) {
+            return request(routes.revokeConnection(grantId), { method: "POST", body: JSON.stringify(input) });
+        },
+        listDeveloperTokens(input = {}) {
+            return request(routes.developerTokens, {}, input);
+        },
+        createDeveloperToken(input) {
+            return request(routes.developerTokens, { method: "POST", body: JSON.stringify(input) });
+        },
+        revokeDeveloperToken(tokenId, input = {}) {
+            return request(routes.revokeDeveloperToken(tokenId), { method: "POST", body: JSON.stringify(input) });
+        },
+        listAuditEvents(filters = {}) {
+            return request(routes.auditEvents, {}, filters);
+        }
+    };
+}

package/dist/core/http.d.ts

@@ -0,0 +1,27 @@
+/** Inputs checked before accepting a remote HTTP MCP request. */
+export interface McpHttpEnvelopeInput {
+    url: URL;
+    method: string;
+    headers: Headers;
+    requireHttps: boolean;
+    allowedOrigins: readonly string[];
+    allowedHosts: readonly string[];
+    supportedProtocolVersions: readonly string[];
+    forwardedProto?: string | null;
+}
+/** Result of transport-level MCP HTTP validation. */
+export type McpHttpEnvelopeValidation = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    message: string;
+    reason: "query_token" | "https_required" | "invalid_host" | "invalid_origin" | "unsupported_protocol";
+};
+/**
+ * Validate request-level MCP transport constraints before parsing JSON-RPC.
+ *
+ * This guards against unsupported protocol versions, insecure production
+ * traffic, untrusted hosts/origins, and access tokens sent in query strings.
+ */
+export declare function validateMcpHttpEnvelope(input: McpHttpEnvelopeInput): McpHttpEnvelopeValidation;

package/dist/core/http.js

@@ -0,0 +1,29 @@
+import { isLocalOrigin } from "./urls.js";
+/**
+ * Validate request-level MCP transport constraints before parsing JSON-RPC.
+ *
+ * This guards against unsupported protocol versions, insecure production
+ * traffic, untrusted hosts/origins, and access tokens sent in query strings.
+ */
+export function validateMcpHttpEnvelope(input) {
+    if (input.url.searchParams.has("access_token")) {
+        return { ok: false, status: 401, message: "Access tokens in the query string are not accepted", reason: "query_token" };
+    }
+    const isSecure = input.forwardedProto ? input.forwardedProto === "https" : input.url.protocol === "https:";
+    if (input.requireHttps && !isSecure && !isLocalOrigin(input.url.origin)) {
+        return { ok: false, status: 400, message: "HTTPS is required for remote MCP requests", reason: "https_required" };
+    }
+    const host = input.headers.get("host");
+    if (input.allowedHosts.length > 0 && (!host || !input.allowedHosts.includes(host))) {
+        return { ok: false, status: 403, message: "Invalid Host header", reason: "invalid_host" };
+    }
+    const origin = input.headers.get("origin");
+    if (origin && input.allowedOrigins.length > 0 && !input.allowedOrigins.includes("*") && !input.allowedOrigins.includes(origin)) {
+        return { ok: false, status: 403, message: "Invalid Origin header", reason: "invalid_origin" };
+    }
+    const protocolVersion = input.headers.get("mcp-protocol-version");
+    if (protocolVersion && !input.supportedProtocolVersions.includes(protocolVersion)) {
+        return { ok: false, status: 400, message: "Unsupported MCP protocol version", reason: "unsupported_protocol" };
+    }
+    return { ok: true };
+}

package/dist/core/index.d.ts

@@ -0,0 +1,5 @@
+export * from "./http.js";
+export * from "./redaction.js";
+export * from "./scopes.js";
+export * from "./types.js";
+export * from "./urls.js";

package/dist/core/index.js

@@ -0,0 +1,5 @@
+export * from "./http.js";
+export * from "./redaction.js";
+export * from "./scopes.js";
+export * from "./types.js";
+export * from "./urls.js";

package/dist/core/redaction.d.ts

@@ -0,0 +1,11 @@
+import type { McpAuditEvent, McpConnectionSummary } from "./types.js";
+/** Marker used when secret-bearing audit metadata is removed. */
+export declare const MCP_REDACTION_MARKER = "[redacted]";
+/** Return whether a metadata key is likely to contain token or secret data. */
+export declare function isSensitiveMcpMetadataKey(key: string): boolean;
+/** Recursively redact secret-bearing MCP audit metadata before display. */
+export declare function sanitizeMcpAuditMetadata(value: unknown): unknown;
+/** Return an audit event with sanitized metadata. */
+export declare function sanitizeMcpAuditEvent(event: McpAuditEvent): McpAuditEvent;
+/** Return a connection summary with sanitized recent audit events. */
+export declare function sanitizeMcpConnection<S extends string>(connection: McpConnectionSummary<S>): McpConnectionSummary<S>;

package/dist/core/redaction.js

@@ -0,0 +1,43 @@
+/** Marker used when secret-bearing audit metadata is removed. */
+export const MCP_REDACTION_MARKER = "[redacted]";
+const sensitiveKeyMatchers = [
+    "authorization",
+    "authorization_code",
+    "authorizationcode",
+    "bearer",
+    "code",
+    "cookie",
+    "headers",
+    "secret",
+    "token",
+    "access_token",
+    "accesstoken",
+    "refresh_token",
+    "refreshtoken",
+    "set-cookie"
+];
+/** Return whether a metadata key is likely to contain token or secret data. */
+export function isSensitiveMcpMetadataKey(key) {
+    const normalized = key.toLowerCase().replace(/[\s.-]+/g, "_");
+    return sensitiveKeyMatchers.some((matcher) => normalized === matcher || normalized.endsWith(`_${matcher}`) || normalized.includes(matcher));
+}
+/** Recursively redact secret-bearing MCP audit metadata before display. */
+export function sanitizeMcpAuditMetadata(value) {
+    if (Array.isArray(value))
+        return value.map(sanitizeMcpAuditMetadata);
+    if (!value || typeof value !== "object")
+        return value;
+    return Object.fromEntries(Object.entries(value).map(([key, child]) => {
+        if (isSensitiveMcpMetadataKey(key))
+            return [key, MCP_REDACTION_MARKER];
+        return [key, sanitizeMcpAuditMetadata(child)];
+    }));
+}
+/** Return an audit event with sanitized metadata. */
+export function sanitizeMcpAuditEvent(event) {
+    return { ...event, metadata: sanitizeMcpAuditMetadata(event.metadata) };
+}
+/** Return a connection summary with sanitized recent audit events. */
+export function sanitizeMcpConnection(connection) {
+    return { ...connection, recentAuditEvents: connection.recentAuditEvents.map(sanitizeMcpAuditEvent) };
+}

package/dist/core/scopes.d.ts

@@ -0,0 +1,13 @@
+import type { McpScopeValue, McpToolDescriptor } from "./types.js";
+/** Normalize a scope string or array to supported, de-duplicated scopes. */
+export declare function normalizeMcpScopes<S extends McpScopeValue>(value: string | readonly string[] | null | undefined, supportedScopes: readonly S[]): S[];
+/** Format granted scopes for OAuth responses or metadata. */
+export declare function formatMcpScopeString<S extends McpScopeValue>(scopes: readonly S[]): string;
+/** Return whether all required scopes are present in a granted scope set. */
+export declare function hasRequiredMcpScopes<S extends McpScopeValue>(granted: readonly S[], required: readonly S[]): boolean;
+/** Filter tool descriptors to only those allowed by a granted scope set. */
+export declare function filterMcpToolsByScopes<S extends McpScopeValue, T extends McpToolDescriptor<S>>(tools: readonly T[], scopes: readonly S[]): T[];
+/** Resolve requested OAuth scopes, falling back to defaults when none are supplied. */
+export declare function requestedMcpScopes<S extends McpScopeValue>(value: string | null | undefined, allowedScopes: readonly S[], defaultScopes: readonly S[]): S[];
+/** Return whether a raw OAuth scope string includes any unsupported scope. */
+export declare function includesUnsupportedMcpScope<S extends McpScopeValue>(value: string | undefined, allowedScopes: readonly S[]): boolean;

package/dist/core/scopes.js

@@ -0,0 +1,35 @@
+/** Normalize a scope string or array to supported, de-duplicated scopes. */
+export function normalizeMcpScopes(value, supportedScopes) {
+    const raw = typeof value === "string" ? value.split(/\s+/) : value ?? [];
+    const requested = new Set(raw.map((scope) => scope.trim()).filter(Boolean));
+    return supportedScopes.filter((scope, index) => supportedScopes.indexOf(scope) === index && requested.has(scope));
+}
+/** Format granted scopes for OAuth responses or metadata. */
+export function formatMcpScopeString(scopes) {
+    return [...new Set(scopes)].join(" ");
+}
+/** Return whether all required scopes are present in a granted scope set. */
+export function hasRequiredMcpScopes(granted, required) {
+    const grantedSet = new Set(granted);
+    return required.every((scope) => grantedSet.has(scope));
+}
+/** Filter tool descriptors to only those allowed by a granted scope set. */
+export function filterMcpToolsByScopes(tools, scopes) {
+    return tools.filter((tool) => hasRequiredMcpScopes(scopes, tool.requiredScopes));
+}
+/** Resolve requested OAuth scopes, falling back to defaults when none are supplied. */
+export function requestedMcpScopes(value, allowedScopes, defaultScopes) {
+    const scopes = normalizeMcpScopes(value, allowedScopes);
+    return scopes.length > 0 ? scopes : [...defaultScopes];
+}
+/** Return whether a raw OAuth scope string includes any unsupported scope. */
+export function includesUnsupportedMcpScope(value, allowedScopes) {
+    if (!value)
+        return false;
+    const allowed = new Set(allowedScopes);
+    return value
+        .split(/\s+/)
+        .map((scope) => scope.trim())
+        .filter(Boolean)
+        .some((scope) => !allowed.has(scope));
+}

package/dist/core/types.d.ts

@@ -0,0 +1,256 @@
+export type McpScopeValue = string;
+export type McpTokenSourceKind = "oauth" | "personal_access_token" | (string & {});
+export type McpActivityKind = "read" | "write" | "management" | (string & {});
+export type McpAuditOutcome = "created" | "updated" | "matched" | "rejected" | "revoked" | "error" | "partial_success" | (string & {});
+/** Product human user shape used in MCP grants, consent, tokens, and audit events. */
+export interface McpUser {
+    id: string;
+    authProviderKey?: string | null;
+    authIssuer?: string | null;
+    authSubject?: string | null;
+    email: string | null;
+    emailVerified?: boolean | null;
+    displayName: string | null;
+    imageUrl?: string | null;
+}
+/** Tenant/workspace shape used to bind every MCP grant and tool call. */
+export interface McpWorkspace {
+    id: string;
+    displayName: string;
+    kind?: string | null;
+}
+/** Product-owned membership context for a user inside one workspace. */
+export interface McpWorkspaceMembership {
+    workspaceId: string;
+    userId: string;
+    role?: string | null;
+    capabilities?: readonly string[];
+    joinedAt?: string | null;
+    lastActiveAt?: string | null;
+}
+/** Signed-in human identity plus the selected workspace for consent/management. */
+export interface McpHumanIdentityContext {
+    user: McpUser;
+    workspace: McpWorkspace;
+    membership: McpWorkspaceMembership;
+    sessionFresh?: boolean;
+}
+/** User-facing definition of one supported MCP scope. */
+export interface McpScopeDefinition<S extends McpScopeValue = McpScopeValue> {
+    scope: S;
+    title: string;
+    description: string;
+}
+/** MCP tool annotations mirrored from the MCP SDK shape for portable descriptors. */
+export interface McpToolAnnotations {
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint?: boolean;
+    [key: string]: unknown;
+}
+/** Product-neutral descriptor for an MCP tool shown in consent/settings UI. */
+export interface McpToolDescriptor<S extends McpScopeValue = McpScopeValue> {
+    name: string;
+    title: string;
+    description: string;
+    requiredScopes: readonly S[];
+    activityKind?: McpActivityKind;
+    annotations?: McpToolAnnotations;
+}
+/** Product-neutral descriptor for an MCP resource shown in the tool reference. */
+export interface McpResourceDescriptor<S extends McpScopeValue = McpScopeValue> {
+    name: string;
+    uri: string;
+    title: string;
+    description: string;
+    requiredScopes: readonly S[];
+}
+/** Product-neutral descriptor for an MCP prompt shown in the tool reference. */
+export interface McpPromptDescriptor<S extends McpScopeValue = McpScopeValue> {
+    name: string;
+    title: string;
+    description: string;
+    requiredScopes: readonly S[];
+}
+/** Persisted OAuth client registered by a remote MCP client. */
+export interface OAuthClientRecord<S extends McpScopeValue = McpScopeValue> {
+    id: string;
+    name: string;
+    displayName: string;
+    redirectUris: readonly string[];
+    scopes: readonly S[];
+    createdAt: string;
+    revokedAt?: string | null;
+    revokedByUserId?: string | null;
+    revokedReason?: string | null;
+}
+/** Persisted, hashed, single-use authorization code created after consent. */
+export interface OAuthAuthorizationCodeRecord<S extends McpScopeValue = McpScopeValue> {
+    id: string;
+    codeHash: string;
+    clientId: string;
+    redirectUri: string;
+    workspaceId: string;
+    userId: string;
+    scopes: readonly S[];
+    resource: string;
+    codeChallenge: string;
+    codeChallengeMethod: "S256";
+    expiresAt: string;
+    createdAt: string;
+    consumedAt: string | null;
+}
+/** Persisted, hashed MCP access or refresh token. */
+export interface OAuthTokenRecord<S extends McpScopeValue = McpScopeValue> {
+    id: string;
+    tokenHash: string;
+    kind: "access" | "refresh";
+    grantId: string;
+    clientId: string;
+    workspaceId: string;
+    userId: string;
+    scopes: readonly S[];
+    resource: string;
+    sourceKind: McpTokenSourceKind;
+    displayName: string | null;
+    expiresAt: string;
+    createdAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    revokedByUserId: string | null;
+    revokedReason: string | null;
+}
+/** Product session record for initialized Streamable HTTP MCP sessions. */
+export interface McpSessionRecord<S extends McpScopeValue = McpScopeValue> {
+    id: string;
+    accessTokenId: string;
+    clientId: string;
+    workspaceId: string;
+    userId: string;
+    scopes: readonly S[];
+    protocolVersion: string | null;
+    createdAt: string;
+    lastSeenAt: string;
+    closedAt: string | null;
+}
+/** Auditable externally authorized MCP activity. */
+export interface McpAuditEvent {
+    id: string;
+    workspaceId: string;
+    userId: string;
+    clientId: string;
+    accessTokenId: string | null;
+    sourceKind: McpTokenSourceKind;
+    activityKind: McpActivityKind;
+    toolName: string;
+    targetRecordIds: string[];
+    outcome: McpAuditOutcome;
+    metadata: Record<string, unknown>;
+    createdAt: string;
+}
+/** Settings-page summary of one OAuth connection/grant. */
+export interface McpConnectionSummary<S extends McpScopeValue = McpScopeValue> {
+    grantId: string;
+    workspaceId: string;
+    userId: string;
+    userEmail: string | null;
+    clientId: string;
+    clientName: string;
+    redirectOrigin: string | null;
+    redirectUris: string[];
+    scopes: S[];
+    resource: string;
+    tokenSourceKind: "oauth";
+    createdAt: string;
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    revokedByUserId: string | null;
+    activeSessionCount: number;
+    tokenCount: number;
+    recentAuditEvents: McpAuditEvent[];
+}
+/** Settings-page summary of one manually created developer token. */
+export interface McpDeveloperTokenSummary<S extends McpScopeValue = McpScopeValue> {
+    tokenId: string;
+    workspaceId: string;
+    userId: string;
+    userEmail: string | null;
+    name: string;
+    scopes: S[];
+    resource: string;
+    sourceKind: "personal_access_token";
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    revokedByUserId: string | null;
+    expired: boolean;
+}
+/** Connector details displayed to users and advertised to MCP clients. */
+export interface McpConnectorConfig<S extends McpScopeValue = McpScopeValue> {
+    connectorUrl: string;
+    appBaseUrl: string;
+    resourceUri: string;
+    publicHttpsReady: boolean;
+    scopes: McpScopeDefinition<S>[];
+    tools: McpToolDescriptor<S>[];
+}
+/** Combined connector details for a workspace settings page. */
+export interface McpConnectorDetails<S extends McpScopeValue = McpScopeValue> {
+    workspace: McpWorkspace;
+    user: McpUser;
+    connector: McpConnectorConfig<S>;
+}
+/** Server-side filters accepted by the shared audit-event management endpoint. */
+export interface McpAuditEventFilters {
+    userId?: string;
+    clientId?: string;
+    accessTokenId?: string;
+    sourceKind?: McpTokenSourceKind;
+    toolName?: string;
+    outcome?: McpAuditOutcome;
+    activityKind?: McpActivityKind;
+    limit?: number;
+}
+/** Request body for creating a developer token. */
+export interface McpCreateDeveloperTokenInput<S extends McpScopeValue = McpScopeValue> {
+    userId?: string;
+    name: string;
+    scopes: readonly S[];
+    expiresAt?: string;
+    expiresInDays?: number;
+}
+/** Developer-token create response; rawToken must be displayed once and not stored. */
+export interface McpCreateDeveloperTokenResult<S extends McpScopeValue = McpScopeValue> {
+    token: McpDeveloperTokenSummary<S>;
+    rawToken: string;
+}
+/** Response body for listing OAuth connections. */
+export interface McpConnectionListResponse<S extends McpScopeValue = McpScopeValue> {
+    connections: McpConnectionSummary<S>[];
+}
+/** Response body for loading one OAuth connection. */
+export interface McpConnectionDetailResponse<S extends McpScopeValue = McpScopeValue> {
+    connection: McpConnectionSummary<S>;
+}
+/** Response body for listing developer tokens. */
+export interface McpDeveloperTokenListResponse<S extends McpScopeValue = McpScopeValue> {
+    tokens: McpDeveloperTokenSummary<S>[];
+}
+/** Response body for creating a developer token. */
+export interface McpDeveloperTokenCreateResponse<S extends McpScopeValue = McpScopeValue> extends McpCreateDeveloperTokenResult<S> {
+}
+/** Response body for revoking a developer token. */
+export interface McpDeveloperTokenRevokeResponse<S extends McpScopeValue = McpScopeValue> {
+    token: McpDeveloperTokenSummary<S>;
+}
+/** Response body for revoking an OAuth connection. */
+export interface McpConnectionRevokeResponse<S extends McpScopeValue = McpScopeValue> {
+    connection: McpConnectionSummary<S>;
+}
+/** Response body for listing audit events. */
+export interface McpAuditEventListResponse {
+    events: McpAuditEvent[];
+}

package/dist/core/types.js

@@ -0,0 +1 @@
+export {};