@iblai/data-layer 1.37.0 → 1.38.0

package/dist/src/features/mcp/constants.d.ts

@@ -53,5 +53,21 @@ export declare const MCP_ENDPOINTS: {
         readonly path: (org: string, userId: string) => string;
         readonly service: SERVICES.DM;
     };
+    readonly MCP_SERVER_PREFERENCE: {
+        readonly path: (org: string, userId: string, id: number) => string;
+        readonly service: SERVICES.DM;
+    };
+    readonly MCP_SERVER_SESSION_PREFERENCE: {
+        readonly path: (org: string, userId: string, id: number) => string;
+        readonly service: SERVICES.DM;
+    };
+    readonly MCP_SERVER_MENTOR_AUTH_SCOPE: {
+        readonly path: (org: string, userId: string, id: number) => string;
+        readonly service: SERVICES.DM;
+    };
+    readonly MCP_SERVER_CREDENTIALS: {
+        readonly path: (org: string, userId: string, id: number) => string;
+        readonly service: SERVICES.DM;
+    };
 };
-export declare const MCP_TAG_TYPES: readonly ["MCPServers", "ConnectedServices", "MCPServerConnections"];
+export declare const MCP_TAG_TYPES: readonly ["MCPServers", "ConnectedServices", "MCPServerConnections", "MCPServerPreferences", "MCPServerCredentials"];

package/dist/src/features/mcp/types.d.ts

@@ -12,6 +12,8 @@ export interface GetMCPServersParams extends MCPBaseParams {
     page?: number;
     pageSize?: number;
     search?: string;
+    /** Makes each server's `user_enabled` reflect that conversation's choices. */
+    sessionId?: string;
     transport?: TransportEnum;
     url?: string;
 }
@@ -59,10 +61,63 @@ export interface MCPServer {
     connected_service_summary?: Record<string, unknown> | null;
     oauth_service_data?: OAuthServiceData | null;
     mentor?: string | null;
+    is_featured?: boolean;
+    /** When false the server is never used, whatever the agent or user chose. */
+    is_enabled?: boolean;
+    /** When false the server is mandatory: users cannot turn it off. */
+    user_can_disable?: boolean;
+    /**
+     * Whether the server is on for the caller after their permanent and, when
+     * the list was requested with `sessionId`, per-conversation choices.
+     */
+    user_enabled?: boolean;
+    /** The agent's override of `auth_scope`; present when listed with `mentorUniqueId`. */
+    mentor_auth_scope?: string | null;
+    /** The credential scope in force for that agent; present when listed with `mentorUniqueId`. */
+    effective_auth_scope?: string;
+    /**
+     * Set on a connector seeded from the MCP directory (`source: "registry"`): the
+     * organization cannot edit or delete it, only choose how it signs in per agent.
+     */
+    registry?: MCPServerRegistry | null;
     created_at: string;
     updated_at?: string;
     permissions?: MCPServerPermissions;
 }
+export interface MCPServerRegistry {
+    name: string;
+    version?: string;
+    namespace?: string;
+    source: 'registry' | string;
+    trust_tier?: string;
+    status?: string;
+    website_url?: string;
+    icon_url?: string;
+    transport_deprecated?: boolean;
+    auth_kind?: string;
+    supports_dcr?: boolean | null;
+    setup?: string;
+    declared_headers?: string[];
+}
+/** The credential scopes the API accepts; `platform` is the organization-wide one. */
+export type MCPAuthScope = 'user' | 'mentor' | 'platform';
+/** How a server signs in for one agent (guide §5.9). */
+export interface MCPServerMentorAuthScope {
+    server: number;
+    mentor: string;
+    /** The agent's override; null means the server's own `auth_scope`. */
+    auth_scope: MCPAuthScope | null;
+    server_auth_scope: MCPAuthScope | string;
+    effective_auth_scope: MCPAuthScope | string;
+}
+export interface GetMCPServerMentorAuthScopeParams extends MCPServerParams {
+    /** Agent unique id (uuid). */
+    mentor: string;
+}
+export interface SetMCPServerMentorAuthScopeParams extends GetMCPServerMentorAuthScopeParams {
+    /** null restores the server's own scope. */
+    authScope: MCPAuthScope | null;
+}
 export interface PaginatedMCPServerList {
     count: number;
     next: string | null;
@@ -80,6 +135,9 @@ export interface MCPServerRequestBody {
     extra_headers?: Record<string, string>;
     oauth_service?: number | null;
     mentor?: string | null;
+    /** False makes the server mandatory: users cannot turn it off. Default true. */
+    user_can_disable?: boolean;
+    is_enabled?: boolean;
 }
 export interface CreateMCPServerArgs extends MCPBaseParams {
     body?: MCPServerRequestBody;
@@ -96,6 +154,33 @@ export interface PartialUpdateMCPServerArgs extends MCPServerParams {
 export interface OAuthServiceParams {
     org: string;
 }
+/** One sign-in service of a provider, as `GET /api/ai-account/orgs/{org}/oauth-services/` lists them. */
+export interface OAuthServiceSummary {
+    id: number;
+    oauth_provider: string;
+    oauth_provider_id: number;
+    name: string;
+    display_name: string;
+    description?: string;
+    scope?: string;
+    image?: string | null;
+    created_at?: string;
+    updated_at?: string;
+}
+/** A sign-in provider the platform knows, with its services (`services[].id` is an MCP server's `oauth_service`). */
+export interface OAuthProviderSummary {
+    id: number;
+    name: string;
+    description?: string;
+    url?: string;
+    image?: string | null;
+    auth_url?: string;
+    token_url?: string;
+    is_enabled?: boolean;
+    services: OAuthServiceSummary[];
+    created_at?: string;
+    updated_at?: string;
+}
 export interface ConnectedServicesParams extends MCPBaseParams {
 }
 export interface StartOAuthFlowParams extends MCPBaseParams {
@@ -160,7 +245,20 @@ export interface ConnectedService {
 export interface OAuthFindParams extends MCPBaseParams {
     url: string;
     name?: string;
+    /** The redirect URI; required with `client_id`, as registered in the vendor's console. */
     callback_url?: string;
+    /**
+     * The organization's own OAuth app, for when automatic registration fails
+     * (guide §5.4). Every field below is accepted only together with it.
+     */
+    client_id?: string;
+    /** `""` for a public client. */
+    client_secret?: string;
+    /** Only for a server that publishes no sign-in settings; send both or neither. */
+    authorization_url?: string;
+    token_url?: string;
+    token_endpoint_auth_method?: MCPTokenEndpointAuthMethod;
+    scopes?: string[];
 }
 export interface OAuthFindResponse {
     id: number;
@@ -174,3 +272,116 @@ export interface OAuthFindResponse {
     created_at: string;
     updated_at: string;
 }
+export interface MCPServerPreference {
+    server: number;
+    /** The stored choice; `null` when the user never chose. */
+    is_enabled: boolean | null;
+    user_can_disable: boolean;
+    /** Whether the server is used for this user. */
+    effective_is_enabled: boolean;
+}
+export interface SetMCPServerPreferenceParams extends MCPServerParams {
+    isEnabled: boolean;
+}
+export interface MCPServerSessionPreference {
+    server: number;
+    session_id: string;
+    /** The stored choice for this conversation; `null` when the user never chose. */
+    is_enabled: boolean | null;
+    /** The user's permanent choice. */
+    user_is_enabled: boolean | null;
+    user_can_disable: boolean;
+    /** Whether the server is used in this conversation. */
+    effective_is_enabled: boolean;
+}
+export interface GetMCPServerSessionPreferenceParams extends MCPServerParams {
+    sessionId: string;
+}
+export interface SetMCPServerSessionPreferenceParams extends MCPServerParams {
+    sessionId: string;
+    isEnabled: boolean;
+}
+export type MCPOAuthClientSource = 'dcr' | 'manual' | 'legacy_backfill';
+export type MCPTokenEndpointAuthMethod = 'client_secret_post' | 'client_secret_basic' | 'none';
+export interface MCPServerOAuthCredentials {
+    auth_type: 'oauth2';
+    configured: boolean;
+    /** Users can already sign in through a client shared by ibl.ai; one of your own is optional. */
+    shared_client_allowed: boolean;
+    source?: MCPOAuthClientSource;
+    client_id?: string;
+    /** Masked, e.g. "****89"; `""` for a public client. */
+    client_secret?: string | null;
+    redirect_uri?: string;
+    scopes?: string[];
+    token_endpoint_auth_method?: MCPTokenEndpointAuthMethod | string;
+    authorization_params?: Record<string, string>;
+    token_params?: Record<string, string>;
+    /** The organization's endpoint overrides; `""` when the discovered ones are used. */
+    authorization_url?: string;
+    token_url?: string;
+    client_secret_expires_at?: string | null;
+    updated_at?: string;
+}
+export interface MCPServerApiKeyCredentials {
+    auth_type: 'token';
+    configured: boolean;
+    /** Masked, e.g. "****9f". */
+    api_key?: string;
+    authorization_scheme?: string;
+    header_name?: string;
+    updated_at?: string;
+}
+export type MCPServerCredentials = MCPServerOAuthCredentials | MCPServerApiKeyCredentials;
+export interface SetMCPServerOAuthCredentialsBody {
+    client_id: string;
+    /** Required on the first save; omit to keep the stored one, `""` for a public client. */
+    client_secret?: string;
+    redirect_uri: string;
+    scopes?: string[];
+    token_endpoint_auth_method?: MCPTokenEndpointAuthMethod;
+    authorization_params?: Record<string, string>;
+    token_params?: Record<string, string>;
+    /** Omit to keep the stored overrides; `""` goes back to the discovered endpoints. */
+    authorization_url?: string;
+    token_url?: string;
+}
+export interface SetMCPServerApiKeyCredentialsBody {
+    /** Required on the first save; omit to keep the stored one. */
+    api_key?: string;
+    authorization_scheme?: string;
+    /** Blank for `Authorization`. */
+    header_name?: string;
+}
+export interface SetMCPServerCredentialsParams extends MCPServerParams {
+    body: SetMCPServerOAuthCredentialsBody | SetMCPServerApiKeyCredentialsBody;
+}
+export interface OAuthFindDiagnosticAttempt {
+    step: string;
+    url: string | null;
+    status_code: number | null;
+    outcome: string;
+    detail: string;
+}
+export type OAuthFindFailedStep = 'mcp_server_url' | 'authorization_server_metadata' | 'client_registration' | 'provider_name_conflict' | 'tenant_client_configured'
+/** The organization's own app was refused; `hint` says why. */
+ | 'manual_client' | 'internal_error';
+export interface OAuthFindDiagnostic {
+    succeeded: boolean;
+    failed_step: OAuthFindFailedStep | string | null;
+    hint: string;
+    /** The check ran out of time; the backend then refuses an organization's own app. */
+    timed_out?: boolean;
+    discovered?: {
+        authorization_endpoint?: string;
+        token_endpoint?: string;
+        registration_endpoint?: string;
+        scopes_supported?: string[];
+        token_endpoint_auth_methods_supported?: string[];
+    };
+    attempts?: OAuthFindDiagnosticAttempt[];
+}
+export interface OAuthFindErrorBody {
+    error: string;
+    diagnostic?: OAuthFindDiagnostic;
+}