@narrative.io/data-collaboration-sdk-ts 4.1.0 → 4.2.0

package/build/mcp-connections/index.d.ts

@@ -6,7 +6,10 @@ import type { CreateMcpConnectionRequest, ListMcpConnectionsResponse, McpConnect
  * can reference it by id via `mcp_servers[].connection_id`. Tokens are never returned by the API.
  *
  * The OAuth callback (`GET /mcp-connections/callback`) is a browser redirect, not an SDK call, so
- * it is intentionally not wrapped here.
+ * it is intentionally not wrapped here. It only stores the authorization code and redirects; the
+ * app then calls {@link McpConnectionsApi.completeMcpConnection} to finish, authenticated as the
+ * user who began the flow. Because the callback is public, it is not allowed to complete anything
+ * itself — otherwise a `state` alone could turn another user's consent into a stored token.
  */
 export declare class McpConnectionsApi extends BaseApi {
     /**
@@ -21,6 +24,20 @@ export declare class McpConnectionsApi extends BaseApi {
      * `authorization_url` the user must visit to consent.
      */
     createMcpConnection(request: CreateMcpConnectionRequest): Promise<McpConnectionCreatedResponse>;
+    /**
+     * Completes a connection begun with {@link McpConnectionsApi.createMcpConnection}, once the user
+     * has consented and the OAuth callback has stored the authorization code. Exchanges that code and
+     * validates the connection with a `tools/list` call before storing the tokens.
+     *
+     * Must be called with the credentials of the user who began the flow — the `state` on its own is
+     * not enough.
+     * @param {string} state - The one-time `state` the OAuth callback forwarded to the app.
+     * @returns {Promise<McpConnectionSummary>} The connection's status view, normally `connected`.
+     * Rejects with 404 if the connection does not exist or belongs to another user; 400 if the
+     * `state` is unknown or expired, the authorization code has not arrived yet, or the token
+     * exchange or validation failed.
+     */
+    completeMcpConnection(state: string): Promise<McpConnectionSummary>;
     /**
      * Fetches one of the calling user's connections.
      * @param {string} connectionId - The connection id.

package/build/mcp-connections/index.js

@@ -6,7 +6,10 @@ const resourceName = "mcp-connections";
  * can reference it by id via `mcp_servers[].connection_id`. Tokens are never returned by the API.
  *
  * The OAuth callback (`GET /mcp-connections/callback`) is a browser redirect, not an SDK call, so
- * it is intentionally not wrapped here.
+ * it is intentionally not wrapped here. It only stores the authorization code and redirects; the
+ * app then calls {@link McpConnectionsApi.completeMcpConnection} to finish, authenticated as the
+ * user who began the flow. Because the callback is public, it is not allowed to complete anything
+ * itself — otherwise a `state` alone could turn another user's consent into a stored token.
  */
 export class McpConnectionsApi extends BaseApi {
     /**
@@ -25,6 +28,22 @@ export class McpConnectionsApi extends BaseApi {
     async createMcpConnection(request) {
         return await this.post(resourceName, request);
     }
+    /**
+     * Completes a connection begun with {@link McpConnectionsApi.createMcpConnection}, once the user
+     * has consented and the OAuth callback has stored the authorization code. Exchanges that code and
+     * validates the connection with a `tools/list` call before storing the tokens.
+     *
+     * Must be called with the credentials of the user who began the flow — the `state` on its own is
+     * not enough.
+     * @param {string} state - The one-time `state` the OAuth callback forwarded to the app.
+     * @returns {Promise<McpConnectionSummary>} The connection's status view, normally `connected`.
+     * Rejects with 404 if the connection does not exist or belongs to another user; 400 if the
+     * `state` is unknown or expired, the authorization code has not arrived yet, or the token
+     * exchange or validation failed.
+     */
+    async completeMcpConnection(state) {
+        return await this.post(`${resourceName}/complete`, { state });
+    }
     /**
      * Fetches one of the calling user's connections.
      * @param {string} connectionId - The connection id.

package/build/mcp-connections/types.d.ts

@@ -7,6 +7,9 @@ export interface McpConnectionCreatedResponse {
     connection_id: string;
     authorization_url: string;
 }
+export interface CompleteMcpConnectionRequest {
+    state: string;
+}
 export interface McpConnectionSummary {
     connection_id: string;
     server_url: string;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@narrative.io/data-collaboration-sdk-ts",
-	"version": "4.1.0",
+	"version": "4.2.0",
 	"main": "build/index.js",
 	"repository": "github:narrative-io/data-collaboration-sdk-ts",
 	"source": "src/index.ts",