@naturali/sdk 0.223.0 → 0.225.0

package/dist/index.cjs

@@ -3770,7 +3770,7 @@ var McpServers = class {
 	* Create an MCP server
 	*
 	* Each item of `tools` is checked against the tool it names: the project's own or an installed one, else `400`. `action` is required, and must be one of the tool's available actions, when the tool declares `actions`; otherwise it is ignored and stored as `null`. A tool whose definition reads `{{context:naturali_caller_…}}` is refused unless `auth.type` is `oauth`.
-	* `daily_call_limit` is required when `auth` is `none` or `oauth` with `mode: any_account`.
+	* `daily_call_limit` is required when `auth` is `none`.
 	*
 	*/
 	static createMcpServer(options) {

package/dist/index.d.cts

@@ -6447,14 +6447,32 @@ type McpServerToolEntry = {
   description: string | null;
 };
 /**
- * Who may connect. `oauth` with `mode` `members` (project members), `allowlist` (the listed emails) or `any_account` (any naturali account); `header` (holders of a key from [`POST /v1/projects/{project_id}/mcp-servers/{mcp_server_id}/keys`](/docs/api/mcp-servers/create-mcp-server-key), sent in `header_name`, default `Authorization`); `none` (anyone).
+ * Who may connect. `oauth` without `issuer` signs callers in by naturali login, with `mode` `members` (project members) or `allowlist` (the listed emails, verified); `oauth` with `issuer` accepts tokens of the tenant's authorization server; `header` (holders of a key from [`POST /v1/projects/{project_id}/mcp-servers/{mcp_server_id}/keys`](/docs/api/mcp-servers/create-mcp-server-key), sent in `header_name`, default `Authorization`); `none` (anyone).
  */
 type McpServerAuthWrite = {
   type: 'oauth' | 'header' | 'none';
   /**
-   * `oauth` only, required.
+   * `oauth` without `issuer` only, required.
    */
-  mode?: 'members' | 'allowlist' | 'any_account';
+  mode?: 'members' | 'allowlist';
+  /**
+   * The tenant's authorization server (an `https` issuer identifier). A token is accepted when its signature verifies against `jwks_uri` and its `iss` is this value, `exp` is in the future, `aud` names the server's `url`, and its `scope` holds every one of `scopes`.
+   */
+  issuer?: string;
+  /**
+   * Required with `issuer`; an `https` URL. Keys signing `RS256`, `ES256` or `EdDSA`.
+   */
+  jwks_uri?: string;
+  /**
+   * With `issuer`. Scopes every token must carry; default none.
+   */
+  scopes?: Array<string>;
+  /**
+   * With `issuer`. Each key, a `tool_context` key as in `context`, takes the string value of the token claim it names; a claim absent or not a string sets nothing.
+   */
+  context_claims?: {
+    [key: string]: string;
+  };
   /**
    * `mode: allowlist` only, required and non-empty.
    */
@@ -6469,7 +6487,13 @@ type McpServerAuthWrite = {
 };
 type McpServerAuth = {
   type: 'oauth' | 'header' | 'none';
-  mode?: 'members' | 'allowlist' | 'any_account';
+  mode?: 'members' | 'allowlist';
+  issuer?: string;
+  jwks_uri?: string;
+  scopes?: Array<string>;
+  context_claims?: {
+    [key: string]: string;
+  };
   allowlist?: Array<{
     email: string;
     context_keys: McpContextKeys;
@@ -6483,7 +6507,7 @@ type McpServer = {
   id: string;
   project_id: string;
   /**
-   * Where MCP clients connect (Streamable HTTP). Served for `header` and `none` auth; an `oauth` server answers `401`.
+   * Where MCP clients connect (Streamable HTTP). An `oauth` server answers `401` without a token, naming its OAuth protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource/servers/{id}` on the same host, which names the issuer to sign in at.
    */
   url: string;
   /**
@@ -6534,7 +6558,7 @@ type McpServerCreate = {
   context?: McpContext;
   auth: McpServerAuthWrite;
   /**
-   * Tool calls per UTC day, over every caller; past it a call is `429 mcp_daily_limit_reached`. Required for `none` and `any_account`.
+   * Tool calls per UTC day, over every caller; past it a call is `429 mcp_daily_limit_reached`. Required for `none`.
    */
   daily_call_limit?: number | null;
 };
@@ -6581,11 +6605,11 @@ type McpServerUsage = {
   day: Date;
   caller: {
     /**
-     * `key` on a `header` server, `anonymous` on a `none` one.
+     * `key` on a `header` server, `account` on an `oauth` server by naturali login, `subject` on one with `auth.issuer`, `anonymous` on a `none` one.
      */
-    type: 'key' | 'anonymous';
+    type: 'key' | 'account' | 'subject' | 'anonymous';
     /**
-     * The key's ID (mcpk_ prefix); `null` for `anonymous`.
+     * The key's ID (mcpk_ prefix), the naturali account's, or the token's `sub`; `null` for `anonymous`.
      */
     id: string | null;
   };
@@ -34852,7 +34876,7 @@ export declare class McpServers {
    * Create an MCP server
    *
    * Each item of `tools` is checked against the tool it names: the project's own or an installed one, else `400`. `action` is required, and must be one of the tool's available actions, when the tool declares `actions`; otherwise it is ignored and stored as `null`. A tool whose definition reads `{{context:naturali_caller_…}}` is refused unless `auth.type` is `oauth`.
-   * `daily_call_limit` is required when `auth` is `none` or `oauth` with `mode: any_account`.
+   * `daily_call_limit` is required when `auth` is `none`.
    *
    */
   static createMcpServer<ThrowOnError extends boolean = false>(options: Options<CreateMcpServerData, ThrowOnError>): RequestResult<CreateMcpServerResponses, CreateMcpServerErrors, ThrowOnError>;

package/dist/index.d.mts

@@ -6447,14 +6447,32 @@ type McpServerToolEntry = {
   description: string | null;
 };
 /**
- * Who may connect. `oauth` with `mode` `members` (project members), `allowlist` (the listed emails) or `any_account` (any naturali account); `header` (holders of a key from [`POST /v1/projects/{project_id}/mcp-servers/{mcp_server_id}/keys`](/docs/api/mcp-servers/create-mcp-server-key), sent in `header_name`, default `Authorization`); `none` (anyone).
+ * Who may connect. `oauth` without `issuer` signs callers in by naturali login, with `mode` `members` (project members) or `allowlist` (the listed emails, verified); `oauth` with `issuer` accepts tokens of the tenant's authorization server; `header` (holders of a key from [`POST /v1/projects/{project_id}/mcp-servers/{mcp_server_id}/keys`](/docs/api/mcp-servers/create-mcp-server-key), sent in `header_name`, default `Authorization`); `none` (anyone).
  */
 type McpServerAuthWrite = {
   type: 'oauth' | 'header' | 'none';
   /**
-   * `oauth` only, required.
+   * `oauth` without `issuer` only, required.
    */
-  mode?: 'members' | 'allowlist' | 'any_account';
+  mode?: 'members' | 'allowlist';
+  /**
+   * The tenant's authorization server (an `https` issuer identifier). A token is accepted when its signature verifies against `jwks_uri` and its `iss` is this value, `exp` is in the future, `aud` names the server's `url`, and its `scope` holds every one of `scopes`.
+   */
+  issuer?: string;
+  /**
+   * Required with `issuer`; an `https` URL. Keys signing `RS256`, `ES256` or `EdDSA`.
+   */
+  jwks_uri?: string;
+  /**
+   * With `issuer`. Scopes every token must carry; default none.
+   */
+  scopes?: Array<string>;
+  /**
+   * With `issuer`. Each key, a `tool_context` key as in `context`, takes the string value of the token claim it names; a claim absent or not a string sets nothing.
+   */
+  context_claims?: {
+    [key: string]: string;
+  };
   /**
    * `mode: allowlist` only, required and non-empty.
    */
@@ -6469,7 +6487,13 @@ type McpServerAuthWrite = {
 };
 type McpServerAuth = {
   type: 'oauth' | 'header' | 'none';
-  mode?: 'members' | 'allowlist' | 'any_account';
+  mode?: 'members' | 'allowlist';
+  issuer?: string;
+  jwks_uri?: string;
+  scopes?: Array<string>;
+  context_claims?: {
+    [key: string]: string;
+  };
   allowlist?: Array<{
     email: string;
     context_keys: McpContextKeys;
@@ -6483,7 +6507,7 @@ type McpServer = {
   id: string;
   project_id: string;
   /**
-   * Where MCP clients connect (Streamable HTTP). Served for `header` and `none` auth; an `oauth` server answers `401`.
+   * Where MCP clients connect (Streamable HTTP). An `oauth` server answers `401` without a token, naming its OAuth protected resource metadata (RFC 9728) at `/.well-known/oauth-protected-resource/servers/{id}` on the same host, which names the issuer to sign in at.
    */
   url: string;
   /**
@@ -6534,7 +6558,7 @@ type McpServerCreate = {
   context?: McpContext;
   auth: McpServerAuthWrite;
   /**
-   * Tool calls per UTC day, over every caller; past it a call is `429 mcp_daily_limit_reached`. Required for `none` and `any_account`.
+   * Tool calls per UTC day, over every caller; past it a call is `429 mcp_daily_limit_reached`. Required for `none`.
    */
   daily_call_limit?: number | null;
 };
@@ -6581,11 +6605,11 @@ type McpServerUsage = {
   day: Date;
   caller: {
     /**
-     * `key` on a `header` server, `anonymous` on a `none` one.
+     * `key` on a `header` server, `account` on an `oauth` server by naturali login, `subject` on one with `auth.issuer`, `anonymous` on a `none` one.
      */
-    type: 'key' | 'anonymous';
+    type: 'key' | 'account' | 'subject' | 'anonymous';
     /**
-     * The key's ID (mcpk_ prefix); `null` for `anonymous`.
+     * The key's ID (mcpk_ prefix), the naturali account's, or the token's `sub`; `null` for `anonymous`.
      */
     id: string | null;
   };
@@ -34852,7 +34876,7 @@ export declare class McpServers {
    * Create an MCP server
    *
    * Each item of `tools` is checked against the tool it names: the project's own or an installed one, else `400`. `action` is required, and must be one of the tool's available actions, when the tool declares `actions`; otherwise it is ignored and stored as `null`. A tool whose definition reads `{{context:naturali_caller_…}}` is refused unless `auth.type` is `oauth`.
-   * `daily_call_limit` is required when `auth` is `none` or `oauth` with `mode: any_account`.
+   * `daily_call_limit` is required when `auth` is `none`.
    *
    */
   static createMcpServer<ThrowOnError extends boolean = false>(options: Options<CreateMcpServerData, ThrowOnError>): RequestResult<CreateMcpServerResponses, CreateMcpServerErrors, ThrowOnError>;

package/dist/index.mjs

@@ -3769,7 +3769,7 @@ var McpServers = class {
 	* Create an MCP server
 	*
 	* Each item of `tools` is checked against the tool it names: the project's own or an installed one, else `400`. `action` is required, and must be one of the tool's available actions, when the tool declares `actions`; otherwise it is ignored and stored as `null`. A tool whose definition reads `{{context:naturali_caller_…}}` is refused unless `auth.type` is `oauth`.
-	* `daily_call_limit` is required when `auth` is `none` or `oauth` with `mode: any_account`.
+	* `daily_call_limit` is required when `auth` is `none`.
 	*
 	*/
 	static createMcpServer(options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.223.0",
+  "version": "0.225.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.223.0",
+    "@naturali/api": "0.225.0",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",