@opendatalabs/personal-server-ts-core 1.29.1 → 1.30.0

package/dist/mcp/approval-url.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Where the owner answers an MCP client's scope request.
+ *
+ * `request_scope_access` only records a pending request; the owner decides it
+ * on Vana Web (the same approval surface as app data connection requests).
+ * The page loads the request from this server and posts the decision back to
+ * `POST /v1/mcp/connections/:id/scope-request/{approve,deny}` with a
+ * Web3Signed owner request, so the link has to name both the connection and
+ * the server's public origin:
+ *
+ *   https://app.vana.org/mcp/requests/<connectionId>?ps_origin=<server origin>
+ *
+ * `ps_origin` is the same param the MCP OAuth approval link carries. The page
+ * treats it as a claim, never as proof: before it signs anything it checks
+ * that the Gateway lists an active server registered by the signed-in owner
+ * at exactly that origin.
+ */
+/** Production Vana Web. */
+export declare const VANA_WEB_ORIGIN = "https://app.vana.org";
+/** Vana Web route that renders one MCP scope request. */
+export declare const MCP_SCOPE_REQUEST_APPROVAL_PATH = "/mcp/requests";
+/** Query param naming the server that holds the request. */
+export declare const MCP_APPROVAL_PS_ORIGIN_PARAM = "ps_origin";
+/** What a host knows when the agent asks for a link. */
+export interface McpScopeRequestApprovalUrlContext {
+    /**
+     * This server's current public origin (the Web3Signed audience): the
+     * tunnel URL once it is up, otherwise the configured origin.
+     */
+    serverOrigin?: string;
+}
+/**
+ * Host hook: returns the page for one connection's pending request, or
+ * undefined to keep pointing the owner at Vana without a link.
+ */
+export type McpScopeRequestApprovalUrlHook = (connectionId: string, context: McpScopeRequestApprovalUrlContext) => string | undefined;
+/**
+ * The approval link for one connection, or undefined when this server cannot
+ * be reached from that web origin (no public origin yet, local-only http).
+ */
+export declare function buildMcpScopeRequestApprovalUrl(input: {
+    connectionId: string;
+    serverOrigin: string | undefined;
+    webOrigin?: string;
+}): string | undefined;
+/**
+ * Default hook for hosts that let Vana Web answer scope requests: builds the
+ * link from the server's current public origin at the moment the agent asks.
+ * Pass `webOrigin` for app-dev or a local web dev server.
+ */
+export declare function vanaWebMcpScopeRequestApprovalUrl(options?: {
+    webOrigin?: string;
+}): McpScopeRequestApprovalUrlHook;
+//# sourceMappingURL=approval-url.d.ts.map

package/dist/mcp/approval-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-url.d.ts","sourceRoot":"","sources":["../../src/mcp/approval-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,2BAA2B;AAC3B,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,yDAAyD;AACzD,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,cAAc,CAAC;AAExD,wDAAwD;AACxD,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAC3C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,iCAAiC,KACvC,MAAM,GAAG,SAAS,CAAC;AAkCxB;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,GAAG,SAAS,CAWrB;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,8BAA8B,CAOhC"}

package/dist/mcp/approval-url.js

@@ -0,0 +1,81 @@
+/**
+ * Where the owner answers an MCP client's scope request.
+ *
+ * `request_scope_access` only records a pending request; the owner decides it
+ * on Vana Web (the same approval surface as app data connection requests).
+ * The page loads the request from this server and posts the decision back to
+ * `POST /v1/mcp/connections/:id/scope-request/{approve,deny}` with a
+ * Web3Signed owner request, so the link has to name both the connection and
+ * the server's public origin:
+ *
+ *   https://app.vana.org/mcp/requests/<connectionId>?ps_origin=<server origin>
+ *
+ * `ps_origin` is the same param the MCP OAuth approval link carries. The page
+ * treats it as a claim, never as proof: before it signs anything it checks
+ * that the Gateway lists an active server registered by the signed-in owner
+ * at exactly that origin.
+ */
+/** Production Vana Web. */
+export const VANA_WEB_ORIGIN = "https://app.vana.org";
+/** Vana Web route that renders one MCP scope request. */
+export const MCP_SCOPE_REQUEST_APPROVAL_PATH = "/mcp/requests";
+/** Query param naming the server that holds the request. */
+export const MCP_APPROVAL_PS_ORIGIN_PARAM = "ps_origin";
+function parseOrigin(value) {
+    if (!value)
+        return undefined;
+    try {
+        const url = new URL(value);
+        return url.protocol === "http:" || url.protocol === "https:"
+            ? url
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isLoopbackHost(hostname) {
+    return (hostname === "localhost" ||
+        hostname === "127.0.0.1" ||
+        hostname === "[::1]" ||
+        hostname.endsWith(".localhost"));
+}
+/**
+ * A page on `webOrigin` can only call a server it can reach: an https server
+ * from anywhere, a loopback http server only from a loopback dev web origin
+ * (a public https page cannot fetch http, and a phone cannot reach the
+ * laptop's loopback at all).
+ */
+function isReachableFromWeb(web, server) {
+    if (server.protocol === "https:")
+        return true;
+    return isLoopbackHost(server.hostname) && isLoopbackHost(web.hostname);
+}
+/**
+ * The approval link for one connection, or undefined when this server cannot
+ * be reached from that web origin (no public origin yet, local-only http).
+ */
+export function buildMcpScopeRequestApprovalUrl(input) {
+    const web = parseOrigin(input.webOrigin ?? VANA_WEB_ORIGIN);
+    const server = parseOrigin(input.serverOrigin);
+    if (!web || !server || !input.connectionId)
+        return undefined;
+    if (!isReachableFromWeb(web, server))
+        return undefined;
+    const url = new URL(`${MCP_SCOPE_REQUEST_APPROVAL_PATH}/${encodeURIComponent(input.connectionId)}`, web.origin);
+    url.searchParams.set(MCP_APPROVAL_PS_ORIGIN_PARAM, server.origin);
+    return url.toString();
+}
+/**
+ * Default hook for hosts that let Vana Web answer scope requests: builds the
+ * link from the server's current public origin at the moment the agent asks.
+ * Pass `webOrigin` for app-dev or a local web dev server.
+ */
+export function vanaWebMcpScopeRequestApprovalUrl(options = {}) {
+    return (connectionId, context) => buildMcpScopeRequestApprovalUrl({
+        connectionId,
+        serverOrigin: context.serverOrigin,
+        webOrigin: options.webOrigin,
+    });
+}
+//# sourceMappingURL=approval-url.js.map

package/dist/mcp/approval-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-url.js","sourceRoot":"","sources":["../../src/mcp/approval-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD,yDAAyD;AACzD,MAAM,CAAC,MAAM,+BAA+B,GAAG,eAAe,CAAC;AAE/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAoBxD,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAQ,EAAE,MAAW;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAI/C;IACC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,GAAG,+BAA+B,IAAI,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAC9E,GAAG,CAAC,MAAM,CACX,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkC,EAAE;IAEpC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAC/B,+BAA+B,CAAC;QAC9B,YAAY;QACZ,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACP,CAAC"}

package/dist/mcp/connection-api.d.ts

@@ -7,13 +7,18 @@
  *   POST   /v1/mcp/connections/:id/approve
  *   DELETE /v1/mcp/connections/:id
  *
+ * plus the server-signed answer to an MCP client's `request_scope_access`:
+ *
+ *   POST   /v1/mcp/connections/:id/scope-request/approve
+ *   POST   /v1/mcp/connections/:id/scope-request/deny
+ *
  * These endpoints DO NOT read user data. They only manage connection records
  * — create the per-connection grantee/token, store grant ids after the user
  * approves them, and mark connections revoked.
  */
-import type { DataPortabilityGatewayConfig, GatewayClient } from "@opendatalabs/vana-sdk/browser";
+import { type DataPortabilityGatewayConfig, type GatewayClient } from "@opendatalabs/vana-sdk/browser";
 import type { ServerSigner } from "../signing/index.js";
-import type { McpConnectionRecord, McpConnectionStore, McpConnectionGrant, McpScopeAccessRequest, McpOAuthAuthorizationRecord, McpOAuthAuthorizationStore } from "./types.js";
+import type { McpConnectionRecord, McpConnectionStore, McpConnectionGrant, McpScopeAccessDecision, McpScopeAccessRequest, McpOAuthAuthorizationRecord, McpOAuthAuthorizationStore } from "./types.js";
 export declare function hashConnectionToken(token: string): Promise<string>;
 export interface CreateMcpConnectionInput {
     displayName?: string;
@@ -49,6 +54,13 @@ export interface ApproveMcpConnectionOptions {
     store: McpConnectionStore;
     now?: () => Date;
 }
+/**
+ * errorCode for an unknown connection id on the single-connection and
+ * scope-request routes. Distinct from the generic `NOT_FOUND` a server
+ * answers for a route it does not have, so a caller (Vana Web) can tell
+ * "this request is gone" from "this server predates the route".
+ */
+export declare const MCP_CONNECTION_NOT_FOUND = "MCP_CONNECTION_NOT_FOUND";
 export declare class McpConnectionNotFoundError extends Error {
     connectionId: string;
     constructor(connectionId: string);
@@ -71,6 +83,51 @@ export declare function requestMcpScopeAccess(input: {
     connection: McpConnectionRecord;
     requestRecorded: boolean;
 }>;
+/** A scope-request answer the owner cannot give in the connection's state. */
+export declare class McpScopeRequestError extends Error {
+    code: string;
+    status: 400 | 409 | 500 | 502;
+    body?: unknown | undefined;
+    constructor(code: string, message: string, status?: 400 | 409 | 500 | 502, body?: unknown | undefined);
+}
+export interface ApproveMcpScopeAccessRequestInput {
+    connectionId: string;
+    /** Scopes the owner approves; must be a subset of the pending request. */
+    scopes: unknown;
+}
+export interface ApproveMcpScopeAccessRequestOptions {
+    store: McpConnectionStore;
+    gateway: Pick<GatewayClient, "getBuilder" | "getGrant" | "createGrant">;
+    serverOwner?: `0x${string}`;
+    serverSigner?: Pick<ServerSigner, "signGrantRegistration">;
+    now?: () => Date;
+}
+export interface ApproveMcpScopeAccessRequestOutput {
+    connection: McpConnectionRecord;
+    grantId: string;
+    /** Every scope the connection's grant now covers. */
+    grantedScopes: string[];
+    approvedScopes: string[];
+    deniedScopes: string[];
+}
+/**
+ * Owner approves (part of) a pending `request_scope_access` without an
+ * external signer: the server signs the grant itself, as the OAuth approve
+ * path does.
+ *
+ * The gateway keeps ONE grant per (owner, grantee) and a new registration
+ * replaces its scopes, so the grant is re-signed over the union of every
+ * scope the connection already holds plus the approved ones. Signing only
+ * the new scopes would silently revoke the old ones.
+ */
+export declare function approveMcpScopeAccessRequest(input: ApproveMcpScopeAccessRequestInput, options: ApproveMcpScopeAccessRequestOptions): Promise<ApproveMcpScopeAccessRequestOutput>;
+/** Owner declines the pending request; the decision stays for the client. */
+export declare function denyMcpScopeAccessRequest(input: {
+    connectionId: string;
+}, options: {
+    store: McpConnectionStore;
+    now?: () => Date;
+}): Promise<McpConnectionRecord>;
 export interface RevokeMcpConnectionOptions {
     store: McpConnectionStore;
     now?: () => Date;
@@ -86,13 +143,20 @@ export interface McpConnectionView {
     granteeAddress: `0x${string}`;
     status: "pending" | "approved" | "revoked";
     grants: McpConnectionGrant[];
+    /** Every scope the connection's grants cover, deduplicated and sorted. */
+    grantedScopes: string[];
+    /** Scopes the MCP client is still asking for, if any. */
     scopeAccessRequest?: McpScopeAccessRequest;
+    /** Owner's answer to the most recent scope request. */
+    scopeAccessDecision?: McpScopeAccessDecision;
     createdAt: string;
     approvedAt?: string;
     revokedAt?: string;
     lastUsedAt?: string;
 }
 export declare function toMcpConnectionView(record: McpConnectionRecord): McpConnectionView;
+/** One connection as the owner sees it; throws when the id is unknown. */
+export declare function getMcpConnectionView(connectionId: string, store: McpConnectionStore): Promise<McpConnectionView>;
 export declare function listMcpConnectionViews(store: McpConnectionStore): Promise<McpConnectionView[]>;
 export interface CreateMcpOAuthAuthorizationInput {
     clientId: string;

package/dist/mcp/connection-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection-api.d.ts","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EACV,4BAA4B,EAC5B,aAAa,EACd,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AA8CpB,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAYD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,GACnB,MAAM,CAKR;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAChC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAGxC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAEvC,YAAY,EAAE,MAAM;IACpB,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,MAAM;gBAFhB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAI1B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAkC9B;AAWD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC;IACT,UAAU,EAAE,mBAAmB,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC,CA8CD;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,iBAAiB,CAanB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAE1C,IAAI,EAAE,MAAM;IAEZ,MAAM;IACN,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,SAAM,EACZ,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gCAAgC,EACvC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CA6D5C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,yBAAyB,CAa3B;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uCAAuC;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAClD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAsD7C;AAED,MAAM,WAAW,yCAA0C,SAAQ,mCAAmC;IACpG,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC;IAC3D,aAAa,EAAE,4BAA4B,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,uCAAuC,EAC9C,OAAO,EAAE,yCAAyC,GACjD,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,MAAM,WAAW,oCAAoC;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAExE,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,oCAAoC,EAC3C,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,qCAAqC,CAAC,CAwEhD;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA2D9B"}
+{"version":3,"file":"connection-api.d.ts","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AA8CpB,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAYD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,GACnB,MAAM,CAKR;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,qBAAa,0BAA2B,SAAQ,KAAK;IAChC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAGxC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAEvC,YAAY,EAAE,MAAM;IACpB,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,MAAM;gBAFhB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAI1B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAkC9B;AAWD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC;IACT,UAAU,EAAE,mBAAmB,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC,CA8CD;AAED,8EAA8E;AAC9E,qBAAa,oBAAqB,SAAQ,KAAK;IAEpC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;IAC7B,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,GAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAS,EACnC,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,MAAM,WAAW,iCAAiC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACxE,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,mBAAmB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAoF7C;AAED,6EAA6E;AAC7E,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EAC/B,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAsID,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IAC3C,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,iBAAiB,CAenB;AAED,0EAA0E;AAC1E,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAI5B;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAE1C,IAAI,EAAE,MAAM;IAEZ,MAAM;IACN,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,SAAM,EACZ,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gCAAgC,EACvC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CA6D5C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,yBAAyB,CAa3B;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uCAAuC;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAClD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAsD7C;AAED,MAAM,WAAW,yCAA0C,SAAQ,mCAAmC;IACpG,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC;IAC3D,aAAa,EAAE,4BAA4B,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,uCAAuC,EAC9C,OAAO,EAAE,yCAAyC,GACjD,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,MAAM,WAAW,oCAAoC;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAExE,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,oCAAoC,EAC3C,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,qCAAqC,CAAC,CAwEhD;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA2D9B"}

package/dist/mcp/connection-api.js

@@ -7,12 +7,18 @@
  *   POST   /v1/mcp/connections/:id/approve
  *   DELETE /v1/mcp/connections/:id
  *
+ * plus the server-signed answer to an MCP client's `request_scope_access`:
+ *
+ *   POST   /v1/mcp/connections/:id/scope-request/approve
+ *   POST   /v1/mcp/connections/:id/scope-request/deny
+ *
  * These endpoints DO NOT read user data. They only manage connection records
  * — create the per-connection grantee/token, store grant ids after the user
  * approves them, and mark connections revoked.
  */
 import { generateMcpGrantee } from "./grantee.js";
 import { createGrantContract } from "../contracts/index.js";
+import { ScopeSchema, } from "@opendatalabs/vana-sdk/browser";
 import { appUrlFromOAuthRedirectUri, ensureMcpGranteeRegistered, McpGranteeRegistrationError, } from "./builder-registration.js";
 import { MCP_SCOPE_ACCESS_REQUEST_LIMIT } from "./types.js";
 import { isMcpRefreshExpired, MCP_TOKEN_TTL_MS, mcpRefreshExpiry, mcpTokenExpiry, } from "./token-expiry.js";
@@ -103,6 +109,13 @@ export function buildMcpProtectedResourceMetadataUrl(publicOrigin) {
         : publicOrigin;
     return `${base}/.well-known/oauth-protected-resource/mcp`;
 }
+/**
+ * errorCode for an unknown connection id on the single-connection and
+ * scope-request routes. Distinct from the generic `NOT_FOUND` a server
+ * answers for a route it does not have, so a caller (Vana Web) can tell
+ * "this request is gone" from "this server predates the route".
+ */
+export const MCP_CONNECTION_NOT_FOUND = "MCP_CONNECTION_NOT_FOUND";
 export class McpConnectionNotFoundError extends Error {
     connectionId;
     constructor(connectionId) {
@@ -185,6 +198,212 @@ export async function requestMcpScopeAccess(input, options) {
             missingInputScopes.every((scope) => updated.scopeAccessRequest?.scopes.includes(scope)),
     };
 }
+/** A scope-request answer the owner cannot give in the connection's state. */
+export class McpScopeRequestError extends Error {
+    code;
+    status;
+    body;
+    constructor(code, message, status = 400, body) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.body = body;
+        this.name = "McpScopeRequestError";
+    }
+}
+/**
+ * Owner approves (part of) a pending `request_scope_access` without an
+ * external signer: the server signs the grant itself, as the OAuth approve
+ * path does.
+ *
+ * The gateway keeps ONE grant per (owner, grantee) and a new registration
+ * replaces its scopes, so the grant is re-signed over the union of every
+ * scope the connection already holds plus the approved ones. Signing only
+ * the new scopes would silently revoke the old ones.
+ */
+export async function approveMcpScopeAccessRequest(input, options) {
+    const connection = await options.store.getById(input.connectionId);
+    if (!connection)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    const pending = requirePendingScopeRequest(connection);
+    const approvedScopes = parseApprovedScopes(input.scopes, pending);
+    const live = await readLiveGrantState(connection, options.gateway);
+    const grantedScopes = sortedUnique([...live.scopes, ...approvedScopes]);
+    let grantResult;
+    try {
+        grantResult = await createGrantContract({
+            gateway: options.gateway,
+            serverOwner: options.serverOwner,
+            serverSigner: options.serverSigner,
+            body: {
+                granteeAddress: connection.granteeAddress,
+                scopes: grantedScopes,
+                grantVersion: live.nextGrantVersion,
+                ...(live.expiresAt !== undefined ? { expiresAt: live.expiresAt } : {}),
+            },
+        });
+    }
+    catch (err) {
+        throw new McpScopeRequestError("GRANT_CREATION_FAILED", err instanceof Error ? err.message : String(err), 502);
+    }
+    if (!grantResult.ok) {
+        throw new McpScopeRequestError("GRANT_CREATION_FAILED", extractGrantErrorMessage(grantResult.body), grantResult.status >= 500 ? 502 : grantResult.status === 409 ? 409 : 400, grantResult.body);
+    }
+    const grantId = grantResult.body.grantId;
+    if (!grantId) {
+        throw new McpScopeRequestError("GRANT_CREATION_FAILED", "Gateway did not return a grant id.", 502, grantResult.body);
+    }
+    const decidedAt = nowIso(options.now);
+    const deniedScopes = pending.scopes.filter((scope) => !approvedScopes.includes(scope));
+    const updated = await options.store.mutate(input.connectionId, (latest) => {
+        // The grant above was signed from the state read before the gateway
+        // round trip; refuse to store it over a change made in between.
+        requirePendingScopeRequest(latest);
+        if (JSON.stringify(latest.grants) !== JSON.stringify(connection.grants)) {
+            throw new McpScopeRequestError("CONCURRENT_UPDATE", "The connection's grants changed during approval; retry.", 409);
+        }
+        const decision = {
+            decision: "approved",
+            approvedScopes,
+            deniedScopes,
+            requestedAt: pending.requestedAt,
+            decidedAt,
+        };
+        return {
+            ...latest,
+            grants: [{ grantId, scopes: grantedScopes }],
+            scopeAccessRequest: undefined,
+            scopeAccessDecision: decision,
+        };
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    return {
+        connection: updated,
+        grantId,
+        grantedScopes,
+        approvedScopes,
+        deniedScopes,
+    };
+}
+/** Owner declines the pending request; the decision stays for the client. */
+export async function denyMcpScopeAccessRequest(input, options) {
+    const decidedAt = nowIso(options.now);
+    const updated = await options.store.mutate(input.connectionId, (latest) => {
+        const pending = requirePendingScopeRequest(latest);
+        const decision = {
+            decision: "denied",
+            approvedScopes: [],
+            deniedScopes: pending.scopes,
+            requestedAt: pending.requestedAt,
+            decidedAt,
+        };
+        return {
+            ...latest,
+            scopeAccessRequest: undefined,
+            scopeAccessDecision: decision,
+        };
+    });
+    if (!updated)
+        throw new McpConnectionNotFoundError(input.connectionId);
+    return updated;
+}
+function requirePendingScopeRequest(connection) {
+    if (connection.status !== "approved") {
+        throw new McpConnectionStateError(connection.id, connection.status, "approved");
+    }
+    const pending = connection.scopeAccessRequest;
+    if (!pending || pending.scopes.length === 0) {
+        throw new McpScopeRequestError("NO_PENDING_REQUEST", `mcp connection ${connection.id} has no pending scope request`, 409);
+    }
+    return pending;
+}
+function parseApprovedScopes(value, pending) {
+    if (!Array.isArray(value) || value.length === 0) {
+        throw new McpScopeRequestError("SCOPES_REQUIRED", "Approve requires a non-empty scopes array; use deny to decline all.");
+    }
+    const scopes = [];
+    for (const raw of value) {
+        const scope = typeof raw === "string" ? raw.trim() : "";
+        if (!ScopeSchema.safeParse(scope).success) {
+            throw new McpScopeRequestError("INVALID_SCOPE", `Invalid scope: ${JSON.stringify(raw)}`);
+        }
+        if (!pending.scopes.includes(scope)) {
+            throw new McpScopeRequestError("SCOPE_NOT_REQUESTED", `Scope ${scope} is not part of the pending request`);
+        }
+        if (!scopes.includes(scope))
+            scopes.push(scope);
+    }
+    return scopes.sort();
+}
+/**
+ * Read what the gateway holds for this connection's grantee: the scopes the
+ * replacement grant must keep, the version counter it must advance past, and
+ * the expiry it must not outlive. A revoked grant contributes its version but
+ * no scopes, so approval never resurrects access the owner already pulled.
+ */
+async function readLiveGrantState(connection, gateway) {
+    const grantIds = sortedUnique(connection.grants.map((grant) => grant.grantId));
+    const revoked = new Set();
+    const scopes = new Set();
+    let maxVersion = 0n;
+    let expiresAt;
+    for (const grantId of grantIds) {
+        let live;
+        try {
+            live = await gateway.getGrant(grantId);
+        }
+        catch (err) {
+            throw new McpScopeRequestError("GATEWAY_UNAVAILABLE", `Could not read grant ${grantId}: ${err instanceof Error ? err.message : String(err)}`, 502);
+        }
+        if (!live)
+            continue;
+        const version = parseUint(live.grantVersion);
+        if (version !== null && version > maxVersion)
+            maxVersion = version;
+        if (live.revokedAt) {
+            revoked.add(grantId);
+            continue;
+        }
+        for (const scope of live.scopes)
+            scopes.add(scope);
+        const liveExpiry = parseExpirySeconds(live.expiresAt);
+        if (liveExpiry !== undefined) {
+            expiresAt =
+                expiresAt === undefined ? liveExpiry : Math.max(expiresAt, liveExpiry);
+        }
+    }
+    for (const grant of connection.grants) {
+        if (revoked.has(grant.grantId))
+            continue;
+        for (const scope of grant.scopes)
+            scopes.add(scope);
+    }
+    return {
+        scopes: sortedUnique(scopes),
+        nextGrantVersion: (maxVersion + 1n).toString(),
+        ...(expiresAt !== undefined ? { expiresAt } : {}),
+    };
+}
+function parseUint(value) {
+    if (typeof value !== "string" || !/^\d+$/u.test(value))
+        return null;
+    return BigInt(value);
+}
+/** Gateway expiry may be unix seconds or an ISO date; 0/null means perpetual. */
+function parseExpirySeconds(value) {
+    if (!value)
+        return undefined;
+    if (/^\d+$/u.test(value)) {
+        const seconds = Number(value);
+        return seconds > 0 ? seconds : undefined;
+    }
+    const ms = Date.parse(value);
+    return Number.isFinite(ms) ? Math.floor(ms / 1000) : undefined;
+}
+function sortedUnique(values) {
+    return Array.from(new Set(values)).sort();
+}
 export async function revokeMcpConnection(connectionId, options) {
     const existing = await options.store.getById(connectionId);
     if (!existing)
@@ -210,13 +429,22 @@ export function toMcpConnectionView(record) {
         granteeAddress: record.granteeAddress,
         status: record.status,
         grants: record.grants,
+        grantedScopes: sortedUnique(record.grants.flatMap((grant) => grant.scopes)),
         scopeAccessRequest: record.scopeAccessRequest,
+        scopeAccessDecision: record.scopeAccessDecision,
         createdAt: record.createdAt,
         approvedAt: record.approvedAt,
         revokedAt: record.revokedAt,
         lastUsedAt: record.lastUsedAt,
     };
 }
+/** One connection as the owner sees it; throws when the id is unknown. */
+export async function getMcpConnectionView(connectionId, store) {
+    const record = await store.getById(connectionId);
+    if (!record)
+        throw new McpConnectionNotFoundError(connectionId);
+    return toMcpConnectionView(record);
+}
 export async function listMcpConnectionViews(store) {
     const records = await store.list();
     return records.map(toMcpConnectionView);