@opendatalabs/personal-server-ts-core 1.29.2 → 1.31.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/mcp/approval-url.d.ts +68 -0
- package/dist/mcp/approval-url.d.ts.map +1 -0
- package/dist/mcp/approval-url.js +95 -0
- package/dist/mcp/approval-url.js.map +1 -0
- package/dist/mcp/connection-api.d.ts +124 -6
- package/dist/mcp/connection-api.d.ts.map +1 -1
- package/dist/mcp/connection-api.js +317 -2
- package/dist/mcp/connection-api.js.map +1 -1
- package/dist/mcp/index.d.ts +1 -0
- package/dist/mcp/index.d.ts.map +1 -1
- package/dist/mcp/index.js +1 -0
- package/dist/mcp/index.js.map +1 -1
- package/dist/mcp/server.d.ts +2 -0
- package/dist/mcp/server.d.ts.map +1 -1
- package/dist/mcp/server.js +2 -0
- package/dist/mcp/server.js.map +1 -1
- package/dist/mcp/tools.d.ts +14 -0
- package/dist/mcp/tools.d.ts.map +1 -1
- package/dist/mcp/tools.js +64 -8
- package/dist/mcp/tools.js.map +1 -1
- package/dist/mcp/types.d.ts +28 -1
- package/dist/mcp/types.d.ts.map +1 -1
- package/package.json +1 -1
|
@@ -0,0 +1,68 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Where the owner answers an MCP client's scope request.
|
|
3
|
+
*
|
|
4
|
+
* `request_scope_access` only records a pending request; the owner decides it
|
|
5
|
+
* on Vana Web (the same approval surface as app data connection requests).
|
|
6
|
+
* The page loads the request from this server and posts the decision back to
|
|
7
|
+
* `POST /v1/mcp/connections/:id/scope-request/{approve,deny}` with a
|
|
8
|
+
* Web3Signed owner request, so the link has to name both the connection and
|
|
9
|
+
* the server's public origin:
|
|
10
|
+
*
|
|
11
|
+
* https://app.vana.org/mcp/requests/<connectionId>?ps_origin=<server origin>#t=<read token>
|
|
12
|
+
*
|
|
13
|
+
* `ps_origin` is the same param the MCP OAuth approval link carries. The page
|
|
14
|
+
* treats it as a claim, never as proof: before it calls the server it checks
|
|
15
|
+
* that the Gateway lists an active server registered by the signed-in owner
|
|
16
|
+
* at exactly that origin.
|
|
17
|
+
*
|
|
18
|
+
* `t` is the request's read token. It lets the page load the request without
|
|
19
|
+
* an owner signature (`GET /v1/mcp/connections/:id/scope-request` with the
|
|
20
|
+
* `X-Vana-Scope-Request-Token` header), so the owner signs only to answer.
|
|
21
|
+
* It sits in the fragment, which browsers never send to the web server or in
|
|
22
|
+
* a Referer, and the page strips it from the address bar once read.
|
|
23
|
+
*/
|
|
24
|
+
/** Production Vana Web. */
|
|
25
|
+
export declare const VANA_WEB_ORIGIN = "https://app.vana.org";
|
|
26
|
+
/** Vana Web route that renders one MCP scope request. */
|
|
27
|
+
export declare const MCP_SCOPE_REQUEST_APPROVAL_PATH = "/mcp/requests";
|
|
28
|
+
/** Query param naming the server that holds the request. */
|
|
29
|
+
export declare const MCP_APPROVAL_PS_ORIGIN_PARAM = "ps_origin";
|
|
30
|
+
/** Fragment param carrying the request's read token. */
|
|
31
|
+
export declare const MCP_SCOPE_REQUEST_TOKEN_FRAGMENT_PARAM = "t";
|
|
32
|
+
/** What a host knows when the agent asks for a link. */
|
|
33
|
+
export interface McpScopeRequestApprovalUrlContext {
|
|
34
|
+
/**
|
|
35
|
+
* This server's current public origin (the Web3Signed audience): the
|
|
36
|
+
* tunnel URL once it is up, otherwise the configured origin.
|
|
37
|
+
*/
|
|
38
|
+
serverOrigin?: string;
|
|
39
|
+
/**
|
|
40
|
+
* Read token for the request just recorded. Put it in the link's fragment
|
|
41
|
+
* (see {@link buildMcpScopeRequestApprovalUrl}); never in the query or path.
|
|
42
|
+
*/
|
|
43
|
+
readToken?: string;
|
|
44
|
+
}
|
|
45
|
+
/**
|
|
46
|
+
* Host hook: returns the page for one connection's pending request, or
|
|
47
|
+
* undefined to keep pointing the owner at Vana without a link.
|
|
48
|
+
*/
|
|
49
|
+
export type McpScopeRequestApprovalUrlHook = (connectionId: string, context: McpScopeRequestApprovalUrlContext) => string | undefined;
|
|
50
|
+
/**
|
|
51
|
+
* The approval link for one connection, or undefined when this server cannot
|
|
52
|
+
* be reached from that web origin (no public origin yet, local-only http).
|
|
53
|
+
*/
|
|
54
|
+
export declare function buildMcpScopeRequestApprovalUrl(input: {
|
|
55
|
+
connectionId: string;
|
|
56
|
+
serverOrigin: string | undefined;
|
|
57
|
+
webOrigin?: string;
|
|
58
|
+
readToken?: string;
|
|
59
|
+
}): string | undefined;
|
|
60
|
+
/**
|
|
61
|
+
* Default hook for hosts that let Vana Web answer scope requests: builds the
|
|
62
|
+
* link from the server's current public origin at the moment the agent asks.
|
|
63
|
+
* Pass `webOrigin` for app-dev or a local web dev server.
|
|
64
|
+
*/
|
|
65
|
+
export declare function vanaWebMcpScopeRequestApprovalUrl(options?: {
|
|
66
|
+
webOrigin?: string;
|
|
67
|
+
}): McpScopeRequestApprovalUrlHook;
|
|
68
|
+
//# sourceMappingURL=approval-url.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"approval-url.d.ts","sourceRoot":"","sources":["../../src/mcp/approval-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,2BAA2B;AAC3B,eAAO,MAAM,eAAe,yBAAyB,CAAC;AAEtD,yDAAyD;AACzD,eAAO,MAAM,+BAA+B,kBAAkB,CAAC;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,4BAA4B,cAAc,CAAC;AAExD,wDAAwD;AACxD,eAAO,MAAM,sCAAsC,MAAM,CAAC;AAE1D,wDAAwD;AACxD,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,8BAA8B,GAAG,CAC3C,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,iCAAiC,KACvC,MAAM,GAAG,SAAS,CAAC;AAkCxB;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,KAAK,EAAE;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,GAAG,SAAS,CAgBrB;AAED;;;;GAIG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GACnC,8BAA8B,CAQhC"}
|
|
@@ -0,0 +1,95 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Where the owner answers an MCP client's scope request.
|
|
3
|
+
*
|
|
4
|
+
* `request_scope_access` only records a pending request; the owner decides it
|
|
5
|
+
* on Vana Web (the same approval surface as app data connection requests).
|
|
6
|
+
* The page loads the request from this server and posts the decision back to
|
|
7
|
+
* `POST /v1/mcp/connections/:id/scope-request/{approve,deny}` with a
|
|
8
|
+
* Web3Signed owner request, so the link has to name both the connection and
|
|
9
|
+
* the server's public origin:
|
|
10
|
+
*
|
|
11
|
+
* https://app.vana.org/mcp/requests/<connectionId>?ps_origin=<server origin>#t=<read token>
|
|
12
|
+
*
|
|
13
|
+
* `ps_origin` is the same param the MCP OAuth approval link carries. The page
|
|
14
|
+
* treats it as a claim, never as proof: before it calls the server it checks
|
|
15
|
+
* that the Gateway lists an active server registered by the signed-in owner
|
|
16
|
+
* at exactly that origin.
|
|
17
|
+
*
|
|
18
|
+
* `t` is the request's read token. It lets the page load the request without
|
|
19
|
+
* an owner signature (`GET /v1/mcp/connections/:id/scope-request` with the
|
|
20
|
+
* `X-Vana-Scope-Request-Token` header), so the owner signs only to answer.
|
|
21
|
+
* It sits in the fragment, which browsers never send to the web server or in
|
|
22
|
+
* a Referer, and the page strips it from the address bar once read.
|
|
23
|
+
*/
|
|
24
|
+
/** Production Vana Web. */
|
|
25
|
+
export const VANA_WEB_ORIGIN = "https://app.vana.org";
|
|
26
|
+
/** Vana Web route that renders one MCP scope request. */
|
|
27
|
+
export const MCP_SCOPE_REQUEST_APPROVAL_PATH = "/mcp/requests";
|
|
28
|
+
/** Query param naming the server that holds the request. */
|
|
29
|
+
export const MCP_APPROVAL_PS_ORIGIN_PARAM = "ps_origin";
|
|
30
|
+
/** Fragment param carrying the request's read token. */
|
|
31
|
+
export const MCP_SCOPE_REQUEST_TOKEN_FRAGMENT_PARAM = "t";
|
|
32
|
+
function parseOrigin(value) {
|
|
33
|
+
if (!value)
|
|
34
|
+
return undefined;
|
|
35
|
+
try {
|
|
36
|
+
const url = new URL(value);
|
|
37
|
+
return url.protocol === "http:" || url.protocol === "https:"
|
|
38
|
+
? url
|
|
39
|
+
: undefined;
|
|
40
|
+
}
|
|
41
|
+
catch {
|
|
42
|
+
return undefined;
|
|
43
|
+
}
|
|
44
|
+
}
|
|
45
|
+
function isLoopbackHost(hostname) {
|
|
46
|
+
return (hostname === "localhost" ||
|
|
47
|
+
hostname === "127.0.0.1" ||
|
|
48
|
+
hostname === "[::1]" ||
|
|
49
|
+
hostname.endsWith(".localhost"));
|
|
50
|
+
}
|
|
51
|
+
/**
|
|
52
|
+
* A page on `webOrigin` can only call a server it can reach: an https server
|
|
53
|
+
* from anywhere, a loopback http server only from a loopback dev web origin
|
|
54
|
+
* (a public https page cannot fetch http, and a phone cannot reach the
|
|
55
|
+
* laptop's loopback at all).
|
|
56
|
+
*/
|
|
57
|
+
function isReachableFromWeb(web, server) {
|
|
58
|
+
if (server.protocol === "https:")
|
|
59
|
+
return true;
|
|
60
|
+
return isLoopbackHost(server.hostname) && isLoopbackHost(web.hostname);
|
|
61
|
+
}
|
|
62
|
+
/**
|
|
63
|
+
* The approval link for one connection, or undefined when this server cannot
|
|
64
|
+
* be reached from that web origin (no public origin yet, local-only http).
|
|
65
|
+
*/
|
|
66
|
+
export function buildMcpScopeRequestApprovalUrl(input) {
|
|
67
|
+
const web = parseOrigin(input.webOrigin ?? VANA_WEB_ORIGIN);
|
|
68
|
+
const server = parseOrigin(input.serverOrigin);
|
|
69
|
+
if (!web || !server || !input.connectionId)
|
|
70
|
+
return undefined;
|
|
71
|
+
if (!isReachableFromWeb(web, server))
|
|
72
|
+
return undefined;
|
|
73
|
+
const url = new URL(`${MCP_SCOPE_REQUEST_APPROVAL_PATH}/${encodeURIComponent(input.connectionId)}`, web.origin);
|
|
74
|
+
url.searchParams.set(MCP_APPROVAL_PS_ORIGIN_PARAM, server.origin);
|
|
75
|
+
if (input.readToken) {
|
|
76
|
+
url.hash = new URLSearchParams({
|
|
77
|
+
[MCP_SCOPE_REQUEST_TOKEN_FRAGMENT_PARAM]: input.readToken,
|
|
78
|
+
}).toString();
|
|
79
|
+
}
|
|
80
|
+
return url.toString();
|
|
81
|
+
}
|
|
82
|
+
/**
|
|
83
|
+
* Default hook for hosts that let Vana Web answer scope requests: builds the
|
|
84
|
+
* link from the server's current public origin at the moment the agent asks.
|
|
85
|
+
* Pass `webOrigin` for app-dev or a local web dev server.
|
|
86
|
+
*/
|
|
87
|
+
export function vanaWebMcpScopeRequestApprovalUrl(options = {}) {
|
|
88
|
+
return (connectionId, context) => buildMcpScopeRequestApprovalUrl({
|
|
89
|
+
connectionId,
|
|
90
|
+
serverOrigin: context.serverOrigin,
|
|
91
|
+
webOrigin: options.webOrigin,
|
|
92
|
+
readToken: context.readToken,
|
|
93
|
+
});
|
|
94
|
+
}
|
|
95
|
+
//# sourceMappingURL=approval-url.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"approval-url.js","sourceRoot":"","sources":["../../src/mcp/approval-url.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD,yDAAyD;AACzD,MAAM,CAAC,MAAM,+BAA+B,GAAG,eAAe,CAAC;AAE/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,wDAAwD;AACxD,MAAM,CAAC,MAAM,sCAAsC,GAAG,GAAG,CAAC;AAyB1D,SAAS,WAAW,CAAC,KAAyB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC1D,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAChC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,GAAQ,EAAE,MAAW;IAC/C,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,KAK/C;IACC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,SAAS,IAAI,eAAe,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,GAAG,+BAA+B,IAAI,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAC9E,GAAG,CAAC,MAAM,CACX,CAAC;IACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,4BAA4B,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC;YAC7B,CAAC,sCAAsC,CAAC,EAAE,KAAK,CAAC,SAAS;SAC1D,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAC/C,UAAkC,EAAE;IAEpC,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,EAAE,CAC/B,+BAA+B,CAAC;QAC9B,YAAY;QACZ,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;AACP,CAAC"}
|
|
@@ -7,13 +7,38 @@
|
|
|
7
7
|
* POST /v1/mcp/connections/:id/approve
|
|
8
8
|
* DELETE /v1/mcp/connections/:id
|
|
9
9
|
*
|
|
10
|
+
* plus the server-signed answer to an MCP client's `request_scope_access`:
|
|
11
|
+
*
|
|
12
|
+
* POST /v1/mcp/connections/:id/scope-request/approve
|
|
13
|
+
* POST /v1/mcp/connections/:id/scope-request/deny
|
|
14
|
+
*
|
|
15
|
+
* and one read that is NOT owner-signed, because the owner's page needs it
|
|
16
|
+
* before it asks for any signature:
|
|
17
|
+
*
|
|
18
|
+
* GET /v1/mcp/connections/:id/scope-request
|
|
19
|
+
* (header `X-Vana-Scope-Request-Token`, from the approval link)
|
|
20
|
+
*
|
|
10
21
|
* These endpoints DO NOT read user data. They only manage connection records
|
|
11
22
|
* — create the per-connection grantee/token, store grant ids after the user
|
|
12
23
|
* approves them, and mark connections revoked.
|
|
13
24
|
*/
|
|
14
|
-
import type
|
|
25
|
+
import { type DataPortabilityGatewayConfig, type GatewayClient } from "@opendatalabs/vana-sdk/browser";
|
|
15
26
|
import type { ServerSigner } from "../signing/index.js";
|
|
16
|
-
import type { McpConnectionRecord, McpConnectionStore, McpConnectionGrant, McpScopeAccessRequest, McpOAuthAuthorizationRecord, McpOAuthAuthorizationStore } from "./types.js";
|
|
27
|
+
import type { McpConnectionRecord, McpConnectionStore, McpConnectionGrant, McpScopeAccessDecision, McpScopeAccessRequest, McpScopeAccessRequestView, McpOAuthAuthorizationRecord, McpOAuthAuthorizationStore } from "./types.js";
|
|
28
|
+
/**
|
|
29
|
+
* Request header carrying the scope-request read token. The token travels in
|
|
30
|
+
* the approval link's URL fragment, so the page reads it client-side and
|
|
31
|
+
* sends it here; it never reaches a web server log or a Referer.
|
|
32
|
+
*/
|
|
33
|
+
export declare const MCP_SCOPE_REQUEST_TOKEN_HEADER = "X-Vana-Scope-Request-Token";
|
|
34
|
+
/**
|
|
35
|
+
* errorCode for every failed token read: unknown connection, nothing
|
|
36
|
+
* pending, wrong, missing or expired token. One answer for all of them, so
|
|
37
|
+
* the route does not reveal which connections or requests exist.
|
|
38
|
+
*/
|
|
39
|
+
export declare const MCP_SCOPE_REQUEST_NOT_FOUND = "MCP_SCOPE_REQUEST_NOT_FOUND";
|
|
40
|
+
/** How long an approval link can load its request without a signature. */
|
|
41
|
+
export declare const MCP_SCOPE_REQUEST_READ_TOKEN_TTL_MS: number;
|
|
17
42
|
export declare function hashConnectionToken(token: string): Promise<string>;
|
|
18
43
|
export interface CreateMcpConnectionInput {
|
|
19
44
|
displayName?: string;
|
|
@@ -49,6 +74,13 @@ export interface ApproveMcpConnectionOptions {
|
|
|
49
74
|
store: McpConnectionStore;
|
|
50
75
|
now?: () => Date;
|
|
51
76
|
}
|
|
77
|
+
/**
|
|
78
|
+
* errorCode for an unknown connection id on the single-connection and
|
|
79
|
+
* scope-request routes. Distinct from the generic `NOT_FOUND` a server
|
|
80
|
+
* answers for a route it does not have, so a caller (Vana Web) can tell
|
|
81
|
+
* "this request is gone" from "this server predates the route".
|
|
82
|
+
*/
|
|
83
|
+
export declare const MCP_CONNECTION_NOT_FOUND = "MCP_CONNECTION_NOT_FOUND";
|
|
52
84
|
export declare class McpConnectionNotFoundError extends Error {
|
|
53
85
|
connectionId: string;
|
|
54
86
|
constructor(connectionId: string);
|
|
@@ -60,6 +92,17 @@ export declare class McpConnectionStateError extends Error {
|
|
|
60
92
|
constructor(connectionId: string, state: string, expected: string);
|
|
61
93
|
}
|
|
62
94
|
export declare function approveMcpConnection(input: ApproveMcpConnectionInput, options: ApproveMcpConnectionOptions): Promise<McpConnectionRecord>;
|
|
95
|
+
export interface RequestMcpScopeAccessOutput {
|
|
96
|
+
connection: McpConnectionRecord;
|
|
97
|
+
requestRecorded: boolean;
|
|
98
|
+
/**
|
|
99
|
+
* Raw read token for the request just written, returned ONCE so it can go
|
|
100
|
+
* into the approval link; the record keeps only its hash. Absent when the
|
|
101
|
+
* request was not (re)written. Every write mints a new token and kills the
|
|
102
|
+
* previous one.
|
|
103
|
+
*/
|
|
104
|
+
readToken?: string;
|
|
105
|
+
}
|
|
63
106
|
export declare function requestMcpScopeAccess(input: {
|
|
64
107
|
connectionId: string;
|
|
65
108
|
scopes: string[];
|
|
@@ -67,10 +110,76 @@ export declare function requestMcpScopeAccess(input: {
|
|
|
67
110
|
}, options: {
|
|
68
111
|
store: McpConnectionStore;
|
|
69
112
|
now?: () => Date;
|
|
70
|
-
}): Promise<
|
|
113
|
+
}): Promise<RequestMcpScopeAccessOutput>;
|
|
114
|
+
/**
|
|
115
|
+
* What a holder of the approval link may see without signing: who is asking,
|
|
116
|
+
* for what, and what it already has. Nothing that identifies the grantee or
|
|
117
|
+
* the connection's tokens.
|
|
118
|
+
*/
|
|
119
|
+
export interface McpScopeRequestReadView {
|
|
120
|
+
id: string;
|
|
121
|
+
displayName: string;
|
|
122
|
+
scopeAccessRequest: McpScopeAccessRequestView;
|
|
123
|
+
grantedScopes: string[];
|
|
124
|
+
}
|
|
125
|
+
/**
|
|
126
|
+
* Load one pending scope request with the read token from its approval link.
|
|
127
|
+
* Returns null for an unknown or non-approved connection, no pending request,
|
|
128
|
+
* a request without a token, a wrong or missing token, or an expired one, so
|
|
129
|
+
* a caller can answer all of them the same way.
|
|
130
|
+
*/
|
|
131
|
+
export declare function readMcpScopeRequestWithToken(input: {
|
|
132
|
+
connectionId: string;
|
|
133
|
+
token: string | null | undefined;
|
|
134
|
+
}, options: {
|
|
135
|
+
store: McpConnectionStore;
|
|
136
|
+
now?: () => Date;
|
|
137
|
+
}): Promise<McpScopeRequestReadView | null>;
|
|
138
|
+
/** A scope-request answer the owner cannot give in the connection's state. */
|
|
139
|
+
export declare class McpScopeRequestError extends Error {
|
|
140
|
+
code: string;
|
|
141
|
+
status: 400 | 409 | 500 | 502;
|
|
142
|
+
body?: unknown | undefined;
|
|
143
|
+
constructor(code: string, message: string, status?: 400 | 409 | 500 | 502, body?: unknown | undefined);
|
|
144
|
+
}
|
|
145
|
+
export interface ApproveMcpScopeAccessRequestInput {
|
|
146
|
+
connectionId: string;
|
|
147
|
+
/** Scopes the owner approves; must be a subset of the pending request. */
|
|
148
|
+
scopes: unknown;
|
|
149
|
+
}
|
|
150
|
+
export interface ApproveMcpScopeAccessRequestOptions {
|
|
151
|
+
store: McpConnectionStore;
|
|
152
|
+
gateway: Pick<GatewayClient, "getBuilder" | "getGrant" | "createGrant">;
|
|
153
|
+
serverOwner?: `0x${string}`;
|
|
154
|
+
serverSigner?: Pick<ServerSigner, "signGrantRegistration">;
|
|
155
|
+
now?: () => Date;
|
|
156
|
+
}
|
|
157
|
+
export interface ApproveMcpScopeAccessRequestOutput {
|
|
71
158
|
connection: McpConnectionRecord;
|
|
72
|
-
|
|
73
|
-
|
|
159
|
+
grantId: string;
|
|
160
|
+
/** Every scope the connection's grant now covers. */
|
|
161
|
+
grantedScopes: string[];
|
|
162
|
+
approvedScopes: string[];
|
|
163
|
+
deniedScopes: string[];
|
|
164
|
+
}
|
|
165
|
+
/**
|
|
166
|
+
* Owner approves (part of) a pending `request_scope_access` without an
|
|
167
|
+
* external signer: the server signs the grant itself, as the OAuth approve
|
|
168
|
+
* path does.
|
|
169
|
+
*
|
|
170
|
+
* The gateway keeps ONE grant per (owner, grantee) and a new registration
|
|
171
|
+
* replaces its scopes, so the grant is re-signed over the union of every
|
|
172
|
+
* scope the connection already holds plus the approved ones. Signing only
|
|
173
|
+
* the new scopes would silently revoke the old ones.
|
|
174
|
+
*/
|
|
175
|
+
export declare function approveMcpScopeAccessRequest(input: ApproveMcpScopeAccessRequestInput, options: ApproveMcpScopeAccessRequestOptions): Promise<ApproveMcpScopeAccessRequestOutput>;
|
|
176
|
+
/** Owner declines the pending request; the decision stays for the client. */
|
|
177
|
+
export declare function denyMcpScopeAccessRequest(input: {
|
|
178
|
+
connectionId: string;
|
|
179
|
+
}, options: {
|
|
180
|
+
store: McpConnectionStore;
|
|
181
|
+
now?: () => Date;
|
|
182
|
+
}): Promise<McpConnectionRecord>;
|
|
74
183
|
export interface RevokeMcpConnectionOptions {
|
|
75
184
|
store: McpConnectionStore;
|
|
76
185
|
now?: () => Date;
|
|
@@ -86,13 +195,22 @@ export interface McpConnectionView {
|
|
|
86
195
|
granteeAddress: `0x${string}`;
|
|
87
196
|
status: "pending" | "approved" | "revoked";
|
|
88
197
|
grants: McpConnectionGrant[];
|
|
89
|
-
|
|
198
|
+
/** Every scope the connection's grants cover, deduplicated and sorted. */
|
|
199
|
+
grantedScopes: string[];
|
|
200
|
+
/** Scopes the MCP client is still asking for, if any. */
|
|
201
|
+
scopeAccessRequest?: McpScopeAccessRequestView;
|
|
202
|
+
/** Owner's answer to the most recent scope request. */
|
|
203
|
+
scopeAccessDecision?: McpScopeAccessDecision;
|
|
90
204
|
createdAt: string;
|
|
91
205
|
approvedAt?: string;
|
|
92
206
|
revokedAt?: string;
|
|
93
207
|
lastUsedAt?: string;
|
|
94
208
|
}
|
|
209
|
+
/** A scope request without its read token, for anything that leaves the server. */
|
|
210
|
+
export declare function toMcpScopeAccessRequestView(request: McpScopeAccessRequest): McpScopeAccessRequestView;
|
|
95
211
|
export declare function toMcpConnectionView(record: McpConnectionRecord): McpConnectionView;
|
|
212
|
+
/** One connection as the owner sees it; throws when the id is unknown. */
|
|
213
|
+
export declare function getMcpConnectionView(connectionId: string, store: McpConnectionStore): Promise<McpConnectionView>;
|
|
96
214
|
export declare function listMcpConnectionViews(store: McpConnectionStore): Promise<McpConnectionView[]>;
|
|
97
215
|
export interface CreateMcpOAuthAuthorizationInput {
|
|
98
216
|
clientId: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"connection-api.d.ts","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"connection-api.d.ts","sourceRoot":"","sources":["../../src/mcp/connection-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,aAAa,EACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAMxD,OAAO,KAAK,EACV,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AAYpB;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,+BAA+B,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE,0EAA0E;AAC1E,eAAO,MAAM,mCAAmC,QAAsB,CAAC;AAuCvE,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIxE;AAYD,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,EAC/B,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,yBAAyB,CAAC,CA6BpC;AAED,wBAAgB,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAK9D;AAED,wBAAgB,oCAAoC,CAClD,YAAY,EAAE,MAAM,GACnB,MAAM,CAKR;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,6BAA6B,CAAC;AAEnE,qBAAa,0BAA2B,SAAQ,KAAK;IAChC,YAAY,EAAE,MAAM;gBAApB,YAAY,EAAE,MAAM;CAGxC;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAEvC,YAAY,EAAE,MAAM;IACpB,KAAK,EAAE,MAAM;IACb,QAAQ,EAAE,MAAM;gBAFhB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM;CAI1B;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CAuC9B;AAWD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,mBAAmB,CAAC;IAChC,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC,2BAA2B,CAAC,CAwDtC;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,yBAAyB,CAAC;IAC9C,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAYD;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,EACjE,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAsBzC;AAED,8EAA8E;AAC9E,qBAAa,oBAAqB,SAAQ,KAAK;IAEpC,IAAI,EAAE,MAAM;IAEZ,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG;IAC7B,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,GAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAS,EACnC,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,MAAM,WAAW,iCAAiC;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,mCAAmC;IAClD,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,UAAU,GAAG,aAAa,CAAC,CAAC;IACxE,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,mBAAmB,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAoF7C;AAED,6EAA6E;AAC7E,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,EAC/B,OAAO,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD,OAAO,CAAC,mBAAmB,CAAC,CAmB9B;AAsID,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAsB,mBAAmB,CACvC,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IAC/C,uDAAuD;IACvD,mBAAmB,CAAC,EAAE,sBAAsB,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,qBAAqB,GAC7B,yBAAyB,CAM3B;AAED,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,mBAAmB,GAC1B,iBAAiB,CAiBnB;AAED,0EAA0E;AAC1E,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAI5B;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAG9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kCAAkC;IACjD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IAE1C,IAAI,EAAE,MAAM;IAEZ,MAAM;IACN,IAAI,CAAC,EAAE,OAAO;gBAHd,IAAI,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACR,MAAM,SAAM,EACZ,IAAI,CAAC,EAAE,OAAO,YAAA;CAKxB;AAED,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,gCAAgC,EACvC,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CA6D5C;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,KAAK,MAAM,EAAE,CAAC;IAC9B,MAAM,EAAE,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,2BAA2B,GAClC,yBAAyB,CAa3B;AAED,MAAM,WAAW,iCAAiC;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,uCAAuC;IACtD,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mCAAmC;IAClD,eAAe,EAAE,kBAAkB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,EACxC,OAAO,EAAE,mCAAmC,GAC3C,OAAO,CAAC,kCAAkC,CAAC,CAsD7C;AAED,MAAM,WAAW,yCAA0C,SAAQ,mCAAmC;IACpG,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC;IAC3D,aAAa,EAAE,4BAA4B,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,KAAK,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,uBAAuB,CAAC,CAAC;IAC3D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,wBAAsB,sCAAsC,CAC1D,KAAK,EAAE,uCAAuC,EAC9C,OAAO,EAAE,yCAAyC,GACjD,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,MAAM,WAAW,oCAAoC;IACnD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,kBAAkB,EAAE,0BAA0B,CAAC;IAC/C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qCAAqC,GAAG,mBAAmB,CAAC;AAExE,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,oCAAoC,EAC3C,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,qCAAqC,CAAC,CAwEhD;AAED,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,eAAe,EAAE,kBAAkB,CAAC;IACpC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,mBAAmB,CAAC,CA2D9B"}
|